feat: add 'UserinfoSignedResponseAlg' attribute to hydra.ory.sh_oauth2clients CRD

.github/workflows/licenses.yml

@@ -8,10 +8,12 @@ on:
   push:
     branches:
       - main
+      - v3
       - master
 
 jobs:
-  check:
+  licenses:
+    name: License compliance
     runs-on: ubuntu-latest
     steps:
       - name: Install script
@@ -20,8 +22,14 @@ jobs:
           token: ${{ secrets.ORY_BOT_PAT || secrets.GITHUB_TOKEN }}
       - name: Check licenses
         uses: ory/ci/licenses/check@master
-      - name: Write licenses
+      - name: Write, commit, push licenses
         uses: ory/ci/licenses/write@master
         if:
           ${{ github.ref == 'refs/heads/main' || github.ref ==
-          'refs/heads/master' }}
+          'refs/heads/master' || github.ref == 'refs/heads/v3' }}
+        with:
+          author-email:
+            ${{ secrets.ORY_BOT_PAT &&
+            '60093411+ory-bot@users.noreply.github.com' ||
+            format('{0}@users.noreply.github.com', github.actor) }}
+          author-name: ${{ secrets.ORY_BOT_PAT && 'ory-bot' || github.actor }}

.reports/dep-licenses.csv

@@ -0,0 +1,176 @@
+
+"github.com/go-logr/logr","Apache-2.0"
+"github.com/asaskevich/govalidator","MIT"
+"github.com/go-openapi/errors","Apache-2.0"
+"github.com/go-openapi/runtime","Apache-2.0"
+"github.com/go-openapi/strfmt","Apache-2.0"
+"github.com/go-openapi/swag","Apache-2.0"
+"github.com/google/uuid","BSD-3-Clause"
+"github.com/josharian/intern","MIT"
+"github.com/mailru/easyjson","MIT"
+"github.com/mitchellh/mapstructure","MIT"
+"github.com/oklog/ulid","Apache-2.0"
+"go.mongodb.org/mongo-driver","Apache-2.0"
+"golang.org/x/sync/errgroup","BSD-3-Clause"
+"gopkg.in/yaml.v3","MIT"
+"github.com/fsnotify/fsnotify","BSD-3-Clause"
+"github.com/nxadm/tail","MIT"
+"github.com/nxadm/tail/ratelimiter","MIT"
+"github.com/onsi/ginkgo","MIT"
+"github.com/onsi/ginkgo/reporters/stenographer/support/go-colorable","MIT"
+"golang.org/x/sys/unix","BSD-3-Clause"
+"gopkg.in/tomb.v1","BSD-3-Clause"
+"github.com/google/go-cmp/cmp","BSD-3-Clause"
+"github.com/onsi/gomega","MIT"
+"golang.org/x/net/html","BSD-3-Clause"
+"golang.org/x/text","BSD-3-Clause"
+"gopkg.in/yaml.v3","MIT"
+"github.com/asaskevich/govalidator","MIT"
+"github.com/beorn7/perks/quantile","MIT"
+"github.com/cespare/xxhash/v2","MIT"
+"github.com/davecgh/go-spew/spew","ISC"
+"github.com/emicklei/go-restful/v3","MIT"
+"github.com/evanphx/json-patch/v5","BSD-3-Clause"
+"github.com/fsnotify/fsnotify","BSD-3-Clause"
+"github.com/go-logr/logr","Apache-2.0"
+"github.com/go-logr/stdr","Apache-2.0"
+"github.com/go-logr/zapr","Apache-2.0"
+"github.com/go-openapi/analysis","Apache-2.0"
+"github.com/go-openapi/errors","Apache-2.0"
+"github.com/go-openapi/jsonpointer","Apache-2.0"
+"github.com/go-openapi/jsonreference","Apache-2.0"
+"github.com/go-openapi/loads","Apache-2.0"
+"github.com/go-openapi/runtime","Apache-2.0"
+"github.com/go-openapi/runtime/middleware/denco","MIT"
+"github.com/go-openapi/spec","Apache-2.0"
+"github.com/go-openapi/strfmt","Apache-2.0"
+"github.com/go-openapi/swag","Apache-2.0"
+"github.com/go-openapi/validate","Apache-2.0"
+"github.com/gogo/protobuf","BSD-3-Clause"
+"github.com/golang/groupcache/lru","Apache-2.0"
+"github.com/golang/protobuf","BSD-3-Clause"
+"github.com/google/gnostic-models","Apache-2.0"
+"github.com/google/go-cmp/cmp","BSD-3-Clause"
+"github.com/google/gofuzz","Apache-2.0"
+"github.com/google/uuid","BSD-3-Clause"
+"github.com/imdario/mergo","BSD-3-Clause"
+"github.com/josharian/intern","MIT"
+"github.com/json-iterator/go","MIT"
+"github.com/mailru/easyjson","MIT"
+"github.com/matttproud/golang_protobuf_extensions/pbutil","Apache-2.0"
+"github.com/mitchellh/mapstructure","MIT"
+"github.com/modern-go/concurrent","Apache-2.0"
+"github.com/modern-go/reflect2","Apache-2.0"
+"github.com/munnerz/goautoneg","BSD-3-Clause"
+"github.com/oklog/ulid","Apache-2.0"
+"github.com/opentracing/opentracing-go","Apache-2.0"
+"github.com/ory/hydra-maester","Apache-2.0"
+"github.com/pkg/errors","BSD-2-Clause"
+"github.com/prometheus/client_golang/prometheus","Apache-2.0"
+"github.com/prometheus/client_model/go","Apache-2.0"
+"github.com/prometheus/common","Apache-2.0"
+"github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg","BSD-3-Clause"
+"github.com/prometheus/procfs","Apache-2.0"
+"github.com/spf13/pflag","BSD-3-Clause"
