| 203 | } |
| 204 | |
| 205 | func parseTenant(accessToken string) (tenant, domain string, err error) { |
| 206 | parts := strings.Split(accessToken, ".") |
| 207 | v, err := base64.RawURLEncoding.DecodeString(parts[1]) |
| 208 | if err != nil { |
| 209 | return "", "", err |
| 210 | } |
| 211 | var payload struct { |
| 212 | AUDs []string `json:"aud"` |
| 213 | } |
| 214 | if err := json.Unmarshal(v, &payload); err != nil { |
| 215 | return "", "", err |
| 216 | } |
| 217 | |
| 218 | for _, aud := range payload.AUDs { |
| 219 | u, err := url.Parse(aud) |
| 220 | if err != nil { |
| 221 | return "", "", err |
| 222 | } |
| 223 | if u.Path == audiencePath { |
| 224 | parts := strings.Split(u.Host, ".") |
| 225 | return parts[0], u.Host, nil |
| 226 | } |
| 227 | } |
| 228 | return "", "", fmt.Errorf("audience not found for %s", audiencePath) |
| 229 | } |
| 230 | |
| 231 | // ClientCredentials encapsulates all data to facilitate access token creation with client credentials (client ID and client secret). |
| 232 | type ClientCredentials struct { |