| 32 | |
| 33 | |
| 34 | def _parse_access_token(provider, oauth_token): |
| 35 | token = oauth_token.get("access_token") |
| 36 | if token is None: |
| 37 | return {} |
| 38 | |
| 39 | def load_key(header, payload): |
| 40 | jwk_set = JsonWebKey.import_key_set(provider.fetch_jwk_set(force=True)) |
| 41 | return jwk_set.find_by_kid(header.get("kid")) |
| 42 | |
| 43 | metadata = provider.load_server_metadata() |
| 44 | algs = metadata.get("id_token_signing_alg_values_supported", ["RS256"]) |
| 45 | jwt = JsonWebToken(algs) |
| 46 | claims = {"exp": {"essential": True}} |
| 47 | return jwt.decode(token, key=load_key, claims_options=claims) |
| 48 | |
| 49 | |
| 50 | def _get_groups(provider, oauth_token, id_token): |