+"go.mongodb.org/mongo-driver","Apache-2.0"
+"go.opentelemetry.io/otel","Apache-2.0"
+"go.opentelemetry.io/otel/metric","Apache-2.0"
+"go.opentelemetry.io/otel/trace","Apache-2.0"
+"go.uber.org/multierr","MIT"
+"go.uber.org/zap","MIT"
+"golang.org/x/exp/maps","BSD-3-Clause"
+"golang.org/x/net","BSD-3-Clause"
+"golang.org/x/oauth2","BSD-3-Clause"
+"golang.org/x/sync/errgroup","BSD-3-Clause"
+"golang.org/x/sys/unix","BSD-3-Clause"
+"golang.org/x/term","BSD-3-Clause"
+"golang.org/x/text","BSD-3-Clause"
+"golang.org/x/time/rate","BSD-3-Clause"
+"gomodules.xyz/jsonpatch/v2","Apache-2.0"
+"google.golang.org/protobuf","BSD-3-Clause"
+"gopkg.in/inf.v0","BSD-3-Clause"
+"gopkg.in/yaml.v2","Apache-2.0"
+"gopkg.in/yaml.v3","MIT"
+"k8s.io/api","Apache-2.0"
+"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions","Apache-2.0"
+"k8s.io/apimachinery/pkg","Apache-2.0"
+"k8s.io/apimachinery/third_party/forked/golang","BSD-3-Clause"
+"k8s.io/client-go","Apache-2.0"
+"k8s.io/klog/v2","Apache-2.0"
+"k8s.io/kube-openapi/pkg","Apache-2.0"
+"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json","BSD-3-Clause"
+"k8s.io/kube-openapi/pkg/validation/spec","Apache-2.0"
+"k8s.io/utils","Apache-2.0"
+"k8s.io/utils/internal/third_party/forked/golang/net","BSD-3-Clause"
+"sigs.k8s.io/controller-runtime","Apache-2.0"
+"sigs.k8s.io/json","Apache-2.0"
+"sigs.k8s.io/json","BSD-3-Clause"
+"sigs.k8s.io/structured-merge-diff/v4","Apache-2.0"
+"sigs.k8s.io/yaml","MIT"
+"sigs.k8s.io/yaml","BSD-3-Clause"
+"github.com/stretchr/testify","MIT"
+"k8s.io/api","Apache-2.0"
+"k8s.io/apimachinery","Apache-2.0"
+"k8s.io/client-go","Apache-2.0"
+"github.com/beorn7/perks/quantile","MIT"
+"github.com/cespare/xxhash/v2","MIT"
+"github.com/davecgh/go-spew/spew","ISC"
+"github.com/emicklei/go-restful/v3","MIT"
+"github.com/evanphx/json-patch/v5","BSD-3-Clause"
+"github.com/fsnotify/fsnotify","BSD-3-Clause"
+"github.com/go-logr/logr","Apache-2.0"
+"github.com/go-openapi/jsonpointer","Apache-2.0"
+"github.com/go-openapi/jsonreference","Apache-2.0"
+"github.com/go-openapi/swag","Apache-2.0"
+"github.com/gogo/protobuf","BSD-3-Clause"
+"github.com/golang/groupcache/lru","Apache-2.0"
+"github.com/golang/protobuf","BSD-3-Clause"
+"github.com/google/gnostic-models","Apache-2.0"
+"github.com/google/go-cmp/cmp","BSD-3-Clause"
+"github.com/google/gofuzz","Apache-2.0"
+"github.com/google/uuid","BSD-3-Clause"
+"github.com/imdario/mergo","BSD-3-Clause"
+"github.com/josharian/intern","MIT"
+"github.com/json-iterator/go","MIT"
+"github.com/mailru/easyjson","MIT"
+"github.com/matttproud/golang_protobuf_extensions/pbutil","Apache-2.0"
+"github.com/modern-go/concurrent","Apache-2.0"
+"github.com/modern-go/reflect2","Apache-2.0"
+"github.com/munnerz/goautoneg","BSD-3-Clause"
+"github.com/pkg/errors","BSD-2-Clause"
+"github.com/prometheus/client_golang/prometheus","Apache-2.0"
+"github.com/prometheus/client_model/go","Apache-2.0"
+"github.com/prometheus/common","Apache-2.0"
+"github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg","BSD-3-Clause"
+"github.com/prometheus/procfs","Apache-2.0"
+"github.com/spf13/pflag","BSD-3-Clause"
+"golang.org/x/exp/maps","BSD-3-Clause"
+"golang.org/x/net","BSD-3-Clause"
+"golang.org/x/oauth2","BSD-3-Clause"
+"golang.org/x/sys/unix","BSD-3-Clause"
+"golang.org/x/term","BSD-3-Clause"
+"golang.org/x/text","BSD-3-Clause"
+"golang.org/x/time/rate","BSD-3-Clause"
+"gomodules.xyz/jsonpatch/v2","Apache-2.0"
+"google.golang.org/protobuf","BSD-3-Clause"
+"gopkg.in/inf.v0","BSD-3-Clause"
+"gopkg.in/yaml.v2","Apache-2.0"
+"gopkg.in/yaml.v3","MIT"
+"k8s.io/api","Apache-2.0"
+"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions","Apache-2.0"
+"k8s.io/apimachinery/pkg","Apache-2.0"
+"k8s.io/apimachinery/third_party/forked/golang","BSD-3-Clause"
+"k8s.io/client-go","Apache-2.0"
+"k8s.io/klog/v2","Apache-2.0"
+"k8s.io/kube-openapi/pkg","Apache-2.0"
+"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json","BSD-3-Clause"
+"k8s.io/kube-openapi/pkg/validation/spec","Apache-2.0"
+"k8s.io/utils","Apache-2.0"
+"k8s.io/utils/internal/third_party/forked/golang/net","BSD-3-Clause"
+"sigs.k8s.io/controller-runtime","Apache-2.0"
+"sigs.k8s.io/json","Apache-2.0"
+"sigs.k8s.io/json","BSD-3-Clause"
+"sigs.k8s.io/structured-merge-diff/v4","Apache-2.0"
+"sigs.k8s.io/yaml","MIT"
+"sigs.k8s.io/yaml","BSD-3-Clause"
+

