Bump the version

go mod tidy
Build(deps): bump k8s.io/client-go from 0.17.3 to 0.17.4 (#252 )
2026-03-01 08:20:20 +00:00 · 2020-03-26 10:36:06 +09:00 · 2020-03-26 10:29:32 +09:00 · 2020-03-26 10:24:49 +09:00 · 2020-03-26 10:24:31 +09:00 · 2020-03-26 10:13:54 +09:00
61 changed files with 908 additions and 891 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -2,7 +2,7 @@ version: 2
 jobs:
  build:
    docker:
-      - image: circleci/golang:1.13.4
+      - image: circleci/golang:1.14.1
    steps:
      - run: mkdir -p ~/bin
      - run: echo 'export PATH="$HOME/bin:$PATH"' >> $BASH_ENV
--- a/.github/workflows/acceptance-test.yaml
+++ b/.github/workflows/acceptance-test.yaml
@@ -8,7 +8,7 @@ jobs:
    steps:
      - uses: actions/setup-go@v1
        with:
-          go-version: 1.13
+          go-version: 1.14.1
        id: go
      - uses: actions/checkout@v1
      - uses: actions/cache@v1
--- a/2
+++ b/2
@@ -57,7 +57,7 @@ clean:
 ci-setup-linux-amd64:
 	mkdir -p ~/bin
 	# https://github.com/golangci/golangci-lint
-	curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b ~/bin v1.21.0
+	curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b ~/bin v1.24.0
 	# https://github.com/int128/goxzst
 	curl -sfL -o /tmp/goxzst.zip https://github.com/int128/goxzst/releases/download/v0.3.0/goxzst_linux_amd64.zip
 	unzip /tmp/goxzst.zip -d ~/bin
--- a/README.md
+++ b/README.md
@@ -28,12 +28,9 @@ brew install int128/kubelogin/kubelogin
 kubectl krew install oidc-login

 # GitHub Releases
-curl -LO https://github.com/int128/kubelogin/releases/download/v1.16.0/kubelogin_linux_amd64.zip
+curl -LO https://github.com/int128/kubelogin/releases/download/v1.18.0/kubelogin_linux_amd64.zip
 unzip kubelogin_linux_amd64.zip
 ln -s kubelogin kubectl-oidc_login
-
-# Docker
-docker run --rm quay.io/int128/kubelogin:v1.16.0
 ```

 You need to set up the OIDC provider, cluster role binding, Kubernetes API server and kubeconfig.
@@ -94,14 +91,16 @@ Kubelogin will perform authentication if the token cache file does not exist.
 You can dump the claims of token by passing `-v1` option.

 ```
-I1212 10:14:17.754394    2517 get_token.go:91] the ID token has the claim: sub=********
-I1212 10:14:17.754434    2517 get_token.go:91] the ID token has the claim: at_hash=********
-I1212 10:14:17.754449    2517 get_token.go:91] the ID token has the claim: nonce=********
-I1212 10:14:17.754459    2517 get_token.go:91] the ID token has the claim: iat=1576113256
-I1212 10:14:17.754467    2517 get_token.go:91] the ID token has the claim: exp=1576116856
-I1212 10:14:17.754484    2517 get_token.go:91] the ID token has the claim: iss=https://accounts.google.com
-I1212 10:14:17.754497    2517 get_token.go:91] the ID token has the claim: azp=********.apps.googleusercontent.com
-I1212 10:14:17.754506    2517 get_token.go:91] the ID token has the claim: aud=********.apps.googleusercontent.com
+I0221 21:54:08.151850   28231 get_token.go:104] you got a token: {
+  "sub": "********",
+  "iss": "https://accounts.google.com",
+  "aud": "********",
+  "iat": 1582289639,
+  "exp": 1582293239,
+  "jti": "********",
+  "nonce": "********",
+  "at_hash": "********"
+}
 ```


@@ -117,21 +116,22 @@ Usage:
  kubelogin get-token [flags]

 Flags:
-      --oidc-issuer-url string              Issuer URL of the provider (mandatory)
-      --oidc-client-id string               Client ID of the provider (mandatory)
-      --oidc-client-secret string           Client secret of the provider
-      --oidc-extra-scope strings            Scopes to request to the provider
-      --certificate-authority string        Path to a cert file for the certificate authority
-      --certificate-authority-data string   Base64 encoded data for the certificate authority
-      --insecure-skip-tls-verify            If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
-      --token-cache-dir string              Path to a directory for caching tokens (default "~/.kube/cache/oidc-login")
-      --grant-type string                   The authorization grant type to use. One of (auto|authcode|authcode-keyboard|password) (default "auto")
-      --listen-address strings              Address to bind to the local server. If multiple addresses are given, it will try binding in order (default [127.0.0.1:8000,127.0.0.1:18000])
-      --listen-port ints                    (Deprecated: use --listen-address)
-      --skip-open-browser                   If true, it does not open the browser on authentication
-      --username string                     If set, perform the resource owner password credentials grant
-      --password string                     If set, use the password instead of asking it
-  -h, --help                                help for get-token
+      --oidc-issuer-url string                          Issuer URL of the provider (mandatory)
+      --oidc-client-id string                           Client ID of the provider (mandatory)
+      --oidc-client-secret string                       Client secret of the provider
+      --oidc-extra-scope strings                        Scopes to request to the provider
+      --certificate-authority string                    Path to a cert file for the certificate authority
+      --certificate-authority-data string               Base64 encoded data for the certificate authority
+      --insecure-skip-tls-verify                        If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
+      --token-cache-dir string                          Path to a directory for caching tokens (default "~/.kube/cache/oidc-login")
+      --grant-type string                               The authorization grant type to use. One of (auto|authcode|authcode-keyboard|password) (default "auto")
+      --listen-address strings                          Address to bind to the local server. If multiple addresses are given, it will try binding in order (default [127.0.0.1:8000,127.0.0.1:18000])
+      --listen-port ints                                (Deprecated: use --listen-address)
+      --skip-open-browser                               If true, it does not open the browser on authentication
+      --oidc-auth-request-extra-params stringToString   Extra query parameters to send with an authentication request (default [])
+      --username string                                 If set, perform the resource owner password credentials grant
+      --password string                                 If set, use the password instead of asking it
+  -h, --help                                            help for get-token

 Global Flags:
      --add_dir_header                   If true, adds the file directory to the header
@@ -173,39 +173,6 @@ You can use your self-signed certificate for the provider.
 You can set the following environment variables if you are behind a proxy: `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY`.
 See also [net/http#ProxyFromEnvironment](https://golang.org/pkg/net/http/#ProxyFromEnvironment).

-### Docker
-
-You can run [the Docker image](https://quay.io/repository/int128/kubelogin) instead of the binary.
-The kubeconfig looks like:
-
-```yaml
-users:
- name: oidc
-  user:
-    exec:
-      apiVersion: client.authentication.k8s.io/v1beta1
-      command: docker
-      args:
-      - run
-      - --rm
-      - -v
-      - /tmp/.token-cache:/.token-cache
-      - -p
-      - 8000:8000
-      - quay.io/int128/kubelogin:v1.16.0
-      - get-token
-      - --token-cache-dir=/.token-cache
-      - --listen-address=0.0.0.0:8000
-      - --oidc-issuer-url=ISSUER_URL
-      - --oidc-client-id=YOUR_CLIENT_ID
-      - --oidc-client-secret=YOUR_CLIENT_SECRET
-```
-
-Known limitations:
-
- It cannot open the browser automatically.
- The container port and listen port must be equal for consistency of the redirect URI.
-
 ### Authentication flows

 #### Authorization code flow
@@ -225,6 +192,12 @@ You can change the listening address.
      - --listen-address=127.0.0.1:23456
 ```

+You can add extra parameters to the authentication request.
+
+```yaml
+      - --oidc-auth-request-extra-params=ttl=86400
+```
+
 #### Authorization code flow with keyboard interactive

 If you cannot access the browser, instead use the authorization code flow with keyboard interactive.
@@ -245,6 +218,12 @@ Enter code: YOUR_CODE
 Note that this flow uses the redirect URI `urn:ietf:wg:oauth:2.0:oob` and
 some OIDC providers do not support it.

+You can add extra parameters to the authentication request.
+
+```yaml
+      - --oidc-auth-request-extra-params=ttl=86400
+```
+
 #### Resource owner password credentials grant flow

 Kubelogin performs the resource owner password credentials grant flow
@@ -283,6 +262,39 @@ Username: foo
 Password:
 ```

+### Docker
+
+You can run [the Docker image](https://quay.io/repository/int128/kubelogin) instead of the binary.
+The kubeconfig looks like:
+
+```yaml
+users:
+- name: oidc
+  user:
+    exec:
+      apiVersion: client.authentication.k8s.io/v1beta1
+      command: docker
+      args:
+      - run
+      - --rm
+      - -v
+      - /tmp/.token-cache:/.token-cache
+      - -p
+      - 8000:8000
+      - quay.io/int128/kubelogin:v1.18.0
+      - get-token
+      - --token-cache-dir=/.token-cache
+      - --listen-address=0.0.0.0:8000
+      - --oidc-issuer-url=ISSUER_URL
+      - --oidc-client-id=YOUR_CLIENT_ID
+      - --oidc-client-secret=YOUR_CLIENT_SECRET
+```
+
+Known limitations:
+
+- It cannot open the browser automatically.
+- The container port and listen port must be equal for consistency of the redirect URI.
+

 ## Related works

--- a/acceptance_test/README.md
+++ b/acceptance_test/README.md
@@ -1,7 +1,21 @@
 # kubelogin/acceptance_test

-This is an acceptance test to verify behavior of kubelogin using a real Kubernetes cluster and OpenID Connect provider.
-It runs on [GitHub Actions](https://github.com/int128/kubelogin/actions?query=workflow%3Aacceptance-test).
+This is an acceptance test for walkthrough of the OIDC initial setup and plugin behavior using a real Kubernetes cluster and OpenID Connect provider, running on [GitHub Actions](https://github.com/int128/kubelogin/actions?query=workflow%3Aacceptance-test).
+
+It is intended to verify the following points:
+
+- User can set up Kubernetes OIDC authentication and this plugin.
+- User can access a cluster after login.
+
+It performs the test using the following components:
+
+- Kubernetes cluster (Kind)
+- OIDC provider (Dex)
+- Browser (Chrome)
+- kubectl command
+
+
+## How it works

 Let's take a look at the diagram.

@@ -28,6 +42,32 @@ It performs the test by the following steps:
 1. Check if kubectl exited with code 0.


+## Run locally
+
+You need to set up the following components:
+
+- Docker
+- Kind
+- Chrome or Chromium
+
+You need to add the following line to `/etc/hosts` so that the browser can access the Dex.
+
+```
+127.0.0.1 dex-server
+```
+
+Run the test.
+
+```shell script
+# run the test
+make
+
+# clean up
+make delete-cluster
+make delete-dex
+```
+
+
 ## Technical consideration

 ### Network and DNS
@@ -67,25 +107,3 @@ As a result,
 - Set the issuer URL to kubectl. See [`kubeconfig_oidc.yaml`](kubeconfig_oidc.yaml).
 - Set the issuer URL to kube-apiserver. See [`cluster.yaml`](cluster.yaml).
 - Set `BROWSER` environment variable to run [`chromelogin`](chromelogin) by `xdg-open`.
-
-
-## Run locally
-
-You need to set up Docker and Kind.
-
-You need to add the following line to `/etc/hosts`:
-
-```
-127.0.0.1 dex-server
-```
-
-Run:
-
-```shell script
-# run the test
-make
-
-# clean up
-make delete-cluster
-make delete-dex
-```
--- a/go.mod
+++ b/go.mod
@@ -6,21 +6,21 @@ require (
 	github.com/chromedp/chromedp v0.5.3
 	github.com/coreos/go-oidc v2.2.1+incompatible
 	github.com/dgrijalva/jwt-go v3.2.0+incompatible
-	github.com/golang/mock v1.4.0
+	github.com/golang/mock v1.4.3
 	github.com/google/go-cmp v0.4.0
 	github.com/google/wire v0.4.0
-	github.com/int128/oauth2cli v1.8.1
+	github.com/int128/oauth2cli v1.10.0
 	github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4
 	github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 // indirect
-	github.com/spf13/cobra v0.0.5
+	github.com/spf13/cobra v0.0.6
 	github.com/spf13/pflag v1.0.5
-	golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586
-	golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45
+	golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975
+	golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
 	golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e
 	golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543
 	gopkg.in/square/go-jose.v2 v2.3.1 // indirect
 	gopkg.in/yaml.v2 v2.2.8
-	k8s.io/apimachinery v0.17.2
-	k8s.io/client-go v0.17.2
+	k8s.io/apimachinery v0.17.4
+	k8s.io/client-go v0.17.4
 	k8s.io/klog v1.0.0
 )
--- a/go.sum
+++ b/go.sum
@@ -10,56 +10,72 @@ github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6L
 github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbtp2fGCgRFtBroKn4Dk=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
+github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/chromedp/cdproto v0.0.0-20200116234248-4da64dd111ac h1:T7V5BXqnYd55Hj/g5uhDYumg9Fp3rMTS6bykYtTIFX4=
 github.com/chromedp/cdproto v0.0.0-20200116234248-4da64dd111ac/go.mod h1:PfAWWKJqjlGFYJEidUM6aVIWPr0EpobeyVWEEmplX7g=
 github.com/chromedp/chromedp v0.5.3 h1:F9LafxmYpsQhWQBdCs+6Sret1zzeeFyHS5LkRF//Ffg=
 github.com/chromedp/chromedp v0.5.3/go.mod h1:YLdPtndaHQ4rCpSpBG+IPpy9JvX0VD+7aaLxYgYj28w=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
-github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
-github.com/coreos/go-oidc v2.1.0+incompatible h1:sdJrfw8akMnCuUlaZU3tE/uYXFgfqom8DBE9so9EBsM=
-github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
 github.com/coreos/go-oidc v2.2.1+incompatible h1:mh48q/BqXqgjVHpy2ZY7WnWAbenxRjsz9N1i1YxjHAk=
 github.com/coreos/go-oidc v2.2.1+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
 github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
+github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
+github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/davecgh/go-spew v0.0.0-20151105211317-5215b55f46b2/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
 github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
 github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
 github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
 github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
 github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
 github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee h1:s+21KNqlpePfkah2I+gwHF8xmJWRjooY+5248k6m4A0=
 github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee/go.mod h1:L0fX3K22YWvt/FAX9NnzrNzcI4wNYi9Yku4O0LKYflo=
 github.com/gobwas/pool v0.2.0 h1:QEmUOlnSjWtnpRGHF3SauEiOsy82Cup83Vf2LcMlnc8=
 github.com/gobwas/pool v0.2.0/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.0.2 h1:CoAavW/wd/kulfZmSIBt6p24n4j7tHgNVCjsfHVNUbo=
 github.com/gobwas/ws v1.0.2/go.mod h1:szmBTxLgaFppYjEmNtny/v3w89xOydFnnZMcgRRu/EM=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
 github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d h1:3PaI8p3seN09VjbTYC/QWlUZdZ1qS1zGjy7LH2Wt07I=
 github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.4.0 h1:Rd1kQnQu0Hq3qvJppYSG0HtP+f5LPPUiDswTLiEegLg=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.3 h1:GV+pQPG/EUUbkh47niozDcADz6go/dUwhVzdUQHIVRw=
+github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
@@ -67,8 +83,6 @@ github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1 h1:Xye71clBPdm5HgqGwUkwhbynsUJZhDbS20FvLhQ2izg=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/gofuzz v0.0.0-20161122191042-44d81051d367/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
@@ -83,7 +97,11 @@ github.com/google/wire v0.4.0/go.mod h1:ngWDr9Qvq3yZA10YrxfyGELY/AFWGVpy9c1LTRi1
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
 github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8=
+github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
+github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
@@ -94,16 +112,21 @@ github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NH
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/int128/listener v1.0.0 h1:a9H3m4jbXgXpxJUK3fxWrh37Iic/UU/kYOGE0WtjbbI=
 github.com/int128/listener v1.0.0/go.mod h1:sho0rrH7mNRRZH4hYOYx+xwRDGmtRndaUiu2z9iumes=
-github.com/int128/oauth2cli v1.8.1 h1:Vkmfx0w225l4qUpJ1ZWGw1elw7hnXAybSiYoYyh1iBw=
-github.com/int128/oauth2cli v1.8.1/go.mod h1:MkxKWhHUaPOaq/92Z5ifdCWySAKJKo04hUXaKA7OgDE=
+github.com/int128/oauth2cli v1.10.0 h1:ypYxwjuBblyTRTdZTFQLgA08gYhVwsdlBEvuoNs6Xsw=
+github.com/int128/oauth2cli v1.10.0/go.mod h1:m5tJro14TyPDlIg+RIlGVnavkm1kTooROlcFlnhteVo=
+github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/json-iterator/go v0.0.0-20180612202835-f2b4162afba3/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.8 h1:QiWkFLKq0T7mpzwOTu6BzNDbfTE8OLrYhVKYMLF46Ok=
 github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/knq/sysutil v0.0.0-20191005231841-15668db23d08 h1:V0an7KRw92wmJysvFvtqtKMAPmvS5O0jtB0nYo6t+gs=
 github.com/knq/sysutil v0.0.0-20191005231841-15668db23d08/go.mod h1:dFWs1zEqDjFtnBXsd1vPOZaLsESovai349994nHx3e0=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -113,6 +136,7 @@ github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czP
 github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.7.0 h1:aizVhC/NAAcKWb+5QsU1iNOZb4Yws5UO2I+aIprQITM=
 github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -123,7 +147,9 @@ github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lN
 github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
@@ -133,59 +159,87 @@ github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/9
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
 github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4 h1:49lOXmGaUpV9Fz3gd7TFZY106KVlPVa5jcYD1gaQf98=
 github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 h1:J9b7z+QKAmPf4YLrFg6oQUotqHQeUNWwkvo7jZp1GLU=
 github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
-github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
+github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
+github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
 github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cobra v0.0.5 h1:f0B+LkLX6DtmRH1isoNA9VTtNUK9K8xYd28JNNfOv/s=
-github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
+github.com/spf13/cobra v0.0.6 h1:breEStsVwemnKh2/s6gMvSdMEkwW0sK8vGStnlVBMCs=
+github.com/spf13/cobra v0.0.6/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3 h1:zPAT6CGy6wXeQ7NtTnaTerfKOsV6V6F8agHXFiazDkg=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
+github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
+github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
+github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
+go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 h1:VklqNMn3ovrHsnt90PveolxSbWFaJdECFbxSq0Mqo2M=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586 h1:7KByu05hhLed2MO29w7p1XfZvZ13m8mub3shuVftRs0=
-golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 h1:/Tl7pH94bvbAAHBdZJT947M/+gp0+CqQXDtMRC0fseo=
+golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a h1:oWX7TPOiFAMXLq8o0ikBYfCJVlRHBcsciT5bXOrH628=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9 h1:rjwSpXsdiK0dV8/Naq3kAw9ymfAeJIyd0upUIElB+lI=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 h1:SVwTIAaPC2U/AvvLNZ2a7OVsmBpC8L5BlwK1whH3hm0=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d h1:TzXSXBo42m9gQenoE3b9BGiEpg5IG2JkU5FkPIawgtw=
+golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 h1:YUO/7uOKsKeq9UokNS62b8FYywz3ker1l1vDZRCRefw=
@@ -197,8 +251,10 @@ golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e h1:vcxGaoTs7kV8m5Np9uUNQin4
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190209173611-3b5209105503/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -215,11 +271,13 @@ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4 h1:SvFZT6jyqRaOeXpc5h/JSfZenJ2O330aBsf7JfSUXmQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190422233926-fe54fb35175b/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
@@ -236,6 +294,8 @@ google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoA
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
@@ -243,24 +303,25 @@ gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
 gopkg.in/square/go-jose.v2 v2.3.1 h1:SK5KegNXmKmqE342YYN2qPHEnUYeoMiXXl1poUlI+o4=
 gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
 gopkg.in/yaml.v2 v2.2.1 h1:mUhvW9EsL+naU5Q3cakzfE91YhliOondGd6ZrsDBHQE=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/api v0.17.2 h1:NF1UFXcKN7/OOv1uxdRz3qfra8AHsPav5M93hlV9+Dc=
-k8s.io/api v0.17.2/go.mod h1:BS9fjjLc4CMuqfSO8vgbHPKMt5+SF0ET6u/RVDihTo4=
-k8s.io/apimachinery v0.17.2 h1:hwDQQFbdRlpnnsR64Asdi55GyCaIP/3WQpMmbNBeWr4=
-k8s.io/apimachinery v0.17.2/go.mod h1:b9qmWdKlLuU9EBh+06BtLcSf/Mu89rWL33naRxs1uZg=
-k8s.io/client-go v0.17.2 h1:ndIfkfXEGrNhLIgkr0+qhRguSD3u6DCmonepn1O6NYc=
-k8s.io/client-go v0.17.2/go.mod h1:QAzRgsa0C2xl4/eVpeVAZMvikCn8Nm81yqVx3Kk9XYI=
+k8s.io/api v0.17.4 h1:HbwOhDapkguO8lTAE8OX3hdF2qp8GtpC9CW/MQATXXo=
+k8s.io/api v0.17.4/go.mod h1:5qxx6vjmwUVG2nHQTKGlLts8Tbok8PzHl4vHtVFuZCA=
+k8s.io/apimachinery v0.17.4 h1:UzM+38cPUJnzqSQ+E1PY4YxMHIzQyCg29LOoGfo79Zw=
+k8s.io/apimachinery v0.17.4/go.mod h1:gxLnyZcGNdZTCLnq3fgzyg2A5BVCHTNDFrw8AmuJ+0g=
+k8s.io/client-go v0.17.4 h1:VVdVbpTY70jiNHS1eiFkUt7ZIJX3txd29nDxxXH4en8=
+k8s.io/client-go v0.17.4/go.mod h1:ouF6o5pz3is8qU0/qYL2RnoxOPqgfuidYLowytyLJmc=
 k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
 k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
 k8s.io/klog v0.3.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
--- a/integration_test/credetial_plugin_test.go
+++ b/integration_test/credetial_plugin_test.go
@@ -17,9 +17,10 @@ import (
 	"github.com/int128/kubelogin/pkg/adaptors/browser/mock_browser"
 	"github.com/int128/kubelogin/pkg/adaptors/credentialpluginwriter"
 	"github.com/int128/kubelogin/pkg/adaptors/credentialpluginwriter/mock_credentialpluginwriter"
-	"github.com/int128/kubelogin/pkg/adaptors/logger/mock_logger"
 	"github.com/int128/kubelogin/pkg/adaptors/tokencache"
 	"github.com/int128/kubelogin/pkg/di"
+	"github.com/int128/kubelogin/pkg/testing/jwt"
+	"github.com/int128/kubelogin/pkg/testing/logger"
 )

 // Run the integration tests of the credential plugin use-case.
