snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

selfservice/strategy/oidc/token_verifier.go

@@ -0,0 +1,58 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package oidc
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+
+	"github.com/ory/x/reqlog"
+)
+
+func verifyToken(ctx context.Context, keySet oidc.KeySet, config *Configuration, rawIDToken, issuerURL string) (*Claims, error) {
+	tokenAudiences := append([]string{config.ClientID}, config.AdditionalIDTokenAudiences...)
+	var token *oidc.IDToken
+	err := fmt.Errorf("no audience matched the token's audience")
+	for _, aud := range tokenAudiences {
+		verifier := oidc.NewVerifier(issuerURL, keySet, &oidc.Config{
+			ClientID: aud,
+		})
+		t0 := time.Now()
+		token, err = verifier.Verify(ctx, rawIDToken)
+		reqlog.AccumulateExternalLatency(ctx, time.Since(t0))
+		if err != nil && strings.Contains(err.Error(), "oidc: expected audience") {
+			// The audience is not the one we expect, try the next one
+			continue
+		} else if err != nil {
+			// Something else went wrong
+			return nil, err
+		}
+		// The token was verified successfully
+		break
+	}
+	if err != nil {
+		// None of the allowed audiences matched the audience in the token
+		return nil, fmt.Errorf("token audience didn't match allowed audiences: %+v %w", tokenAudiences, err)
+	}
+	claims := &Claims{}
+	var rawClaims map[string]any
+
+	if token == nil {
+		return nil, fmt.Errorf("token is nil")
+	}
+
+	if err := token.Claims(claims); err != nil {
+		return nil, err
+	}
+	if err = token.Claims(&rawClaims); err != nil {
+		return nil, err
+	}
+	claims.RawClaims = rawClaims
+
+	return claims, nil
+}