api/v1alpha1/oauth2client_types.go

@@ -225,6 +225,11 @@ type OAuth2ClientSpec struct {
 	// Indicates if a deleted OAuth2Client custom resource should delete the database row or not.
 	// Value 1 means deletion of the OAuth2 client, value 2 means keep an orphan oauth2 client.
 	DeletionPolicy OAuth2ClientDeletionPolicy `json:"deletionPolicy,omitempty"`
+
+	// +kubebuilder:validation:type=string
+	//
+	// UserInfoSignedResponseAlg value specifying the JWS alg algorithm for signing UserInfo Responses
+	UserInfoSignedResponseAlg string `json:"userInfoSignedResponseAlg,omitempty"`
 }
 
 // GrantType represents an OAuth 2.0 grant type

config/crd/bases/hydra.ory.sh_oauth2clients.yaml

@@ -37,75 +37,64 @@ spec:
           metadata:
             type: object
           spec:
-              description:
+            description: OAuth2ClientSpec defines the desired state of OAuth2Client
-                OAuth2ClientSpec defines the desired state of OAuth2Client
             properties:
               allowedCorsOrigins:
-                  description:
+                description: AllowedCorsOrigins is an array of allowed CORS origins
-                    AllowedCorsOrigins is an array of allowed CORS origins
                 items:
-                    description:
+                  description: RedirectURI represents a redirect URI for the client
-                      RedirectURI represents a redirect URI for the client
                   pattern: \w+:/?/?[^\s]+
                   type: string
                 type: array
               audience:
-                  description:
+                description: Audience is a whitelist defining the audiences this client
-                    Audience is a whitelist defining the audiences this client
                   is allowed to request tokens for
                 items:
                   type: string
                 type: array
               backChannelLogoutSessionRequired:
                 default: false
-                  description:
+                description: BackChannelLogoutSessionRequired Boolean value specifying
-                    BackChannelLogoutSessionRequired Boolean value specifying
+                  whether the RP requires that a sid (session ID) Claim be included
-                    whether the RP requires that a sid (session ID) Claim be
+                  in the Logout Token to identify the RP session with the OP when
-                    included in the Logout Token to identify the RP session with
+                  the backchannel_logout_uri is used. If omitted, the default value
-                    the OP when the backchannel_logout_uri is used. If omitted,
+                  is false.
-                    the default value is false.
                 type: boolean
               backChannelLogoutURI:
-                  description:
+                description: BackChannelLogoutURI RP URL that will cause the RP to
-                    BackChannelLogoutURI RP URL that will cause the RP to log
+                  log itself out when sent a Logout Token by the OP
-                    itself out when sent a Logout Token by the OP
                 pattern: (^$|^https?://.*)
                 type: string
               clientName:
-                  description:
+                description: ClientName is the human-readable string name of the client
-                    ClientName is the human-readable string name of the client
                   to be presented to the end-user during authorization.
                 type: string
               deletionPolicy:
                 description: |-
                   Indicates if a deleted OAuth2Client custom resource should delete the database row or not.
-                    Value 0 means deletion of the OAuth2 client, value 1 means keep an orphan oauth2 client.
+                  Value 1 means deletion of the OAuth2 client, value 2 means keep an orphan oauth2 client.
                 enum:
-                    - 0
                 - 1
+                - 2
                 type: integer
               frontChannelLogoutSessionRequired:
                 default: false
-                  description:
+                description: FrontChannelLogoutSessionRequired Boolean value specifying
-                    FrontChannelLogoutSessionRequired Boolean value specifying
+                  whether the RP requires that iss (issuer) and sid (session ID) query
-                    whether the RP requires that iss (issuer) and sid (session
+                  parameters be included to identify the RP session with the OP when
-                    ID) query parameters be included to identify the RP session
+                  the frontchannel_logout_uri is used
-                    with the OP when the frontchannel_logout_uri is used
                 type: boolean
               frontChannelLogoutURI:
-                  description:
+                description: FrontChannelLogoutURI RP URL that will cause the RP to
-                    FrontChannelLogoutURI RP URL that will cause the RP to log
+                  log itself out when rendered in an iframe by the OP. An iss (issuer)
-                    itself out when rendered in an iframe by the OP. An iss
+                  query parameter and a sid (session ID) query parameter MAY be included
-                    (issuer) query parameter and a sid (session ID) query
+                  by the OP to enable the RP to validate the request and to determine