@@ -96,7 +97,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
 		serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys)
 		defer server.Shutdown(t, ctx)
 		var idToken string
-		setupAuthCodeFlow(t, provider, serverURL, "openid", &idToken)
+		setupAuthCodeFlow(t, provider, serverURL, "openid", nil, &idToken)
 		writerMock := newCredentialPluginWriterMock(t, ctrl, &idToken)
 		browserMock := newBrowserMock(ctx, t, ctrl, tc.Keys)

@@ -177,7 +178,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
 		expiredIDToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryPast)

 		provider.EXPECT().Discovery().Return(idp.NewDiscoveryResponse(serverURL))
-		provider.EXPECT().GetCertificates().Return(idp.NewCertificatesResponse(keys.JWSKeyPair))
+		provider.EXPECT().GetCertificates().Return(idp.NewCertificatesResponse(jwt.PrivateKey))
 		provider.EXPECT().Refresh("VALID_REFRESH_TOKEN").
 			Return(idp.NewTokenResponse(validIDToken, "NEW_REFRESH_TOKEN"), nil)

@@ -213,7 +214,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
 		validIDToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryFuture)
 		expiredIDToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryPast)

-		setupAuthCodeFlow(t, provider, serverURL, "openid", &validIDToken)
+		setupAuthCodeFlow(t, provider, serverURL, "openid", nil, &validIDToken)
 		provider.EXPECT().Refresh("EXPIRED_REFRESH_TOKEN").
 			Return(nil, &idp.ErrorResponse{Code: "invalid_request", Description: "token has expired"}).
 			MaxTimes(2) // package oauth2 will retry refreshing the token
@@ -248,7 +249,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
 		serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys)
 		defer server.Shutdown(t, ctx)
 		var idToken string
-		setupAuthCodeFlow(t, provider, serverURL, "email profile openid", &idToken)
+		setupAuthCodeFlow(t, provider, serverURL, "email profile openid", nil, &idToken)
 		writerMock := newCredentialPluginWriterMock(t, ctrl, &idToken)
 		browserMock := newBrowserMock(ctx, t, ctrl, tc.Keys)

@@ -261,6 +262,34 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
 		args = append(args, tc.ExtraArgs...)
 		runGetTokenCmd(t, ctx, browserMock, writerMock, args)
 	})
+
+	t.Run("ExtraParams", func(t *testing.T) {
+		t.Parallel()
+		ctx, cancel := context.WithTimeout(context.TODO(), timeout)
+		defer cancel()
+		ctrl := gomock.NewController(t)
+		defer ctrl.Finish()
+
+		provider := mock_idp.NewMockProvider(ctrl)
+		serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys)
+		defer server.Shutdown(t, ctx)
+		var idToken string
+		setupAuthCodeFlow(t, provider, serverURL, "openid", map[string]string{
+			"ttl":    "86400",
+			"reauth": "false",
+		}, &idToken)
+		writerMock := newCredentialPluginWriterMock(t, ctrl, &idToken)
+		browserMock := newBrowserMock(ctx, t, ctrl, tc.Keys)
+
+		args := []string{
+			"--oidc-issuer-url", serverURL,
+			"--oidc-client-id", "kubernetes",
+			"--oidc-auth-request-extra-params", "ttl=86400",
+			"--oidc-auth-request-extra-params", "reauth=false",
+		}
+		args = append(args, tc.ExtraArgs...)
+		runGetTokenCmd(t, ctx, browserMock, writerMock, args)
+	})
 }

 func newCredentialPluginWriterMock(t *testing.T, ctrl *gomock.Controller, idToken *string) *mock_credentialpluginwriter.MockInterface {
@@ -281,7 +310,7 @@ func newCredentialPluginWriterMock(t *testing.T, ctrl *gomock.Controller, idToke

 func runGetTokenCmd(t *testing.T, ctx context.Context, b browser.Interface, w credentialpluginwriter.Interface, args []string) {
 	t.Helper()
-	cmd := di.NewCmdForHeadless(mock_logger.New(t), b, w)
+	cmd := di.NewCmdForHeadless(logger.New(t), b, w)
 	exitCode := cmd.Run(ctx, append([]string{
 		"kubelogin", "get-token",
 		"--v=1",
--- a/integration_test/helpers_test.go
+++ b/integration_test/helpers_test.go
@@ -6,13 +6,13 @@ import (
 	"testing"
 	"time"

-	"github.com/dgrijalva/jwt-go"
 	"github.com/golang/mock/gomock"
 	"github.com/int128/kubelogin/integration_test/idp"
 	"github.com/int128/kubelogin/integration_test/idp/mock_idp"
 	"github.com/int128/kubelogin/integration_test/keys"
 	"github.com/int128/kubelogin/pkg/adaptors/browser"
 	"github.com/int128/kubelogin/pkg/adaptors/browser/mock_browser"
+	"github.com/int128/kubelogin/pkg/testing/jwt"
 )

 var (
@@ -22,35 +22,33 @@ var (

 func newIDToken(t *testing.T, issuer, nonce string, expiry time.Time) string {
 	t.Helper()
-	var claims struct {
-		jwt.StandardClaims
-		Nonce  string   `json:"nonce"`
-		Groups []string `json:"groups"`
-	}
-	claims.StandardClaims = jwt.StandardClaims{
-		Issuer:    issuer,
-		Audience:  "kubernetes",
-		Subject:   "SUBJECT",
-		IssuedAt:  time.Now().Unix(),
-		ExpiresAt: expiry.Unix(),
-	}
-	claims.Nonce = nonce
-	claims.Groups = []string{"admin", "users"}
-	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
-	s, err := token.SignedString(keys.JWSKeyPair)
-	if err != nil {
-		t.Fatalf("Could not sign the claims: %s", err)
-	}
-	return s
+	return jwt.EncodeF(t, func(claims *jwt.Claims) {
+		claims.Issuer = issuer
+		claims.Subject = "SUBJECT"
+		claims.IssuedAt = time.Now().Unix()
+		claims.ExpiresAt = expiry.Unix()
+		claims.Audience = []string{"kubernetes", "system"}
+		claims.Nonce = nonce
+		claims.Groups = []string{"admin", "users"}
+	})
 }

-func setupAuthCodeFlow(t *testing.T, provider *mock_idp.MockProvider, serverURL, scope string, idToken *string) {
+func setupAuthCodeFlow(t *testing.T, provider *mock_idp.MockProvider, serverURL, scope string, extraParams map[string]string, idToken *string) {
 	var nonce string
 	provider.EXPECT().Discovery().Return(idp.NewDiscoveryResponse(serverURL))
-	provider.EXPECT().GetCertificates().Return(idp.NewCertificatesResponse(keys.JWSKeyPair))
-	provider.EXPECT().AuthenticateCode(scope, gomock.Any()).
-		DoAndReturn(func(_, gotNonce string) (string, error) {
-			nonce = gotNonce
+	provider.EXPECT().GetCertificates().Return(idp.NewCertificatesResponse(jwt.PrivateKey))
+	provider.EXPECT().AuthenticateCode(gomock.Any()).
+		DoAndReturn(func(req idp.AuthenticationRequest) (string, error) {
+			if req.Scope != scope {
+				t.Errorf("scope wants `%s` but was `%s`", scope, req.Scope)
+			}
+			for k, v := range extraParams {
+				got := req.RawQuery.Get(k)
+				if got != v {
+					t.Errorf("parameter %s wants `%s` but was `%s`", k, v, got)
+				}
+			}
+			nonce = req.Nonce
 			return "YOUR_AUTH_CODE", nil
 		})
 	provider.EXPECT().Exchange("YOUR_AUTH_CODE").
@@ -62,7 +60,7 @@ func setupAuthCodeFlow(t *testing.T, provider *mock_idp.MockProvider, serverURL,

 func setupROPCFlow(provider *mock_idp.MockProvider, serverURL, scope, username, password, idToken string) {
 	provider.EXPECT().Discovery().Return(idp.NewDiscoveryResponse(serverURL))
-	provider.EXPECT().GetCertificates().Return(idp.NewCertificatesResponse(keys.JWSKeyPair))
+	provider.EXPECT().GetCertificates().Return(idp.NewCertificatesResponse(jwt.PrivateKey))
 	provider.EXPECT().AuthenticatePassword(username, password, scope).
 		Return(idp.NewTokenResponse(idToken, "YOUR_REFRESH_TOKEN"), nil)
 }
--- a/integration_test/idp/handler.go
+++ b/integration_test/idp/handler.go
@@ -74,8 +74,14 @@ func (h *Handler) serveHTTP(w http.ResponseWriter, r *http.Request) error {
 		// 3.1.2.1. Authentication Request
 		// https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
 		q := r.URL.Query()
-		redirectURI, scope, state, nonce := q.Get("redirect_uri"), q.Get("scope"), q.Get("state"), q.Get("nonce")
-		code, err := h.provider.AuthenticateCode(scope, nonce)
+		redirectURI, state := q.Get("redirect_uri"), q.Get("state")
+		code, err := h.provider.AuthenticateCode(AuthenticationRequest{
+			RedirectURI: redirectURI,
+			State:       state,
+			Scope:       q.Get("scope"),
+			Nonce:       q.Get("nonce"),
+			RawQuery:    q,
+		})
 		if err != nil {
 			return xerrors.Errorf("authentication error: %w", err)
 		}
--- a/integration_test/idp/idp.go
+++ b/integration_test/idp/idp.go
@@ -1,13 +1,14 @@
 // Package idp provides a test double of an OpenID Connect Provider.
 package idp

-//go:generate mockgen -destination mock_idp/mock_idp.go github.com/int128/kubelogin/e2e_test/idp Provider
+//go:generate mockgen -destination mock_idp/mock_idp.go github.com/int128/kubelogin/integration_test/idp Provider

 import (
 	"crypto/rsa"
 	"encoding/base64"
 	"fmt"
 	"math/big"
+	"net/url"
 )

 // Provider provides discovery and authentication methods.
@@ -17,7 +18,7 @@ import (
 type Provider interface {
 	Discovery() *DiscoveryResponse
 	GetCertificates() *CertificatesResponse
-	AuthenticateCode(scope, nonce string) (code string, err error)
+	AuthenticateCode(req AuthenticationRequest) (code string, err error)
 	Exchange(code string) (*TokenResponse, error)
 	AuthenticatePassword(username, password, scope string) (*TokenResponse, error)
 	Refresh(refreshToken string) (*TokenResponse, error)
@@ -89,6 +90,14 @@ func NewCertificatesResponse(idTokenKeyPair *rsa.PrivateKey) *CertificatesRespon
 	}
 }

+type AuthenticationRequest struct {
+	RedirectURI string
+	State       string
+	Scope       string // space separated string
+	Nonce       string
+	RawQuery    url.Values
+}
+
 type TokenResponse struct {
 	AccessToken  string `json:"access_token"`
 	TokenType    string `json:"token_type"`
--- a/integration_test/idp/mock_idp/mock_idp.go
+++ b/integration_test/idp/mock_idp/mock_idp.go
@@ -1,5 +1,5 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/int128/kubelogin/e2e_test/idp (interfaces: Provider)
+// Source: github.com/int128/kubelogin/integration_test/idp (interfaces: Provider)

 // Package mock_idp is a generated GoMock package.
 package mock_idp
@@ -34,18 +34,18 @@ func (m *MockProvider) EXPECT() *MockProviderMockRecorder {
 }

 // AuthenticateCode mocks base method
-func (m *MockProvider) AuthenticateCode(arg0, arg1 string) (string, error) {
+func (m *MockProvider) AuthenticateCode(arg0 idp.AuthenticationRequest) (string, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "AuthenticateCode", arg0, arg1)
+	ret := m.ctrl.Call(m, "AuthenticateCode", arg0)
 	ret0, _ := ret[0].(string)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }

 // AuthenticateCode indicates an expected call of AuthenticateCode
-func (mr *MockProviderMockRecorder) AuthenticateCode(arg0, arg1 interface{}) *gomock.Call {
+func (mr *MockProviderMockRecorder) AuthenticateCode(arg0 interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AuthenticateCode", reflect.TypeOf((*MockProvider)(nil).AuthenticateCode), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AuthenticateCode", reflect.TypeOf((*MockProvider)(nil).AuthenticateCode), arg0)
 }

 // AuthenticatePassword mocks base method
--- a/integration_test/keys/keys.go
+++ b/integration_test/keys/keys.go
@@ -1,11 +1,9 @@
 package keys

 import (
-	"crypto/rsa"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/base64"
-	"encoding/pem"
 	"io"
 	"io/ioutil"
 	"os"
@@ -34,13 +32,6 @@ var Server = Keys{
 	TLSConfig:    newTLSConfig("keys/testdata/ca.crt"),
 }

-// JWSKey is path to the key for signing ID tokens.
-// This file should be generated by Makefile before test.
-const JWSKey = "keys/testdata/jws.key"
-
-// JWSKeyPair is the key pair loaded from JWSKey.
