mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2026-01-29 08:21:23 -05:00
42 lines
1.2 KiB
Go
42 lines
1.2 KiB
Go
package keyfunc
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/golang-jwt/jwt/v4"
|
|
)
|
|
|
|
var (
|
|
// ErrKID indicates that the JWT had an invalid kid.
|
|
ErrKID = errors.New("the JWT has an invalid kid")
|
|
)
|
|
|
|
// Keyfunc matches the signature of github.com/golang-jwt/jwt/v4's jwt.Keyfunc function.
|
|
func (j *JWKS) Keyfunc(token *jwt.Token) (interface{}, error) {
|
|
kidInter, ok := token.Header["kid"]
|
|
if !ok {
|
|
return nil, fmt.Errorf("%w: could not find kid in JWT header", ErrKID)
|
|
}
|
|
kid, ok := kidInter.(string)
|
|
if !ok {
|
|
return nil, fmt.Errorf("%w: could not convert kid in JWT header to string", ErrKID)
|
|
}
|
|
|
|
return j.getKey(kid)
|
|
}
|
|
|
|
// base64urlTrailingPadding removes trailing padding before decoding a string from base64url. Some non-RFC compliant
|
|
// JWKS contain padding at the end values for base64url encoded public keys.
|
|
//
|
|
// Trailing padding is required to be removed from base64url encoded keys.
|
|
// RFC 7517 defines base64url the same as RFC 7515 Section 2:
|
|
// https://datatracker.ietf.org/doc/html/rfc7517#section-1.1
|
|
// https://datatracker.ietf.org/doc/html/rfc7515#section-2
|
|
func base64urlTrailingPadding(s string) ([]byte, error) {
|
|
s = strings.TrimRight(s, "=")
|
|
return base64.RawURLEncoding.DecodeString(s)
|
|
}
|