-                    parameter MAY be included by the OP to enable the RP to
+                  which of the potentially multiple sessions is to be logged out;
-                    validate the request and to determine which of the
+                  if either is included, both MUST be
-                    potentially multiple sessions is to be logged out; if either
-                    is included, both MUST be
                 pattern: (^$|^https?://.*)
                 type: string
               grantTypes:
-                  description:
+                description: GrantTypes is an array of grant types the client is allowed
-                    GrantTypes is an array of grant types the client is allowed
                   to use.
                 items:
                   description: GrantType represents an OAuth 2.0 grant type
@@ -155,10 +144,9 @@ spec:
                     type: string
                 type: object
               jwksUri:
-                  description:
+                description: JwksUri Define the URL where the JSON Web Key Set should
-                    JwksUri Define the URL where the JSON Web Key Set should be
+                  be fetched from when performing the private_key_jwt client authentication
-                    fetched from when performing the private_key_jwt client
+                  method.
-                    authentication method.
                 pattern: (^$|^https?://.*)
                 type: string
               metadata:
@@ -167,22 +155,18 @@ spec:
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
               postLogoutRedirectUris:
-                  description:
+                description: PostLogoutRedirectURIs is an array of the post logout
-                    PostLogoutRedirectURIs is an array of the post logout
                   redirect URIs allowed for the application
                 items:
-                    description:
+                  description: RedirectURI represents a redirect URI for the client
-                      RedirectURI represents a redirect URI for the client
                   pattern: \w+:/?/?[^\s]+
                   type: string
                 type: array
               redirectUris:
-                  description:
+                description: RedirectURIs is an array of the redirect URIs allowed
-                    RedirectURIs is an array of the redirect URIs allowed for
+                  for the application
-                    the application
                 items:
-                    description:
+                  description: RedirectURI represents a redirect URI for the client
-                      RedirectURI represents a redirect URI for the client
                   pattern: \w+:/?/?[^\s]+
                   type: string
                 type: array
@@ -191,8 +175,8 @@ spec:
                   ResponseTypes is an array of the OAuth 2.0 response type strings that the client can
                   use at the authorization endpoint.
                 items:
-                    description:
+                  description: ResponseType represents an OAuth 2.0 response type
-                      ResponseType represents an OAuth 2.0 response type strings
+                    strings
                   enum:
                   - id_token
                   - code
@@ -221,8 +205,7 @@ spec:
                   type: string
                 type: array
               secretName:
-                  description:
+                description: SecretName points to the K8s secret that contains this
-                    SecretName points to the K8s secret that contains this
                   client's ID and password
                 maxLength: 253
                 minLength: 1
@@ -230,8 +213,7 @@ spec:
                 type: string
               skipConsent:
                 default: false
-                  description:
+                description: SkipConsent skips the consent screen for this client.
-                    SkipConsent skips the consent screen for this client.
                 type: boolean
               tokenEndpointAuthMethod:
                 allOf:
@@ -245,9 +227,8 @@ spec:
                   - client_secret_post
                   - private_key_jwt
                   - none
-                  description:
+                description: Indication which authentication method should be used
-                    Indication which authentication method should be used for
+                  for the token endpoint
-                    the token endpoint
                 type: string
               tokenLifespans:
                 description: |-
@@ -258,76 +239,78 @@ spec:
                     description: |-
                       AuthorizationCodeGrantAccessTokenLifespan is the access token lifespan
                       issued on an authorization_code grant.
-                      pattern: "[0-9]+(ns|us|ms|s|m|h)"
+                    pattern: '[0-9]+(ns|us|ms|s|m|h)'
                     type: string
                   authorization_code_grant_id_token_lifespan:
                     description: |-
                       AuthorizationCodeGrantIdTokenLifespan is the id token lifespan
                       issued on an authorization_code grant.
-                      pattern: "[0-9]+(ns|us|ms|s|m|h)"
+                    pattern: '[0-9]+(ns|us|ms|s|m|h)'
                     type: string
                   authorization_code_grant_refresh_token_lifespan:
