func NewOpenIDMetadata(issuerURL, jwksURI, defaultExternalAddress string, pubKeys []interface{}) (*OpenIDMetadata, error) {
	if issuerURL == "" {
		return nil, fmt.Errorf("empty issuer URL")
	}
	if jwksURI == "" && defaultExternalAddress == "" {
		return nil, fmt.Errorf("either the JWKS URI or the default external address, or both, must be set")
	}
	if len(pubKeys) == 0 {
		return nil, fmt.Errorf("no keys provided for validating keyset")
	}

	// Ensure the issuer URL meets the OIDC spec (this is the additional
	// validation the doc comment warns about).
	// https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
	iss, err := url.Parse(issuerURL)
	if err != nil {
		return nil, err
	}
	if iss.Scheme != "https" {
		return nil, fmt.Errorf("issuer URL must use https scheme, got: %s", issuerURL)
	}
	if iss.RawQuery != "" {
		return nil, fmt.Errorf("issuer URL may not include a query, got: %s", issuerURL)
	}
	if iss.Fragment != "" {
		return nil, fmt.Errorf("issuer URL may not include a fragment, got: %s", issuerURL)
	}

	// Either use the provided JWKS URI or default to ExternalAddress plus
	// the JWKS path.
	if jwksURI == "" {
		const msg = "attempted to build jwks_uri from external " +
			"address %s, but could not construct a valid URL. Error: %v"

		if defaultExternalAddress == "" {
			return nil, fmt.Errorf(msg, defaultExternalAddress,
				fmt.Errorf("empty address"))
		}

		u := &url.URL{
			Scheme: "https",
			Host:   defaultExternalAddress,
			Path:   JWKSPath,
		}
		jwksURI = u.String()

		// TODO(mtaufen): I think we can probably expect ExternalAddress is
		// at most just host + port and skip the sanity check, but want to be
		// careful until that is confirmed.

		// Sanity check that the jwksURI we produced is the valid URL we expect.
		// This is just in case ExternalAddress came in as something weird,
		// like a scheme + host + port, instead of just host + port.
		parsed, err := url.Parse(jwksURI)
		if err != nil {
			return nil, fmt.Errorf(msg, defaultExternalAddress, err)
		} else if u.Scheme != parsed.Scheme ||
			u.Host != parsed.Host ||
			u.Path != parsed.Path {
			return nil, fmt.Errorf(msg, defaultExternalAddress,
				fmt.Errorf("got %v, expected %v", parsed, u))
		}
	} else {
		// Double-check that jwksURI is an https URL
		if u, err := url.Parse(jwksURI); err != nil {
			return nil, err
		} else if u.Scheme != "https" {
			return nil, fmt.Errorf("jwksURI requires https scheme, parsed as: %v", u.String())
		}
	}

	configJSON, err := openIDConfigJSON(issuerURL, jwksURI, pubKeys)
	if err != nil {
		return nil, fmt.Errorf("could not marshal issuer discovery JSON, error: %v", err)
	}

	keysetJSON, err := openIDKeysetJSON(pubKeys)
	if err != nil {
		return nil, fmt.Errorf("could not marshal issuer keys JSON, error: %v", err)
	}