-var JWSKeyPair = readPrivateKey(JWSKey)
-
 func readAsBase64(name string) string {
 	f, err := os.Open(name)
 	if err != nil {
@@ -69,22 +60,3 @@ func newTLSConfig(name string) *tls.Config {
 	}
 	return &tls.Config{RootCAs: p}
 }
-
-func readPrivateKey(name string) *rsa.PrivateKey {
-	b, err := ioutil.ReadFile(name)
-	if err != nil {
-		panic(err)
-	}
-	block, rest := pem.Decode(b)
-	if block == nil {
-		panic("could not decode PEM")
-	}
-	if len(rest) > 0 {
-		panic("PEM should contain single key but multiple keys")
-	}
-	k, err := x509.ParsePKCS1PrivateKey(block.Bytes)
-	if err != nil {
-		panic(err)
-	}
-	return k
-}
--- a/integration_test/keys/testdata/Makefile
+++ b/integration_test/keys/testdata/Makefile
@@ -4,7 +4,6 @@ TARGETS := ca.key
 TARGETS += ca.crt
 TARGETS += server.key
 TARGETS += server.crt
-TARGETS += jws.key

 .PHONY: all
 all: $(TARGETS)
@@ -22,9 +21,6 @@ server.csr: openssl.cnf server.key
 server.crt: openssl.cnf server.csr ca.crt ca.key
 	openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out $@ -sha256 -days $(EXPIRY) -extensions v3_req -extfile openssl.cnf

-jws.key:
-	openssl genrsa -out $@ 2048
-
 .PHONY: clean
 clean:
 	-rm -v $(TARGETS)
--- a/integration_test/keys/testdata/jws.key
+++ b/integration_test/keys/testdata/jws.key
@@ -1,27 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEAvKJxjhaEnV/64i+GBDn4+PUno693bQBumE6a/pUf5RC8faZu
-dpj7vFJsTPHqHNqR5EIKCGZMlYvnxXbOJDElqbDkRtFG4l3k/WXAea5rE4v+AKDm
-/49dY6SLgH7iP2Z2gmgbqICjDFyn89Mye3H4ZEY0dHiY/7Fbhg637+aaE/CkPNue
-LFn3UjqmytkxiBhLX8H6zQU6RP6IVFpSjuJ6TfRVvJ4lg1ThxX+rKqUDzIdF2FNe
-1KBYfEKV1J9ZY671qrV07H8jw42Kw8/hmGECb1hr93JOu0odWM6EhXhig3oL299c
-2jlQAh4y04uUybS6xYhZxrk6FcpzzaJO/eRPHQIDAQABAoIBABhtlPUIl33l2xCF
-hP5xH3vmC48X/wg/oRLaQxoq56l7ZF2FOxLitt7pcZr5TQ8VgwUjRDdYQByxtH8O
-5p0rPCxgev9sxJg1/pyOG8HmQ3mRjIA6Vg/MWhS4T1SBmf0J4Nj8cHB+0B6etSVP
-OV9hIACkUtCueWnLZwXSTCGmJFfmfeKQSM3yyF3BxQDpyAQFdzCbIwQsTmSnZOZx
-5wJ8Fv/BMrqKBje158ISePBZWz54eBnFc2VKKDRxj16e5Ni0BhCwpgDI7MRUzKVS
-qKAkCwsUcmXpRZPUU5mDB6yPJU8DZwTcS5L1PWUIUnY3mlosukVUxTaoJigwulr9
-RXp9tmUCgYEA6x40cnT2sibSPuytycs4Tpg5UjeCkPMNCscX+x9hdSWjJkC7eolH
-qTHemjC896ExTMMFzpFKjymJbdeMn6BslOt6RvHnXugJ8IRi10JgZYHFQ/hr6A3+
-SsPA7cT712Ya63i19WWCySYDccy33qGt2rtdhJlrGKEfnTiNjEMw1hMCgYEAzWNc
-ae/tWbmYhjEoFt/pJp1Lb/zIDRpjV4zfeyr/wPY9Q0d/llKUISPdi1slQxpNTHqT
-idiRnc8Qweisqt+84UiTU9JEG7D3T71SA+MO57NIm2wTt/7U7yb3abMZZijIPw5U
-6td5jh78dGT3WRPgAsGnACXA2WJchD5m0nthrA8CgYEAiCMeJSPab/8Qf8TVP+G+
-gaucjSF9JWbGJ3ZuSUa7THR1ikGzDFmOt8YbaVZNJGkePZ8yro/sBwb6/zHux8LA
-/F14mLmayZY7oxtUi+VwIXZJfXjLKjtoAWxlOodzdx40+iET4rpbRxMOrYbm9C7T
-lrIkjRG0NDefMY68TvncvicCgYBNtkO4PbTj1yqT07OkfBI+rxNlCxMyigJ+lOnW
-M53TiBgEBeCLozEzHNvtp44AxsnqnxKF/LCUMk3X4M68VK2l3A0KkSt+AsaAoFSQ
-7e+s0ZQuYoVPgBdXaboBf2ej1Nh3q1eMB/2RPb4t2CoSxUdkI5upnZ9LYUE6NFY5
-W7/IFwKBgAdQxrwfQmXqtuHwiorfCm3AS/w5xmGjbBTPHnZWme2zrmFTOKSWsxAs
-XAVU9B+RXJsPehC84SEreHtmZi79RRxHZOZhrl4oxrYth83QuzsR546kJwadBOj0
-91yAjrekXHI3YHFQJRFUBvlswgZKDiqP74DSBbmXwfO/h2wNUYyZ
-----END RSA PRIVATE KEY-----
--- a/integration_test/standalone_test.go
+++ b/integration_test/standalone_test.go
@@ -14,8 +14,9 @@ import (
 	"github.com/int128/kubelogin/integration_test/localserver"
 	"github.com/int128/kubelogin/pkg/adaptors/browser"
 	"github.com/int128/kubelogin/pkg/adaptors/browser/mock_browser"
-	"github.com/int128/kubelogin/pkg/adaptors/logger/mock_logger"
 	"github.com/int128/kubelogin/pkg/di"
+	"github.com/int128/kubelogin/pkg/testing/jwt"
+	"github.com/int128/kubelogin/pkg/testing/logger"
 )

 // Run the integration tests of the Login use-case.
@@ -49,7 +50,7 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) {
 		defer server.Shutdown(t, ctx)
 		browserMock := newBrowserMock(ctx, t, ctrl, idpTLS)
 		var idToken string
-		setupAuthCodeFlow(t, provider, serverURL, "openid", &idToken)
+		setupAuthCodeFlow(t, provider, serverURL, "openid", nil, &idToken)
 		kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{
 			Issuer:                  serverURL,
 			IDPCertificateAuthority: idpTLS.CACertPath,
@@ -140,7 +141,7 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) {
 		defer server.Shutdown(t, ctx)
 		idToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryFuture)
 		provider.EXPECT().Discovery().Return(idp.NewDiscoveryResponse(serverURL))
-		provider.EXPECT().GetCertificates().Return(idp.NewCertificatesResponse(keys.JWSKeyPair))
+		provider.EXPECT().GetCertificates().Return(idp.NewCertificatesResponse(jwt.PrivateKey))
 		provider.EXPECT().Refresh("VALID_REFRESH_TOKEN").
 			Return(idp.NewTokenResponse(idToken, "NEW_REFRESH_TOKEN"), nil)
 		browserMock := mock_browser.NewMockInterface(ctrl)
@@ -174,7 +175,7 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) {
 		serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), idpTLS)
 		defer server.Shutdown(t, ctx)
 		var idToken string
-		setupAuthCodeFlow(t, provider, serverURL, "openid", &idToken)
+		setupAuthCodeFlow(t, provider, serverURL, "openid", nil, &idToken)
 		provider.EXPECT().Refresh("EXPIRED_REFRESH_TOKEN").
 			Return(nil, &idp.ErrorResponse{Code: "invalid_request", Description: "token has expired"}).
 			MaxTimes(2) // package oauth2 will retry refreshing the token
@@ -209,7 +210,7 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) {
 		serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), idpTLS)
 		defer server.Shutdown(t, ctx)
 		var idToken string
-		setupAuthCodeFlow(t, provider, serverURL, "openid", &idToken)
+		setupAuthCodeFlow(t, provider, serverURL, "openid", nil, &idToken)
 		browserMock := newBrowserMock(ctx, t, ctrl, idpTLS)

 		kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{
@@ -241,7 +242,7 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) {
 		serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), idpTLS)
 		defer server.Shutdown(t, ctx)
 		var idToken string
-		setupAuthCodeFlow(t, provider, serverURL, "profile groups openid", &idToken)
+		setupAuthCodeFlow(t, provider, serverURL, "profile groups openid", nil, &idToken)
 		browserMock := newBrowserMock(ctx, t, ctrl, idpTLS)

 		kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{
@@ -264,7 +265,7 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) {

 func runRootCmd(t *testing.T, ctx context.Context, b browser.Interface, args []string) {
 	t.Helper()
-	cmd := di.NewCmdForHeadless(mock_logger.New(t), b, nil)
+	cmd := di.NewCmdForHeadless(logger.New(t), b, nil)
 	exitCode := cmd.Run(ctx, append([]string{
 		"kubelogin",
 		"--v=1",
--- a/pkg/adaptors/browser/browser.go
+++ b/pkg/adaptors/browser/browser.go
@@ -16,7 +16,6 @@ func init() {
 	browser.Stdout = os.Stderr
 }

-// Set provides an implementation and interface for Env.
 var Set = wire.NewSet(
 	wire.Struct(new(Browser)),
 	wire.Bind(new(Interface), new(*Browser)),
--- a/pkg/adaptors/clock/clock.go
+++ b/pkg/adaptors/clock/clock.go
@@ -0,0 +1,24 @@
+// Package clock provides the system clock.
+package clock
+
+import (
+	"time"
+
+	"github.com/google/wire"
+)
+
+var Set = wire.NewSet(
+	wire.Struct(new(Clock), "*"),
+	wire.Bind(new(Interface), new(*Clock)),
+)
+
+type Interface interface {
+	Now() time.Time
+}
+
+type Clock struct{}
+
+// Now returns the current time.
+func (c *Clock) Now() time.Time {
+	return time.Now()
+}
--- a/pkg/adaptors/cmd/cmd.go
+++ b/pkg/adaptors/cmd/cmd.go
@@ -2,7 +2,6 @@ package cmd

 import (
 	"context"
-	"path/filepath"

 	"github.com/google/wire"
 	"github.com/int128/kubelogin/pkg/adaptors/logger"
@@ -37,17 +36,15 @@ type Cmd struct {
 // Run parses the command line arguments and executes the specified use-case.
 // It returns an exit code, that is 0 on success or 1 on error.
 func (cmd *Cmd) Run(ctx context.Context, args []string, version string) int {
-	executable := filepath.Base(args[0])
-
-	rootCmd := cmd.Root.New(ctx, executable)
+	rootCmd := cmd.Root.New()
 	rootCmd.Version = version
 	rootCmd.SilenceUsage = true
 	rootCmd.SilenceErrors = true

-	getTokenCmd := cmd.GetToken.New(ctx)
+	getTokenCmd := cmd.GetToken.New()
 	rootCmd.AddCommand(getTokenCmd)

-	setupCmd := cmd.Setup.New(ctx)
+	setupCmd := cmd.Setup.New()
 	rootCmd.AddCommand(setupCmd)

 	versionCmd := &cobra.Command{
@@ -55,13 +52,13 @@ func (cmd *Cmd) Run(ctx context.Context, args []string, version string) int {
 		Short: "Print the version information",
 		Args:  cobra.NoArgs,
 		Run: func(*cobra.Command, []string) {
-			cmd.Logger.Printf("%s version %s", executable, version)
+			cmd.Logger.Printf("kubelogin version %s", version)
 		},
 	}
 	rootCmd.AddCommand(versionCmd)

 	rootCmd.SetArgs(args[1:])
-	if err := rootCmd.Execute(); err != nil {
+	if err := rootCmd.ExecuteContext(ctx); err != nil {
 		cmd.Logger.Printf("error: %s", err)
 		cmd.Logger.V(1).Infof("stacktrace: %+v", err)
 		return 1
--- a/pkg/adaptors/cmd/cmd_test.go
+++ b/pkg/adaptors/cmd/cmd_test.go
@@ -5,7 +5,7 @@ import (
 	"testing"

 	"github.com/golang/mock/gomock"
-	"github.com/int128/kubelogin/pkg/adaptors/logger/mock_logger"
+	"github.com/int128/kubelogin/pkg/testing/logger"
 	"github.com/int128/kubelogin/pkg/usecases/authentication"
 	"github.com/int128/kubelogin/pkg/usecases/credentialplugin"
 	"github.com/int128/kubelogin/pkg/usecases/credentialplugin/mock_credentialplugin"
@@ -146,9 +146,9 @@ func TestCmd_Run(t *testing.T) {
 				cmd := Cmd{
 					Root: &Root{
 						Standalone: mockStandalone,
-						Logger:     mock_logger.New(t),
+						Logger:     logger.New(t),
 					},
-					Logger: mock_logger.New(t),
+					Logger: logger.New(t),
 				}
 				exitCode := cmd.Run(ctx, c.args, version)
 				if exitCode != 0 {
@@ -163,9 +163,9 @@ func TestCmd_Run(t *testing.T) {
 			cmd := Cmd{
 				Root: &Root{
 					Standalone: mock_standalone.NewMockInterface(ctrl),
-					Logger:     mock_logger.New(t),
+					Logger:     logger.New(t),
 				},
-				Logger: mock_logger.New(t),
+				Logger: logger.New(t),
 			}
 			exitCode := cmd.Run(context.TODO(), []string{executable, "some"}, version)
 			if exitCode != 1 {
@@ -212,6 +212,8 @@ func TestCmd_Run(t *testing.T) {
 					"--listen-address", "127.0.0.1:10080",
 					"--listen-address", "127.0.0.1:20080",
 					"--skip-open-browser",
+					"--oidc-auth-request-extra-params", "ttl=86400",
+					"--oidc-auth-request-extra-params", "reauth=true",
 					"--username", "USER",
 					"--password", "PASS",
 				},
@@ -226,8 +228,9 @@ func TestCmd_Run(t *testing.T) {
 					SkipTLSVerify:  true,
 					GrantOptionSet: authentication.GrantOptionSet{
 						AuthCodeOption: &authentication.AuthCodeOption{
-							BindAddress:     []string{"127.0.0.1:10080", "127.0.0.1:20080"},
-							SkipOpenBrowser: true,
+							BindAddress:            []string{"127.0.0.1:10080", "127.0.0.1:20080"},
+							SkipOpenBrowser:        true,
+							AuthRequestExtraParams: map[string]string{"ttl": "86400", "reauth": "true"},
 						},
 					},
 				},
@@ -238,13 +241,16 @@ func TestCmd_Run(t *testing.T) {
 					"--oidc-issuer-url", "https://issuer.example.com",
 					"--oidc-client-id", "YOUR_CLIENT_ID",
 					"--grant-type", "authcode-keyboard",
+					"--oidc-auth-request-extra-params", "ttl=86400",
 				},
 				in: credentialplugin.Input{
 					TokenCacheDir: defaultTokenCacheDir,
 					IssuerURL:     "https://issuer.example.com",
 					ClientID:      "YOUR_CLIENT_ID",
 					GrantOptionSet: authentication.GrantOptionSet{
-						AuthCodeKeyboardOption: &authentication.AuthCodeKeyboardOption{},
+						AuthCodeKeyboardOption: &authentication.AuthCodeKeyboardOption{
+							AuthRequestExtraParams: map[string]string{"ttl": "86400"},
+						},
 					},
 				},
 			},
@@ -304,13 +310,13 @@ func TestCmd_Run(t *testing.T) {
 					Do(ctx, c.in)
 				cmd := Cmd{
 					Root: &Root{
-						Logger: mock_logger.New(t),
+						Logger: logger.New(t),
 					},
 					GetToken: &GetToken{
 						GetToken: getToken,
-						Logger:   mock_logger.New(t),
+						Logger:   logger.New(t),
 					},
-					Logger: mock_logger.New(t),
+					Logger: logger.New(t),
 				}
 				exitCode := cmd.Run(ctx, c.args, version)
 				if exitCode != 0 {
@@ -325,13 +331,13 @@ func TestCmd_Run(t *testing.T) {
 			ctx := context.TODO()
 			cmd := Cmd{
 				Root: &Root{
-					Logger: mock_logger.New(t),
+					Logger: logger.New(t),
 				},
 				GetToken: &GetToken{
 					GetToken: mock_credentialplugin.NewMockInterface(ctrl),
-					Logger:   mock_logger.New(t),
+					Logger:   logger.New(t),
 				},
-				Logger: mock_logger.New(t),
+				Logger: logger.New(t),
 			}
 			exitCode := cmd.Run(ctx, []string{executable, "get-token"}, version)
 			if exitCode != 1 {
@@ -345,13 +351,13 @@ func TestCmd_Run(t *testing.T) {
 			ctx := context.TODO()
 			cmd := Cmd{
 				Root: &Root{
-					Logger: mock_logger.New(t),
+					Logger: logger.New(t),
 				},
 				GetToken: &GetToken{
 					GetToken: mock_credentialplugin.NewMockInterface(ctrl),
-					Logger:   mock_logger.New(t),
+					Logger:   logger.New(t),
 				},
-				Logger: mock_logger.New(t),
+				Logger: logger.New(t),
 			}
 			exitCode := cmd.Run(ctx, []string{executable, "get-token", "foo"}, version)
 			if exitCode != 1 {
--- a/pkg/adaptors/cmd/get_token.go
+++ b/pkg/adaptors/cmd/get_token.go
@@ -1,8 +1,6 @@
 package cmd

 import (
-	"context"
-
 	"github.com/int128/kubelogin/pkg/adaptors/logger"
 	"github.com/int128/kubelogin/pkg/usecases/credentialplugin"
 	"github.com/spf13/cobra"
@@ -41,7 +39,7 @@ type GetToken struct {
 	Logger   logger.Interface
 }

-func (cmd *GetToken) New(ctx context.Context) *cobra.Command {
+func (cmd *GetToken) New() *cobra.Command {
 	var o getTokenOptions
 	c := &cobra.Command{
 		Use:   "get-token [flags]",
@@ -58,10 +56,10 @@ func (cmd *GetToken) New(ctx context.Context) *cobra.Command {
 			}
 			return nil
 		},
-		RunE: func(*cobra.Command, []string) error {
+		RunE: func(c *cobra.Command, _ []string) error {
 			grantOptionSet, err := o.authenticationOptions.grantOptionSet()
 			if err != nil {
-				return xerrors.Errorf("error: %w", err)
+				return xerrors.Errorf("get-token: %w", err)
 			}
 			in := credentialplugin.Input{
 				IssuerURL:      o.IssuerURL,
@@ -74,8 +72,8 @@ func (cmd *GetToken) New(ctx context.Context) *cobra.Command {
 				TokenCacheDir:  o.TokenCacheDir,
 				GrantOptionSet: grantOptionSet,
 			}
-			if err := cmd.GetToken.Do(ctx, in); err != nil {
-				return xerrors.Errorf("error: %w", err)
+			if err := cmd.GetToken.Do(c.Context(), in); err != nil {
+				return xerrors.Errorf("get-token: %w", err)
 			}
 			return nil
 		},
--- a/pkg/adaptors/cmd/root.go
+++ b/pkg/adaptors/cmd/root.go
@@ -1,7 +1,6 @@
 package cmd

 import (
-	"context"
 	"fmt"
 	"strings"

@@ -45,12 +44,13 @@ func (o *rootOptions) register(f *pflag.FlagSet) {
 }

 type authenticationOptions struct {
-	GrantType       string
-	ListenAddress   []string
-	ListenPort      []int // deprecated
-	SkipOpenBrowser bool
-	Username        string
-	Password        string
+	GrantType              string
+	ListenAddress          []string
+	ListenPort             []int // deprecated
+	SkipOpenBrowser        bool
+	AuthRequestExtraParams map[string]string
+	Username               string
+	Password               string
 }

 // determineListenAddress returns the addresses from the flags.
