@@ -29,12 +29,12 @@ const clientID = "https://test.myapp.com"
2929const secret = "secret"
3030
3131type idTokenClaims struct {
32− Name string `json:"name,omitempty"`
33− Email string `json:"email,omitempty"`
34− Phone string `json:"phone_number,omitempty"`
35− Picture string `json:"picture,omitempty"`
36− Groups []string `json:"groups,omitempty"`
37− OtherGroups []string `json:"other_groups,omitempty"`
32+ Name string `json:"name,omitempty"`
33+ Email string `json:"email,omitempty"`
34+ Phone string `json:"phone_number,omitempty"`
35+ Picture string `json:"picture,omitempty"`
36+ Groups interface{} `json:"groups,omitempty"`
37+ OtherGroups interface{} `json:"other_groups,omitempty"`
3838 jwt.StandardClaims
3939}
4040
@@ -64,6 +64,29 @@ var defaultIDToken idTokenClaims = idTokenClaims{
6464 },
6565}
6666
67+var customGroupClaimIDToken idTokenClaims = idTokenClaims{
68+ "Jane Dobbs",
69+ "janed@me.com",
70+ "+4798765432",
71+ "http://mugbook.com/janed/me.jpg",
72+ []map[string]interface{}{
73+ {
74+ "groupId": "Admin Group Id",
75+ "roles": []string{"Admin"},
76+ },
77+ },
78+ []string{"test:c", "test:d"},
79+ jwt.StandardClaims{
80+ Audience: "https://test.myapp.com",
81+ ExpiresAt: time.Now().Add(time.Duration(5) * time.Minute).Unix(),
82+ Id: "id-some-id",
83+ IssuedAt: time.Now().Unix(),
84+ Issuer: "https://issuer.example.com",
85+ NotBefore: 0,
86+ Subject: "123456789",
87+ },
88+}
89+
6790var minimalIDToken idTokenClaims = idTokenClaims{
6891 "",
6992 "",
@@ -283,7 +306,7 @@ func TestCreateSessionStateFromBearerToken(t *testing.T) {
283306 GroupsClaim string
284307 ExpectedUser string
285308 ExpectedEmail string
286− ExpectedGroups []string
309+ ExpectedGroups interface{}
287310 }{
288311 "Default IDToken": {
289312 IDToken: defaultIDToken,
@@ -306,6 +329,13 @@ func TestCreateSessionStateFromBearerToken(t *testing.T) {
306329 ExpectedEmail: defaultIDToken.Email,
307330 ExpectedGroups: []string{"test:c", "test:d"},
308331 },
332+ "Custom Groups Claim2": {
333+ IDToken: customGroupClaimIDToken,
334+ GroupsClaim: "groups",
335+ ExpectedUser: customGroupClaimIDToken.Subject,
336+ ExpectedEmail: customGroupClaimIDToken.Email,
337+ ExpectedGroups: []string{"{\"groupId\":\"Admin Group Id\",\"roles\":[\"Admin\"]}"},
338+ },
309339 }
310340 for testName, tc := range testCases {
311341 t.Run(testName, func(t *testing.T) {
@@ -373,3 +403,31 @@ func TestOIDCProvider_findVerifiedIdToken(t *testing.T) {
373403 assert.Equal(t, nil, err)
374404 assert.Equal(t, true, verifiedIDToken == nil)
375405}
406+
407+func Test_formatGroup(t *testing.T) {
408+ testCases := map[string]struct {
409+ RawGroup interface{}
410+ ExpectedFormattedGroupValue string
411+ }{
412+ "String Group": {
413+ RawGroup: "group",
414+ ExpectedFormattedGroupValue: "group",
415+ },
416+ "Map Group": {
417+ RawGroup: map[string]string{"id": "1", "name": "Test"},
418+ ExpectedFormattedGroupValue: "{\"id\":\"1\",\"name\":\"Test\"}",
419+ },
420+ "List Group": {
421+ RawGroup: []string{"First", "Second"},
422+ ExpectedFormattedGroupValue: "[\"First\",\"Second\"]",
423+ },
424+ }
425+
426+ for testName, tc := range testCases {
427+ t.Run(testName, func(t *testing.T) {
428+ formattedGroup, err := formatGroup(tc.RawGroup)
429+ assert.Nil(t, err)
430+ assert.Equal(t, tc.ExpectedFormattedGroupValue, formattedGroup)
431+ })
432+ }
433+}