                     description: |-
                       AuthorizationCodeGrantRefreshTokenLifespan is the refresh token lifespan
                       issued on an authorization_code grant.
-                      pattern: "[0-9]+(ns|us|ms|s|m|h)"
+                    pattern: '[0-9]+(ns|us|ms|s|m|h)'
                     type: string
                   client_credentials_grant_access_token_lifespan:
                     description: |-
                       AuthorizationCodeGrantRefreshTokenLifespan is the access token lifespan
                       issued on a client_credentials grant.
-                      pattern: "[0-9]+(ns|us|ms|s|m|h)"
+                    pattern: '[0-9]+(ns|us|ms|s|m|h)'
                     type: string
                   implicit_grant_access_token_lifespan:
                     description: |-
                       ImplicitGrantAccessTokenLifespan is the access token lifespan
                       issued on an implicit grant.
-                      pattern: "[0-9]+(ns|us|ms|s|m|h)"
+                    pattern: '[0-9]+(ns|us|ms|s|m|h)'
                     type: string
                   implicit_grant_id_token_lifespan:
                     description: |-
                       ImplicitGrantIdTokenLifespan is the id token lifespan
                       issued on an implicit grant.
-                      pattern: "[0-9]+(ns|us|ms|s|m|h)"
+                    pattern: '[0-9]+(ns|us|ms|s|m|h)'
                     type: string
                   jwt_bearer_grant_access_token_lifespan:
                     description: |-
                       JwtBearerGrantAccessTokenLifespan is the access token lifespan
                       issued on a jwt_bearer grant.
-                      pattern: "[0-9]+(ns|us|ms|s|m|h)"
+                    pattern: '[0-9]+(ns|us|ms|s|m|h)'
                     type: string
                   refresh_token_grant_access_token_lifespan:
                     description: |-
                       RefreshTokenGrantAccessTokenLifespan is the access token lifespan
                       issued on a refresh_token grant.
-                      pattern: "[0-9]+(ns|us|ms|s|m|h)"
+                    pattern: '[0-9]+(ns|us|ms|s|m|h)'
                     type: string
                   refresh_token_grant_id_token_lifespan:
                     description: |-
                       RefreshTokenGrantIdTokenLifespan is the id token lifespan
                       issued on a refresh_token grant.
-                      pattern: "[0-9]+(ns|us|ms|s|m|h)"
+                    pattern: '[0-9]+(ns|us|ms|s|m|h)'
                     type: string
                   refresh_token_grant_refresh_token_lifespan:
                     description: |-
                       RefreshTokenGrantRefreshTokenLifespan is the refresh token lifespan
                       issued on a refresh_token grant.
-                      pattern: "[0-9]+(ns|us|ms|s|m|h)"
+                    pattern: '[0-9]+(ns|us|ms|s|m|h)'
                     type: string
                 type: object
+              userInfoSignedResponseAlg:
+                description: UserInfoSignedResponseAlg value specifying the JWS alg
+                  algorithm for signing UserInfo Responses
+                type: string
             required:
             - grantTypes
             - secretName
             type: object
           status:
-              description:
+            description: OAuth2ClientStatus defines the observed state of OAuth2Client
-                OAuth2ClientStatus defines the observed state of OAuth2Client
             properties:
               conditions:
                 items:
-                    description:
+                  description: OAuth2ClientCondition contains condition information
-                      OAuth2ClientCondition contains condition information for
+                    for an OAuth2Client
-                      an OAuth2Client
                   properties:
                     status:
                       enum:
@@ -343,24 +326,20 @@ spec:
                   type: object
                 type: array
               observedGeneration:
-                  description:
+                description: ObservedGeneration represents the most recent generation
-                    ObservedGeneration represents the most recent generation
                   observed by the daemon set controller.
                 format: int64
                 type: integer
               reconciliationError:
-                  description:
+                description: ReconciliationError represents an error that occurred
-                    ReconciliationError represents an error that occurred during
+                  during the reconciliation process
-                    the reconciliation process
                 properties:
                   description:
-                      description:
+                    description: Description is the description of the reconciliation
-                        Description is the description of the reconciliation
                       error
                     type: string
                   statusCode:
-                      description:
+                    description: Code is the status code of the reconciliation error
-                        Code is the status code of the reconciliation error
                     type: string
                 type: object
             type: object