@@ -81,6 +81,7 @@ func (o *authenticationOptions) register(f *pflag.FlagSet) {
 	//TODO: remove the deprecated flag
 	f.IntSliceVar(&o.ListenPort, "listen-port", nil, "(Deprecated: use --listen-address)")
 	f.BoolVar(&o.SkipOpenBrowser, "skip-open-browser", false, "If true, it does not open the browser on authentication")
+	f.StringToStringVar(&o.AuthRequestExtraParams, "oidc-auth-request-extra-params", nil, "Extra query parameters to send with an authentication request")
 	f.StringVar(&o.Username, "username", "", "If set, perform the resource owner password credentials grant")
 	f.StringVar(&o.Password, "password", "", "If set, use the password instead of asking it")
 }
@@ -89,11 +90,14 @@ func (o *authenticationOptions) grantOptionSet() (s authentication.GrantOptionSe
 	switch {
 	case o.GrantType == "authcode" || (o.GrantType == "auto" && o.Username == ""):
 		s.AuthCodeOption = &authentication.AuthCodeOption{
-			BindAddress:     o.determineListenAddress(),
-			SkipOpenBrowser: o.SkipOpenBrowser,
+			BindAddress:            o.determineListenAddress(),
+			SkipOpenBrowser:        o.SkipOpenBrowser,
+			AuthRequestExtraParams: o.AuthRequestExtraParams,
 		}
 	case o.GrantType == "authcode-keyboard":
-		s.AuthCodeKeyboardOption = &authentication.AuthCodeKeyboardOption{}
+		s.AuthCodeKeyboardOption = &authentication.AuthCodeKeyboardOption{
+			AuthRequestExtraParams: o.AuthRequestExtraParams,
+		}
 	case o.GrantType == "password" || (o.GrantType == "auto" && o.Username != ""):
 		s.ROPCOption = &authentication.ROPCOption{
 			Username: o.Username,
@@ -110,14 +114,14 @@ type Root struct {
 	Logger     logger.Interface
 }

-func (cmd *Root) New(ctx context.Context, executable string) *cobra.Command {
+func (cmd *Root) New() *cobra.Command {
 	var o rootOptions
 	rootCmd := &cobra.Command{
-		Use:   executable,
+		Use:   "kubelogin",
 		Short: "Login to the OpenID Connect provider",
 		Long:  longDescription,
 		Args:  cobra.NoArgs,
-		RunE: func(*cobra.Command, []string) error {
+		RunE: func(c *cobra.Command, _ []string) error {
 			grantOptionSet, err := o.authenticationOptions.grantOptionSet()
 			if err != nil {
 				return xerrors.Errorf("invalid option: %w", err)
@@ -130,8 +134,8 @@ func (cmd *Root) New(ctx context.Context, executable string) *cobra.Command {
 				SkipTLSVerify:      o.SkipTLSVerify,
 				GrantOptionSet:     grantOptionSet,
 			}
-			if err := cmd.Standalone.Do(ctx, in); err != nil {
-				return xerrors.Errorf("error: %w", err)
+			if err := cmd.Standalone.Do(c.Context(), in); err != nil {
+				return xerrors.Errorf("login: %w", err)
 			}
 			return nil
 		},
--- a/pkg/adaptors/cmd/setup.go
+++ b/pkg/adaptors/cmd/setup.go
@@ -1,8 +1,6 @@
 package cmd

 import (
-	"context"
-
 	"github.com/int128/kubelogin/pkg/usecases/setup"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
@@ -37,7 +35,7 @@ type Setup struct {
 	Setup setup.Interface
 }

-func (cmd *Setup) New(ctx context.Context) *cobra.Command {
+func (cmd *Setup) New() *cobra.Command {
 	var o setupOptions
 	c := &cobra.Command{
 		Use:   "setup",
@@ -46,7 +44,7 @@ func (cmd *Setup) New(ctx context.Context) *cobra.Command {
 		RunE: func(c *cobra.Command, _ []string) error {
 			grantOptionSet, err := o.authenticationOptions.grantOptionSet()
 			if err != nil {
-				return xerrors.Errorf("error: %w", err)
+				return xerrors.Errorf("setup: %w", err)
 			}
 			in := setup.Stage2Input{
 				IssuerURL:      o.IssuerURL,
@@ -65,8 +63,8 @@ func (cmd *Setup) New(ctx context.Context) *cobra.Command {
 				cmd.Setup.DoStage1()
 				return nil
 			}
-			if err := cmd.Setup.DoStage2(ctx, in); err != nil {
-				return xerrors.Errorf("error: %w", err)
+			if err := cmd.Setup.DoStage2(c.Context(), in); err != nil {
+				return xerrors.Errorf("setup: %w", err)
 			}
 			return nil
 		},
--- a/pkg/adaptors/env/env.go
+++ b/pkg/adaptors/env/env.go
@@ -1,66 +0,0 @@
-// Package env provides environment dependent facilities.
-package env
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-	"strings"
-	"syscall"
-	"time"
-
-	"github.com/google/wire"
-	"golang.org/x/crypto/ssh/terminal"
-	"golang.org/x/xerrors"
-)
-
-//go:generate mockgen -destination mock_env/mock_env.go github.com/int128/kubelogin/pkg/adaptors/env Interface
-
-// Set provides an implementation and interface for Env.
-var Set = wire.NewSet(
-	wire.Struct(new(Env), "*"),
-	wire.Bind(new(Interface), new(*Env)),
-)
-
-type Interface interface {
-	ReadString(prompt string) (string, error)
-	ReadPassword(prompt string) (string, error)
-	Now() time.Time
-}
-
-// Env provides environment specific facilities.
-type Env struct{}
-
-// ReadString reads a string from the stdin.
-func (*Env) ReadString(prompt string) (string, error) {
-	if _, err := fmt.Fprint(os.Stderr, prompt); err != nil {
-		return "", xerrors.Errorf("could not write the prompt: %w", err)
-	}
-	r := bufio.NewReader(os.Stdin)
-	s, err := r.ReadString('\n')
-	if err != nil {
-		return "", xerrors.Errorf("could not read from stdin: %w", err)
-	}
-	s = strings.TrimRight(s, "\r\n")
-	return s, nil
-}
-
-// ReadPassword reads a password from the stdin without echo back.
-func (*Env) ReadPassword(prompt string) (string, error) {
-	if _, err := fmt.Fprint(os.Stderr, prompt); err != nil {
-		return "", xerrors.Errorf("could not write the prompt: %w", err)
-	}
-	b, err := terminal.ReadPassword(int(syscall.Stdin))
-	if err != nil {
-		return "", xerrors.Errorf("could not read from stdin: %w", err)
-	}
-	if _, err := fmt.Fprintln(os.Stderr); err != nil {
-		return "", xerrors.Errorf("could not write a new line: %w", err)
-	}
-	return string(b), nil
-}
-
-// Now returns the current time.
-func (*Env) Now() time.Time {
-	return time.Now()
-}
--- a/pkg/adaptors/jwtdecoder/decoder.go
+++ b/pkg/adaptors/jwtdecoder/decoder.go
@@ -1,68 +0,0 @@
-// Package jwtdecoder provides decoding a JWT.
-package jwtdecoder
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/dgrijalva/jwt-go"
-	"github.com/google/wire"
-	"github.com/int128/kubelogin/pkg/domain/oidc"
-	"golang.org/x/xerrors"
-)
-
-//go:generate mockgen -destination mock_jwtdecoder/mock_jwtdecoder.go github.com/int128/kubelogin/pkg/adaptors/jwtdecoder Interface
-
-// Set provides an implementation and interface.
-var Set = wire.NewSet(
-	wire.Struct(new(Decoder), "*"),
-	wire.Bind(new(Interface), new(*Decoder)),
-)
-
-type Interface interface {
-	Decode(s string) (*oidc.Claims, error)
-}
-
-type Decoder struct{}
-
-// Decode returns the claims of the JWT.
-// Note that this method does not verify the signature and always trust it.
-func (d *Decoder) Decode(s string) (*oidc.Claims, error) {
-	parts := strings.Split(s, ".")
-	if len(parts) != 3 {
-		return nil, xerrors.Errorf("token contains an invalid number of segments")
-	}
-	b, err := jwt.DecodeSegment(parts[1])
-	if err != nil {
-		return nil, xerrors.Errorf("could not decode the token: %w", err)
-	}
-	var claims jwt.StandardClaims
-	if err := json.NewDecoder(bytes.NewBuffer(b)).Decode(&claims); err != nil {
-		return nil, xerrors.Errorf("could not decode the json of token: %w", err)
-	}
-	var rawClaims map[string]interface{}
-	if err := json.NewDecoder(bytes.NewBuffer(b)).Decode(&rawClaims); err != nil {
-		return nil, xerrors.Errorf("could not decode the json of token: %w", err)
-	}
-	return &oidc.Claims{
-		Subject: claims.Subject,
-		Expiry:  time.Unix(claims.ExpiresAt, 0),
-		Pretty:  dumpRawClaims(rawClaims),
-	}, nil
-}
-
-func dumpRawClaims(rawClaims map[string]interface{}) map[string]string {
-	claims := make(map[string]string)
-	for k, v := range rawClaims {
-		switch v := v.(type) {
-		case float64:
-			claims[k] = fmt.Sprintf("%.f", v)
-		default:
-			claims[k] = fmt.Sprintf("%v", v)
-		}
-	}
-	return claims
-}
--- a/pkg/adaptors/jwtdecoder/decoder_test.go
+++ b/pkg/adaptors/jwtdecoder/decoder_test.go
@@ -1,87 +0,0 @@
-package jwtdecoder
-
-import (
-	"crypto/rsa"
-	"crypto/x509"
-	"encoding/pem"
-	"io/ioutil"
-	"testing"
-	"time"
-
-	"github.com/dgrijalva/jwt-go"
-)
-
-func TestDecoder_Decode(t *testing.T) {
-	var decoder Decoder
-
-	t.Run("ValidToken", func(t *testing.T) {
-		expiry := time.Now().Round(time.Second)
-		idToken := newIDToken(t, "https://issuer.example.com", expiry)
-		decodedToken, err := decoder.Decode(idToken)
-		if err != nil {
-			t.Fatalf("Decode error: %s", err)
-		}
-		if decodedToken.Expiry != expiry {
-			t.Errorf("Expiry wants %s but %s", expiry, decodedToken.Expiry)
-		}
-		t.Logf("Pretty=%+v", decodedToken.Pretty)
-	})
-	t.Run("InvalidToken", func(t *testing.T) {
-		decodedToken, err := decoder.Decode("HEADER.INVALID_TOKEN.SIGNATURE")
-		if err == nil {
-			t.Errorf("error wants non-nil but nil")
-		} else {
-			t.Logf("expected error: %+v", err)
-		}
-		if decodedToken != nil {
-			t.Errorf("decodedToken wants nil but %+v", decodedToken)
-		}
-	})
-}
-
-func newIDToken(t *testing.T, issuer string, expiry time.Time) string {
-	t.Helper()
-	claims := struct {
-		jwt.StandardClaims
-		Nonce         string   `json:"nonce"`
-		Groups        []string `json:"groups"`
-		EmailVerified bool     `json:"email_verified"`
-	}{
-		StandardClaims: jwt.StandardClaims{
-			Issuer:    issuer,
-			Audience:  "kubernetes",
-			Subject:   "SUBJECT",
-			IssuedAt:  time.Now().Unix(),
-			ExpiresAt: expiry.Unix(),
-		},
-		Nonce:         "NONCE",
-		Groups:        []string{"admin", "users"},
-		EmailVerified: false,
-	}
-	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
-	s, err := token.SignedString(readPrivateKey(t, "testdata/jws.key"))
-	if err != nil {
-		t.Fatalf("Could not sign the claims: %s", err)
-	}
-	return s
-}
-
-func readPrivateKey(t *testing.T, name string) *rsa.PrivateKey {
-	t.Helper()
-	b, err := ioutil.ReadFile(name)
-	if err != nil {
-		t.Fatalf("could not read the file: %s", err)
-	}
-	block, rest := pem.Decode(b)
-	if block == nil {
-		t.Fatalf("could not decode PEM")
-	}
-	if len(rest) > 0 {
-		t.Fatalf("PEM should contain single key but multiple keys")
-	}
-	k, err := x509.ParsePKCS1PrivateKey(block.Bytes)
-	if err != nil {
-		t.Fatalf("could not parse the key: %s", err)
-	}
-	return k
-}
--- a/pkg/adaptors/jwtdecoder/mock_jwtdecoder/mock_jwtdecoder.go
+++ b/pkg/adaptors/jwtdecoder/mock_jwtdecoder/mock_jwtdecoder.go
@@ -1,49 +0,0 @@
-// Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/int128/kubelogin/pkg/adaptors/jwtdecoder (interfaces: Interface)
-
-// Package mock_jwtdecoder is a generated GoMock package.
-package mock_jwtdecoder
-
-import (
-	gomock "github.com/golang/mock/gomock"
-	oidc "github.com/int128/kubelogin/pkg/domain/oidc"
-	reflect "reflect"
-)
-
-// MockInterface is a mock of Interface interface
-type MockInterface struct {
-	ctrl     *gomock.Controller
-	recorder *MockInterfaceMockRecorder
-}
-
-// MockInterfaceMockRecorder is the mock recorder for MockInterface
-type MockInterfaceMockRecorder struct {
-	mock *MockInterface
-}
-
-// NewMockInterface creates a new mock instance
-func NewMockInterface(ctrl *gomock.Controller) *MockInterface {
-	mock := &MockInterface{ctrl: ctrl}
-	mock.recorder = &MockInterfaceMockRecorder{mock}
-	return mock
-}
-
-// EXPECT returns an object that allows the caller to indicate expected use
-func (m *MockInterface) EXPECT() *MockInterfaceMockRecorder {
-	return m.recorder
-}
-
-// Decode mocks base method
-func (m *MockInterface) Decode(arg0 string) (*oidc.Claims, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Decode", arg0)
-	ret0, _ := ret[0].(*oidc.Claims)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// Decode indicates an expected call of Decode
-func (mr *MockInterfaceMockRecorder) Decode(arg0 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Decode", reflect.TypeOf((*MockInterface)(nil).Decode), arg0)
-}
--- a/pkg/adaptors/jwtdecoder/testdata/Makefile
+++ b/pkg/adaptors/jwtdecoder/testdata/Makefile
@@ -1,8 +0,0 @@
-all: jws.key
-
-jws.key:
-	openssl genrsa -out $@ 1024
-
-.PHONY: clean
-clean:
-	-rm -v jws.key
--- a/pkg/adaptors/jwtdecoder/testdata/jws.key
+++ b/pkg/adaptors/jwtdecoder/testdata/jws.key
@@ -1,15 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCrH34yA/f/sBOUlkYnRtd2jgDZ3WivhidqvoQaa73xqTazbkn6
-GZ9r7jx0CGLRV2bmErj2WoyT54yrhezrKh0YXAHlrwLdsmV4dwiV0lOfUJd9P/vF
-e2hiAWv4CcO9ZuNkTsrxM5W8Wdj2tjqOvsIn4We+HWPkpknT7VtT5RrumwIDAQAB
-AoGAFqy5oA7+kZbXQV0YNqQgcMkoO7Ym5Ps1xeMwxf94z8jIQsZebxFuGnMa95UU
-4wBd1ias85fUANUxwpigaBjQee5Hk+dnfUe1snUWYNm9H6tKrXEF8ajer3a2knEv
-GfK0CSEumFougfW2xG88ChGTS60wc+MIRfXERCvWpGm/5EECQQDdv5IBSi89g/R1
-5AGZKFCoqr6Zw5bWEKPzCCYJZzncR1ER9vP2AnMExM8Io/87WYvmpZIUrXJvQYm8
-hkfVOcBZAkEAxY4VcqmRWru3zmnbj21MwcwtgESaONkWsHeYs1C/Y/3zt7TuelYz
-ZJ9aUuUsaiJLEs9Y26nMt0L0snWGr2noEwJBANaDp1PWFyMUTt3pB17JcFXqb15C
-pt1I1cGapWk9Uez1lMijNNhNAEWhuoKqW5Nnif5DN7EHJYfZR8x3vm/YYWkCQHAA
-0iAkCwjKDLe2RIjYiwAE5ncmbdl1GuwJokVnrlrei+LHbb1mSdTuk6MT006JCs8r
-R1GivzHXgCv9fdLN1IkCQHxRvv9RPND80eEkdMv4qu0s22OLRhLQ/pb+YeT5Cjjv
-pJYWKrvXdRZcuNde9JiiTgK2UW1wM8KeD/EGvK2yF6M=
-----END RSA PRIVATE KEY-----
--- a/pkg/adaptors/kubeconfig/load.go
+++ b/pkg/adaptors/kubeconfig/load.go
@@ -11,7 +11,7 @@ import (
 func (*Kubeconfig) GetCurrentAuthProvider(explicitFilename string, contextName ContextName, userName UserName) (*AuthProvider, error) {
 	config, err := loadByDefaultRules(explicitFilename)
 	if err != nil {
-		return nil, xerrors.Errorf("could not load kubeconfig: %w", err)
+		return nil, xerrors.Errorf("could not load the kubeconfig: %w", err)
 	}
 	auth, err := findCurrentAuthProvider(config, contextName, userName)
 	if err != nil {
@@ -25,7 +25,7 @@ func loadByDefaultRules(explicitFilename string) (*api.Config, error) {
 	rules.ExplicitPath = explicitFilename
 	config, err := rules.Load()
 	if err != nil {
-		return nil, xerrors.Errorf("error while loading config: %w", err)
+		return nil, xerrors.Errorf("load error: %w", err)
 	}
 	return config, err
 }
--- a/pkg/adaptors/oidcclient/factory.go
+++ b/pkg/adaptors/oidcclient/factory.go
@@ -47,7 +47,7 @@ func New(ctx context.Context, config Config) (Interface, error) {
 	ctx = context.WithValue(ctx, oauth2.HTTPClient, httpClient)
 	provider, err := oidc.NewProvider(ctx, config.IssuerURL)
 	if err != nil {
-		return nil, xerrors.Errorf("could not discovery the issuer: %w", err)
+		return nil, xerrors.Errorf("oidc discovery error: %w", err)
 	}
 	return &client{
 		httpClient: httpClient,
--- a/pkg/adaptors/oidcclient/logging/transport_test.go
+++ b/pkg/adaptors/oidcclient/logging/transport_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"

 	"github.com/golang/mock/gomock"
-	"github.com/int128/kubelogin/pkg/adaptors/logger/mock_logger"
+	"github.com/int128/kubelogin/pkg/testing/logger"
 )

 type mockTransport struct {
@@ -37,7 +37,7 @@ dummy`)), req)

 	transport := &Transport{
 		Base:   &mockTransport{resp: resp},
-		Logger: mock_logger.New(t),
+		Logger: logger.New(t),
 	}
 	gotResp, err := transport.RoundTrip(req)
 	if err != nil {
--- a/pkg/adaptors/oidcclient/oidcclient.go
+++ b/pkg/adaptors/oidcclient/oidcclient.go
@@ -2,14 +2,13 @@ package oidcclient

 import (
 	"context"
-	"fmt"
 	"net/http"
 	"time"

 	"github.com/coreos/go-oidc"
 	"github.com/google/wire"
 	"github.com/int128/kubelogin/pkg/adaptors/logger"
-	oidcModel "github.com/int128/kubelogin/pkg/domain/oidc"
+	"github.com/int128/kubelogin/pkg/domain/jwt"
 	"github.com/int128/oauth2cli"
 	"golang.org/x/oauth2"
 	"golang.org/x/xerrors"
@@ -30,11 +29,12 @@ type Interface interface {
 }

 type AuthCodeURLInput struct {
-	State               string
-	Nonce               string
-	CodeChallenge       string
-	CodeChallengeMethod string
-	RedirectURI         string
+	State                  string
+	Nonce                  string
+	CodeChallenge          string
+	CodeChallengeMethod    string
+	RedirectURI            string
+	AuthRequestExtraParams map[string]string
 }

 type ExchangeAuthCodeInput struct {
@@ -45,11 +45,13 @@ type ExchangeAuthCodeInput struct {
 }

 type GetTokenByAuthCodeInput struct {
-	BindAddress         []string
-	Nonce               string
-	CodeChallenge       string
-	CodeChallengeMethod string
-	CodeVerifier        string
+	BindAddress            []string
+	State                  string
+	Nonce                  string
+	CodeChallenge          string
+	CodeChallengeMethod    string
+	CodeVerifier           string
+	AuthRequestExtraParams map[string]string
 }

 // TokenSet represents an output DTO of
@@ -57,7 +59,7 @@ type GetTokenByAuthCodeInput struct {
 type TokenSet struct {
 	IDToken       string
 	RefreshToken  string
-	IDTokenClaims oidcModel.Claims
+	IDTokenClaims jwt.Claims
 }

 type client struct {
@@ -79,6 +81,7 @@ func (c *client) GetTokenByAuthCode(ctx context.Context, in GetTokenByAuthCodeIn
 	ctx = c.wrapContext(ctx)
 	config := oauth2cli.Config{
 		OAuth2Config: c.oauth2Config,
+		State:        in.State,
 		AuthCodeOptions: []oauth2.AuthCodeOption{
 			oauth2.AccessTypeOffline,
 			oidc.Nonce(in.Nonce),
@@ -91,9 +94,13 @@ func (c *client) GetTokenByAuthCode(ctx context.Context, in GetTokenByAuthCodeIn
 		LocalServerBindAddress: in.BindAddress,
 		LocalServerReadyChan:   localServerReadyChan,
 	}
+	for key, value := range in.AuthRequestExtraParams {
+		config.AuthCodeOptions = append(config.AuthCodeOptions, oauth2.SetAuthURLParam(key, value))
+	}
+
 	token, err := oauth2cli.GetToken(ctx, config)
 	if err != nil {
-		return nil, xerrors.Errorf("could not get a token: %w", err)
+		return nil, xerrors.Errorf("oauth2 error: %w", err)
 	}
 	return c.verifyToken(ctx, token, in.Nonce)
 }
@@ -102,12 +109,16 @@ func (c *client) GetTokenByAuthCode(ctx context.Context, in GetTokenByAuthCodeIn
 func (c *client) GetAuthCodeURL(in AuthCodeURLInput) string {
 	cfg := c.oauth2Config
 	cfg.RedirectURL = in.RedirectURI
-	return cfg.AuthCodeURL(in.State,
+	opts := []oauth2.AuthCodeOption{
 		oauth2.AccessTypeOffline,
 		oidc.Nonce(in.Nonce),
 		oauth2.SetAuthURLParam("code_challenge", in.CodeChallenge),
 		oauth2.SetAuthURLParam("code_challenge_method", in.CodeChallengeMethod),
-	)
+	}
+	for key, value := range in.AuthRequestExtraParams {
+		opts = append(opts, oauth2.SetAuthURLParam(key, value))
+	}
+	return cfg.AuthCodeURL(in.State, opts...)
