some

auth/oidc.go

@@ -67,7 +67,7 @@ func (o *OIDC) Authenticate(r *http.Request) (*Principal, error) {
 	if err != nil {
 		return nil, err
 	}
-	return &Principal{Subject: c.Subject, Scopes: c.Scopes, Kind: KindOIDC}, nil
+	return &Principal{Subject: c.Subject, Scopes: c.Scopes, Roles: c.Roles, Kind: KindOIDC}, nil
 }
 
 // Claims is the parsed, verified claim set returned by VerifyClaims. Only
@@ -83,6 +83,7 @@ type Claims struct {
 	Expires   int64    `json:"exp"`
 	NotBefore int64    `json:"nbf"`
 	Scopes    []string `json:"scope,omitempty"` // parsed from "scope" space-separated claim
+	Roles     []string `json:"roles,omitempty"` // parsed from "roles" or "groups" claim
 }
 
 // Audience unmarshals the `aud` claim, which RFC 7519 allows to be either a
@@ -187,6 +188,8 @@ func (o *OIDC) VerifyClaims(token string) (*Claims, error) {
 		Expires   int64    `json:"exp"`
 		NotBefore int64    `json:"nbf"`
 		Scope     string   `json:"scope"`
+		Roles     []string `json:"roles"`
+		Groups    []string `json:"groups"`
 	}
 	if err := json.Unmarshal(payloadJSON, &raw); err != nil {
 		return nil, fmt.Errorf("oidc: bad claims: %w", err)
@@ -209,6 +212,11 @@ func (o *OIDC) VerifyClaims(token string) (*Claims, error) {
 	if raw.Scope != "" {
 		scopes = strings.Fields(raw.Scope)
 	}
+	roles := raw.Roles
+	if len(roles) == 0 && len(raw.Groups) > 0 {
+		roles = raw.Groups
+	}
+
 	return &Claims{
 		Issuer:    raw.Issuer,
 		Subject:   raw.Subject,
@@ -218,6 +226,7 @@ func (o *OIDC) VerifyClaims(token string) (*Claims, error) {
 		Expires:   raw.Expires,
 		NotBefore: raw.NotBefore,
 		Scopes:    scopes,
+		Roles:     roles,
 	}, nil
 }