diff --git a/claims.go b/claims.go index ef48ea7b..941005b5 100644 --- a/claims.go +++ b/claims.go @@ -5,13 +5,11 @@ package jwtauth import ( "encoding/json" - "errors" "fmt" "strconv" "strings" log "github.com/hashicorp/go-hclog" - "github.com/hashicorp/go-secure-stdlib/strutil" "github.com/mitchellh/pointerstructure" "github.com/ryanuber/go-glob" ) @@ -89,26 +87,6 @@ func extractMetadata(logger log.Logger, allClaims map[string]interface{}, claimM return metadata, nil } -// validateAudience checks whether any of the audiences in audClaim match those -// in boundAudiences. If strict is true and there are no bound audiences, then the -// presence of any audience in the received claim is considered an error. -func validateAudience(boundAudiences, audClaim []string, strict bool) error { - if strict && len(boundAudiences) == 0 && len(audClaim) > 0 { - return errors.New("audience claim found in JWT but no audiences bound to the role") - } - - if len(boundAudiences) > 0 { - for _, v := range boundAudiences { - if strutil.StrListContains(audClaim, v) { - return nil - } - } - return errors.New("aud claim does not match any bound audience") - } - - return nil -} - // validateBoundClaims checks that all of the claim:value requirements in boundClaims are // met in allClaims. func validateBoundClaims(logger log.Logger, boundClaimsType string, boundClaims, allClaims map[string]interface{}) error { diff --git a/claims_test.go b/claims_test.go index 13ce5f7a..4723c912 100644 --- a/claims_test.go +++ b/claims_test.go @@ -199,33 +199,6 @@ func TestExtractMetadata(t *testing.T) { } } -func TestValidateAudience(t *testing.T) { - tests := []struct { - boundAudiences []string - audience []string - strict bool - errExpected bool - }{ - {[]string{"a"}, []string{"a"}, false, false}, - {[]string{"a"}, []string{"b"}, false, true}, - {[]string{"a"}, []string{""}, false, true}, - {[]string{}, []string{"a"}, false, false}, - {[]string{}, []string{"a"}, true, true}, - {[]string{"a", "b"}, []string{"a"}, false, false}, - {[]string{"a", "b"}, []string{"b"}, false, false}, - {[]string{"a", "b"}, []string{"a", "b", "c"}, false, false}, - {[]string{"a", "b"}, []string{"c", "d"}, false, true}, - } - - for _, test := range tests { - err := validateAudience(test.boundAudiences, test.audience, test.strict) - if test.errExpected != (err != nil) { - t.Fatalf("unexpected error result: boundAudiences %v, audience %v, strict %t, err: %v", - test.boundAudiences, test.audience, test.strict, err) - } - } -} - func TestValidateBoundClaims(t *testing.T) { tests := []struct { name string