 }

 // ExchangeAuthCode exchanges the authorization code and token.
@@ -117,7 +128,7 @@ func (c *client) ExchangeAuthCode(ctx context.Context, in ExchangeAuthCodeInput)
 	cfg.RedirectURL = in.RedirectURI
 	token, err := cfg.Exchange(ctx, in.Code, oauth2.SetAuthURLParam("code_verifier", in.CodeVerifier))
 	if err != nil {
-		return nil, xerrors.Errorf("could not exchange the authorization code: %w", err)
+		return nil, xerrors.Errorf("exchange error: %w", err)
 	}
 	return c.verifyToken(ctx, token, in.Nonce)
 }
@@ -127,7 +138,7 @@ func (c *client) GetTokenByROPC(ctx context.Context, username, password string)
 	ctx = c.wrapContext(ctx)
 	token, err := c.oauth2Config.PasswordCredentialsToken(ctx, username, password)
 	if err != nil {
-		return nil, xerrors.Errorf("could not get a token: %w", err)
+		return nil, xerrors.Errorf("resource owner password credentials flow error: %w", err)
 	}
 	return c.verifyToken(ctx, token, "")
 }
@@ -150,49 +161,29 @@ func (c *client) Refresh(ctx context.Context, refreshToken string) (*TokenSet, e
 // verifyToken verifies the token with the certificates of the provider and the nonce.
 // If the nonce is an empty string, it does not verify the nonce.
 func (c *client) verifyToken(ctx context.Context, token *oauth2.Token, nonce string) (*TokenSet, error) {
-	idTokenString, ok := token.Extra("id_token").(string)
+	idToken, ok := token.Extra("id_token").(string)
 	if !ok {
 		return nil, xerrors.Errorf("id_token is missing in the token response: %s", token)
 	}
 	verifier := c.provider.Verifier(&oidc.Config{ClientID: c.oauth2Config.ClientID})
-	idToken, err := verifier.Verify(ctx, idTokenString)
+	verifiedIDToken, err := verifier.Verify(ctx, idToken)
 	if err != nil {
 		return nil, xerrors.Errorf("could not verify the ID token: %w", err)
 	}
-	if nonce != "" && nonce != idToken.Nonce {
-		return nil, xerrors.Errorf("nonce did not match (wants %s but was %s)", nonce, idToken.Nonce)
+	if nonce != "" && nonce != verifiedIDToken.Nonce {
+		return nil, xerrors.Errorf("nonce did not match (wants %s but got %s)", nonce, verifiedIDToken.Nonce)
 	}
-	claims, err := dumpClaims(idToken)
+	pretty, err := jwt.DecodePayloadAsPrettyJSON(idToken)
 	if err != nil {
-		c.logger.V(1).Infof("incomplete claims of the ID token: %w", err)
+		return nil, xerrors.Errorf("could not decode the token: %w", err)
 	}
 	return &TokenSet{
-		IDToken:       idTokenString,
-		IDTokenClaims: claims,
-		RefreshToken:  token.RefreshToken,
+		IDToken: idToken,
+		IDTokenClaims: jwt.Claims{
+			Subject: verifiedIDToken.Subject,
+			Expiry:  verifiedIDToken.Expiry,
+			Pretty:  pretty,
+		},
+		RefreshToken: token.RefreshToken,
 	}, nil
 }
-
-func dumpClaims(token *oidc.IDToken) (oidcModel.Claims, error) {
-	var rawClaims map[string]interface{}
-	err := token.Claims(&rawClaims)
-	pretty := dumpRawClaims(rawClaims)
-	return oidcModel.Claims{
-		Subject: token.Subject,
-		Expiry:  token.Expiry,
-		Pretty:  pretty,
-	}, err
-}
-
-func dumpRawClaims(rawClaims map[string]interface{}) map[string]string {
-	claims := make(map[string]string)
-	for k, v := range rawClaims {
-		switch v := v.(type) {
-		case float64:
-			claims[k] = fmt.Sprintf("%.f", v)
-		default:
-			claims[k] = fmt.Sprintf("%v", v)
-		}
-	}
-	return claims
-}
--- a/pkg/adaptors/reader/mock_reader/mock_reader.go
+++ b/pkg/adaptors/reader/mock_reader/mock_reader.go
@@ -1,13 +1,12 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/int128/kubelogin/pkg/adaptors/env (interfaces: Interface)
+// Source: github.com/int128/kubelogin/pkg/adaptors/reader (interfaces: Interface)

-// Package mock_env is a generated GoMock package.
-package mock_env
+// Package mock_reader is a generated GoMock package.
+package mock_reader

 import (
 	gomock "github.com/golang/mock/gomock"
 	reflect "reflect"
-	time "time"
 )

 // MockInterface is a mock of Interface interface
@@ -33,20 +32,6 @@ func (m *MockInterface) EXPECT() *MockInterfaceMockRecorder {
 	return m.recorder
 }

-// Now mocks base method
-func (m *MockInterface) Now() time.Time {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Now")
-	ret0, _ := ret[0].(time.Time)
-	return ret0
-}
-
-// Now indicates an expected call of Now
-func (mr *MockInterfaceMockRecorder) Now() *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Now", reflect.TypeOf((*MockInterface)(nil).Now))
-}
-
 // ReadPassword mocks base method
 func (m *MockInterface) ReadPassword(arg0 string) (string, error) {
 	m.ctrl.T.Helper()
--- a/pkg/adaptors/reader/reader.go
+++ b/pkg/adaptors/reader/reader.go
@@ -0,0 +1,58 @@
+// Package reader provides the reader of standard input.
+package reader
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"strings"
+	"syscall"
+
+	"github.com/google/wire"
+	"golang.org/x/crypto/ssh/terminal"
+	"golang.org/x/xerrors"
+)
+
+//go:generate mockgen -destination mock_reader/mock_reader.go github.com/int128/kubelogin/pkg/adaptors/reader Interface
+
+// Set provides an implementation and interface for Reader.
+var Set = wire.NewSet(
+	wire.Struct(new(Reader), "*"),
+	wire.Bind(new(Interface), new(*Reader)),
+)
+
+type Interface interface {
+	ReadString(prompt string) (string, error)
+	ReadPassword(prompt string) (string, error)
+}
+
+type Reader struct{}
+
+// ReadString reads a string from the stdin.
+func (*Reader) ReadString(prompt string) (string, error) {
+	if _, err := fmt.Fprint(os.Stderr, prompt); err != nil {
+		return "", xerrors.Errorf("write error: %w", err)
+	}
+	r := bufio.NewReader(os.Stdin)
+	s, err := r.ReadString('\n')
+	if err != nil {
+		return "", xerrors.Errorf("read error: %w", err)
+	}
+	s = strings.TrimRight(s, "\r\n")
+	return s, nil
+}
+
+// ReadPassword reads a password from the stdin without echo back.
+func (*Reader) ReadPassword(prompt string) (string, error) {
+	if _, err := fmt.Fprint(os.Stderr, prompt); err != nil {
+		return "", xerrors.Errorf("write error: %w", err)
+	}
+	b, err := terminal.ReadPassword(int(syscall.Stdin))
+	if err != nil {
+		return "", xerrors.Errorf("read error: %w", err)
+	}
+	if _, err := fmt.Fprintln(os.Stderr); err != nil {
+		return "", xerrors.Errorf("write error: %w", err)
+	}
+	return string(b), nil
+}
--- a/pkg/adaptors/tokencache/tokencache.go
+++ b/pkg/adaptors/tokencache/tokencache.go
@@ -60,7 +60,7 @@ func (r *Repository) FindByKey(dir string, key Key) (*Value, error) {
 	d := json.NewDecoder(f)
 	var c Value
 	if err := d.Decode(&c); err != nil {
-		return nil, xerrors.Errorf("could not decode json file %s: %w", p, err)
+		return nil, xerrors.Errorf("invalid json file %s: %w", p, err)
 	}
 	return &c, nil
 }
@@ -81,7 +81,7 @@ func (r *Repository) Save(dir string, key Key, value Value) error {
 	defer f.Close()
 	e := json.NewEncoder(f)
 	if err := e.Encode(&value); err != nil {
-		return xerrors.Errorf("could not encode json to file %s: %w", p, err)
+		return xerrors.Errorf("json encode error: %w", err)
 	}
 	return nil
 }
--- a/pkg/di/di.go
+++ b/pkg/di/di.go
@@ -7,13 +7,13 @@ import (
 	"github.com/google/wire"
 	"github.com/int128/kubelogin/pkg/adaptors/browser"
 	"github.com/int128/kubelogin/pkg/adaptors/certpool"
+	"github.com/int128/kubelogin/pkg/adaptors/clock"
 	"github.com/int128/kubelogin/pkg/adaptors/cmd"
 	"github.com/int128/kubelogin/pkg/adaptors/credentialpluginwriter"
-	"github.com/int128/kubelogin/pkg/adaptors/env"
-	"github.com/int128/kubelogin/pkg/adaptors/jwtdecoder"
 	"github.com/int128/kubelogin/pkg/adaptors/kubeconfig"
 	"github.com/int128/kubelogin/pkg/adaptors/logger"
 	"github.com/int128/kubelogin/pkg/adaptors/oidcclient"
+	"github.com/int128/kubelogin/pkg/adaptors/reader"
 	"github.com/int128/kubelogin/pkg/adaptors/tokencache"
 	"github.com/int128/kubelogin/pkg/usecases/authentication"
 	"github.com/int128/kubelogin/pkg/usecases/credentialplugin"
@@ -45,11 +45,11 @@ func NewCmdForHeadless(logger.Interface, browser.Interface, credentialpluginwrit

 		// adaptors
 		cmd.Set,
-		env.Set,
+		reader.Set,
+		clock.Set,
 		kubeconfig.Set,
 		tokencache.Set,
 		oidcclient.Set,
-		jwtdecoder.Set,
 		certpool.Set,
 	)
 	return nil
--- a/pkg/di/wire_gen.go
+++ b/pkg/di/wire_gen.go
@@ -8,13 +8,13 @@ package di
 import (
 	"github.com/int128/kubelogin/pkg/adaptors/browser"
 	"github.com/int128/kubelogin/pkg/adaptors/certpool"
+	"github.com/int128/kubelogin/pkg/adaptors/clock"
 	"github.com/int128/kubelogin/pkg/adaptors/cmd"
 	"github.com/int128/kubelogin/pkg/adaptors/credentialpluginwriter"
-	"github.com/int128/kubelogin/pkg/adaptors/env"
-	"github.com/int128/kubelogin/pkg/adaptors/jwtdecoder"
 	"github.com/int128/kubelogin/pkg/adaptors/kubeconfig"
 	"github.com/int128/kubelogin/pkg/adaptors/logger"
 	"github.com/int128/kubelogin/pkg/adaptors/oidcclient"
+	"github.com/int128/kubelogin/pkg/adaptors/reader"
 	"github.com/int128/kubelogin/pkg/adaptors/tokencache"
 	"github.com/int128/kubelogin/pkg/usecases/authentication"
 	"github.com/int128/kubelogin/pkg/usecases/credentialplugin"
@@ -34,26 +34,24 @@ func NewCmd() cmd.Interface {

 func NewCmdForHeadless(loggerInterface logger.Interface, browserInterface browser.Interface, credentialpluginwriterInterface credentialpluginwriter.Interface) cmd.Interface {
 	newFunc := _wireNewFuncValue
-	decoder := &jwtdecoder.Decoder{}
-	envEnv := &env.Env{}
+	clockClock := &clock.Clock{}
 	authCode := &authentication.AuthCode{
-		Env:     envEnv,
 		Browser: browserInterface,
 		Logger:  loggerInterface,
 	}
+	readerReader := &reader.Reader{}
 	authCodeKeyboard := &authentication.AuthCodeKeyboard{
-		Env:    envEnv,
+		Reader: readerReader,
 		Logger: loggerInterface,
 	}
 	ropc := &authentication.ROPC{
-		Env:    envEnv,
+		Reader: readerReader,
 		Logger: loggerInterface,
 	}
 	authenticationAuthentication := &authentication.Authentication{
 		NewOIDCClient:    newFunc,
-		JWTDecoder:       decoder,
 		Logger:           loggerInterface,
-		Env:              envEnv,
+		Clock:            clockClock,
 		AuthCode:         authCode,
 		AuthCodeKeyboard: authCodeKeyboard,
 		ROPC:             ropc,
--- a/pkg/domain/jwt/decode.go
+++ b/pkg/domain/jwt/decode.go
@@ -0,0 +1,72 @@
+// Package jwt provides JWT manipulations.
+// See https://tools.ietf.org/html/rfc7519#section-4.1.3
+package jwt
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"strings"
+	"time"
+
+	"golang.org/x/xerrors"
+)
+
+// DecodeWithoutVerify decodes the JWT string and returns the claims.
+// Note that this method does not verify the signature and always trust it.
+func DecodeWithoutVerify(s string) (*Claims, error) {
+	payload, err := DecodePayloadAsRawJSON(s)
+	if err != nil {
+		return nil, xerrors.Errorf("could not decode the payload: %w", err)
+	}
+	var claims struct {
+		Subject   string `json:"sub,omitempty"`
+		ExpiresAt int64  `json:"exp,omitempty"`
+	}
+	if err := json.NewDecoder(bytes.NewReader(payload)).Decode(&claims); err != nil {
+		return nil, xerrors.Errorf("could not decode the json of token: %w", err)
+	}
+	var prettyJson bytes.Buffer
+	if err := json.Indent(&prettyJson, payload, "", "  "); err != nil {
+		return nil, xerrors.Errorf("could not indent the json of token: %w", err)
+	}
+	return &Claims{
+		Subject: claims.Subject,
+		Expiry:  time.Unix(claims.ExpiresAt, 0),
+		Pretty:  prettyJson.String(),
+	}, nil
+}
+
+// DecodePayloadAsPrettyJSON decodes the JWT string and returns the pretty JSON string.
+func DecodePayloadAsPrettyJSON(s string) (string, error) {
+	payload, err := DecodePayloadAsRawJSON(s)
+	if err != nil {
+		return "", xerrors.Errorf("could not decode the payload: %w", err)
+	}
+	var prettyJson bytes.Buffer
+	if err := json.Indent(&prettyJson, payload, "", "  "); err != nil {
+		return "", xerrors.Errorf("could not indent the json of token: %w", err)
+	}
+	return prettyJson.String(), nil
+}
+
+// DecodePayloadAsRawJSON extracts the payload and returns the raw JSON.
+func DecodePayloadAsRawJSON(s string) ([]byte, error) {
+	parts := strings.SplitN(s, ".", 3)
+	if len(parts) != 3 {
+		return nil, xerrors.Errorf("wants %d segments but got %d segments", 3, len(parts))
+	}
+	payloadJSON, err := decodePayload(parts[1])
+	if err != nil {
+		return nil, xerrors.Errorf("could not decode the payload: %w", err)
+	}
+	return payloadJSON, nil
+}
+
+func decodePayload(payload string) ([]byte, error) {
+	b, err := base64.URLEncoding.WithPadding(base64.NoPadding).DecodeString(payload)
+	if err != nil {
+		return nil, xerrors.Errorf("invalid base64: %w", err)
+	}
+	return b, nil
+}
--- a/pkg/domain/jwt/decode_test.go
+++ b/pkg/domain/jwt/decode_test.go
@@ -0,0 +1,48 @@
+package jwt
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestDecode(t *testing.T) {
+	t.Run("ValidToken", func(t *testing.T) {
+		const (
+			// https://tools.ietf.org/html/rfc7519#section-3.1
+			header    = "eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9"
+			payload   = "eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ"
+			signature = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
+			token     = header + "." + payload + "." + signature
+		)
+		got, err := DecodeWithoutVerify(token)
+		if err != nil {
+			t.Fatalf("Decode error: %s", err)
+		}
+		want := &Claims{
+			Subject: "",
+			Expiry:  time.Unix(1300819380, 0),
+			Pretty: `{
+  "iss": "joe",
+  "exp": 1300819380,
+  "http://example.com/is_root": true
+}`,
+		}
+		if diff := cmp.Diff(want, got); diff != "" {
+			t.Errorf("mismatch (-want +got):\n%s", diff)
+		}
+	})
+
+	t.Run("InvalidToken", func(t *testing.T) {
+		decodedToken, err := DecodeWithoutVerify("HEADER.INVALID_TOKEN.SIGNATURE")
+		if err == nil {
+			t.Errorf("error wants non-nil but nil")
+		} else {
+			t.Logf("expected error: %+v", err)
+		}
+		if decodedToken != nil {
+			t.Errorf("decodedToken wants nil but %+v", decodedToken)
+		}
+	})
+}
--- a/pkg/domain/jwt/token.go
+++ b/pkg/domain/jwt/token.go
@@ -0,0 +1,20 @@
+package jwt
+
+import "time"
+
+// Claims represents claims of an ID token.
+type Claims struct {
+	Subject string
+	Expiry  time.Time
+	Pretty  string // string representation for debug and logging
+}
+
+// Clock provides the current time.
+type Clock interface {
+	Now() time.Time
+}
+
+// IsExpired returns true if the token is expired.
