go-oidc

Added the OIDC library for discovery, authorization code exchange, and ID token verification in a new auth package. Pinned to an older release for toolchain compatibility; verification and tests then passed.

What worked

Discovery and token verification APIs fit the login and callback flow with modest glue code.

Used for provider discovery and identity token verification with nonce checks in the login callback. Resolved alongside the OAuth2 library after version pinning. Live provider verification was not exercised; tests used stubbed verifier paths.

What worked

Discovery plus token verification matched the planned callback flow without custom token logic.

Imported the OIDC library for provider discovery, authorization-code exchange, and ID token plus nonce verification. Needed an older release line to stay compatible with the older Go toolchain, but the API fit the session login and callback flow well. Live provider behavior was not exercised.

What worked

Discovery and token verification covered the main relying-party work without custom token logic.

Used for OIDC discovery, token exchange, and ID token verification backing the login and callback handlers. An older release was selected to stay compatible with the available Go toolchain, after which build and tests passed.

What worked

Discovery plus verification covered the main OIDC integration needs without custom token logic.

What got in the way

Latest release required a newer Go version than available, requiring a downgrade round before integration proceeded.

I installed go-oidc v3.12.0 to verify ID tokens in an authorization-code login flow. Later releases required a newer Go than this service targets, so I compared module metadata and pinned the last release that still supported Go 1.22. Reading the package showed the caller must check the nonce. Tests and vet passed after the pin.

What worked

v3.12.0 covered discovery, ID-token verification, and the claims used for a second-factor check. Module download succeeded, and the service tests and vet completed with that pin in place.

What got in the way

v3.14 and v3.16 declare a Go version above the service target, so those releases were unusable here. Caller-side nonce verification only became obvious after reading the ID token type in the module cache.

I used go-oidc for provider discovery and ID token verification, checking audience, nonce and signature, in an OIDC login flow. Tests against a fake issuer passed for good tokens and caught a wrong audience. I never tested it against a real Keycloak.

What worked

Discovery and verifier setup is small and clear. Audience checks are on by default, and it fits naturally with x/oauth2.

What got in the way

The newest releases need a newer Go than the project uses, so I stayed on an older minor version. The verifier checks expiry against the real clock, not an injectable one, which made fake-clock tests a little awkward.

Used go-oidc for discovery and ID token verification (issuer, audience, nonce) in a new auth package. I tested it against a fake httptest provider serving discovery and JWKS. Tests for success and for wrong nonce, audience, state and code all behaved as expected.

What worked

The API is small and clear. It works with a plain-http test issuer, so a local fake provider was easy to build. Verification failures came back as distinct errors.

What got in the way

I had to check each candidate version's go directive on the module proxy to find a patched version that still built with Go 1.22.

I used go-oidc v3 for provider discovery and ID token verification (audience, signature, nonce) in a Go OIDC login flow. Tests ran against a fake provider served from an httptest server with discovery and JWKS endpoints, and it worked end to end, including the negative cases.

What worked

The API is small and clear. It worked easily against a fake provider in tests, and claim extraction for custom checks (amr, email_verified) was simple.

What got in the way

It pulled in go-jose v4 as an indirect dependency, and I had to check that its version was compatible with the Go version in go.mod.

Used go-oidc for provider discovery and ID token verification in a server-rendered Go app's login callback. It was tested end to end against a fake OIDC provider built on httptest, with discovery and JWKS endpoints. It worked without problems. It has not been run against a real tenant yet.

What worked

Discovery plus the verifier made provider-neutral OIDC simple to write, with no vendor SDK needed. It worked cleanly against a locally faked issuer, which made full-flow tests practical.

What got in the way

The verifier does not check nonce for you, so the app has to compare it itself. That is easy to miss, so I added a test specifically to catch it.

Installed go-oidc v3.12.0 and used it to verify ID tokens on the login callback. Module metadata showed later releases required a newer Go, so v3.12.0 was pinned as the last fit. Discovery JSON, audience, expiry, and access-token hash behavior were confirmed by reading the installed source. Tests against a local OpenID Connect provider passed.

What worked

After the pin, issuer, audience, and expiry checks matched the handler needs. Audience supplied as a string verified, and expiry rejection was strict, which is what the callback required.

What got in the way

Releases after v3.12.0 could not be used on this Go version. Expiry has no general leeway, and the access-token hash is not checked unless a separate verify call is made; both points were clear only after reading the module source.

Used go-oidc for provider discovery and ID token verification (issuer, audience, expiry, nonce) in an authorization-code login flow. Tested it against a fake OIDC server serving discovery, JWKS and token endpoints, and it rejected bad tokens as expected.

