Deny suspended directory identities

src/internal/server/oidc/userinfo.go

@@ -21,10 +21,10 @@ import (
 // the user, and returns claims that are consistent with those in the ID token
 // for the same scope set.
 type UserinfoHandler struct {
-	Users     domain.UserRepository
+	Users      domain.UserRepository
 	SigningKey *rsa.PublicKey // used to verify the incoming access token
-	Issuer    string
-	Emitter   telemetry.Emitter
+	Issuer     string
+	Emitter    telemetry.Emitter
 }
 
 // ServeHTTP handles GET /userinfo.
@@ -59,6 +59,10 @@ func (h *UserinfoHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, `{"error":"invalid_token","description":"subject not found"}`, http.StatusUnauthorized)
 		return
 	}
+	if isSuspended(user) {
+		http.Error(w, `{"error":"invalid_token","description":"subject is suspended"}`, http.StatusUnauthorized)
+		return
+	}
 
 	// 5. Build response claims filtered by the scopes embedded in the token.
 	scopeStr, _ := claims["scope"].(string)