	return &OpenIDMetadata{
		ConfigJSON:       configJSON,
		PublicKeysetJSON: keysetJSON,
	}, nil
}
// NewOpenIDMetadata returns the pre-rendered JSON responses for the OIDC discovery
// endpoints, or an error if they could not be constructed. Callers should note
// that this function may perform additional validation on inputs that is not
// backwards-compatible with all command-line validation. The recommendation is
// to log the error and skip installing the OIDC discovery endpoints.
NewOpenIDMetadata returns the pre-rendered JSON responses for the OIDC discovery
endpoints, or an error if they could not be constructed. Callers should note
that this function may perform additional validation on inputs that is not
backwards-compatible with all command-line validation. The recommendation is
to log the error and skip installing the OIDC discovery endpoints.
// NewOpenIDMetadata returns the pre - rendered JSON responses for the OIDC discovery // endpoints or an error if they could not be constructed . Callers should note // that this function may perform additional validation on inputs that is not // backwards - compatible with all command - line validation . The recommendation is // to log the error and skip installing the OIDC discovery endpoints .
func NewOpenIDMetadata(issuerURL, jwksURI, defaultExternalAddress string, pubKeys []interface{}) (*OpenIDMetadata, error) {
	if issuerURL == "" {
		return nil, fmt.Errorf("empty issuer URL")
	}
	if jwksURI == "" && defaultExternalAddress == "" {
		return nil, fmt.Errorf("either the JWKS URI or the default external address, or both, must be set")
	}
	if len(pubKeys) == 0 {
		return nil, fmt.Errorf("no keys provided for validating keyset")
	}
	iss, err := url.Parse(issuerURL)
	if err != nil {
		return nil, err
	}
	if iss.Scheme != "https" {
		return nil, fmt.Errorf("issuer URL must use https scheme, got: %s", issuerURL)
	}
	if iss.RawQuery != "" {
		return nil, fmt.Errorf("issuer URL may not include a query, got: %s", issuerURL)
	}
	if iss.Fragment != "" {
		return nil, fmt.Errorf("issuer URL may not include a fragment, got: %s", issuerURL)
	}
	if jwksURI == "" {
		const msg = "attempted to build jwks_uri from external " +
			"address %s, but could not construct a valid URL. Error: %v"
		if defaultExternalAddress == "" {
			return nil, fmt.Errorf(msg, defaultExternalAddress,
				fmt.Errorf("empty address"))
		}
		u := &url.URL{
			Scheme: "https",
			Host:   defaultExternalAddress,
			Path:   JWKSPath,
		}
		jwksURI = u.String()
		parsed, err := url.Parse(jwksURI)
		if err != nil {
			return nil, fmt.Errorf(msg, defaultExternalAddress, err)
		} else if u.Scheme != parsed.Scheme ||
			u.Host != parsed.Host ||
			u.Path != parsed.Path {
			return nil, fmt.Errorf(msg, defaultExternalAddress,
				fmt.Errorf("got %v, expected %v", parsed, u))
		}
	} else {
		if u, err := url.Parse(jwksURI); err != nil {
			return nil, err
		} else if u.Scheme != "https" {
			return nil, fmt.Errorf("jwksURI requires https scheme, parsed as: %v", u.String())
		}
	}
	configJSON, err := openIDConfigJSON(issuerURL, jwksURI, pubKeys)
	if err != nil {
		return nil, fmt.Errorf("could not marshal issuer discovery JSON, error: %v", err)
	}
	keysetJSON, err := openIDKeysetJSON(pubKeys)
	if err != nil {
		return nil, fmt.Errorf("could not marshal issuer keys JSON, error: %v", err)
	}
	return &OpenIDMetadata{
		ConfigJSON:       configJSON,
		PublicKeysetJSON: keysetJSON,
	}, nil
}
func NewOpenIDMetadata ( issuerURL , jwksURI , defaultExternalAddress string , pubKeys [ ] interface { } ) ( * OpenIDMetadata , error ) { if issuerURL == " " { return nil , fmt . Errorf ( " " ) } if jwksURI == " " && defaultExternalAddress == " " { return nil , fmt . Errorf ( " " ) } if len ( pubKeys ) == 0 { return nil , fmt . Errorf ( " " ) } iss , err := url . Parse ( issuerURL ) if err != nil { return nil , err } if iss . Scheme != " " { return nil , fmt . Errorf ( " " , issuerURL ) } if iss . RawQuery != " " { return nil , fmt . Errorf ( " " , issuerURL ) } if iss . Fragment != " " { return nil , fmt . Errorf ( " " , issuerURL ) } if jwksURI == " " { const msg = " " + " " if defaultExternalAddress == " " { return nil , fmt . Errorf ( msg , defaultExternalAddress , fmt . Errorf ( " " ) ) } u := & url . URL { Scheme : " " , Host : defaultExternalAddress , Path : JWKSPath , } jwksURI = u . String ( ) parsed , err := url . Parse ( jwksURI ) if err != nil { return nil , fmt . Errorf ( msg , defaultExternalAddress , err ) } else if u . Scheme != parsed . Scheme || u . Host != parsed . Host || u . Path != parsed . Path { return nil , fmt . Errorf ( msg , defaultExternalAddress , fmt . Errorf ( " " , parsed , u ) ) } } else { if u , err := url . Parse ( jwksURI ) ; err != nil { return nil , err } else if u . Scheme != " " { return nil , fmt . Errorf ( " " , u . String ( ) ) } } configJSON , err := openIDConfigJSON ( issuerURL , jwksURI , pubKeys ) if err != nil { return nil , fmt . Errorf ( " " , err ) } keysetJSON , err := openIDKeysetJSON ( pubKeys ) if err != nil { return nil , fmt . Errorf ( " " , err ) } return & OpenIDMetadata { ConfigJSON : configJSON , PublicKeysetJSON : keysetJSON , } , nil }
NewOpenIDMetadata returns the pre-rendered JSON responses for the OIDC discovery
endpoints, or an error if they could not be constructed.
NewOpenIDMetadata returns the pre - rendered JSON responses for the OIDC discovery endpoints or an error if they could not be constructed .
// Ensure the issuer URL meets the OIDC spec (this is the additional // validation the doc comment warns about). // https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata // Either use the provided JWKS URI or default to ExternalAddress plus // the JWKS path. // TODO(mtaufen): I think we can probably expect ExternalAddress is // at most just host + port and skip the sanity check, but want to be // careful until that is confirmed. // Sanity check that the jwksURI we produced is the valid URL we expect. // This is just in case ExternalAddress came in as something weird, // like a scheme + host + port, instead of just host + port. // Double-check that jwksURI is an https URL