diff --git a/src/pyop/provider.py b/src/pyop/provider.py index 2103d45..81ae812 100644 --- a/src/pyop/provider.py +++ b/src/pyop/provider.py @@ -449,19 +449,20 @@ def _do_code_exchange(self, request, # type: Dict[str, str] if refresh_token is not None: response['refresh_token'] = refresh_token - extra_id_token_claims = ( - extra_id_token_claims(user_id, authentication_request['client_id']) - if callable(extra_id_token_claims) - else {} - if not extra_id_token_claims - else extra_id_token_claims - ) - extra_id_token_claims_in_code = ( - self.authz_state.get_extra_id_token_claims_for_code(token_request['code']) - if self.stateless - else {} - ) - extra_id_token_claims.update(extra_id_token_claims_in_code) + if callable(extra_id_token_claims): + # In stateless mode there is no user_db for the callable to consult, and its + # result would be overwritten by the claims stored in the code below. + extra_id_token_claims = ( + {} if self.stateless + else extra_id_token_claims(user_id, authentication_request['client_id']) + ) + elif not extra_id_token_claims: + extra_id_token_claims = {} + + if self.stateless: + extra_id_token_claims.update( + self.authz_state.get_extra_id_token_claims_for_code(token_request['code']) + ) requested_claims = self._get_requested_claims_in(authentication_request, 'id_token') if self.stateless: diff --git a/src/pyop/userinfo.py b/src/pyop/userinfo.py index b01e563..ae9e6d7 100644 --- a/src/pyop/userinfo.py +++ b/src/pyop/userinfo.py @@ -31,6 +31,6 @@ def get_claims_for(self, user_id, requested_claims, userinfo=None): """ if not userinfo: - userinfo = self._db[user_id] if user_id else {} + userinfo = self._db.get(user_id, {}) if user_id else {} claims = {claim: userinfo[claim] for claim in requested_claims if claim in userinfo} return claims