String audience is not parsed correctly on userinfo

[nsklikas]

When using dex as an IdP with userinfo authentication, the aud returned from the userinfo endpoint is a string with the value of the client_id. Our code expects aud to be an array of strings ([]string) that includes the client_id.

While this works fine with hydra, there are a couple of issues with this:

• only signed userinfo responses (https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse) are required to include the aud claim. We don't use signed userinfo, so our assumption that the aud will be there will not always be true
• the aud claim can be either a list of strings or a single string (https://openid.net/specs/openid-connect-core-1_0.html#IDToken), our code should handle both cases

[syncronize-issues-to-jira]

Thank you for reporting us your feedback!

The internal ticket has been created: https://warthogs.atlassian.net/browse/IAM-990.

This message was autogenerated