@@ -119,7 +119,6 @@ type Options struct {
119119 sessionStore sessionsapi.SessionStore
120120 signatureData *SignatureData
121121 oidcVerifier *oidc.IDTokenVerifier
122− jwtIssuers [][]string
123122 jwtBearerVerifiers []*oidc.IDTokenVerifier
124123}
125124
@@ -172,6 +171,12 @@ func NewOptions() *Options {
172171 }
173172}
174173
174+// JwtIssuer hold parsed JWT issuer info that's used to construct a verifier.
175+type JwtIssuer struct {
176+ issuerURI string
177+ audience string
178+}
179+
175180func parseURL(toParse string, urltype string, msgs []string) (*url.URL, []string) {
176181 parsed, err := url.Parse(toParse)
177182 if err != nil {
@@ -255,25 +260,12 @@ func (o *Options) Validate() error {
255260 }
256261 // Configure extra issuers
257262 if len(o.ExtraJwtIssuers) > 0 {
258− msgs = parseJwtIssuers(o, msgs)
259− for _, pair := range o.jwtIssuers {
260− issuer, audience := pair[0], pair[1]
261− config := &oidc.Config{
262− ClientID: audience,
263− }
264− // Try as an OpenID Connect Provider first
265− var verifier *oidc.IDTokenVerifier
266− provider, err := oidc.NewProvider(context.Background(), issuer)
263+ var jwtIssuers []JwtIssuer
264+ jwtIssuers, msgs = parseJwtIssuers(o.ExtraJwtIssuers, msgs)
265+ for _, jwtIssuer := range jwtIssuers {
266+ verifier, err := newVerifierFromJwtIssuer(jwtIssuer)
267267 if err != nil {
268− // Try as JWKS URI
269− jwksURI := strings.TrimSuffix(issuer, "/") + "/.well-known/jwks.json"
270− _, err := http.NewRequest("GET", jwksURI, nil)
271− if err != nil {
272− return err
273− }
274− verifier = oidc.NewVerifier(issuer, oidc.NewRemoteKeySet(context.Background(), jwksURI), config)
275− } else {
276− verifier = provider.Verifier(config)
268+ msgs = append(msgs, fmt.Sprintf("error building verifiers: %s", err))
277269 }
278270 o.jwtBearerVerifiers = append(o.jwtBearerVerifiers, verifier)
279271 }
@@ -466,17 +458,43 @@ func parseSignatureKey(o *Options, msgs []string) []string {
466458 return msgs
467459}
468460
469−func parseJwtIssuers(o *Options, msgs []string) []string {
470− for _, jwtVerifier := range o.ExtraJwtIssuers {
461+// parseJwtIssuers takes in an array of strings in the form of issuer=audience
462+// and parses to an array of JwtIssuer structs.
463+func parseJwtIssuers(issuers []string, msgs []string) ([]JwtIssuer, []string) {
464+ var parsedIssuers []JwtIssuer
465+ for _, jwtVerifier := range issuers {
471466 components := strings.Split(jwtVerifier, "=")
472467 if len(components) < 2 {
473− return append(msgs, "invalid jwt verifier uri=audience spec: "+
474− jwtVerifier)
468+ msgs = append(msgs, fmt.Sprintf("invalid jwt verifier uri=audience spec: %s", jwtVerifier))
469+ continue
475470 }
476471 uri, audience := components[0], strings.Join(components[1:], "=")
477− o.jwtIssuers = append(o.jwtIssuers, []string{uri, audience})
472+ parsedIssuers = append(parsedIssuers, JwtIssuer{issuerURI: uri, audience: audience})
478473 }
479− return msgs
474+ return parsedIssuers, msgs
475+}
476+
477+// newVerifierFromJwtIssuer takes in issuer information in JwtIssuer info and returns
478+// a verifier for that issuer.
479+func newVerifierFromJwtIssuer(jwtIssuer JwtIssuer) (*oidc.IDTokenVerifier, error) {
480+ config := &oidc.Config{
481+ ClientID: jwtIssuer.audience,
482+ }
483+ // Try as an OpenID Connect Provider first
484+ var verifier *oidc.IDTokenVerifier
485+ provider, err := oidc.NewProvider(context.Background(), jwtIssuer.issuerURI)
486+ if err != nil {
487+ // Try as JWKS URI
488+ jwksURI := strings.TrimSuffix(jwtIssuer.issuerURI, "/") + "/.well-known/jwks.json"
489+ _, err := http.NewRequest("GET", jwksURI, nil)
490+ if err != nil {
491+ return nil, err
492+ }
493+ verifier = oidc.NewVerifier(jwtIssuer.issuerURI, oidc.NewRemoteKeySet(context.Background(), jwksURI), config)
494+ } else {
495+ verifier = provider.Verifier(config)
496+ }
497+ return verifier, nil
480498}
481499
482500func validateCookieName(o *Options, msgs []string) []string {