+func (c *Claims) IsExpired(clock Clock) bool {
+	return c.Expiry.Before(clock.Now())
+}
--- a/pkg/domain/oidc/token_test.go
+++ b/pkg/domain/oidc/token_test.go
@@ -1,10 +1,10 @@
-package oidc_test
+package jwt_test

 import (
 	"testing"
 	"time"

-	"github.com/int128/kubelogin/pkg/domain/oidc"
+	"github.com/int128/kubelogin/pkg/domain/jwt"
 )

 type timeProvider time.Time
@@ -14,7 +14,7 @@ func (tp timeProvider) Now() time.Time {
 }

 func TestClaims_IsExpired(t *testing.T) {
-	claims := oidc.Claims{
+	claims := jwt.Claims{
 		Expiry: time.Date(2019, 1, 2, 3, 4, 5, 0, time.UTC),
 	}

--- a/pkg/domain/oidc/oidc.go
+++ b/pkg/domain/oidc/oidc.go
@@ -5,7 +5,6 @@ import (
 	"crypto/sha256"
 	"encoding/base64"
 	"encoding/binary"
-	"strings"

 	"golang.org/x/xerrors"
 )
@@ -44,7 +43,7 @@ func NewPKCEParams() (*PKCEParams, error) {
 func random32() ([]byte, error) {
 	b := make([]byte, 32)
 	if err := binary.Read(rand.Reader, binary.LittleEndian, b); err != nil {
-		return nil, xerrors.Errorf("could not read: %w", err)
+		return nil, xerrors.Errorf("read error: %w", err)
 	}
 	return b, nil
 }
@@ -61,5 +60,5 @@ func computeS256(b []byte) PKCEParams {
 }

 func base64URLEncode(b []byte) string {
-	return strings.TrimRight(base64.URLEncoding.EncodeToString(b), "=")
+	return base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(b)
 }
--- a/pkg/domain/oidc/token.go
+++ b/pkg/domain/oidc/token.go
@@ -1,20 +0,0 @@
-package oidc
-
-import "time"
-
-// Claims represents claims of an ID token.
-type Claims struct {
-	Subject string
-	Expiry  time.Time
-	Pretty  map[string]string // string representation for debug and logging
-}
-
-// TimeProvider provides the current time.
-type TimeProvider interface {
-	Now() time.Time
-}
-
-// IsExpired returns true if the token is expired.
-func (c *Claims) IsExpired(timeProvider TimeProvider) bool {
-	return c.Expiry.Before(timeProvider.Now())
-}
--- a/pkg/testing/clock/clock.go
+++ b/pkg/testing/clock/clock.go
@@ -0,0 +1,9 @@
+package clock
+
+import "time"
+
+type Fake time.Time
+
+func (f Fake) Now() time.Time {
+	return time.Time(f)
+}
--- a/pkg/testing/jwt/encode.go
+++ b/pkg/testing/jwt/encode.go
@@ -0,0 +1,43 @@
+package jwt
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"testing"
+
+	"github.com/dgrijalva/jwt-go"
+)
+
+var PrivateKey = generateKey(1024)
+
+func generateKey(b int) *rsa.PrivateKey {
+	k, err := rsa.GenerateKey(rand.Reader, b)
+	if err != nil {
+		panic(err)
+	}
+	return k
+}
+
+type Claims struct {
+	jwt.StandardClaims
+	// aud claim is either a string or an array of strings.
+	// https://tools.ietf.org/html/rfc7519#section-4.1.3
+	Audience      []string `json:"aud,omitempty"`
+	Nonce         string   `json:"nonce,omitempty"`
+	Groups        []string `json:"groups,omitempty"`
+	EmailVerified bool     `json:"email_verified,omitempty"`
+}
+
+func Encode(t *testing.T, claims Claims) string {
+	s, err := jwt.NewWithClaims(jwt.SigningMethodRS256, claims).SignedString(PrivateKey)
+	if err != nil {
+		t.Fatalf("could not encode JWT: %s", err)
+	}
+	return s
+}
+
+func EncodeF(t *testing.T, mutation func(*Claims)) string {
+	var claims Claims
+	mutation(&claims)
+	return Encode(t, claims)
+}
--- a/pkg/adaptors/logger/mock_logger/logger.go
+++ b/pkg/adaptors/logger/mock_logger/logger.go
@@ -1,4 +1,4 @@
-package mock_logger
+package logger

 import (
 	"fmt"
@@ -8,7 +8,7 @@ import (
 )

 func New(t testingLogger) *Logger {
-	return &Logger{t}
+	return &Logger{t: t}
 }

 type testingLogger interface {
@@ -17,30 +17,38 @@ type testingLogger interface {

 // Logger provides logging facility using testing.T.
 type Logger struct {
-	t testingLogger
+	t        testingLogger
+	maxLevel int
 }

-func (*Logger) AddFlags(f *pflag.FlagSet) {
-	f.IntP("v", "v", 0, "dummy flag used in the tests")
+func (l *Logger) AddFlags(f *pflag.FlagSet) {
+	f.IntVarP(&l.maxLevel, "v", "v", 0, "dummy flag used in the tests")
 }

 func (l *Logger) Printf(format string, args ...interface{}) {
 	l.t.Logf(format, args...)
 }

-type Verbose struct {
+func (l *Logger) V(level int) logger.Verbose {
+	if l.IsEnabled(level) {
+		return &verbose{l.t, level}
+	}
+	return &noopVerbose{}
+}
+
+func (l *Logger) IsEnabled(level int) bool {
+	return level <= l.maxLevel
+}
+
+type verbose struct {
 	t     testingLogger
 	level int
 }

-func (v *Verbose) Infof(format string, args ...interface{}) {
+func (v *verbose) Infof(format string, args ...interface{}) {
 	v.t.Logf(fmt.Sprintf("I%d] ", v.level)+format, args...)
 }

-func (l *Logger) V(level int) logger.Verbose {
-	return &Verbose{l.t, level}
-}
+type noopVerbose struct{}

-func (*Logger) IsEnabled(level int) bool {
-	return true
-}
+func (*noopVerbose) Infof(string, ...interface{}) {}
--- a/pkg/usecases/authentication/authcode.go
+++ b/pkg/usecases/authentication/authcode.go
@@ -4,7 +4,6 @@ import (
 	"context"

 	"github.com/int128/kubelogin/pkg/adaptors/browser"
-	"github.com/int128/kubelogin/pkg/adaptors/env"
 	"github.com/int128/kubelogin/pkg/adaptors/logger"
 	"github.com/int128/kubelogin/pkg/adaptors/oidcclient"
 	"github.com/int128/kubelogin/pkg/domain/oidc"
@@ -14,13 +13,16 @@ import (

 // AuthCode provides the authentication code flow.
 type AuthCode struct {
-	Env     env.Interface
 	Browser browser.Interface
 	Logger  logger.Interface
 }

 func (u *AuthCode) Do(ctx context.Context, o *AuthCodeOption, client oidcclient.Interface) (*Output, error) {
 	u.Logger.V(1).Infof("performing the authentication code flow")
+	state, err := oidc.NewState()
+	if err != nil {
+		return nil, xerrors.Errorf("could not generate a state: %w", err)
+	}
 	nonce, err := oidc.NewNonce()
 	if err != nil {
 		return nil, xerrors.Errorf("could not generate a nonce: %w", err)
@@ -30,11 +32,13 @@ func (u *AuthCode) Do(ctx context.Context, o *AuthCodeOption, client oidcclient.
 		return nil, xerrors.Errorf("could not generate PKCE parameters: %w", err)
 	}
 	in := oidcclient.GetTokenByAuthCodeInput{
-		BindAddress:         o.BindAddress,
-		Nonce:               nonce,
-		CodeChallenge:       p.CodeChallenge,
-		CodeChallengeMethod: p.CodeChallengeMethod,
-		CodeVerifier:        p.CodeVerifier,
+		BindAddress:            o.BindAddress,
+		State:                  state,
+		Nonce:                  nonce,
+		CodeChallenge:          p.CodeChallenge,
+		CodeChallengeMethod:    p.CodeChallengeMethod,
+		CodeVerifier:           p.CodeVerifier,
+		AuthRequestExtraParams: o.AuthRequestExtraParams,
 	}
 	readyChan := make(chan string, 1)
 	defer close(readyChan)
@@ -64,7 +68,7 @@ Please visit the following URL in your browser manually: %s`, err, url)
 	eg.Go(func() error {
 		tokenSet, err := client.GetTokenByAuthCode(ctx, in, readyChan)
 		if err != nil {
-			return xerrors.Errorf("error while the authorization code flow: %w", err)
+			return xerrors.Errorf("authorization code flow error: %w", err)
 		}
 		out = Output{
 			IDToken:       tokenSet.IDToken,
@@ -74,7 +78,7 @@ Please visit the following URL in your browser manually: %s`, err, url)
 		return nil
 	})
 	if err := eg.Wait(); err != nil {
-		return nil, xerrors.Errorf("error while the authorization code flow: %w", err)
+		return nil, xerrors.Errorf("authentication error: %w", err)
 	}
 	return &out, nil
 }
--- a/pkg/usecases/authentication/authcode_keyboard.go
+++ b/pkg/usecases/authentication/authcode_keyboard.go
@@ -3,9 +3,9 @@ package authentication
 import (
 	"context"

-	"github.com/int128/kubelogin/pkg/adaptors/env"
 	"github.com/int128/kubelogin/pkg/adaptors/logger"
 	"github.com/int128/kubelogin/pkg/adaptors/oidcclient"
+	"github.com/int128/kubelogin/pkg/adaptors/reader"
 	"github.com/int128/kubelogin/pkg/domain/oidc"
 	"golang.org/x/xerrors"
 )
@@ -15,7 +15,7 @@ const oobRedirectURI = "urn:ietf:wg:oauth:2.0:oob"

 // AuthCodeKeyboard provides the authorization code flow with keyboard interactive.
 type AuthCodeKeyboard struct {
-	Env    env.Interface
+	Reader reader.Interface
 	Logger logger.Interface
 }

@@ -34,16 +34,17 @@ func (u *AuthCodeKeyboard) Do(ctx context.Context, o *AuthCodeKeyboardOption, cl
 		return nil, xerrors.Errorf("could not generate PKCE parameters: %w", err)
 	}
 	authCodeURL := client.GetAuthCodeURL(oidcclient.AuthCodeURLInput{
-		State:               state,
-		Nonce:               nonce,
-		CodeChallenge:       p.CodeChallenge,
-		CodeChallengeMethod: p.CodeChallengeMethod,
-		RedirectURI:         oobRedirectURI,
+		State:                  state,
+		Nonce:                  nonce,
+		CodeChallenge:          p.CodeChallenge,
+		CodeChallengeMethod:    p.CodeChallengeMethod,
+		RedirectURI:            oobRedirectURI,
+		AuthRequestExtraParams: o.AuthRequestExtraParams,
 	})
 	u.Logger.Printf("Open %s", authCodeURL)
-	code, err := u.Env.ReadString(authCodeKeyboardPrompt)
+	code, err := u.Reader.ReadString(authCodeKeyboardPrompt)
 	if err != nil {
-		return nil, xerrors.Errorf("could not read the authorization code: %w", err)
+		return nil, xerrors.Errorf("could not read an authorization code: %w", err)
 	}

 	tokenSet, err := client.ExchangeAuthCode(ctx, oidcclient.ExchangeAuthCodeInput{
@@ -53,7 +54,7 @@ func (u *AuthCodeKeyboard) Do(ctx context.Context, o *AuthCodeKeyboardOption, cl
 		RedirectURI:  oobRedirectURI,
 	})
 	if err != nil {
-		return nil, xerrors.Errorf("could not get the token: %w", err)
+		return nil, xerrors.Errorf("could not exchange the authorization code: %w", err)
 	}
 	return &Output{
 		IDToken:       tokenSet.IDToken,
--- a/pkg/usecases/authentication/authcode_keyboard_test.go
+++ b/pkg/usecases/authentication/authcode_keyboard_test.go
@@ -7,20 +7,20 @@ import (

 	"github.com/golang/mock/gomock"
 	"github.com/google/go-cmp/cmp"
-	"github.com/int128/kubelogin/pkg/adaptors/env/mock_env"
-	"github.com/int128/kubelogin/pkg/adaptors/logger/mock_logger"
 	"github.com/int128/kubelogin/pkg/adaptors/oidcclient"
 	"github.com/int128/kubelogin/pkg/adaptors/oidcclient/mock_oidcclient"
-	"github.com/int128/kubelogin/pkg/domain/oidc"
+	"github.com/int128/kubelogin/pkg/adaptors/reader/mock_reader"
+	"github.com/int128/kubelogin/pkg/domain/jwt"
+	"github.com/int128/kubelogin/pkg/testing/logger"
 )

 var nonNil = gomock.Not(gomock.Nil())

 func TestAuthCodeKeyboard_Do(t *testing.T) {
-	dummyTokenClaims := oidc.Claims{
+	dummyTokenClaims := jwt.Claims{
 		Subject: "YOUR_SUBJECT",
 		Expiry:  time.Date(2019, 1, 2, 3, 4, 5, 0, time.UTC),
-		Pretty:  map[string]string{"sub": "YOUR_SUBJECT"},
+		Pretty:  "PRETTY_JSON",
 	}
 	timeout := 5 * time.Second

@@ -29,9 +29,17 @@ func TestAuthCodeKeyboard_Do(t *testing.T) {
 		defer ctrl.Finish()
 		ctx, cancel := context.WithTimeout(context.TODO(), timeout)
 		defer cancel()
+		o := &AuthCodeKeyboardOption{
+			AuthRequestExtraParams: map[string]string{"ttl": "86400", "reauth": "true"},
+		}
 		mockOIDCClient := mock_oidcclient.NewMockInterface(ctrl)
 		mockOIDCClient.EXPECT().
 			GetAuthCodeURL(nonNil).
+			Do(func(in oidcclient.AuthCodeURLInput) {
+				if diff := cmp.Diff(o.AuthRequestExtraParams, in.AuthRequestExtraParams); diff != "" {
+					t.Errorf("AuthRequestExtraParams mismatch (-want +got):\n%s", diff)
+				}
+			}).
 			Return("https://issuer.example.com/auth")
 		mockOIDCClient.EXPECT().
 			ExchangeAuthCode(nonNil, nonNil).
@@ -45,15 +53,15 @@ func TestAuthCodeKeyboard_Do(t *testing.T) {
 				IDTokenClaims: dummyTokenClaims,
 				RefreshToken:  "YOUR_REFRESH_TOKEN",
 			}, nil)
-		mockEnv := mock_env.NewMockInterface(ctrl)
-		mockEnv.EXPECT().
+		mockReader := mock_reader.NewMockInterface(ctrl)
+		mockReader.EXPECT().
 			ReadString(authCodeKeyboardPrompt).
 			Return("YOUR_AUTH_CODE", nil)
 		u := AuthCodeKeyboard{
-			Env:    mockEnv,
-			Logger: mock_logger.New(t),
+			Reader: mockReader,
+			Logger: logger.New(t),
 		}
-		got, err := u.Do(ctx, nil, mockOIDCClient)
+		got, err := u.Do(ctx, o, mockOIDCClient)
 		if err != nil {
 			t.Errorf("Do returned error: %+v", err)
 		}
--- a/pkg/usecases/authentication/authcode_test.go
+++ b/pkg/usecases/authentication/authcode_test.go
@@ -8,17 +8,17 @@ import (
 	"github.com/golang/mock/gomock"
 	"github.com/google/go-cmp/cmp"
 	"github.com/int128/kubelogin/pkg/adaptors/browser/mock_browser"
-	"github.com/int128/kubelogin/pkg/adaptors/logger/mock_logger"
 	"github.com/int128/kubelogin/pkg/adaptors/oidcclient"
 	"github.com/int128/kubelogin/pkg/adaptors/oidcclient/mock_oidcclient"
-	"github.com/int128/kubelogin/pkg/domain/oidc"
+	"github.com/int128/kubelogin/pkg/domain/jwt"
+	"github.com/int128/kubelogin/pkg/testing/logger"
 )

 func TestAuthCode_Do(t *testing.T) {
-	dummyTokenClaims := oidc.Claims{
+	dummyTokenClaims := jwt.Claims{
 		Subject: "YOUR_SUBJECT",
 		Expiry:  time.Date(2019, 1, 2, 3, 4, 5, 0, time.UTC),
-		Pretty:  map[string]string{"sub": "YOUR_SUBJECT"},
+		Pretty:  "PRETTY_JSON",
 	}
 	timeout := 5 * time.Second

@@ -28,13 +28,20 @@ func TestAuthCode_Do(t *testing.T) {
 		ctx, cancel := context.WithTimeout(context.TODO(), timeout)
 		defer cancel()
 		o := &AuthCodeOption{
-			BindAddress:     []string{"127.0.0.1:8000"},
-			SkipOpenBrowser: true,
+			BindAddress:            []string{"127.0.0.1:8000"},
+			SkipOpenBrowser:        true,
+			AuthRequestExtraParams: map[string]string{"ttl": "86400", "reauth": "true"},
 		}
 		mockOIDCClient := mock_oidcclient.NewMockInterface(ctrl)
 		mockOIDCClient.EXPECT().
 			GetTokenByAuthCode(gomock.Any(), gomock.Any(), gomock.Any()).
-			Do(func(_ context.Context, _ oidcclient.GetTokenByAuthCodeInput, readyChan chan<- string) {
+			Do(func(_ context.Context, in oidcclient.GetTokenByAuthCodeInput, readyChan chan<- string) {
+				if diff := cmp.Diff(o.BindAddress, in.BindAddress); diff != "" {
+					t.Errorf("BindAddress mismatch (-want +got):\n%s", diff)
+				}
+				if diff := cmp.Diff(o.AuthRequestExtraParams, in.AuthRequestExtraParams); diff != "" {
+					t.Errorf("AuthRequestExtraParams mismatch (-want +got):\n%s", diff)
+				}
 				readyChan <- "LOCAL_SERVER_URL"
 			}).
 			Return(&oidcclient.TokenSet{
@@ -43,7 +50,7 @@ func TestAuthCode_Do(t *testing.T) {
 				IDTokenClaims: dummyTokenClaims,
 			}, nil)
 		u := AuthCode{
-			Logger: mock_logger.New(t),
+			Logger: logger.New(t),
 		}
 		got, err := u.Do(ctx, o, mockOIDCClient)
 		if err != nil {
@@ -82,7 +89,7 @@ func TestAuthCode_Do(t *testing.T) {
 		mockBrowser.EXPECT().
 			Open("LOCAL_SERVER_URL")
 		u := AuthCode{
-			Logger:  mock_logger.New(t),
+			Logger:  logger.New(t),
 			Browser: mockBrowser,
 		}
 		got, err := u.Do(ctx, o, mockOIDCClient)
--- a/pkg/usecases/authentication/authentication.go
+++ b/pkg/usecases/authentication/authentication.go
@@ -5,11 +5,10 @@ import (

 	"github.com/google/wire"
 	"github.com/int128/kubelogin/pkg/adaptors/certpool"
-	"github.com/int128/kubelogin/pkg/adaptors/env"
-	"github.com/int128/kubelogin/pkg/adaptors/jwtdecoder"
+	"github.com/int128/kubelogin/pkg/adaptors/clock"
 	"github.com/int128/kubelogin/pkg/adaptors/logger"
 	"github.com/int128/kubelogin/pkg/adaptors/oidcclient"
-	"github.com/int128/kubelogin/pkg/domain/oidc"
+	"github.com/int128/kubelogin/pkg/domain/jwt"
 	"golang.org/x/xerrors"
 )

@@ -36,8 +35,8 @@ type Input struct {
 	ExtraScopes    []string // optional
 	CertPool       certpool.Interface
 	SkipTLSVerify  bool
-	IDToken        string // optional
-	RefreshToken   string // optional
+	IDToken        string // optional, from the token cache
+	RefreshToken   string // optional, from the token cache
 	GrantOptionSet GrantOptionSet
 }

@@ -48,22 +47,25 @@ type GrantOptionSet struct {
 }

 type AuthCodeOption struct {
-	SkipOpenBrowser bool
-	BindAddress     []string
+	SkipOpenBrowser        bool
+	BindAddress            []string
+	AuthRequestExtraParams map[string]string
 }

-type AuthCodeKeyboardOption struct{}
+type AuthCodeKeyboardOption struct {
+	AuthRequestExtraParams map[string]string
+}

 type ROPCOption struct {
 	Username string
-	Password string // If empty, read a password using Env.ReadPassword()
+	Password string // If empty, read a password using Reader.ReadPassword()
 }

 // Output represents an output DTO of the Authentication use-case.
 type Output struct {
 	AlreadyHasValidIDToken bool
 	IDToken                string
-	IDTokenClaims          oidc.Claims
+	IDTokenClaims          jwt.Claims
 	RefreshToken           string
 }

@@ -85,9 +87,8 @@ const passwordPrompt = "Password: "
 //
 type Authentication struct {
 	NewOIDCClient    oidcclient.NewFunc
-	JWTDecoder       jwtdecoder.Interface
 	Logger           logger.Interface
-	Env              env.Interface
+	Clock            clock.Interface
 	AuthCode         *AuthCode
 	AuthCodeKeyboard *AuthCodeKeyboard
 	ROPC             *ROPC
@@ -99,11 +100,11 @@ func (u *Authentication) Do(ctx context.Context, in Input) (*Output, error) {
 		// Skip verification of the token to reduce time of a discovery request.
