@@ -19,7 +19,7 @@ import (
19 "github.com/stretchr/testify/assert"
19 "github.com/stretchr/testify/assert"
21 "github.com/coreos/go-oidc/v3/oidc"
21 "github.com/coreos/go-oidc/v3/oidc"
22− "github.com/golang-jwt/jwt"
22+ "github.com/golang-jwt/jwt/v5"
23 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
23 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
24 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/encryption"
24 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/encryption"
25 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
25 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
@@ -37,45 +37,44 @@ const (
37 oidcSecret = "SuperSecret123456789"
37 oidcSecret = "SuperSecret123456789"
38 oidcNonce = "abcde12345edcba09876abcde12345ff"
38 oidcNonce = "abcde12345edcba09876abcde12345ff"
40− failureTokenID = "this-id-fails-verification"
40+ failureIssuer = "this-id-fails-verification"
44 verified = true
44 verified = true
45 unverified = false
45 unverified = false
47− standardClaims = jwt.StandardClaims{
47+ registeredClaims = jwt.RegisteredClaims{
48− Audience: oidcClientID,
48+ Audience: jwt.ClaimStrings{oidcClientID},
49− ExpiresAt: time.Now().Add(time.Duration(5) * time.Minute).Unix(),
49+ ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Duration(5) * time.Minute)),
51− IssuedAt: time.Now().Unix(),
50+ IssuedAt: jwt.NewNumericDate(time.Now()),
52 Issuer: oidcIssuer,
51 Issuer: oidcIssuer,
53− NotBefore: 0,
52+ NotBefore: jwt.NewNumericDate(time.Time{}),
54 Subject: "123456789",
53 Subject: "123456789",
57 defaultIDToken = idTokenClaims{
56 defaultIDToken = idTokenClaims{
58− Name: "Jane Dobbs",
57+ Name: "Jane Dobbs",
59− Email: "janed@me.com",
58+ Email: "janed@me.com",
60− Phone: "+4798765432",
59+ Phone: "+4798765432",
61− Picture: "http://mugbook.com/janed/me.jpg",
60+ Picture: "http://mugbook.com/janed/me.jpg",
62− Groups: []string{"test:a", "test:b"},
61+ Groups: []string{"test:a", "test:b"},
63− Roles: []string{"test:c", "test:d"},
62+ Roles: []string{"test:c", "test:d"},
64− Verified: &verified,
63+ Verified: &verified,
65− Nonce: encryption.HashNonce([]byte(oidcNonce)),
64+ Nonce: encryption.HashNonce([]byte(oidcNonce)),
66− StandardClaims: standardClaims,
65+ RegisteredClaims: registeredClaims,
69 numericGroupsIDToken = idTokenClaims{
68 numericGroupsIDToken = idTokenClaims{
70− Name: "Jane Dobbs",
69+ Name: "Jane Dobbs",
71− Email: "janed@me.com",
70+ Email: "janed@me.com",
72− Phone: "+4798765432",
71+ Phone: "+4798765432",
73− Picture: "http://mugbook.com/janed/me.jpg",
72+ Picture: "http://mugbook.com/janed/me.jpg",
74− Groups: []interface{}{1, 2, 3},
73+ Groups: []interface{}{1, 2, 3},
75− Roles: []string{"test:c", "test:d"},
74+ Roles: []string{"test:c", "test:d"},
76− Verified: &verified,
75+ Verified: &verified,
77− Nonce: encryption.HashNonce([]byte(oidcNonce)),
76+ Nonce: encryption.HashNonce([]byte(oidcNonce)),
78− StandardClaims: standardClaims,
77+ RegisteredClaims: registeredClaims,
81 complexGroupsIDToken = idTokenClaims{
80 complexGroupsIDToken = idTokenClaims{
@@ -91,24 +90,24 @@ var (
92 "Just::A::String",
91 "Just::A::String",
94− Roles: []string{"test:simple", "test:roles"},
93+ Roles: []string{"test:simple", "test:roles"},
95− Verified: &verified,
94+ Verified: &verified,
96− StandardClaims: standardClaims,
95+ RegisteredClaims: registeredClaims,
99 unverifiedIDToken = idTokenClaims{
98 unverifiedIDToken = idTokenClaims{
100− Name: "Mystery Man",
99+ Name: "Mystery Man",
101− Email: "unverified@email.com",
100+ Email: "unverified@email.com",
102− Phone: "+4025205729",
101+ Phone: "+4025205729",
103− Picture: "http://mugbook.com/unverified/email.jpg",
102+ Picture: "http://mugbook.com/unverified/email.jpg",
104− Groups: []string{"test:a", "test:b"},
103+ Groups: []string{"test:a", "test:b"},
105− Roles: []string{"test:c", "test:d"},
104+ Roles: []string{"test:c", "test:d"},
106− Verified: &unverified,
105+ Verified: &unverified,
107− StandardClaims: standardClaims,
106+ RegisteredClaims: registeredClaims,
110 minimalIDToken = idTokenClaims{
109 minimalIDToken = idTokenClaims{
111− StandardClaims: standardClaims,
110+ RegisteredClaims: registeredClaims,
@@ -121,7 +120,7 @@ type idTokenClaims struct {
121 Roles interface{} `json:"roles,omitempty"`
120 Roles interface{} `json:"roles,omitempty"`
122 Verified *bool `json:"email_verified,omitempty"`
121 Verified *bool `json:"email_verified,omitempty"`
123 Nonce string `json:"nonce,omitempty"`
122 Nonce string `json:"nonce,omitempty"`
124− jwt.StandardClaims
123+ jwt.RegisteredClaims
127type mockJWKS struct{}
126type mockJWKS struct{}
@@ -134,7 +133,7 @@ func (mockJWKS) VerifySignature(_ context.Context, jwt string) ([]byte, error) {
135 tokenClaims := &idTokenClaims{}
134 tokenClaims := &idTokenClaims{}
136 err = json.Unmarshal(decoded, tokenClaims)
135 err = json.Unmarshal(decoded, tokenClaims)
137− if err != nil || tokenClaims.Id == failureTokenID {
136+ if err != nil || tokenClaims.Issuer == failureIssuer {
138 return nil, fmt.Errorf("the validation failed for subject [%v]", tokenClaims.Subject)
137 return nil, fmt.Errorf("the validation failed for subject [%v]", tokenClaims.Subject)
@@ -158,7 +157,7 @@ func newTestOauth2Token() *oauth2.Token {
159func TestProviderData_verifyIDToken(t *testing.T) {
158func TestProviderData_verifyIDToken(t *testing.T) {
160 failureIDToken := defaultIDToken
159 failureIDToken := defaultIDToken
161− failureIDToken.Id = failureTokenID
160+ failureIDToken.Issuer = failureIssuer
163 testCases := map[string]struct {
162 testCases := map[string]struct {
164 IDToken *idTokenClaims
163 IDToken *idTokenClaims
@@ -172,13 +171,6 @@ func TestProviderData_verifyIDToken(t *testing.T) {
172 ExpectIDToken: true,
171 ExpectIDToken: true,
173 ExpectedError: nil,
172 ExpectedError: nil,
175− "Invalid ID Token": {
176− IDToken: &failureIDToken,
178− ExpectIDToken: false,
179− ExpectedError: errors.New("failed to verify token: failed to verify signature: " +
180− "the validation failed for subject [123456789]"),
182 "Missing ID Token": {
174 "Missing ID Token": {
183 IDToken: nil,
175 IDToken: nil,
184 Verifier: true,
176 Verifier: true,