verifier

README

okta-jwt-verifier

Alternative implementation to the official okta-jwt-verifier that includes support for telemetry (ie. OpenTelemetry), minimizing verification latency, and testability.

Examples

Access Token Validation

import (
    "context"
    verifier "github.com/sovietaced/okta-jwt-verifier"
)

func main() {
    ctx := context.Background()
    issuer := "https://test.okta.com"
    clientId := "test"
    v, err := verifier.NewVerifier(issuer, clientId)
	

    idToken := "..."
    token, err := v.VerifyAccessToken(ctx, idToken)
}

Documentation

Index

• Constants
• type Jwt
• type Option
  • func WithKeyfuncProvider(keyfuncProvider keyfunc.Provider) Option
  • func WithLeeway(leeway time.Duration) Option
• type Options
• type Verifier
  • func NewVerifier(issuer string, clientId string, options ...Option) (*Verifier, error)
  • func (v *Verifier) VerifyAccessToken(ctx context.Context, accessToken string) (*Jwt, error)
  • func (v *Verifier) VerifyIdToken(ctx context.Context, idToken string) (*Jwt, error)

Constants

const (
	DefaultLeeway = 0 // Default leeway that is configured for JWT validation
)

Types

type Jwt

type Jwt struct {
	Claims map[string]any
}

Jwt is an implementation independent representation of a JWT that is returned to consumers of our APIs.

type Option

type Option func(*Options)

Option for the Verifier

func WithKeyfuncProvider

func WithKeyfuncProvider(keyfuncProvider keyfunc.Provider) Option

WithKeyfuncProvider allows for a configurable keyfunc.Provider, which may be useful if you want to customize the behavior of how metadata or JWK sets are fetched.

func WithLeeway

func WithLeeway(leeway time.Duration) Option

WithLeeway adds leeway to all time related validations.

type Options

type Options struct {
	// contains filtered or unexported fields
}

Options are configurable options for the Verifier.

type Verifier

type Verifier struct {
	// contains filtered or unexported fields
}

Verifier is the implementation of the Okta JWT verification logic.

func NewVerifier

func NewVerifier(issuer string, clientId string, options ...Option) (*Verifier, error)

NewVerifier creates a new Verifier for the specified issuer or client ID.

func (*Verifier) VerifyAccessToken

func (v *Verifier) VerifyAccessToken(ctx context.Context, accessToken string) (*Jwt, error)

VerifyAccessToken verifies an Okta access token.

func (*Verifier) VerifyIdToken

func (v *Verifier) VerifyIdToken(ctx context.Context, idToken string) (*Jwt, error)

VerifyIdToken verifies an Okta ID token.