@@ -157,7 +157,7 @@ func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Tok
157157 newSession = &sessions.SessionState{}
158158 } else {
159159 var err error
160− newSession, err = p.createSessionStateInternal(ctx, token.Extra("id_token").(string), idToken, token)
160+ newSession, err = p.createSessionStateInternal(ctx, token.Extra("id_token").(string), idToken, token, false)
161161 if err != nil {
162162 return nil, err
163163 }
@@ -172,7 +172,7 @@ func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Tok
172172}
173173
174174func (p *OIDCProvider) CreateSessionStateFromBearerToken(ctx context.Context, rawIDToken string, idToken *oidc.IDToken) (*sessions.SessionState, error) {
175− newSession, err := p.createSessionStateInternal(ctx, rawIDToken, idToken, nil)
175+ newSession, err := p.createSessionStateInternal(ctx, rawIDToken, idToken, nil, true)
176176 if err != nil {
177177 return nil, err
178178 }
@@ -185,7 +185,7 @@ func (p *OIDCProvider) CreateSessionStateFromBearerToken(ctx context.Context, ra
185185 return newSession, nil
186186}
187187
188−func (p *OIDCProvider) createSessionStateInternal(ctx context.Context, rawIDToken string, idToken *oidc.IDToken, token *oauth2.Token) (*sessions.SessionState, error) {
188+func (p *OIDCProvider) createSessionStateInternal(ctx context.Context, rawIDToken string, idToken *oidc.IDToken, token *oauth2.Token, bearer bool) (*sessions.SessionState, error) {
189189
190190 newSession := &sessions.SessionState{}
191191
@@ -197,7 +197,7 @@ func (p *OIDCProvider) createSessionStateInternal(ctx context.Context, rawIDToke
197197 accessToken = token.AccessToken
198198 }
199199
200− claims, err := p.findClaimsFromIDToken(ctx, idToken, accessToken, p.ProfileURL.String())
200+ claims, err := p.findClaimsFromIDToken(ctx, idToken, accessToken, p.ProfileURL.String(), bearer)
201201 if err != nil {
202202 return nil, fmt.Errorf("couldn't extract claims from id_token (%v)", err)
203203 }
@@ -230,7 +230,7 @@ func getOIDCHeader(accessToken string) http.Header {
230230 return header
231231}
232232
233−func (p *OIDCProvider) findClaimsFromIDToken(ctx context.Context, idToken *oidc.IDToken, accessToken string, profileURL string) (*OIDCClaims, error) {
233+func (p *OIDCProvider) findClaimsFromIDToken(ctx context.Context, idToken *oidc.IDToken, accessToken string, profileURL string, bearer bool) (*OIDCClaims, error) {
234234 claims := &OIDCClaims{}
235235 // Extract default claims.
236236 if err := idToken.Claims(&claims); err != nil {
@@ -249,8 +249,11 @@ func (p *OIDCProvider) findClaimsFromIDToken(ctx context.Context, idToken *oidc.
249249 // userID claim was not present or was empty in the ID Token
250250 if claims.UserID == "" {
251251 if profileURL == "" {
252− claims.UserID = claims.Subject
253− return claims, nil
252+ if bearer {
253+ claims.UserID = claims.Subject
254+ return claims, nil
255+ }
256+ return nil, fmt.Errorf("id_token did not contain user ID claim (%q)", p.UserIDClaim)
254257 }
255258
256259 // If the userinfo endpoint profileURL is defined, then there is a chance the userinfo