nov/openid_connect — pull request #3 by pkmitre (2013-08-07 16:03:49+00:00)
Title: allow array of strings for id_token aud(ience) attribute

The OpenID Connect spec says that the "aud" attribute of an ID Token can be either a single string or an array of strings:

http://openid.net/specs/openid-connect-messages-1_0-20.html

> **aud** REQUIRED. Audience(s) that this ID Token is intended for. It MUST contain the OAuth 2.0 client_id of the Relying Party as an audience value. It MAY also contain identifiers for other audiences. In the general case, the aud value is an array of case sensitive strings. In the special case when there is one audience, the aud value MAY be a single case sensitive string.

I've actually run into an OpenID Connect server that returns an array (with a single element). This pull supports an array of identifiers, with the client_id present anywhere in the array.