Use oidc.TokenClaims as a superset of jwt.Claims for azure claims.

Author: Joerger

lib/auth/join_azure.go

@@ -88,7 +88,6 @@ type attestedData struct {
 
 type accessTokenClaims struct {
 	oidc.TokenClaims
-	jwt.Claims
 	TenantID string `json:"tid"`
 	Version  string `json:"ver"`
 
@@ -108,6 +107,18 @@ type accessTokenClaims struct {
 	AzureResourceID            string `json:"xms_az_rid"`
 }
 
+func (c *accessTokenClaims) AsJWTClaims() jwt.Claims {
+	return jwt.Claims{
+		Issuer:    c.Issuer,
+		Subject:   c.Subject,
+		Audience:  jwt.Audience(c.Audience),
+		Expiry:    jwt.NewNumericDate(c.Expiration.AsTime()),
+		NotBefore: jwt.NewNumericDate(c.NotBefore.AsTime()),
+		IssuedAt:  jwt.NewNumericDate(c.IssuedAt.AsTime()),
+		ID:        c.JWTID,
+	}
+}
+
 type azureVerifyTokenFunc func(ctx context.Context, rawIDToken string) (*accessTokenClaims, error)
 
 type vmClientGetter func(subscriptionID string, token *azure.StaticCredential) (azure.VirtualMachinesClient, error)
@@ -259,7 +270,7 @@ func verifyVMIdentity(
 		Time:     requestStart,
 	}
 
-	if err := tokenClaims.Validate(expectedClaims); err != nil {
+	if err := tokenClaims.AsJWTClaims().Validate(expectedClaims); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -282,7 +293,7 @@ func verifyVMIdentity(
 
 	tokenCredential := azure.NewStaticCredential(azcore.AccessToken{
 		Token:     accessToken,
-		ExpiresOn: tokenClaims.Expiry.Time(),
+		ExpiresOn: tokenClaims.GetExpiration(),
 	})
 	vmClient, err := cfg.getVMClient(subscriptionID, tokenCredential)
 	if err != nil {

lib/auth/join_azure_test.go

@@ -34,6 +34,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
+	"github.com/zitadel/oidc/v3/pkg/oidc"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
@@ -144,14 +145,14 @@ func makeToken(managedIdentityResourceID, azureResourceID string, issueTime time
 		return "", trace.Wrap(err)
 	}
 	claims := accessTokenClaims{
-		Claims: jwt.Claims{
-			Issuer:    "https://sts.windows.net/test-tenant-id/",
-			Audience:  []string{azureAccessTokenAudience},
-			Subject:   "test",
-			IssuedAt:  jwt.NewNumericDate(issueTime),
-			NotBefore: jwt.NewNumericDate(issueTime),
-			Expiry:    jwt.NewNumericDate(issueTime.Add(time.Minute)),
-			ID:        "id",
+		TokenClaims: oidc.TokenClaims{
+			Issuer:     "https://sts.windows.net/test-tenant-id/",
+			Audience:   []string{azureAccessTokenAudience},
+			Subject:    "test",
+			IssuedAt:   oidc.FromTime(issueTime),
+			NotBefore:  oidc.FromTime(issueTime),
+			Expiration: oidc.FromTime(issueTime.Add(time.Minute)),
+			JWTID:      "id",
 		},
 		ManangedIdentityResourceID: managedIdentityResourceID,
 		AzureResourceID:            azureResourceID,

lib/githubactions/token_validator_test.go

@@ -381,9 +381,7 @@ func testSigner(t *testing.T) ([]byte, jose.Signer) {
 	return jwksData, signer
 }
 
