Allow tokens with multiple audiences as long as one matches

auth/authzserver/provider.go

@@ -133,12 +133,17 @@ func (p Provider) ValidateAccessToken(ctx context.Context, expectedAudience, tok
 
 func verifyClaims(expectedAudience sets.String, claimsRaw map[string]interface{}) (interfaces.IdentityContext, error) {
 	claims := jwtx.ParseMapStringInterfaceClaims(claimsRaw)
-	if len(claims.Audience) != 1 {
-		return nil, fmt.Errorf("expected exactly one granted audience. found [%v]", len(claims.Audience))
+
+	foundAudIndex := -1
+	for audIndex, aud := range claims.Audience {
+		if expectedAudience.Has(aud) {
+			foundAudIndex = audIndex
+			break
+		}
 	}
 
-	if !expectedAudience.Has(claims.Audience[0]) {
-		return nil, fmt.Errorf("invalid audience [%v]", claims.Audience[0])
+	if foundAudIndex < 0 {
+		return nil, fmt.Errorf("invalid audience [%v]", claims)
 	}
 
 	userInfo := &service.UserInfoResponse{}
@@ -170,7 +175,7 @@ func verifyClaims(expectedAudience sets.String, claimsRaw map[string]interface{}
 		scopes.Insert(auth.ScopeAll)
 	}
 
-	return auth.NewIdentityContext(claims.Audience[0], claims.Subject, clientID, claims.IssuedAt, scopes, userInfo), nil
+	return auth.NewIdentityContext(claims.Audience[foundAudIndex], claims.Subject, clientID, claims.IssuedAt, scopes, userInfo), nil
 }
 
 // NewProvider creates a new OAuth2 Provider that is able to do OAuth 2-legged and 3-legged flows. It'll lookup

auth/authzserver/provider_test.go

@@ -235,5 +235,49 @@ func Test_verifyClaims(t *testing.T) {
 		assert.Equal(t, sets.NewString("all", "offline"), identityCtx.Scopes())
 		assert.Equal(t, "my-client", identityCtx.AppID())
 		assert.Equal(t, "123", identityCtx.UserID())
+		assert.Equal(t, "https://myserver", identityCtx.Audience())
 	})
+
+	t.Run("Multiple audience", func(t *testing.T) {
+		identityCtx, err := verifyClaims(sets.NewString("https://myserver", "https://myserver2"),
+			map[string]interface{}{
+				"aud": []string{"https://myserver"},
+				"user_info": map[string]interface{}{
+					"preferred_name": "John Doe",
+				},
+				"sub":       "123",
+				"client_id": "my-client",
+				"scp":       []interface{}{"all", "offline"},
+			})
+
+		assert.NoError(t, err)
+		assert.Equal(t, "https://myserver", identityCtx.Audience())
+	})
+
+	t.Run("No matching audience", func(t *testing.T) {
+		_, err := verifyClaims(sets.NewString("https://myserver", "https://myserver2"),
+			map[string]interface{}{
+				"aud": []string{"https://myserver3"},
+			})
+
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "invalid audience")
+	})
+
+	t.Run("Use first matching audience", func(t *testing.T) {
+		identityCtx, err := verifyClaims(sets.NewString("https://myserver", "https://myserver2", "https://myserver3"),
+			map[string]interface{}{
+				"aud": []string{"https://myserver", "https://myserver2"},
+				"user_info": map[string]interface{}{
+					"preferred_name": "John Doe",
+				},
+				"sub":       "123",
+				"client_id": "my-client",
+				"scp":       []interface{}{"all", "offline"},
+			})
+
+		assert.NoError(t, err)
+		assert.Equal(t, "https://myserver", identityCtx.Audience())
+	})
+
 }

auth/interfaces/context.go

@@ -59,6 +59,7 @@ type AuthenticationContext interface {
 // to the platform.
 type IdentityContext interface {
 	UserID() string
+	Audience() string
 	AppID() string
 	UserInfo() *service.UserInfoResponse
 	AuthenticatedAt() time.Time