oidc

Documentation

Overview

Package oidc validates OIDC bearer tokens against their issuer's JWKS endpoint.

JWKS keys are cached per issuer for 1 hour. Multi-issuer validation is supported via an optional allowlist.

Index

• func ResetCacheForTesting()
• func SetTrustedJWKSHosts(m map[string][]string)
• type Claims
  • func Validate(ctx context.Context, tokenString string, allowedIssuers []string) (Claims, error)

Functions

func ResetCacheForTesting

func ResetCacheForTesting()

ResetCacheForTesting clears the JWKS cache. Only for use in tests.

func SetTrustedJWKSHosts

func SetTrustedJWKSHosts(m map[string][]string)

SetTrustedJWKSHosts installs the per-issuer JWKS host override map. Set once at startup. Issuer keys are matched after trimming trailing slash; host values are matched case-insensitively against the discovered jwks_uri host.

Types

type Claims

type Claims map[string]any

Claims is a map of decoded JWT claims.

func Validate

func Validate(ctx context.Context, tokenString string, allowedIssuers []string) (Claims, error)

Validate verifies an OIDC bearer token's signature and standard claims against the issuer's JWKS endpoint. If allowedIssuers is non-empty, the token's issuer must be in the list.