 		// Here it trusts the signature and claims and checks only expiration,
 		// because the token has been verified before caching.
-		claims, err := u.JWTDecoder.Decode(in.IDToken)
+		claims, err := jwt.DecodeWithoutVerify(in.IDToken)
 		if err != nil {
-			return nil, xerrors.Errorf("invalid token and you need to remove the cache: %w", err)
+			return nil, xerrors.Errorf("invalid token cache (you may need to remove): %w", err)
 		}
-		if !claims.IsExpired(u.Env) {
+		if !claims.IsExpired(u.Clock) {
 			u.Logger.V(1).Infof("you already have a valid token until %s", claims.Expiry)
 			return &Output{
 				AlreadyHasValidIDToken: true,
@@ -126,7 +127,7 @@ func (u *Authentication) Do(ctx context.Context, in Input) (*Output, error) {
 		Logger:        u.Logger,
 	})
 	if err != nil {
-		return nil, xerrors.Errorf("could not initialize the OpenID Connect client: %w", err)
+		return nil, xerrors.Errorf("oidc error: %w", err)
 	}

 	if in.RefreshToken != "" {
--- a/pkg/usecases/authentication/authentication_test.go
+++ b/pkg/usecases/authentication/authentication_test.go
@@ -8,28 +8,31 @@ import (
 	"github.com/golang/mock/gomock"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
-	"github.com/int128/kubelogin/pkg/adaptors/env/mock_env"
-	"github.com/int128/kubelogin/pkg/adaptors/jwtdecoder/mock_jwtdecoder"
 	"github.com/int128/kubelogin/pkg/adaptors/logger"
-	"github.com/int128/kubelogin/pkg/adaptors/logger/mock_logger"
 	"github.com/int128/kubelogin/pkg/adaptors/oidcclient"
 	"github.com/int128/kubelogin/pkg/adaptors/oidcclient/mock_oidcclient"
-	"github.com/int128/kubelogin/pkg/domain/oidc"
+	"github.com/int128/kubelogin/pkg/domain/jwt"
+	"github.com/int128/kubelogin/pkg/testing/clock"
+	testingJWT "github.com/int128/kubelogin/pkg/testing/jwt"
+	testingLogger "github.com/int128/kubelogin/pkg/testing/logger"
 	"golang.org/x/xerrors"
 )

 var cmpIgnoreLogger = cmpopts.IgnoreInterfaces(struct{ logger.Interface }{})

 func TestAuthentication_Do(t *testing.T) {
-	dummyTokenClaims := oidc.Claims{
-		Subject: "YOUR_SUBJECT",
-		Expiry:  time.Date(2019, 1, 2, 3, 4, 5, 0, time.UTC),
-		Pretty:  map[string]string{"sub": "YOUR_SUBJECT"},
-	}
-	timeBeforeExpiry := time.Date(2019, 1, 2, 1, 0, 0, 0, time.UTC)
-	timeAfterExpiry := time.Date(2019, 1, 2, 4, 0, 0, 0, time.UTC)
 	timeout := 5 * time.Second
-	testingLogger := mock_logger.New(t)
+	expiryTime := time.Date(2020, 1, 2, 3, 4, 5, 0, time.UTC)
+	cachedIDToken := testingJWT.EncodeF(t, func(claims *testingJWT.Claims) {
+		claims.Issuer = "https://issuer.example.com"
+		claims.Subject = "SUBJECT"
+		claims.ExpiresAt = expiryTime.Unix()
+	})
+	dummyClaims := jwt.Claims{
+		Subject: "SUBJECT",
+		Expiry:  time.Date(2020, 1, 1, 0, 0, 0, 0, time.UTC),
+		Pretty:  "PRETTY_JSON",
+	}

 	t.Run("HasValidIDToken", func(t *testing.T) {
 		ctrl := gomock.NewController(t)
@@ -40,20 +43,11 @@ func TestAuthentication_Do(t *testing.T) {
 			IssuerURL:    "https://issuer.example.com",
 			ClientID:     "YOUR_CLIENT_ID",
 			ClientSecret: "YOUR_CLIENT_SECRET",
-			IDToken:      "VALID_ID_TOKEN",
+			IDToken:      cachedIDToken,
 		}
-		mockEnv := mock_env.NewMockInterface(ctrl)
-		mockEnv.EXPECT().
-			Now().
-			Return(timeBeforeExpiry)
-		mockDecoder := mock_jwtdecoder.NewMockInterface(ctrl)
-		mockDecoder.EXPECT().
-			Decode("VALID_ID_TOKEN").
-			Return(&dummyTokenClaims, nil)
 		u := Authentication{
-			JWTDecoder: mockDecoder,
-			Logger:     testingLogger,
-			Env:        mockEnv,
+			Logger: testingLogger.New(t),
+			Clock:  clock.Fake(expiryTime.Add(-time.Hour)),
 		}
 		got, err := u.Do(ctx, in)
 		if err != nil {
@@ -61,8 +55,16 @@ func TestAuthentication_Do(t *testing.T) {
 		}
 		want := &Output{
 			AlreadyHasValidIDToken: true,
-			IDToken:                "VALID_ID_TOKEN",
-			IDTokenClaims:          dummyTokenClaims,
+			IDToken:                cachedIDToken,
+			IDTokenClaims: jwt.Claims{
+				Subject: "SUBJECT",
+				Expiry:  expiryTime,
+				Pretty: `{
+  "exp": 1577934245,
+  "iss": "https://issuer.example.com",
+  "sub": "SUBJECT"
+}`,
+			},
 		}
 		if diff := cmp.Diff(want, got); diff != "" {
 			t.Errorf("mismatch (-want +got):\n%s", diff)
@@ -78,24 +80,16 @@ func TestAuthentication_Do(t *testing.T) {
 			IssuerURL:    "https://issuer.example.com",
 			ClientID:     "YOUR_CLIENT_ID",
 			ClientSecret: "YOUR_CLIENT_SECRET",
-			IDToken:      "EXPIRED_ID_TOKEN",
+			IDToken:      cachedIDToken,
 			RefreshToken: "VALID_REFRESH_TOKEN",
 		}
-		mockEnv := mock_env.NewMockInterface(ctrl)
-		mockEnv.EXPECT().
-			Now().
-			Return(timeAfterExpiry)
-		mockDecoder := mock_jwtdecoder.NewMockInterface(ctrl)
-		mockDecoder.EXPECT().
-			Decode("EXPIRED_ID_TOKEN").
-			Return(&dummyTokenClaims, nil)
 		mockOIDCClient := mock_oidcclient.NewMockInterface(ctrl)
 		mockOIDCClient.EXPECT().
 			Refresh(ctx, "VALID_REFRESH_TOKEN").
 			Return(&oidcclient.TokenSet{
 				IDToken:       "NEW_ID_TOKEN",
 				RefreshToken:  "NEW_REFRESH_TOKEN",
-				IDTokenClaims: dummyTokenClaims,
+				IDTokenClaims: dummyClaims,
 			}, nil)
 		u := Authentication{
 			NewOIDCClient: func(_ context.Context, got oidcclient.Config) (oidcclient.Interface, error) {
@@ -109,9 +103,8 @@ func TestAuthentication_Do(t *testing.T) {
 				}
 				return mockOIDCClient, nil
 			},
-			JWTDecoder: mockDecoder,
-			Logger:     testingLogger,
-			Env:        mockEnv,
+			Logger: testingLogger.New(t),
+			Clock:  clock.Fake(expiryTime.Add(+time.Hour)),
 		}
 		got, err := u.Do(ctx, in)
 		if err != nil {
@@ -120,7 +113,7 @@ func TestAuthentication_Do(t *testing.T) {
 		want := &Output{
 			IDToken:       "NEW_ID_TOKEN",
 			RefreshToken:  "NEW_REFRESH_TOKEN",
-			IDTokenClaims: dummyTokenClaims,
+			IDTokenClaims: dummyClaims,
 		}
 		if diff := cmp.Diff(want, got); diff != "" {
 			t.Errorf("mismatch (-want +got):\n%s", diff)
@@ -142,17 +135,9 @@ func TestAuthentication_Do(t *testing.T) {
 			IssuerURL:    "https://issuer.example.com",
 			ClientID:     "YOUR_CLIENT_ID",
 			ClientSecret: "YOUR_CLIENT_SECRET",
-			IDToken:      "EXPIRED_ID_TOKEN",
+			IDToken:      cachedIDToken,
 			RefreshToken: "EXPIRED_REFRESH_TOKEN",
 		}
-		mockEnv := mock_env.NewMockInterface(ctrl)
-		mockEnv.EXPECT().
-			Now().
-			Return(timeAfterExpiry)
-		mockDecoder := mock_jwtdecoder.NewMockInterface(ctrl)
-		mockDecoder.EXPECT().
-			Decode("EXPIRED_ID_TOKEN").
-			Return(&dummyTokenClaims, nil)
 		mockOIDCClient := mock_oidcclient.NewMockInterface(ctrl)
 		mockOIDCClient.EXPECT().
 			Refresh(ctx, "EXPIRED_REFRESH_TOKEN").
@@ -165,7 +150,7 @@ func TestAuthentication_Do(t *testing.T) {
 			Return(&oidcclient.TokenSet{
 				IDToken:       "NEW_ID_TOKEN",
 				RefreshToken:  "NEW_REFRESH_TOKEN",
-				IDTokenClaims: dummyTokenClaims,
+				IDTokenClaims: dummyClaims,
 			}, nil)
 		u := Authentication{
 			NewOIDCClient: func(_ context.Context, got oidcclient.Config) (oidcclient.Interface, error) {
@@ -179,11 +164,10 @@ func TestAuthentication_Do(t *testing.T) {
 				}
 				return mockOIDCClient, nil
 			},
-			JWTDecoder: mockDecoder,
-			Logger:     testingLogger,
-			Env:        mockEnv,
+			Logger: testingLogger.New(t),
+			Clock:  clock.Fake(expiryTime.Add(+time.Hour)),
 			AuthCode: &AuthCode{
-				Logger: testingLogger,
+				Logger: testingLogger.New(t),
 			},
 		}
 		got, err := u.Do(ctx, in)
@@ -193,7 +177,7 @@ func TestAuthentication_Do(t *testing.T) {
 		want := &Output{
 			IDToken:       "NEW_ID_TOKEN",
 			RefreshToken:  "NEW_REFRESH_TOKEN",
-			IDTokenClaims: dummyTokenClaims,
+			IDTokenClaims: dummyClaims,
 		}
 		if diff := cmp.Diff(want, got); diff != "" {
 			t.Errorf("mismatch (-want +got):\n%s", diff)
@@ -222,7 +206,7 @@ func TestAuthentication_Do(t *testing.T) {
 			Return(&oidcclient.TokenSet{
 				IDToken:       "YOUR_ID_TOKEN",
 				RefreshToken:  "YOUR_REFRESH_TOKEN",
-				IDTokenClaims: dummyTokenClaims,
+				IDTokenClaims: dummyClaims,
 			}, nil)
 		u := Authentication{
 			NewOIDCClient: func(_ context.Context, got oidcclient.Config) (oidcclient.Interface, error) {
@@ -236,9 +220,9 @@ func TestAuthentication_Do(t *testing.T) {
 				}
 				return mockOIDCClient, nil
 			},
-			Logger: testingLogger,
+			Logger: testingLogger.New(t),
 			ROPC: &ROPC{
-				Logger: testingLogger,
+				Logger: testingLogger.New(t),
 			},
 		}
 		got, err := u.Do(ctx, in)
@@ -248,7 +232,7 @@ func TestAuthentication_Do(t *testing.T) {
 		want := &Output{
 			IDToken:       "YOUR_ID_TOKEN",
 			RefreshToken:  "YOUR_REFRESH_TOKEN",
-			IDTokenClaims: dummyTokenClaims,
+			IDTokenClaims: dummyClaims,
 		}
 		if diff := cmp.Diff(want, got); diff != "" {
 			t.Errorf("mismatch (-want +got):\n%s", diff)
--- a/pkg/usecases/authentication/password.go
+++ b/pkg/usecases/authentication/password.go
@@ -3,15 +3,15 @@ package authentication
 import (
 	"context"

-	"github.com/int128/kubelogin/pkg/adaptors/env"
 	"github.com/int128/kubelogin/pkg/adaptors/logger"
 	"github.com/int128/kubelogin/pkg/adaptors/oidcclient"
+	"github.com/int128/kubelogin/pkg/adaptors/reader"
 	"golang.org/x/xerrors"
 )

 // ROPC provides the resource owner password credentials flow.
 type ROPC struct {
-	Env    env.Interface
+	Reader reader.Interface
 	Logger logger.Interface
 }

@@ -19,21 +19,21 @@ func (u *ROPC) Do(ctx context.Context, in *ROPCOption, client oidcclient.Interfa
 	u.Logger.V(1).Infof("performing the resource owner password credentials flow")
 	if in.Username == "" {
 		var err error
-		in.Username, err = u.Env.ReadString(usernamePrompt)
+		in.Username, err = u.Reader.ReadString(usernamePrompt)
 		if err != nil {
-			return nil, xerrors.Errorf("could not get the username: %w", err)
+			return nil, xerrors.Errorf("could not read a username: %w", err)
 		}
 	}
 	if in.Password == "" {
 		var err error
-		in.Password, err = u.Env.ReadPassword(passwordPrompt)
+		in.Password, err = u.Reader.ReadPassword(passwordPrompt)
 		if err != nil {
 			return nil, xerrors.Errorf("could not read a password: %w", err)
 		}
 	}
 	tokenSet, err := client.GetTokenByROPC(ctx, in.Username, in.Password)
 	if err != nil {
-		return nil, xerrors.Errorf("error while the resource owner password credentials flow: %w", err)
+		return nil, xerrors.Errorf("resource owner password credentials flow error: %w", err)
 	}
 	return &Output{
 		IDToken:       tokenSet.IDToken,
--- a/pkg/usecases/authentication/password_test.go
+++ b/pkg/usecases/authentication/password_test.go
@@ -7,19 +7,19 @@ import (

 	"github.com/golang/mock/gomock"
 	"github.com/google/go-cmp/cmp"
-	"github.com/int128/kubelogin/pkg/adaptors/env/mock_env"
-	"github.com/int128/kubelogin/pkg/adaptors/logger/mock_logger"
 	"github.com/int128/kubelogin/pkg/adaptors/oidcclient"
 	"github.com/int128/kubelogin/pkg/adaptors/oidcclient/mock_oidcclient"
-	"github.com/int128/kubelogin/pkg/domain/oidc"
+	"github.com/int128/kubelogin/pkg/adaptors/reader/mock_reader"
+	"github.com/int128/kubelogin/pkg/domain/jwt"
+	"github.com/int128/kubelogin/pkg/testing/logger"
 	"golang.org/x/xerrors"
 )

 func TestROPC_Do(t *testing.T) {
-	dummyTokenClaims := oidc.Claims{
+	dummyTokenClaims := jwt.Claims{
 		Subject: "YOUR_SUBJECT",
 		Expiry:  time.Date(2019, 1, 2, 3, 4, 5, 0, time.UTC),
-		Pretty:  map[string]string{"sub": "YOUR_SUBJECT"},
+		Pretty:  "PRETTY_JSON",
 	}
 	timeout := 5 * time.Second

@@ -37,12 +37,12 @@ func TestROPC_Do(t *testing.T) {
 				IDTokenClaims: dummyTokenClaims,
 				RefreshToken:  "YOUR_REFRESH_TOKEN",
 			}, nil)
-		mockEnv := mock_env.NewMockInterface(ctrl)
-		mockEnv.EXPECT().ReadString(usernamePrompt).Return("USER", nil)
-		mockEnv.EXPECT().ReadPassword(passwordPrompt).Return("PASS", nil)
+		mockReader := mock_reader.NewMockInterface(ctrl)
+		mockReader.EXPECT().ReadString(usernamePrompt).Return("USER", nil)
+		mockReader.EXPECT().ReadPassword(passwordPrompt).Return("PASS", nil)
 		u := ROPC{
-			Env:    mockEnv,
-			Logger: mock_logger.New(t),
+			Reader: mockReader,
+			Logger: logger.New(t),
 		}
 		got, err := u.Do(ctx, o, mockOIDCClient)
 		if err != nil {
@@ -76,7 +76,7 @@ func TestROPC_Do(t *testing.T) {
 				IDTokenClaims: dummyTokenClaims,
 			}, nil)
 		u := ROPC{
-			Logger: mock_logger.New(t),
+			Logger: logger.New(t),
 		}
 		got, err := u.Do(ctx, o, mockOIDCClient)
 		if err != nil {
@@ -108,11 +108,11 @@ func TestROPC_Do(t *testing.T) {
 				RefreshToken:  "YOUR_REFRESH_TOKEN",
 				IDTokenClaims: dummyTokenClaims,
 			}, nil)
-		mockEnv := mock_env.NewMockInterface(ctrl)
+		mockEnv := mock_reader.NewMockInterface(ctrl)
 		mockEnv.EXPECT().ReadPassword(passwordPrompt).Return("PASS", nil)
 		u := ROPC{
-			Env:    mockEnv,
-			Logger: mock_logger.New(t),
+			Reader: mockEnv,
+			Logger: logger.New(t),
 		}
 		got, err := u.Do(ctx, o, mockOIDCClient)
 		if err != nil {
@@ -136,11 +136,11 @@ func TestROPC_Do(t *testing.T) {
 		o := &ROPCOption{
 			Username: "USER",
 		}
-		mockEnv := mock_env.NewMockInterface(ctrl)
+		mockEnv := mock_reader.NewMockInterface(ctrl)
 		mockEnv.EXPECT().ReadPassword(passwordPrompt).Return("", xerrors.New("error"))
 		u := ROPC{
-			Env:    mockEnv,
-			Logger: mock_logger.New(t),
+			Reader: mockEnv,
+			Logger: logger.New(t),
 		}
 		out, err := u.Do(ctx, o, mock_oidcclient.NewMockInterface(ctrl))
 		if err == nil {
--- a/pkg/usecases/credentialplugin/get_token.go
+++ b/pkg/usecases/credentialplugin/get_token.go
@@ -51,7 +51,7 @@ func (u *GetToken) Do(ctx context.Context, in Input) error {
 	u.Logger.V(1).Infof("WARNING: log may contain your secrets such as token or password")
 	out, err := u.getTokenFromCacheOrProvider(ctx, in)
 	if err != nil {
-		return xerrors.Errorf("could not get a token from the cache or provider: %w", err)
+		return xerrors.Errorf("could not get a token: %w", err)
 	}
 	u.Logger.V(1).Infof("writing the token to client-go")
 	if err := u.Writer.Write(credentialpluginwriter.Output{Token: out.IDToken, Expiry: out.IDTokenClaims.Expiry}); err != nil {
@@ -99,11 +99,9 @@ func (u *GetToken) getTokenFromCacheOrProvider(ctx context.Context, in Input) (*
 		GrantOptionSet: in.GrantOptionSet,
 	})
 	if err != nil {
-		return nil, xerrors.Errorf("error while authentication: %w", err)
-	}
-	for k, v := range out.IDTokenClaims.Pretty {
-		u.Logger.V(1).Infof("the ID token has the claim: %s=%v", k, v)
+		return nil, xerrors.Errorf("authentication error: %w", err)
 	}
+	u.Logger.V(1).Infof("you got a token: %s", out.IDTokenClaims.Pretty)
 	if out.AlreadyHasValidIDToken {
 		u.Logger.V(1).Infof("you already have a valid token until %s", out.IDTokenClaims.Expiry)
 		return out, nil
--- a/pkg/usecases/credentialplugin/get_token_test.go
+++ b/pkg/usecases/credentialplugin/get_token_test.go
@@ -10,20 +10,20 @@ import (
 	"github.com/int128/kubelogin/pkg/adaptors/certpool/mock_certpool"
 	"github.com/int128/kubelogin/pkg/adaptors/credentialpluginwriter"
 	"github.com/int128/kubelogin/pkg/adaptors/credentialpluginwriter/mock_credentialpluginwriter"
-	"github.com/int128/kubelogin/pkg/adaptors/logger/mock_logger"
 	"github.com/int128/kubelogin/pkg/adaptors/tokencache"
 	"github.com/int128/kubelogin/pkg/adaptors/tokencache/mock_tokencache"
-	"github.com/int128/kubelogin/pkg/domain/oidc"
+	"github.com/int128/kubelogin/pkg/domain/jwt"
+	"github.com/int128/kubelogin/pkg/testing/logger"
 	"github.com/int128/kubelogin/pkg/usecases/authentication"
 	"github.com/int128/kubelogin/pkg/usecases/authentication/mock_authentication"
 	"golang.org/x/xerrors"
 )

 func TestGetToken_Do(t *testing.T) {
-	dummyTokenClaims := oidc.Claims{
+	dummyTokenClaims := jwt.Claims{
 		Subject: "YOUR_SUBJECT",
 		Expiry:  time.Date(2019, 1, 2, 3, 4, 5, 0, time.UTC),
-		Pretty:  map[string]string{"sub": "YOUR_SUBJECT"},
+		Pretty:  "PRETTY_JSON",
 	}

 	t.Run("FullOptions", func(t *testing.T) {
@@ -98,7 +98,7 @@ func TestGetToken_Do(t *testing.T) {
 			TokenCacheRepository: tokenCacheRepository,
 			NewCertPool:          func() certpool.Interface { return mockCertPool },
 			Writer:               credentialPluginWriter,
-			Logger:               mock_logger.New(t),
+			Logger:               logger.New(t),
 		}
 		if err := u.Do(ctx, in); err != nil {
 			t.Errorf("Do returned error: %+v", err)
@@ -151,7 +151,7 @@ func TestGetToken_Do(t *testing.T) {
 			TokenCacheRepository: tokenCacheRepository,
 			NewCertPool:          func() certpool.Interface { return mockCertPool },
 			Writer:               credentialPluginWriter,
-			Logger:               mock_logger.New(t),
+			Logger:               logger.New(t),
 		}
 		if err := u.Do(ctx, in); err != nil {
 			t.Errorf("Do returned error: %+v", err)
@@ -191,7 +191,7 @@ func TestGetToken_Do(t *testing.T) {
 			TokenCacheRepository: tokenCacheRepository,
 			NewCertPool:          func() certpool.Interface { return mockCertPool },
 			Writer:               mock_credentialpluginwriter.NewMockInterface(ctrl),
-			Logger:               mock_logger.New(t),
+			Logger:               logger.New(t),
 		}
 		if err := u.Do(ctx, in); err == nil {
 			t.Errorf("err wants non-nil but nil")
--- a/pkg/usecases/setup/stage2.go
+++ b/pkg/usecases/setup/stage2.go
@@ -14,9 +14,7 @@ var stage2Tpl = template.Must(template.New("").Parse(`

 You got a token with the following claims:

-{{- range $k, $v := .Claims }}
-	{{ $k }}={{ $v }}
-{{- end }}
+{{ .IDTokenPrettyJSON }}

 ## 3. Bind a cluster role

@@ -68,11 +66,11 @@ You can share the kubeconfig to your team members for on-boarding.
