cim/zitadel-oidc
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

oidc: move token claims according discussion

Browse source
This commit is contained in:
Tim Möhlmann 2023-03-07 17:52:19 +02:00
parent bb266aac4b
commit de33faa2d8
4 changed files with 9 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

3
pkg/oidc/regression_data/oidc.AccessTokenClaims.json
View file

@ -8,19 +8,16 @@
"jti": "900", "jti": "900",
"azp": "just@me.com", "azp": "just@me.com",
"nonce": "6969", "nonce": "6969",
"c_hash": "hashhash",
"acr": "something", "acr": "something",
"amr": [ "amr": [
"some", "some",
"methods" "methods"
], ],
"sid": "666",
"scope": [ "scope": [
"email", "email",
"phone" "phone"
], ],
"client_id": "777", "client_id": "777",
"at_use_nbr": 22,
"exp": 12345, "exp": 12345,
"iat": 12000, "iat": 12000,
"nbf": 12000, "nbf": 12000,

1
pkg/oidc/regression_data/oidc.IDTokenClaims.json
View file

@ -14,6 +14,7 @@
"some", "some",
"methods" "methods"
], ],
"sid": "666",
"client_id": "777", "client_id": "777",
"exp": 12345, "exp": 12345,
"iat": 12000, "iat": 12000,

9
pkg/oidc/token.go
View file

@ -39,6 +39,7 @@ type TokenClaims struct {
Expiration Time `json:"exp,omitempty"` Expiration Time `json:"exp,omitempty"`
IssuedAt Time `json:"iat,omitempty"` IssuedAt Time `json:"iat,omitempty"`
AuthTime Time `json:"auth_time,omitempty"` AuthTime Time `json:"auth_time,omitempty"`
NotBefore Time `json:"nbf,omitempty"`
Nonce string `json:"nonce,omitempty"` Nonce string `json:"nonce,omitempty"`
AuthenticationContextClassReference string `json:"acr,omitempty"` AuthenticationContextClassReference string `json:"acr,omitempty"`
AuthenticationMethodsReferences []string `json:"amr,omitempty"` AuthenticationMethodsReferences []string `json:"amr,omitempty"`
@ -68,12 +69,7 @@ func (c *TokenClaims) SetSignatureAlgorithm(algorithm jose.SignatureAlgorithm) {
type AccessTokenClaims struct { type AccessTokenClaims struct {
TokenClaims TokenClaims
NotBefore Time `json:"nbf,omitempty"`
CodeHash string `json:"c_hash,omitempty"`
SessionID string `json:"sid,omitempty"`
Scopes []string `json:"scope,omitempty"` Scopes []string `json:"scope,omitempty"`
AccessTokenUseNumber int `json:"at_use_nbr,omitempty"`
Claims map[string]any `json:"-"` Claims map[string]any `json:"-"`
} }
@ -89,9 +85,9 @@ func NewAccessTokenClaims(issuer, subject string, audience []string, expiration
Audience: audience, Audience: audience,
Expiration: FromTime(expiration), Expiration: FromTime(expiration),
IssuedAt: FromTime(now), IssuedAt: FromTime(now),
NotBefore: FromTime(now),
JWTID: jwtid, JWTID: jwtid,
}, },
NotBefore: FromTime(now),
} }
} }
@ -114,6 +110,7 @@ type IDTokenClaims struct {
NotBefore Time `json:"nbf,omitempty"` NotBefore Time `json:"nbf,omitempty"`
AccessTokenHash string `json:"at_hash,omitempty"` AccessTokenHash string `json:"at_hash,omitempty"`
CodeHash string `json:"c_hash,omitempty"` CodeHash string `json:"c_hash,omitempty"`
SessionID string `json:"sid,omitempty"` // IDToken - session management spec
UserInfoProfile UserInfoProfile
UserInfoEmail UserInfoEmail
UserInfoPhone UserInfoPhone

6
pkg/oidc/token_test.go
View file

@ -20,6 +20,7 @@ var (
AuthorizedParty: "just@me.com", AuthorizedParty: "just@me.com",
Nonce: "6969", Nonce: "6969",
AuthTime: 12000, AuthTime: 12000,
NotBefore: 12000,
AuthenticationContextClassReference: "something", AuthenticationContextClassReference: "something",
AuthenticationMethodsReferences: []string{"some", "methods"}, AuthenticationMethodsReferences: []string{"some", "methods"},
ClientID: "777", ClientID: "777",
@ -27,11 +28,7 @@ var (
} }
accessTokenData = &AccessTokenClaims{ accessTokenData = &AccessTokenClaims{
TokenClaims: tokenClaimsData, TokenClaims: tokenClaimsData,
NotBefore: 12000,
CodeHash: "hashhash",
SessionID: "666",
Scopes: []string{"email", "phone"}, Scopes: []string{"email", "phone"},
AccessTokenUseNumber: 22,
Claims: map[string]interface{}{ Claims: map[string]interface{}{
"foo": "bar", "foo": "bar",
}, },
@ -41,6 +38,7 @@ var (
NotBefore: 12000, NotBefore: 12000,
AccessTokenHash: "acthashhash", AccessTokenHash: "acthashhash",
CodeHash: "hashhash", CodeHash: "hashhash",
SessionID: "666",
UserInfoProfile: userInfoData.UserInfoProfile, UserInfoProfile: userInfoData.UserInfoProfile,
UserInfoEmail: userInfoData.UserInfoEmail, UserInfoEmail: userInfoData.UserInfoEmail,
UserInfoPhone: userInfoData.UserInfoPhone, UserInfoPhone: userInfoData.UserInfoPhone,