// getClaims gets claims from ID token and UserInfo and returns UserInfo claims merged into ID token claims.
516864
func (a *AuthServer) getClaims(oidcClient *oidc.Client, issuerURL string, scope []string, code string) (jose.Claims, error) {
	var err error

	oac, err := oidcClient.OAuthClient()
	if err != nil {
		return nil, trace.Wrap(err)
	}

	t, err := oac.RequestToken(oauth2.GrantTypeAuthCode, code)
	if err != nil {
		return nil, trace.Wrap(err)
	}

	idTokenClaims, err := claimsFromIDToken(oidcClient, t.IDToken)
	if err != nil {
		log.Debugf("Unable to fetch OIDC ID token claims: %v.", err)
		return nil, trace.Wrap(err)
	}
	log.Debugf("OIDC ID Token claims: %v.", idTokenClaims)

	userInfoClaims, err := claimsFromUserInfo(oidcClient, issuerURL, t.AccessToken)
	if err != nil {
		if trace.IsNotFound(err) {
			log.Debugf("OIDC provider doesn't offer UserInfo endpoint. Returning token claims: %v.", idTokenClaims)
			return idTokenClaims, nil
		}
		log.Debugf("Unable to fetch UserInfo claims: %v.", err)
		return nil, trace.Wrap(err)
	}
	log.Debugf("UserInfo claims: %v.", userInfoClaims)

	// make sure that the subject in the userinfo claim matches the subject in
	// the id token otherwise there is the possibility of a token substitution attack.
	// see section 16.11 of the oidc spec for more details.
	var idsub string
	var uisub string
	var exists bool
	if idsub, exists, err = idTokenClaims.StringClaim("sub"); err != nil || !exists {
		log.Debugf("Unable to extract OIDC sub claim from ID token.")
		return nil, trace.Wrap(err)
	}
	if uisub, exists, err = userInfoClaims.StringClaim("sub"); err != nil || !exists {
		log.Debugf("Unable to extract OIDC sub claim from UserInfo.")
		return nil, trace.Wrap(err)
	}
	if idsub != uisub {
		log.Debugf("OIDC claim subjects don't match '%v' != '%v'.", idsub, uisub)
		return nil, trace.BadParameter("invalid subject in UserInfo")
	}

	claims, err := mergeClaims(idTokenClaims, userInfoClaims)
	if err != nil {
		log.Debugf("Unable to merge OIDC claims: %v.", err)
		return nil, trace.Wrap(err)
	}

	// for GSuite users, fetch extra data from the proprietary google API
	// only if scope includes admin groups readonly scope
	if issuerURL == teleport.GSuiteIssuerURL && utils.SliceContainsStr(scope, teleport.GSuiteGroupsScope) {
		email, _, err := claims.StringClaim("email")
		if err != nil {
			return nil, trace.Wrap(err)
		}
		gsuiteClaims, err := a.claimsFromGSuite(oidcClient, issuerURL, email, t.AccessToken)
		if err != nil {
			if !trace.IsNotFound(err) {
				return nil, trace.Wrap(err)
			}
			log.Debugf("Found no GSuite claims.")
		} else {
			if gsuiteClaims != nil {
				log.Debugf("Got GSuiteclaims: %v.", gsuiteClaims)
			}
			claims, err = mergeClaims(claims, gsuiteClaims)
			if err != nil {
				return nil, trace.Wrap(err)
			}
		}
	}

	return claims, nil
}
1155893
func GetClaimNames(claims jose.Claims) []string {
	var out []string
	for claim := range claims {
		out = append(out, claim)
	}
	return out
}
71639
func GetIdentities() IdentitiesModel {
	identities := IdentitiesModel{}

	IdentityAllocator.ForeachCache(func(id idpool.ID, val allocator.AllocatorKey) {
		if gi, ok := val.(globalIdentity); ok {
			identity := identity.NewIdentityFromLabelArray(identity.NumericIdentity(id), gi.LabelArray)
			identities = append(identities, identity.GetModel())
		}

	})
	// append user reserved identities
	for _, v := range identity.ReservedIdentityCache {
		identities = append(identities, v.GetModel())
	}

	for _, v := range localIdentities.GetIdentities() {
		identities = append(identities, v.GetModel())
	}

	return identities
}
1335103
func TokenClaims(rawtoken string) (*Claims, error) {
	parts := strings.Split(rawtoken, ".")

