idea: declarative token validation

[bobbyrullo]

Issue by sym3tri
Tuesday Jun 30, 2015 at 19:45 GMT
Originally opened as https://github.com/coreos-inc/auth/issues/281

---

I've encountered jwt claim parsing/validation code very frequently. Just an idea, but maybe we create a generic way to declaratively "validate" tokens by ensuring a set of claims/values. I kinda want a function I can call like:

var (
  ErrorClaimMissing = ...
  ErrorClaimMatchFailure = ...
  ErrorClaimCheckInvalidType = ...
  ...
)

type ClaimCheck struct {
  name string
  value interface{} // must be a supported claim type
}

wantClaims := []ClaimCheck{
  // no value, just checks for existence
  ClaimCheck {
    name: "email",
  },
  // existence & equality check
  ClaimCheck {
    name: "aud",
    value: "some-clien-id",
  },
}

valid, err := jwt.HasExpected(wantClaims)
...

Thoughts?

[ericchiang]

Dex no longer does any ID Token validation. Would be better for go-oidc.