@@ -497,6 +497,54 @@ var _ = Describe("Claim Extractor Suite", func() {
497497 expectedDst: stringPointer("{\"foo\":[\"bar\",\"baz\"]}"),
498498 }),
499499 )
500+
501+ It("should extract claims from a JWT response", func() {
502+ jwtResponsePayload := `{
503+ "user": "jwtUser",
504+ "email": "jwtEmail",
505+ "groups": [
506+ "jwtGroup1",
507+ "jwtGroup2"
508+ ]
509+ }`
510+
511+ jwtResponseHandler := func(rw http.ResponseWriter, req *http.Request) {
512+ if !hasAuthorizedHeader(req.Header) {
513+ rw.WriteHeader(403)
514+ rw.Write([]byte("Unauthorized"))
515+ return
516+ }
517+
518+ rw.Header().Set("Content-Type", "application/jwt; charset=utf-8")
519+ rw.Write([]byte(createJWTFromPayload(jwtResponsePayload)))
520+ }
521+
522+ claimExtractor, serverClose, err := newTestClaimExtractor(testClaimExtractorOpts{
523+ idTokenPayload: emptyJSON,
524+ setProfileURL: true,
525+ profileRequestHeaders: newAuthorizedHeader(),
526+ profileRequestHandler: jwtResponseHandler,
527+ })
528+ Expect(err).ToNot(HaveOccurred())
529+ if serverClose != nil {
530+ defer serverClose()
531+ }
532+
533+ value, exists, err := claimExtractor.GetClaim("user")
534+ Expect(err).ToNot(HaveOccurred())
535+ Expect(exists).To(BeTrue())
536+ Expect(value).To(Equal("jwtUser"))
537+
538+ value, exists, err = claimExtractor.GetClaim("email")
539+ Expect(err).ToNot(HaveOccurred())
540+ Expect(exists).To(BeTrue())
541+ Expect(value).To(Equal("jwtEmail"))
542+
543+ value, exists, err = claimExtractor.GetClaim("groups")
544+ Expect(err).ToNot(HaveOccurred())
545+ Expect(exists).To(BeTrue())
546+ Expect(value).To(Equal([]interface{}{"jwtGroup1", "jwtGroup2"}))
547+ })
500548})
501549
502550// ******************************************