	// There are supposed to be three parts for the token
	if len(parts) < 3 {
		return nil, fmt.Errorf("Token is invalid: %v", rawtoken)
	}

	// Access claims in the token
	claimBytes, err := jwt.DecodeSegment(parts[1])
	if err != nil {
		return nil, fmt.Errorf("Failed to decode claims: %v", err)
	}
	var claims *Claims

	// Unmarshal claims
	err = json.Unmarshal(claimBytes, &claims)
	if err != nil {
		return nil, fmt.Errorf("Unable to get information from the claims in the token: %v", err)
	}

	return claims, nil
}
326739
func GetClaims(token string) map[string]interface{} {
	// decode the token
	dec, err := newDecoded(token)
	if err != nil {
		return nil
	}

	// base64 decode payload
	payload, err := base64.RawURLEncoding.DecodeString(dec.payload)
	if err != nil {
		return nil
	}

	dst := map[string]interface{}{}
	err = json.Unmarshal(payload, &dst)
	if err != nil {
		return nil
	}

	return dst

}
973287
func ClaimLeaseOps(
	namespace, name, holder, writer, collection string,
	globalTime time.Time, duration time.Duration,
) ([]txn.Op, error) {
	ops, _, err := claimLeaseOps(
		namespace, name, holder, writer, collection,
		globalTime, duration,
	)
	return ops, errors.Trace(err)
}
517740
func KeyFromClaims(claims *verifierClaims) *ecdsa.PublicKey {
	return &ecdsa.PublicKey{
		Curve: elliptic.P256(),
		X:     claims.X,
		Y:     claims.Y,
	}
}
467343
func mustGetClaimsFromToken(r *http.Request) map[string]interface{} {
	claims, _ := getClaimsFromToken(r)
	return claims
}
404665
func (c *Client) GetUsers() ([]services.User, error) {
	out, err := c.Get(c.Endpoint("users"), url.Values{})
	if err != nil {
		return nil, trace.Wrap(err)
	}
	var items []json.RawMessage
	if err := json.Unmarshal(out.Bytes(), &items); err != nil {
		return nil, trace.Wrap(err)
	}
	users := make([]services.User, len(items))
	for i, userBytes := range items {
		user, err := services.GetUserMarshaler().UnmarshalUser(userBytes, services.SkipValidation())
		if err != nil {
			return nil, trace.Wrap(err)
		}
		users[i] = user
	}
	return users, nil
}
892946
func (facade *Facade) Claim(args params.SingularClaims) (result params.ErrorResults) {
	result.Results = make([]params.ErrorResult, len(args.Claims))
	for i, claim := range args.Claims {
		err := facade.claim(claim)
		result.Results[i].Error = common.ServerError(err)
	}
	return result
}
357697
func (kp *Keypairs) Get(publicKeyID *identity.ID) (*ClaimedKeyPair, error) {
	if publicKeyID == nil {
		return nil, errors.New("Invalid PublicKeyID provided to get keypair")
	}

	ckp, ok := kp.idIndex[*publicKeyID]
	if !ok {
		return nil, ErrPublicKeyNotFound
	}

	return &ckp, nil
}
71034
func (o *OIDCAuthenticator) parseClaims(claims map[string]interface{}) (*Claims, error) {

	// If we have namespace set, then use it to get custom claims:
	if len(o.namespace) > 0 {
		for _, cc := range customClaims {
			// Check if there claims needed are under a namespace
			if v, ok := claims[o.namespace+cc]; ok {
				// Move it to the top of the json tree overwriting anything
				// there with the same name.
				claims[cc] = v
			}
		}
	}

	// Marshal into byte stream so that we can unmarshal into SDK Claims
	cbytes, err := json.Marshal(claims)
	if err != nil {
		return nil, fmt.Errorf("Internal error, unable to re-encode OIDC token claims: %v", err)
	}

	// Return claims
	var sdkClaims Claims
	if err := json.Unmarshal(cbytes, &sdkClaims); err != nil {
		return nil, fmt.Errorf("Unable to get claims from token: %v", err)
	}

	if err := validateUsername(o.usernameClaim, &sdkClaims); err != nil {
		return nil, err
	}

	return &sdkClaims, nil
}
384835
func getClaimStatusForLogging(claim *v1.PersistentVolumeClaim) string {
	bound := metav1.HasAnnotation(claim.ObjectMeta, annBindCompleted)
	boundByController := metav1.HasAnnotation(claim.ObjectMeta, annBoundByController)

	return fmt.Sprintf("phase: %s, bound to: %q, bindCompleted: %v, boundByController: %v", claim.Status.Phase, claim.Spec.VolumeName, bound, boundByController)
}
489480
func (u *User) Claims() (*jwt.StandardClaims, error) {
	parser := &jwt.Parser{
		SkipClaimsValidation: true,
	}
	claims := jwt.StandardClaims{}
	_, _, err := parser.ParseUnverified(u.AuthToken, &claims)
	if err != nil {
		return nil, err
	}
	return &claims, nil
}
524335
func (c Claims) Get(key string) interface{} {
	if c == nil {
		return nil
	}
	return c[key]
}
785825
func (s *TestInvokeAuthorizerOutput) SetClaims(v map[string]*string) *TestInvokeAuthorizerOutput {
	s.Claims = v
	return s
}
212342
func (t *notifyTarget) Claimed(key lease.Key, holder string) {
	docId := leaseHolderDocId(key.Namespace, key.ModelUUID, key.Lease)
	t.log("claimed %q for %q", docId, holder)
	_, err := applyClaimed(t.mongo, t.collection, docId, key, holder)
	if err != nil {
		t.errorLogger.Errorf("couldn't claim lease %q for %q in db: %s", docId, holder, err.Error())
		t.log("couldn't claim lease %q for %q in db: %s", docId, holder, err.Error())
		return
	}
}