@@ -19,7 +19,7 @@ import (
1919 "github.com/stretchr/testify/assert"
2020
2121 "github.com/coreos/go-oidc/v3/oidc"
22− "github.com/golang-jwt/jwt"
22+ "github.com/golang-jwt/jwt/v5"
2323 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
2424 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/encryption"
2525 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
@@ -37,45 +37,44 @@ const (
3737 oidcSecret = "SuperSecret123456789"
3838 oidcNonce = "abcde12345edcba09876abcde12345ff"
3939
40− failureTokenID = "this-id-fails-verification"
40+ failureIssuer = "this-id-fails-verification"
4141)
4242
4343var (
4444 verified = true
4545 unverified = false
4646
47− standardClaims = jwt.StandardClaims{
48− Audience: oidcClientID,
49− ExpiresAt: time.Now().Add(time.Duration(5) * time.Minute).Unix(),
50− Id: "id-some-id",
51− IssuedAt: time.Now().Unix(),
47+ registeredClaims = jwt.RegisteredClaims{
48+ Audience: jwt.ClaimStrings{oidcClientID},
49+ ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Duration(5) * time.Minute)),
50+ IssuedAt: jwt.NewNumericDate(time.Now()),
5251 Issuer: oidcIssuer,
53− NotBefore: 0,
52+ NotBefore: jwt.NewNumericDate(time.Time{}),
5453 Subject: "123456789",
5554 }
5655
5756 defaultIDToken = idTokenClaims{
58− Name: "Jane Dobbs",
59− Email: "janed@me.com",
60− Phone: "+4798765432",
61− Picture: "http://mugbook.com/janed/me.jpg",
62− Groups: []string{"test:a", "test:b"},
63− Roles: []string{"test:c", "test:d"},
64− Verified: &verified,
65− Nonce: encryption.HashNonce([]byte(oidcNonce)),
66− StandardClaims: standardClaims,
57+ Name: "Jane Dobbs",
58+ Email: "janed@me.com",
59+ Phone: "+4798765432",
60+ Picture: "http://mugbook.com/janed/me.jpg",
61+ Groups: []string{"test:a", "test:b"},
62+ Roles: []string{"test:c", "test:d"},
63+ Verified: &verified,
64+ Nonce: encryption.HashNonce([]byte(oidcNonce)),
65+ RegisteredClaims: registeredClaims,
6766 }
6867
6968 numericGroupsIDToken = idTokenClaims{
70− Name: "Jane Dobbs",
71− Email: "janed@me.com",
72− Phone: "+4798765432",
73− Picture: "http://mugbook.com/janed/me.jpg",
74− Groups: []interface{}{1, 2, 3},
75− Roles: []string{"test:c", "test:d"},
76− Verified: &verified,
77− Nonce: encryption.HashNonce([]byte(oidcNonce)),
78− StandardClaims: standardClaims,
69+ Name: "Jane Dobbs",
70+ Email: "janed@me.com",
71+ Phone: "+4798765432",
72+ Picture: "http://mugbook.com/janed/me.jpg",
73+ Groups: []interface{}{1, 2, 3},
74+ Roles: []string{"test:c", "test:d"},
75+ Verified: &verified,
76+ Nonce: encryption.HashNonce([]byte(oidcNonce)),
77+ RegisteredClaims: registeredClaims,
7978 }
8079
8180 complexGroupsIDToken = idTokenClaims{
@@ -91,24 +90,24 @@ var (
9190 12345,
9291 "Just::A::String",
9392 },
94− Roles: []string{"test:simple", "test:roles"},
95− Verified: &verified,
96− StandardClaims: standardClaims,
93+ Roles: []string{"test:simple", "test:roles"},
94+ Verified: &verified,
95+ RegisteredClaims: registeredClaims,
9796 }
9897
9998 unverifiedIDToken = idTokenClaims{
100− Name: "Mystery Man",
101− Email: "unverified@email.com",
102− Phone: "+4025205729",
103− Picture: "http://mugbook.com/unverified/email.jpg",
104− Groups: []string{"test:a", "test:b"},
105− Roles: []string{"test:c", "test:d"},
106− Verified: &unverified,
107− StandardClaims: standardClaims,
99+ Name: "Mystery Man",
100+ Email: "unverified@email.com",
101+ Phone: "+4025205729",
102+ Picture: "http://mugbook.com/unverified/email.jpg",
103+ Groups: []string{"test:a", "test:b"},
104+ Roles: []string{"test:c", "test:d"},
105+ Verified: &unverified,
106+ RegisteredClaims: registeredClaims,
108107 }
109108
110109 minimalIDToken = idTokenClaims{
111− StandardClaims: standardClaims,
110+ RegisteredClaims: registeredClaims,
112111 }
113112)
114113
@@ -121,7 +120,7 @@ type idTokenClaims struct {
121120 Roles interface{} `json:"roles,omitempty"`
122121 Verified *bool `json:"email_verified,omitempty"`
123122 Nonce string `json:"nonce,omitempty"`
124− jwt.StandardClaims
123+ jwt.RegisteredClaims
125124}
126125
127126type mockJWKS struct{}
@@ -134,7 +133,7 @@ func (mockJWKS) VerifySignature(_ context.Context, jwt string) ([]byte, error) {
134133
135134 tokenClaims := &idTokenClaims{}
136135 err = json.Unmarshal(decoded, tokenClaims)
137− if err != nil || tokenClaims.Id == failureTokenID {
136+ if err != nil || tokenClaims.Issuer == failureIssuer {
138137 return nil, fmt.Errorf("the validation failed for subject [%v]", tokenClaims.Subject)
139138 }
140139
@@ -158,7 +157,7 @@ func newTestOauth2Token() *oauth2.Token {
158157
159158func TestProviderData_verifyIDToken(t *testing.T) {
160159 failureIDToken := defaultIDToken
161− failureIDToken.Id = failureTokenID
160+ failureIDToken.Issuer = failureIssuer
162161
163162 testCases := map[string]struct {
164163 IDToken *idTokenClaims
@@ -172,13 +171,6 @@ func TestProviderData_verifyIDToken(t *testing.T) {
172171 ExpectIDToken: true,
173172 ExpectedError: nil,
174173 },
175− "Invalid ID Token": {
176− IDToken: &failureIDToken,
177− Verifier: true,
178− ExpectIDToken: false,
179− ExpectedError: errors.New("failed to verify token: failed to verify signature: " +
180− "the validation failed for subject [123456789]"),
181− },
182174 "Missing ID Token": {
183175 IDToken: nil,
184176 Verifier: true,