-//nolint:govet // there's some weird json struct tag overlap here
 type claims struct {
-	jwt.Claims
 	IDTokenClaims
 	Subject string `json:"sub"`
 }
@@ -409,14 +407,14 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 			claims: claims{
 				IDTokenClaims: IDTokenClaims{
 					Repository: "123",
+					TokenClaims: oidc.TokenClaims{
+						Audience:   oidc.Audience{clusterName},
+						IssuedAt:   oidc.FromTime(now.Add(-1 * time.Minute)),
+						NotBefore:  oidc.FromTime(now.Add(-1 * time.Minute)),
+						Expiration: oidc.FromTime(now.Add(10 * time.Minute)),
+					},
 				},
 				Subject: "foo",
-				Claims: jwt.Claims{
-					Audience:  jwt.Audience{clusterName},
-					IssuedAt:  jwt.NewNumericDate(now.Add(-1 * time.Minute)),
-					NotBefore: jwt.NewNumericDate(now.Add(-1 * time.Minute)),
-					Expiry:    jwt.NewNumericDate(now.Add(10 * time.Minute)),
-				},
 			},
 			wantResult: &IDTokenClaims{
 				Sub:        "foo",
@@ -429,14 +427,14 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 			claims: claims{
 				IDTokenClaims: IDTokenClaims{
 					Repository: "123",
+					TokenClaims: oidc.TokenClaims{
+						Audience:   oidc.Audience{clusterName},
+						IssuedAt:   oidc.FromTime(now.Add(-1 * time.Minute)),
+						NotBefore:  oidc.FromTime(now.Add(-1 * time.Minute)),
+						Expiration: oidc.FromTime(now.Add(10 * time.Minute)),
+					},
 				},
 				Subject: "foo",
-				Claims: jwt.Claims{
-					Audience:  jwt.Audience{clusterName},
-					IssuedAt:  jwt.NewNumericDate(now.Add(-1 * time.Minute)),
-					NotBefore: jwt.NewNumericDate(now.Add(-1 * time.Minute)),
-					Expiry:    jwt.NewNumericDate(now.Add(10 * time.Minute)),
-				},
 			},
 			wantResult: &IDTokenClaims{
 				Sub:        "foo",
@@ -450,14 +448,14 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 			claims: claims{
 				IDTokenClaims: IDTokenClaims{
 					Repository: "123",
+					TokenClaims: oidc.TokenClaims{
+						Audience:   oidc.Audience{clusterName},
+						IssuedAt:   oidc.FromTime(now.Add(-2 * time.Minute)),
+						NotBefore:  oidc.FromTime(now.Add(-2 * time.Minute)),
+						Expiration: oidc.FromTime(now.Add(-1 * time.Minute)),
+					},
 				},
 				Subject: "foo",
-				Claims: jwt.Claims{
-					Audience:  jwt.Audience{clusterName},
-					IssuedAt:  jwt.NewNumericDate(now.Add(-2 * time.Minute)),
-					NotBefore: jwt.NewNumericDate(now.Add(-2 * time.Minute)),
-					Expiry:    jwt.NewNumericDate(now.Add(-1 * time.Minute)),
-				},
 			},
 			wantErr: "token is expired",
 		},
@@ -467,14 +465,14 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 			claims: claims{
 				IDTokenClaims: IDTokenClaims{
 					Repository: "123",
+					TokenClaims: oidc.TokenClaims{
+						Audience:   oidc.Audience{clusterName},
+						IssuedAt:   oidc.FromTime(now.Add(2 * time.Minute)),
+						NotBefore:  oidc.FromTime(now.Add(2 * time.Minute)),
+						Expiration: oidc.FromTime(now.Add(4 * time.Minute)),
+					},
 				},
 				Subject: "foo",
-				Claims: jwt.Claims{
-					Audience:  jwt.Audience{clusterName},
-					IssuedAt:  jwt.NewNumericDate(now.Add(2 * time.Minute)),
-					NotBefore: jwt.NewNumericDate(now.Add(2 * time.Minute)),
-					Expiry:    jwt.NewNumericDate(now.Add(4 * time.Minute)),
-				},
 			},
 			wantErr: "token not valid yet",
 		},