| 622 | } |
| 623 | |
| 624 | func (op *OIDCProvider) verifyToken(ctx context.Context, token string, callbackURLFunc OIDCCallbackURLFunc) (*Identity, error) { |
| 625 | // Get client for issuer |
| 626 | client, err := op.GetClient(ctx, callbackURLFunc) |
| 627 | if err != nil { |
| 628 | return nil, fmt.Errorf("OIDC initialization error: %w", err) |
| 629 | } |
| 630 | |
| 631 | // Verify claims and signature on the JWT; ensure that it's been signed by the provider. |
| 632 | idToken, err := client.verifyJWT(ctx, token) |
| 633 | if err != nil { |
| 634 | base.InfofCtx(ctx, base.KeyAuth, "Client %v could not verify JWT. Error: %v", base.UD(op.Name), err) |
| 635 | return nil, err |
| 636 | } |
| 637 | |
| 638 | identity, ok, err := getIdentity(idToken) |
| 639 | if err != nil { |
| 640 | base.InfofCtx(ctx, base.KeyAuth, "Error getting identity from token (Identity: %+v, Error: %v)", base.UD(identity), err) |
| 641 | } |
| 642 | if !ok { |
| 643 | return nil, err |
| 644 | } |
| 645 | |
| 646 | return identity, nil |
| 647 | } |
| 648 | |
| 649 | func (op *OIDCProvider) common() JWTConfigCommon { |
| 650 | return op.JWTConfigCommon |