Repository: Netflix/consoleme
File: consoleme/lib/oidc.py (Python)

Code before:
            if not algorithm:
                raise UnableToAuthenticate(
                    "ID Token header does not specify a signing algorithm."
                )
            pub_key = oidc_config["jwt_keys"][key_id]
            # This will raises errors if the audience isn't right or if the token is expired or has other errors.
            decoded_id_token = jwt.decode(
                id_token,
                pub_key,
                audience=oidc_config["client_id"],
                algorithms=algorithm,
            )

            email = decoded_id_token.get(
                config.get("get_user_by_oidc_settings.jwt_email_key", "email")
            )

            # For google auth, the access_token does not contain JWT-parsable claims.
            if config.get(
                "get_user_by_oidc_settings.get_groups_from_access_token", True
            ):
                try:
                    header = jwt.get_unverified_header(access_token)
                    key_id = header["kid"]
                    algorithm = header["alg"]
                    if not algorithm:
                        raise UnableToAuthenticate(
                            "Access Token header does not specify a signing algorithm."
                        )
                    pub_key = oidc_config["jwt_keys"][key_id]
                    # This will raises errors if the audience isn't right or if the token is expired or has other
                    # errors.
                    decoded_access_token = jwt.decode(
                        access_token,
                        pub_key,
                        audience=config.get(
                            "get_user_by_oidc_settings.access_token_audience"
                        ),
                        algorithms=algorithm,
                    )
                except (DecodeError, KeyError) as e:
                    # This exception occurs when the access token is opaque or otherwise not JWT-parsable.
                    # It is expected with some IdPs.
                    log.debug(
                        {
                            **log_data,
                            "message": (
                                "Unable to derive user's groups from access_token. Attempting to get groups through "
                                "userinfo endpoint. "
                            ),
                            "error": e,

Review comment (suggestion):
We should also raise this exception on `algorithm.lower() == "none"` (although the lib should™ protect us from this anyway)

Code after:
            if algorithm == "none" or not algorithm:
                raise UnableToAuthenticate(
                    "ID Token header does not specify a signing algorithm."
                )
            pub_key = oidc_config["jwt_keys"][key_id]
            # This will raises errors if the audience isn't right or if the token is expired or has other errors.
            decoded_id_token = jwt.decode(
                id_token,
                pub_key,
                audience=oidc_config["client_id"],
                algorithms=algorithm,
            )

            email = decoded_id_token.get(
                config.get("get_user_by_oidc_settings.jwt_email_key", "email")
            )

            # For google auth, the access_token does not contain JWT-parsable claims.
            if config.get(
                "get_user_by_oidc_settings.get_groups_from_access_token", True
            ):
                try:
                    header = jwt.get_unverified_header(access_token)
                    key_id = header["kid"]
                    algorithm = header["alg"]
                    if algorithm == "none" or not algorithm:
                        raise UnableToAuthenticate(
                            "Access Token header does not specify a signing algorithm."
                        )
                    pub_key = oidc_config["jwt_keys"][key_id]
                    # This will raises errors if the audience isn't right or if the token is expired or has other
                    # errors.
                    decoded_access_token = jwt.decode(
                        access_token,
                        pub_key,
                        audience=config.get(
                            "get_user_by_oidc_settings.access_token_audience"
                        ),
                        algorithms=algorithm,
                    )
                except (DecodeError, KeyError) as e:
                    # This exception occurs when the access token is opaque or otherwise not JWT-parsable.
                    # It is expected with some IdPs.
                    log.debug(
                        {
                            **log_data,
                            "message": (
                                "Unable to derive user's groups from access_token. Attempting to get groups through "
                                "userinfo endpoint. "
                            ),
                            "error": e,