don't return error when OIDC_NO_USERINFO_SUB is set and sub is NULL
@@ -2344,13 +2344,11 @@ apr_byte_t oidc_proto_resolve_userinfo(request_rec *r, oidc_cfg *cfg,
return FALSE;
}
- if (id_token_sub != NULL) {
- if ((user_info_sub == NULL)
- || (apr_strnatcmp(id_token_sub, user_info_sub) != 0)) {
+ if ((id_token_sub != NULL) && (user_info_sub != NULL)) {
+ if (apr_strnatcmp(id_token_sub, user_info_sub) != 0) {
oidc_error(r,
"\"%s\" claim (\"%s\") returned from userinfo endpoint does not match the one in the id_token (\"%s\")",
- OIDC_CLAIM_SUB, user_info_sub ? user_info_sub : "<n/a>",
- id_token_sub);
+ OIDC_CLAIM_SUB, user_info_sub, id_token_sub);
json_decref(claims);
return FALSE;
}
