Files
Trong Huu Nguyen 6cf48cd668 feat(openid/config): validate client assertion alg against provider metadata
Fail at startup rather than on the first token request when the identity
provider does not accept the client assertion algorithm. The check is
skipped when the provider omits the field, which is optional in Discovery.
2026-08-10 12:33:16 +02:00

43 lines
757 B
Go

package config
import (
"context"
wonderwallconfig "github.com/nais/wonderwall/pkg/config"
)
type Config interface {
Client() Client
Provider() Provider
}
type openidconfig struct {
clientConfig Client
providerConfig Provider
}
func (c *openidconfig) Client() Client {
return c.clientConfig
}
func (c *openidconfig) Provider() Provider {
return c.providerConfig
}
func NewConfig(ctx context.Context, cfg *wonderwallconfig.Config) (Config, error) {
clientCfg, err := NewClientConfig(cfg)
if err != nil {
return nil, err
}
providerCfg, err := NewProviderConfig(ctx, cfg, clientCfg.ClientJWKAlgorithm())
if err != nil {
return nil, err
}
return &openidconfig{
clientConfig: clientCfg,
providerConfig: providerCfg,
}, nil
}