 `))

 type stage2Vars struct {
-	Claims    map[string]string
-	IssuerURL string
-	ClientID  string
-	Args      []string
-	Subject   string
+	IDTokenPrettyJSON string
+	IssuerURL         string
+	ClientID          string
+	Args              []string
+	Subject           string
 }

 // Stage2Input represents an input DTO of the stage2.
@@ -111,15 +109,15 @@ func (u *Setup) DoStage2(ctx context.Context, in Stage2Input) error {
 		GrantOptionSet: in.GrantOptionSet,
 	})
 	if err != nil {
-		return xerrors.Errorf("error while authentication: %w", err)
+		return xerrors.Errorf("authentication error: %w", err)
 	}

 	v := stage2Vars{
-		Claims:    out.IDTokenClaims.Pretty,
-		IssuerURL: in.IssuerURL,
-		ClientID:  in.ClientID,
-		Args:      makeCredentialPluginArgs(in),
-		Subject:   out.IDTokenClaims.Subject,
+		IDTokenPrettyJSON: out.IDTokenClaims.Pretty,
+		IssuerURL:         in.IssuerURL,
+		ClientID:          in.ClientID,
+		Args:              makeCredentialPluginArgs(in),
+		Subject:           out.IDTokenClaims.Subject,
 	}
 	var b strings.Builder
 	if err := stage2Tpl.Execute(&b, &v); err != nil {
--- a/pkg/usecases/setup/stage2_test.go
+++ b/pkg/usecases/setup/stage2_test.go
@@ -8,18 +8,13 @@ import (
 	"github.com/golang/mock/gomock"
 	"github.com/int128/kubelogin/pkg/adaptors/certpool"
 	"github.com/int128/kubelogin/pkg/adaptors/certpool/mock_certpool"
-	"github.com/int128/kubelogin/pkg/adaptors/logger/mock_logger"
-	"github.com/int128/kubelogin/pkg/domain/oidc"
+	"github.com/int128/kubelogin/pkg/domain/jwt"
+	"github.com/int128/kubelogin/pkg/testing/logger"
 	"github.com/int128/kubelogin/pkg/usecases/authentication"
 	"github.com/int128/kubelogin/pkg/usecases/authentication/mock_authentication"
 )

 func TestSetup_DoStage2(t *testing.T) {
-	dummyTokenClaims := oidc.Claims{
-		Subject: "YOUR_SUBJECT",
-		Expiry:  time.Date(2019, 1, 2, 3, 4, 5, 0, time.UTC),
-		Pretty:  map[string]string{"sub": "YOUR_SUBJECT"},
-	}
 	var grantOptionSet authentication.GrantOptionSet
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
@@ -50,14 +45,18 @@ func TestSetup_DoStage2(t *testing.T) {
 			GrantOptionSet: grantOptionSet,
 		}).
 		Return(&authentication.Output{
-			IDToken:       "YOUR_ID_TOKEN",
-			RefreshToken:  "YOUR_REFRESH_TOKEN",
-			IDTokenClaims: dummyTokenClaims,
+			IDToken:      "YOUR_ID_TOKEN",
+			RefreshToken: "YOUR_REFRESH_TOKEN",
+			IDTokenClaims: jwt.Claims{
+				Subject: "YOUR_SUBJECT",
+				Expiry:  time.Date(2019, 1, 2, 3, 4, 5, 0, time.UTC),
+				Pretty:  "PRETTY_JSON",
+			},
 		}, nil)
 	u := Setup{
 		Authentication: mockAuthentication,
 		NewCertPool:    func() certpool.Interface { return mockCertPool },
-		Logger:         mock_logger.New(t),
+		Logger:         logger.New(t),
 	}
 	if err := u.DoStage2(ctx, in); err != nil {
 		t.Errorf("DoStage2 returned error: %+v", err)
--- a/pkg/usecases/standalone/standalone.go
+++ b/pkg/usecases/standalone/standalone.go
@@ -93,11 +93,9 @@ func (u *Standalone) Do(ctx context.Context, in Input) error {
 		GrantOptionSet: in.GrantOptionSet,
 	})
 	if err != nil {
-		return xerrors.Errorf("error while authentication: %w", err)
-	}
-	for k, v := range out.IDTokenClaims.Pretty {
-		u.Logger.V(1).Infof("the ID token has the claim: %s=%v", k, v)
+		return xerrors.Errorf("authentication error: %w", err)
 	}
+	u.Logger.V(1).Infof("you got a token: %s", out.IDTokenClaims.Pretty)
 	if out.AlreadyHasValidIDToken {
 		u.Logger.Printf("You already have a valid token until %s", out.IDTokenClaims.Expiry)
 		return nil
@@ -108,7 +106,7 @@ func (u *Standalone) Do(ctx context.Context, in Input) error {
 	authProvider.RefreshToken = out.RefreshToken
 	u.Logger.V(1).Infof("writing the ID token and refresh token to %s", authProvider.LocationOfOrigin)
 	if err := u.Kubeconfig.UpdateAuthProvider(authProvider); err != nil {
-		return xerrors.Errorf("could not write the token to the kubeconfig: %w", err)
+		return xerrors.Errorf("could not update the kubeconfig: %w", err)
 	}
 	return nil
 }
@@ -168,7 +166,7 @@ func (u *Standalone) showDeprecation(in Input, p *kubeconfig.AuthProvider) error
 	}
 	var b strings.Builder
 	if err := deprecationTpl.Execute(&b, &v); err != nil {
-		return xerrors.Errorf("could not render the template: %w", err)
+		return xerrors.Errorf("template error: %w", err)
 	}
 	u.Logger.Printf("%s", b.String())
 	return nil
--- a/pkg/usecases/standalone/standalone_test.go
+++ b/pkg/usecases/standalone/standalone_test.go
@@ -10,18 +10,18 @@ import (
 	"github.com/int128/kubelogin/pkg/adaptors/certpool/mock_certpool"
 	"github.com/int128/kubelogin/pkg/adaptors/kubeconfig"
 	"github.com/int128/kubelogin/pkg/adaptors/kubeconfig/mock_kubeconfig"
-	"github.com/int128/kubelogin/pkg/adaptors/logger/mock_logger"
-	"github.com/int128/kubelogin/pkg/domain/oidc"
+	"github.com/int128/kubelogin/pkg/domain/jwt"
+	"github.com/int128/kubelogin/pkg/testing/logger"
 	"github.com/int128/kubelogin/pkg/usecases/authentication"
 	"github.com/int128/kubelogin/pkg/usecases/authentication/mock_authentication"
 	"golang.org/x/xerrors"
 )

 func TestStandalone_Do(t *testing.T) {
-	dummyTokenClaims := oidc.Claims{
+	dummyTokenClaims := jwt.Claims{
 		Subject: "YOUR_SUBJECT",
 		Expiry:  time.Date(2019, 1, 2, 3, 4, 5, 0, time.UTC),
-		Pretty:  map[string]string{"sub": "YOUR_SUBJECT"},
+		Pretty:  "PRETTY_JSON",
 	}

 	t.Run("FullOptions", func(t *testing.T) {
@@ -88,7 +88,7 @@ func TestStandalone_Do(t *testing.T) {
 			Authentication: mockAuthentication,
 			Kubeconfig:     mockKubeconfig,
 			NewCertPool:    func() certpool.Interface { return mockCertPool },
-			Logger:         mock_logger.New(t),
+			Logger:         logger.New(t),
 		}
 		if err := u.Do(ctx, in); err != nil {
 			t.Errorf("Do returned error: %+v", err)
@@ -131,7 +131,7 @@ func TestStandalone_Do(t *testing.T) {
 			Authentication: mockAuthentication,
 			Kubeconfig:     mockKubeconfig,
 			NewCertPool:    func() certpool.Interface { return mockCertPool },
-			Logger:         mock_logger.New(t),
+			Logger:         logger.New(t),
 		}
 		if err := u.Do(ctx, in); err != nil {
 			t.Errorf("Do returned error: %+v", err)
@@ -151,7 +151,7 @@ func TestStandalone_Do(t *testing.T) {
 		u := Standalone{
 			Authentication: mockAuthentication,
 			Kubeconfig:     mockKubeconfig,
-			Logger:         mock_logger.New(t),
+			Logger:         logger.New(t),
 		}
 		if err := u.Do(ctx, in); err == nil {
 			t.Errorf("err wants non-nil but nil")
@@ -188,7 +188,7 @@ func TestStandalone_Do(t *testing.T) {
 			Authentication: mockAuthentication,
 			Kubeconfig:     mockKubeconfig,
 			NewCertPool:    func() certpool.Interface { return mockCertPool },
-			Logger:         mock_logger.New(t),
+			Logger:         logger.New(t),
 		}
 		if err := u.Do(ctx, in); err == nil {
 			t.Errorf("err wants non-nil but nil")
@@ -240,7 +240,7 @@ func TestStandalone_Do(t *testing.T) {
 			Authentication: mockAuthentication,
 			Kubeconfig:     mockKubeconfig,
 			NewCertPool:    func() certpool.Interface { return mockCertPool },
-			Logger:         mock_logger.New(t),
+			Logger:         logger.New(t),
 		}
 		if err := u.Do(ctx, in); err == nil {
 			t.Errorf("err wants non-nil but nil")
Author	SHA1	Message	Date
Hidetake Iwata	bfc1568057	Bump the version	2020-03-26 10:36:06 +09:00
Hidetake Iwata	8758d55bb3	go mod tidy	2020-03-26 10:29:32 +09:00
dependabot-preview[bot]	d9be392f5a	Build(deps): bump k8s.io/client-go from 0.17.3 to 0.17.4 (#252 ) Bumps [k8s.io/client-go](https://github.com/kubernetes/client-go) from 0.17.3 to 0.17.4. - [Release notes](https://github.com/kubernetes/client-go/releases) - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/kubernetes/client-go/compare/v0.17.3...v0.17.4) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>	2020-03-26 10:24:49 +09:00
dependabot-preview[bot]	af840a519c	Build(deps): bump github.com/golang/mock from 1.4.0 to 1.4.3 (#253 ) Bumps [github.com/golang/mock](https://github.com/golang/mock) from 1.4.0 to 1.4.3. - [Release notes](https://github.com/golang/mock/releases) - [Changelog](https://github.com/golang/mock/blob/master/.goreleaser.yml) - [Commits](https://github.com/golang/mock/compare/v1.4.0...v1.4.3) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>	2020-03-26 10:24:31 +09:00
Hidetake Iwata	285b3b15a8	Bump to Go 1.14.1 (#258 )	2020-03-26 10:13:54 +09:00
Matthew M. Boedicker	123d7c8124	Add --oidc-extra-url-params argument (#255 ) * Add --oidc-extra-url-params argument This accepts a comma-separated list of key-value pairs that will be added to get token requests as query string parameters. Closes #254. * Refactor - move code setting the extra params to the authorization code flow specific functions (it is not needed in ROPC flow) - add unit tests - rename flag to --oidc-auth-request-extra-params - add description to README.md * Add integration test for --oidc-auth-request-extra-params Co-authored-by: Hidetake Iwata <int128@gmail.com>	2020-03-25 11:52:53 +09:00
Hidetake Iwata	e2a6b5d4e2	Update README.md	2020-03-06 10:26:06 +09:00
dependabot-preview[bot]	ce93c739f8	Build(deps): bump github.com/int128/oauth2cli from 1.9.0 to 1.10.0 (#246 ) Bumps [github.com/int128/oauth2cli](https://github.com/int128/oauth2cli) from 1.9.0 to 1.10.0. - [Release notes](https://github.com/int128/oauth2cli/releases) - [Commits](https://github.com/int128/oauth2cli/compare/v1.9.0...v1.10.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>	2020-02-28 22:08:48 +09:00
Hidetake Iwata	dc646c88f9	Bump version to v1.17.1	2020-02-22 16:04:29 +09:00
Hidetake Iwata	07e34d2222	Refactor (#245 ) * Refactor: use Command.Context * Refactor: do not infer command name for help/version	2020-02-22 15:40:43 +09:00
Hidetake Iwata	0e2d402c40	Bump github.com/int128/oauth2cli to v1.9.0 (#244 ) * Bump github.com/int128/oauth2cli to v1.9.0 * Generate state parameter and pass to oauth2cli * Refactor: use base64.NoPadding	2020-02-22 15:26:54 +09:00
Hidetake Iwata	db7c260f9d	go mod tidy	2020-02-22 12:41:11 +09:00
dependabot-preview[bot]	a95dc5c794	Build(deps): bump github.com/spf13/cobra from 0.0.5 to 0.0.6 (#239 ) Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 0.0.5 to 0.0.6. - [Release notes](https://github.com/spf13/cobra/releases) - [Commits](https://github.com/spf13/cobra/compare/0.0.5...v0.0.6) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>	2020-02-22 12:39:26 +09:00
dependabot-preview[bot]	846804f611	Build(deps): bump k8s.io/client-go from 0.17.2 to 0.17.3 (#236 ) Bumps [k8s.io/client-go](https://github.com/kubernetes/client-go) from 0.17.2 to 0.17.3. - [Release notes](https://github.com/kubernetes/client-go/releases) - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/kubernetes/client-go/compare/v0.17.2...v0.17.3) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>	2020-02-22 12:32:56 +09:00
Hidetake Iwata	8b9e31b4c5	Refactor: error messages and testing/logger (#243 ) * Refactor: respect -v option in testing/logger * Refactor: revise error messages	2020-02-22 12:31:00 +09:00
Hidetake Iwata	bc99af6eab	Merge pull request #242 from int128/refactor Refactor	2020-02-21 23:37:32 +09:00
Hidetake Iwata	e3bec130f4	Refactor: fix mock package path	2020-02-21 22:59:59 +09:00
Hidetake Iwata	d59e3355fe	Refactor: rename to adaptor/reader	2020-02-21 22:56:43 +09:00
Hidetake Iwata	9d2d0109d5	Refactor: extract adaptor/clock and testing/clock	2020-02-21 22:49:48 +09:00
Hidetake Iwata	aac8780caf	Refactor: move to testing/logger	2020-02-21 22:39:27 +09:00
Hidetake Iwata	f89525b184	Refactor: extract domain/jwt and testing/jwt (#241 ) * Refactor: extract domain/jwt and testing/jwt * Refactor: remove jwt-go dep from product code	2020-02-21 22:33:08 +09:00
Hidetake Iwata	a46dab3dfd	Fix error if multiple aud claim is given (#240 )	2020-02-21 09:58:01 +09:00