From 33f64ca7d66c099c2f774ee2b5dd75eac008e345 Mon Sep 17 00:00:00 2001
From: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>
Date: Tue, 16 Feb 2021 22:33:09 +0000
Subject: [PATCH] Allow OIDC config to override discovered values (#9384)

Fixes #9347
---
 changelog.d/9384.misc            |  1 +
 synapse/handlers/oidc_handler.py | 27 ++++++++++++++++++---------
 2 files changed, 19 insertions(+), 9 deletions(-)
 create mode 100644 changelog.d/9384.misc

diff --git a/changelog.d/9384.misc b/changelog.d/9384.misc
new file mode 100644
index 0000000000..9db61f44db
--- /dev/null
+++ b/changelog.d/9384.misc
@@ -0,0 +1 @@
+Allow OIDC config to override discovered values.
diff --git a/synapse/handlers/oidc_handler.py b/synapse/handlers/oidc_handler.py
index 702bfb8bc9..c00b9c57c6 100644
--- a/synapse/handlers/oidc_handler.py
+++ b/synapse/handlers/oidc_handler.py
@@ -383,22 +383,31 @@ class OidcProvider:
         return await self._provider_metadata.get()
 
     async def _load_metadata(self) -> OpenIDProviderMetadata:
-        # init the metadata from our config
-        metadata = OpenIDProviderMetadata(
-            issuer=self._config.issuer,
-            authorization_endpoint=self._config.authorization_endpoint,
-            token_endpoint=self._config.token_endpoint,
-            userinfo_endpoint=self._config.userinfo_endpoint,
-            jwks_uri=self._config.jwks_uri,
-        )
+        # start out with just the issuer (unlike the other settings, discovered issuer
+        # takes precedence over configured issuer, because configured issuer is
+        # required for discovery to take place.)
+        #
+        metadata = OpenIDProviderMetadata(issuer=self._config.issuer)
 
         # load any data from the discovery endpoint, if enabled
         if self._config.discover:
             url = get_well_known_url(self._config.issuer, external=True)
             metadata_response = await self._http_client.get_json(url)
-            # TODO: maybe update the other way around to let user override some values?
             metadata.update(metadata_response)
 
+        # override any discovered data with any settings in our config
+        if self._config.authorization_endpoint:
+            metadata["authorization_endpoint"] = self._config.authorization_endpoint
+
+        if self._config.token_endpoint:
+            metadata["token_endpoint"] = self._config.token_endpoint
+
+        if self._config.userinfo_endpoint:
+            metadata["userinfo_endpoint"] = self._config.userinfo_endpoint
+
+        if self._config.jwks_uri:
+            metadata["jwks_uri"] = self._config.jwks_uri
+
         self._validate_metadata(metadata)
 
         return metadata