Spring Security Default retrieveUserInfo for OidcUserService & OidcReactiveOAuth2UserService are inconsistent

By default OidcReactiveOAuth2UserService uses OidcUserRequestUtils::shouldRetrieveUserInfo but OidcUserService uses this::retrieveUserInfo. The logic between these two methods are not consistent and we need to update the logic in retrieveUserInfo for OidcUserService & OidcReactiveOAuth2UserService to be consistent.

We need to:

1) Ensure that the logic in OidcUserRequestUtils::shouldRetrieveUserInfo is correct (since it isn't consistent with OidcUserService::retrieveUserInfo 2) Update the default for OidcUserService to use OidcUserService::retreiveUserInfo.

@jgrandja

Comment From: therepanic

Hi, @rwinch! Since the first part seems to be under review (and @jgrandja was mentioned), would it be okay if I worked on the second part (updating OidcUserService)?

Comment From: rwinch

@therepanic Thanks for reaching out. I think that both of these should be done together since it will potentially be a breaking change.