fix: Handle case where verifier Nonce func is nil (#594)

* Skip nonce check if verifier nonce func is nil

* add unit test

pkg/client/rp/verifier.go

@@ -73,9 +73,11 @@ func VerifyIDToken[C oidc.Claims](ctx context.Context, token string, v *IDTokenV
 		return nilClaims, err
 	}
 
+	if v.Nonce != nil {
 		if err = oidc.CheckNonce(claims, v.Nonce(ctx)); err != nil {
 			return nilClaims, err
 		}
+	}
 
 	if err = oidc.CheckAuthorizationContextClassReference(claims, v.ACR); err != nil {
 		return nilClaims, err

pkg/client/rp/verifier_test.go

@@ -100,22 +100,21 @@ func TestVerifyIDToken(t *testing.T) {
 		MaxAge:            2 * time.Minute,
 		ACR:               tu.ACRVerify,
 		Nonce:             func(context.Context) string { return tu.ValidNonce },
+		ClientID:          tu.ValidClientID,
 	}
 
 	tests := []struct {
 		name           string
-		clientID    string
 		tokenClaims    func() (string, *oidc.IDTokenClaims)
+		customVerifier func(verifier *IDTokenVerifier)
 		wantErr        bool
 	}{
 		{
 			name:        "success",
-			clientID:    tu.ValidClientID,
 			tokenClaims: tu.ValidIDToken,
 		},
 		{
 			name: "custom claims",
-			clientID: tu.ValidClientID,
 			tokenClaims: func() (string, *oidc.IDTokenClaims) {
 				return tu.NewIDTokenCustom(
 					tu.ValidIssuer, tu.ValidSubject, tu.ValidAudience,
@@ -125,21 +124,31 @@ func TestVerifyIDToken(t *testing.T) {
 				)
 			},
 		},
+		{
+			name: "skip nonce check",
+			customVerifier: func(verifier *IDTokenVerifier) {
+				verifier.Nonce = nil
+			},
+			tokenClaims: func() (string, *oidc.IDTokenClaims) {
+				return tu.NewIDToken(
+					tu.ValidIssuer, tu.ValidSubject, tu.ValidAudience,
+					tu.ValidExpiration, tu.ValidAuthTime, "foo",
+					tu.ValidACR, tu.ValidAMR, tu.ValidClientID, tu.ValidSkew, "",
+				)
+			},
+		},
 		{
 			name:        "parse err",
-			clientID:    tu.ValidClientID,
 			tokenClaims: func() (string, *oidc.IDTokenClaims) { return "~~~~", nil },
 			wantErr:     true,
 		},
 		{
 			name:        "invalid signature",
-			clientID:    tu.ValidClientID,
 			tokenClaims: func() (string, *oidc.IDTokenClaims) { return tu.InvalidSignatureToken, nil },
 			wantErr:     true,
 		},
 		{
 			name: "empty subject",
-			clientID: tu.ValidClientID,
 			tokenClaims: func() (string, *oidc.IDTokenClaims) {
 				return tu.NewIDToken(
 					tu.ValidIssuer, "", tu.ValidAudience,
@@ -151,7 +160,6 @@ func TestVerifyIDToken(t *testing.T) {
 		},
 		{
 			name: "wrong issuer",
-			clientID: tu.ValidClientID,
 			tokenClaims: func() (string, *oidc.IDTokenClaims) {
 				return tu.NewIDToken(
 					"foo", tu.ValidSubject, tu.ValidAudience,
@@ -163,13 +171,14 @@ func TestVerifyIDToken(t *testing.T) {
 		},
 		{
 			name: "wrong clientID",
-			clientID:    "foo",
+			customVerifier: func(verifier *IDTokenVerifier) {
+				verifier.ClientID = "foo"
+			},
 			tokenClaims: tu.ValidIDToken,
 			wantErr:     true,
 		},
 		{
 			name: "expired",
-			clientID: tu.ValidClientID,
 			tokenClaims: func() (string, *oidc.IDTokenClaims) {
 				return tu.NewIDToken(
 					tu.ValidIssuer, tu.ValidSubject, tu.ValidAudience,
@@ -181,7 +190,6 @@ func TestVerifyIDToken(t *testing.T) {
 		},
 		{
 			name: "wrong IAT",
-			clientID: tu.ValidClientID,
 			tokenClaims: func() (string, *oidc.IDTokenClaims) {
 				return tu.NewIDToken(
 					tu.ValidIssuer, tu.ValidSubject, tu.ValidAudience,
@@ -193,7 +201,6 @@ func TestVerifyIDToken(t *testing.T) {
 		},
 		{
 			name: "wrong acr",
-			clientID: tu.ValidClientID,
 			tokenClaims: func() (string, *oidc.IDTokenClaims) {
 				return tu.NewIDToken(
 					tu.ValidIssuer, tu.ValidSubject, tu.ValidAudience,
@@ -205,7 +212,6 @@ func TestVerifyIDToken(t *testing.T) {
 		},
 		{
 			name: "expired auth",
-			clientID: tu.ValidClientID,
 			tokenClaims: func() (string, *oidc.IDTokenClaims) {
 				return tu.NewIDToken(
 					tu.ValidIssuer, tu.ValidSubject, tu.ValidAudience,
@@ -217,7 +223,6 @@ func TestVerifyIDToken(t *testing.T) {
 		},
 		{
 			name: "wrong nonce",
-			clientID: tu.ValidClientID,
 			tokenClaims: func() (string, *oidc.IDTokenClaims) {
 				return tu.NewIDToken(
 					tu.ValidIssuer, tu.ValidSubject, tu.ValidAudience,
@@ -231,7 +236,10 @@ func TestVerifyIDToken(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			token, want := tt.tokenClaims()
-			verifier.ClientID = tt.clientID
+			if tt.customVerifier != nil {
+				tt.customVerifier(verifier)
+			}
+
 			got, err := VerifyIDToken[*oidc.IDTokenClaims](context.Background(), token, verifier)
 			if tt.wantErr {
 				assert.Error(t, err)