Missing $userinfo check results in account being created with no user information

Problem/Motivation

The following code in openid_connect_complete_authorization() checks if $userinfo['email'] is empty, but not if $userinfo is FALSE.

  $userinfo = $client->retrieveUserInfo($tokens['access_token']);

  if ($userinfo && empty($userinfo['email'])) {
    watchdog('openid_connect', 'No e-mail address provided by @provider', array('@provider' => $client->getLabel()), WATCHDOG_ERROR);
    return FALSE;
  }

An example of where this becomes problematic is when using the provided Google plugin and Google+ API is disabled. This is the watchdog output when an anonymous user attempts to sign in with Google:

.
TYPE	openid_connect_google
DATE	Tuesday, October 13, 2015 - 10:34
USER	Anonymous (not verified)
LOCATION	http://localhost/d7.dev2/openid-connect/google?state=123456&code=4/123456&authuser=0&session_state=123456&prompt=none
MESSAGE	Could not retrieve user profile information (403 Forbidden). Details: Array ( [error] => Array ( [errors] => Array ( [0] => Array ( [domain] => usageLimits [reason] => accessNotConfigured [message] => Access Not Configured. The API (Google+ API) is not enabled for your project. Please use the Google Developers Console to update your configuration. [extendedHelp] => https://console.developers.google.com ) ) [code] => 403 [message] => Access Not Configured. The API (Google+ API) is not enabled for your project. Please use the Google Developers Console to update your configuration. ) )
SEVERITY	error	

TYPE	user
DATE	Tuesday, October 13, 2015 - 10:34
USER	oidc_google_103025180240695347563 
LOCATION	http://localhost/d7.dev2/openid-connect/google?state=123456&code=4/123456&authuser=0&session_state=123456&prompt=none
MESSAGE	Session opened for oidc_google_103025180240695347563.
SEVERITY	notice
.

 
As you can see, there is an error and yet a user account is still created.

Test:

1. Install module and configure Google client
2. Do the necessary set-up in Google Developer Console, only do not enable Google+ API
3. Configure "OpenID Connect login" block so that it's available to anonymous users.
4. Log out and attempt to connect via "Log in with Google" button

Proposed resolution

Below is the (presumably correct) watchdog output when we check if $userinfo is FALSE. No account is created.

.
TYPE	openid_connect_google
DATE	Tuesday, October 13, 2015 - 10:38
USER	Anonymous (not verified)
LOCATION	http://localhost/d7.dev2/openid-connect/google?state=123456&code=4/123456&authuser=0&session_state=123456&prompt=none
MESSAGE	Could not retrieve user profile information (403 Forbidden). Details: Array ( [error] => Array ( [errors] => Array ( [0] => Array ( [domain] => usageLimits [reason] => accessNotConfigured [message] => Access Not Configured. The API (Google+ API) is not enabled for your project. Please use the Google Developers Console to update your configuration. [extendedHelp] => https://console.developers.google.com ) ) [code] => 403 [message] => Access Not Configured. The API (Google+ API) is not enabled for your project. Please use the Google Developers Console to update your configuration. ) )
SEVERITY	error	

TYPE	openid_connect
DATE	Tuesday, October 13, 2015 - 10:38
USER	Anonymous (not verified)
LOCATION	http://localhost/d7.dev2/openid-connect/google?state=60aaa4b2fc3fcf6a41c454149ab76592&code=4/KO-5P1WjSgLC_-TGCgxwJAcFyww2lpqatO-7IqDVm5g&authuser=0&session_state=9dfc5200ca4cba8c6b488203e73d3b0d1c3c51a3..f56c&prompt=none
MESSAGE	No e-mail address provided by Google
SEVERITY	error	
.

 
Patch to follow...