Add support for OpenId Connect userinfo_endpoint

build.gradle

@@ -607,6 +607,10 @@ dependencies {
     runtimeOnly 'jakarta.xml.bind:jakarta.xml.bind-api:4.0.2'
     runtimeOnly 'org.ow2.asm:asm:9.7'
 
+    implementation 'com.nimbusds:oauth2-oidc-sdk:11.18'
+    implementation 'net.minidev:json-smart:2.5.1'
+    implementation 'com.nimbusds:content-type:2.3'
+
     testImplementation 'org.apache.camel:camel-xmlsecurity:3.22.2'
 
     //OpenSAML

src/main/java/com/amazon/dlic/auth/http/jwt/AbstractHTTPJwtAuthenticator.java

@@ -56,10 +56,10 @@
     private static final Pattern BASIC = Pattern.compile("^\\s*Basic\\s.*", Pattern.CASE_INSENSITIVE);
 
     private KeyProvider keyProvider;
-    private JwtVerifier jwtVerifier;
-    private final String jwtHeaderName;
-    private final boolean isDefaultAuthHeader;
-    private final String jwtUrlParameter;
+    protected JwtVerifier jwtVerifier;
+    protected final String jwtHeaderName;
+    protected final boolean isDefaultAuthHeader;
+    protected final String jwtUrlParameter;
     private final String subjectKey;
     private final String rolesKey;
     private final List<String> requiredAudience;
@@ -81,7 +81,7 @@
         if (!jwtHeaderName.equals(AUTHORIZATION)) {
             deprecationLog.deprecate(
                 "jwt_header",
-                "The 'jwt_header' setting will be removed in the next major version of OpenSearch.  Consult https://github.com/opensearch-project/security/issues/3886 for more details."
+                "The 'jwt_header' setting will be removed in the next major version of OpenSearch. Consult https://github.com/opensearch-project/security/issues/3886 for more details."
             );
         }
 
@@ -117,7 +117,7 @@
 
     private AuthCredentials extractCredentials0(final SecurityRequest request) throws OpenSearchSecurityException {
 
-        String jwtString = getJwtTokenString(request);
+        String jwtString = getJwtTokenString(request, jwtHeaderName, jwtUrlParameter, isDefaultAuthHeader);
 
         if (Strings.isNullOrEmpty(jwtString)) {
             return null;
@@ -155,34 +155,6 @@
         return ac;
     }
 
-    protected String getJwtTokenString(SecurityRequest request) {
-        String jwtToken = request.header(jwtHeaderName);
-        if (isDefaultAuthHeader && jwtToken != null && BASIC.matcher(jwtToken).matches()) {
-            jwtToken = null;
-        }
-
-        if (jwtUrlParameter != null) {
-            if (jwtToken == null || jwtToken.isEmpty()) {
-                jwtToken = request.params().get(jwtUrlParameter);
-            } else {
-                // just consume to avoid "contains unrecognized parameter"
-                request.params().get(jwtUrlParameter);
-            }
-        }
-
-        if (jwtToken == null) {
-            return null;
-        }
-
-        int index;
-
-        if ((index = jwtToken.toLowerCase().indexOf(BEARER)) > -1) { // detect Bearer
-            jwtToken = jwtToken.substring(index + BEARER.length());
-        }
-
-        return jwtToken;
-    }
-
     @VisibleForTesting
     public String extractSubject(JWTClaimsSet claims) {
         String subject = claims.getSubject();
@@ -256,6 +228,39 @@
         );
     }
 
+    public static String getJwtTokenString(
+        SecurityRequest request,
+        String jwtHeaderName,
+        String jwtUrlParameter,
+        boolean isDefaultAuthHeader
+    ) {
+        String jwtToken = request.header(jwtHeaderName);
+        if (isDefaultAuthHeader && jwtToken != null && BASIC.matcher(jwtToken).matches()) {
+            jwtToken = null;
+        }
+
+        if (jwtUrlParameter != null) {
+            if (jwtToken == null || jwtToken.isEmpty()) {
+                jwtToken = request.params().get(jwtUrlParameter);
+            } else {
+                // just consume to avoid "contains unrecognized parameter"
+                request.params().get(jwtUrlParameter);
+            }
+        }
+
+        if (jwtToken == null) {
+            return null;
+        }
+
+        int index;
+
+        if ((index = jwtToken.toLowerCase().indexOf(BEARER)) > -1) { // detect Bearer
+            jwtToken = jwtToken.substring(index + BEARER.length());
+        }
+
+        return jwtToken;
+    }
+
     public List<String> getRequiredAudience() {
         return requiredAudience;
     }