@@ -29,6 +29,12 @@ type GoogleProvider struct {
2929 GroupValidator func(string) bool
3030}
3131
32+type claims struct {
33+ Subject string `json:"sub"`
34+ Email string `json:"email"`
35+ EmailVerified bool `json:"email_verified"`
36+}
37+
3238// NewGoogleProvider initiates a new GoogleProvider
3339func NewGoogleProvider(p *ProviderData) *GoogleProvider {
3440 p.ProviderName = "Google"
@@ -64,7 +70,7 @@ func NewGoogleProvider(p *ProviderData) *GoogleProvider {
6470 }
6571}
6672
67−func emailFromIDToken(idToken string) (string, error) {
73+func claimsFromIDToken(idToken string) (*claims, error) {
6874
6975 // id_token is a base64 encode ID token payload
7076 // https://developers.google.com/accounts/docs/OAuth2Login#obtainuserinfo
@@ -72,24 +78,21 @@ func emailFromIDToken(idToken string) (string, error) {
7278 jwtData := strings.TrimSuffix(jwt[1], "=")
7379 b, err := base64.RawURLEncoding.DecodeString(jwtData)
7480 if err != nil {
75− return "", err
81+ return nil, err
7682 }
7783
78− var email struct {
79− Email string `json:"email"`
80− EmailVerified bool `json:"email_verified"`
81− }
82− err = json.Unmarshal(b, &email)
84+ c := &claims{}
85+ err = json.Unmarshal(b, c)
8386 if err != nil {
84− return "", err
87+ return nil, err
8588 }
86− if email.Email == "" {
87− return "", errors.New("missing email")
89+ if c.Email == "" {
90+ return nil, errors.New("missing email")
8891 }
89− if !email.EmailVerified {
90− return "", fmt.Errorf("email %s not listed as verified", email.Email)
92+ if !c.EmailVerified {
93+ return nil, fmt.Errorf("email %s not listed as verified", c.Email)
9194 }
92− return email.Email, nil
95+ return c, nil
9396}
9497
9598// Redeem exchanges the OAuth2 authentication token for an ID token
@@ -138,8 +141,7 @@ func (p *GoogleProvider) Redeem(redirectURL, code string) (s *SessionState, err
138141 if err != nil {
139142 return
140143 }
141− var email string
142− email, err = emailFromIDToken(jsonResponse.IDToken)
144+ c, err := claimsFromIDToken(jsonResponse.IDToken)
143145 if err != nil {
144146 return
145147 }
@@ -148,7 +150,8 @@ func (p *GoogleProvider) Redeem(redirectURL, code string) (s *SessionState, err
148150 IDToken: jsonResponse.IDToken,
149151 ExpiresOn: time.Now().Add(time.Duration(jsonResponse.ExpiresIn) * time.Second).Truncate(time.Second),
150152 RefreshToken: jsonResponse.RefreshToken,
151− Email: email,
153+ Email: c.Email,
154+ User: c.Subject,
152155 }
153156 return
154157}