config/default/manager_image_patch.yaml

@@ -8,6 +8,6 @@ spec:
     spec:
       containers:
         # Change the value of image field below to your controller image URL
-        - image: controller:latest
+        - image: reg.cadoles.com/wpetit/hydra-maester
           name: manager
           imagePullPolicy: IfNotPresent

hydra/types.go

@@ -44,6 +44,7 @@ type OAuth2ClientJSON struct {
 	RefreshTokenGrantAccessTokenLifespan       string          `json:"refresh_token_grant_access_token_lifespan,omitempty"`
 	RefreshTokenGrantIdTokenLifespan           string          `json:"refresh_token_grant_id_token_lifespan,omitempty"`
 	RefreshTokenGrantRefreshTokenLifespan      string          `json:"refresh_token_grant_refresh_token_lifespan,omitempty"`
+	UserInfoSignedResponseAlg                  string          `json:"userinfo_signed_response_alg,omitempty"`
 }
 
 // Oauth2ClientCredentials represents client ID and password fetched from a
@@ -104,6 +105,7 @@ func FromOAuth2Client(c *hydrav1alpha1.OAuth2Client) (*OAuth2ClientJSON, error)
 		RefreshTokenGrantAccessTokenLifespan:       c.Spec.TokenLifespans.RefreshTokenGrantAccessTokenLifespan,
 		RefreshTokenGrantIdTokenLifespan:           c.Spec.TokenLifespans.RefreshTokenGrantIdTokenLifespan,
 		RefreshTokenGrantRefreshTokenLifespan:      c.Spec.TokenLifespans.RefreshTokenGrantRefreshTokenLifespan,
+		UserInfoSignedResponseAlg:                  c.Spec.UserInfoSignedResponseAlg,
 	}, nil
 }