Accept audience specified in scope audience:server:client_id

[barrbrain]

The motivation is to support cross-client trust and authorized party (DexIdP). This PR only accepts the first such scope.

[ctron]

Thanks for the PR. I'd just like to understand it a bit better. So the idea is that "client A" requests a token for "client B". Therefore it will come back with "client B", and the verification expects "client A". The new code automatically extracts "client B" as a value, and uses it as an alternative for the verification.

This is Dex specific?

I like the fact that it's "automatic". But I also wonder if there's a way to do this more generic. Maybe not.

At least, I'd kindly ask you to add a bit of docs in the code of what happens there. Maybe extract this part in a dedicated function. I also think this could be enhanced to handling all such scopes (more than one). If that makes sense, let's add it. If it doesn't ok. If you don't have a good idea how to implement, I can take that part.

[ctron]

The CI fails because commits needs to conform to https://www.conventionalcommits.org/en/v1.0.0/ … I guess this would be feat:

[barrbrain]

I'm still looking for documentation of this scope beyond specific implementations.

• https://docs.aws.amazon.com/cognito/latest/developerguide/google.html
• https://github.com/edgeflare/ngx-oidc
• https://developer.mercedes-benz.com/de/produkte/vehicle_status_15/docs#_how_to_authenticate_management_api

It looks like it hit the mailing list once:

• https://lists.openid.net/pipermail/openid-specs-ab/2014-March/004632.html

[ctron]

I'd be ok with you summing this up at the fn level of this new function you added. Maybe adding those links. That should be a good pointer for the future. Maybe add a link to this PR, as a further point of reference. Just so that someone who sees that in the future has an idea of "why" that was done.

[barrbrain]

My first attempt at a fn level comment was a bit awkward and rendered poorly with cargo doc. I tried to be less terse and hopefully more clear.

[ctron]

❤️

[ctron]

Released as 0.6.4 (0.6.3 had a hiccup in the release CI)