minisculegirraffe / oidc_jwt_validator Goto Github PK

I can also take a crack at this, might help with some folks' smell-test and likelihood for adoption

While reviewing this lib with a colleague, we noticed internal use of strings and a normalization function.

I will send a PR for this if there aren't objections.

const OIDC_URL: &str = "https://oidc.eks.eu-central-1.amazonaws.com/id/secret";
const TOKEN: &str = "secret";

type TokenClaims = HashMap<String, serde_json::Value>;

#[tokio::test]
async fn test_token_verification() {
    let client = reqwest::ClientBuilder::new()
        .timeout(Duration::from_secs(2))
        .build()
        .unwrap();

    let mut settings = ValidationSettings::new();

    settings.set_issuer(&[OIDC_URL]);
    settings.set_audience(&["account"]);

    let validator = Validator::new(OIDC_URL, client, Strategy::Automatic, settings)
        .await
        .unwrap();

    let validation_result = validator.validate::<TokenClaims>(TOKEN).await;

    println!("{:?}", validation_result);
}

gives

Err(CacheError)

Hi!

Before making a request to an OIDC provider I'd like to check if the audience and OIDC provider mentioned in the JWT token is whitelisted from my side. That means I have to decode the JWT token first.

Could you make the Decoder that the lib is using public and maybe add an validate fn that does accept an decoded token (to not decode it twice in such a case)?

Thanks

Hi!

Could you add a rustls feature to use rustls for outgoing http requests?