DefaultOAuth2UserService -> assert UserInfo Uri is set

Fixes gh-4992

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java

@@ -47,18 +47,29 @@ import java.util.Set;
  * @see DefaultOAuth2User
  */
 public class DefaultOAuth2UserService implements OAuth2UserService<OAuth2UserRequest, OAuth2User> {
+	private static final String MISSING_USER_INFO_URI_ERROR_CODE = "missing_user_info_uri";
 	private static final String MISSING_USER_NAME_ATTRIBUTE_ERROR_CODE = "missing_user_name_attribute";
 	private NimbusUserInfoResponseClient userInfoResponseClient = new NimbusUserInfoResponseClient();
 
 	@Override
 	public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
 		Assert.notNull(userRequest, "userRequest cannot be null");
+
+		if (!StringUtils.hasText(userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri())) {
+			OAuth2Error oauth2Error = new OAuth2Error(
+				MISSING_USER_INFO_URI_ERROR_CODE,
+				"Missing required UserInfo Uri in UserInfoEndpoint for Client Registration: " +
+					userRequest.getClientRegistration().getRegistrationId(),
+				null
+			);
+			throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
+		}
 		String userNameAttributeName = userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUserNameAttributeName();
 		if (!StringUtils.hasText(userNameAttributeName)) {
 			OAuth2Error oauth2Error = new OAuth2Error(
 				MISSING_USER_NAME_ATTRIBUTE_ERROR_CODE,
 				"Missing required \"user name\" attribute name in UserInfoEndpoint for Client Registration: " +
-				userRequest.getClientRegistration().getRegistrationId(),
+					userRequest.getClientRegistration().getRegistrationId(),
 				null
 			);
 			throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());

oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserServiceTests.java

@@ -73,11 +73,21 @@ public class DefaultOAuth2UserServiceTests {
 		this.userService.loadUser(null);
 	}
 
+	@Test
+	public void loadUserWhenUserInfoUriIsNullThenThrowOAuth2AuthenticationException() {
+		this.exception.expect(OAuth2AuthenticationException.class);
+		this.exception.expectMessage(containsString("missing_user_info_uri"));
+
+		when(this.userInfoEndpoint.getUri()).thenReturn(null);
+		this.userService.loadUser(new OAuth2UserRequest(this.clientRegistration, this.accessToken));
+	}
+
 	@Test
 	public void loadUserWhenUserNameAttributeNameIsNullThenThrowOAuth2AuthenticationException() {
 		this.exception.expect(OAuth2AuthenticationException.class);
 		this.exception.expectMessage(containsString("missing_user_name_attribute"));
 
+		when(this.userInfoEndpoint.getUri()).thenReturn("http://provider.com/user");
 		when(this.userInfoEndpoint.getUserNameAttributeName()).thenReturn(null);
 		this.userService.loadUser(new OAuth2UserRequest(this.clientRegistration, this.accessToken));
 	}