Function assertJWTAuth

coderd/oauthpki/okidcpki_test.go:331–355

assertJWTAuth will assert the basic JWT auth assertions. It will return the url.Values from the request body for any additional assertions to be made.

(t testing.TB, r *http.Request)

// assertJWTAuth will assert the basic JWT auth assertions. It will return the
// url.Values from the request body for any additional assertions to be made.
func assertJWTAuth(t testing.TB, r *http.Request) url.Values {
	body, err := io.ReadAll(r.Body)
	if !assert.NoError(t, err) {
		return nil
	}
	vals, err := url.ParseQuery(string(body))
	if !assert.NoError(t, err) {
		return nil
	}

	assert.Equal(t, "urn:ietf:params:oauth:client-assertion-type:jwt-bearer", vals.Get("client_assertion_type"))
	jwtToken := vals.Get("client_assertion")
	// No need to actually verify the jwt is signed right.
	parsedToken, _, err := (&jwt.Parser{}).ParseUnverified(jwtToken, jwt.MapClaims{})
	if !assert.NoError(t, err, "failed to parse jwt token") {
		return nil
	}

	// Azure requirements
	assert.NotEmpty(t, parsedToken.Header["x5t"], "hashed cert missing")
	assert.Equal(t, "RS256", parsedToken.Header["alg"], "azure only accepts RS256")
	assert.Equal(t, "JWT", parsedToken.Header["typ"], "azure only accepts JWT")

	return vals
}