Method parseIdToken

tools/auth/oidc.go:133–188

(token *oauth2.Token)

}

func (p *OIDC) parseIdToken(token *oauth2.Token) (jwt.MapClaims, error) {
	idToken := token.Extra("id_token").(string)
	if idToken == "" {
		return nil, errors.New("empty id_token")
	}

	claims := jwt.MapClaims{}
	_, _, err := jwt.NewParser().ParseUnverified(idToken, claims)
	if err != nil {
		return nil, err
	}

	// validate common claims
	jwtValidator := jwt.NewValidator(
		jwt.WithIssuedAt(),
		jwt.WithLeeway(idTokenLeeway),
		jwt.WithAudience(p.clientId),
	)
	err = jwtValidator.Validate(claims)
	if err != nil {
		return nil, err
	}

	// validate iss (if "issuers" extra config is set)
	issuers := cast.ToStringSlice(p.Extra()["issuers"])
	if len(issuers) > 0 {
		var isIssValid bool
		claimIssuer, _ := claims.GetIssuer()

		for _, issuer := range issuers {
			if security.Equal(claimIssuer, issuer) {
				isIssValid = true
				break
			}
		}

		if !isIssValid {
			return nil, fmt.Errorf("iss must be one of %v, got %#v", issuers, claims["iss"])
		}
	}

	// validate signature (if "jwksURL" extra config is set)
	//
	// note: this step could be technically considered optional because we trust
	// the token which is a result of direct TLS communication with the provider
	// (see also https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation)
	jwksURL := cast.ToString(p.Extra()["jwksURL"])
	if jwksURL != "" {
		err = jwk.ValidateTokenSignature(p.ctx, idToken, jwksURL)
		if err != nil {
			return nil, fmt.Errorf("id_token validation failed: %w", err)
		}
	}

	return claims, nil
}