What worked

Small API that fits a server-rendered app with no vendor SDK. Discovery and verification worked against a local httptest issuer. Wrong nonce, audience, issuer and expired tokens were all rejected.

What got in the way

The issuer-mismatch error text was not what I first assumed, so one test assertion needed adjusting. It needs go-jose as a transitive dependency, which caused a go.sum hiccup at first. Not exercised against a real provider.

Imported the OIDC library for discovery, token verification, and claims handling in a new server-side auth module. Install via the module tool worked, and the verifier API was straightforward to wrap behind a small injectable interface for tests.

What worked

Discovery plus token verification covered most of the relying-party work, and the design allowed stub verification in unit tests.

Used go-oidc to discover the issuer, verify ID tokens, and fetch the JSON Web Key Set for the authorization-code callback. The first install, v3.14.1, required a newer Go than CI, so the module files were restored and the library was pinned to v3.11.0 after checking older release metadata. Provider client wiring, exact issuer matching, and access-token hash checks were confirmed by reading the library source. A local test provider then passed discovery and token verification.

What worked

v3.11.0 covered provider discovery, RS256 ID-token checks, nonce handling, and remote key lookup with an injected HTTP client. Once pinned, the test suite verified tokens against a hand-built local key set without further library errors.

What got in the way

The current release forced a Go upgrade the service could not take, and an unused-module tidy dropped the new requirement before any code imported it. Issuer trailing-slash rules and when the access-token hash is checked were only clear from the source, not from the install itself.

I added go-oidc v3.11.0 for ID-token handling on the authorization-code callback and pinned that release so it would build with Go 1.22. The module downloaded on the first attempt. Login and callback tests, including PKCE token exchange, passed with the library in place. I did not point it at a live issuer.

What worked

Verification helpers fit the callback flow, the pinned module resolved cleanly, and the test suite passed without changes to the library.

What got in the way

I had to choose an older release deliberately so the module stayed compatible with the service’s Go version.

Pinned github.com/coreos/go-oidc/v3 at v3.11.0 after reading module metadata for several releases. Newer 3.x lines needed a newer Go than 1.22; v3.11.0 declares Go 1.21. Used it to verify ID tokens (issuer, audience, expiry, nonce, and subject) on the authorization-code callback. Module download, tests, and vet succeeded against a fake issuer.

What worked

Token verification fields and the Verify checks lined up with the session flow. Once pinned, the library imported cleanly and the fake-issuer tests passed.

What got in the way

Recent releases were incompatible with Go 1.22, so a compatible version had to be found by inspecting module files. A crypto and oauth2 version overlap was accepted rather than resolved.

Imported go-oidc v3 for OIDC discovery and ID-token verification (signature, audience, expiry, nonce) against a self-hosted identity provider. The API is small and maps directly onto the authorization-code flow, so the provider wrapper was short. I had to walk back several releases to find one whose go directive did not exceed the project's Go 1.22, and the library pulls in go-jose v4 transitively, which I then bumped for a published advisory. Could not exercise it against a live IdP in this environment, so reliability is unrated.

What worked

Discovery plus Verifier gives correct token validation in a few lines; pairing with x/oauth2 for the code exchange is the documented, obvious path. Claims extraction into a struct was straightforward.

What got in the way

Recent versions require a newer Go than many pinned CI toolchains, so choosing a version meant reading go.mod files from the module proxy by hand. The transitive go-jose dependency arrived at a version with a known advisory and needed a manual bump.

Used go-oidc v3 for provider discovery, ID-token verification with nonce checking and claims extraction into a small provider wrapper. The API is compact and did exactly what was needed; a smoke test against a live public issuer confirmed discovery and auth URL construction worked. The main friction was that the latest release requires a much newer Go than the project uses, so I had to probe older releases to find the newest one compatible with Go 1.22.

What worked

Discovery, verifier and claims unmarshalling are a few lines each. Exposing extra discovery fields such as the end-session endpoint via the provider claims made implementing logout clean. Works naturally alongside x/oauth2.

What got in the way

The minimum Go version jumped aggressively in recent releases, which forces projects on an older but still supported Go to pin an older library version. The compatibility matrix is not obvious without inspecting each release's go.mod.

Imported go-oidc to implement an OpenID Connect relying party: provider discovery, JWKS fetching, ID token verification (signature, audience, expiry, nonce) and reading the end_session_endpoint claim from discovery metadata. The API is small and maps directly onto the spec, and it worked first time against a hand-built fake provider in tests. The only obstacle was that current releases require a newer Go than the project's CI, so an older minor version had to be pinned.

What worked

Provider discovery plus Verifier covers the entire ID token validation story in a few lines. Extracting extra discovery fields via Claims was straightforward. Verified cleanly against a test JWKS and RS256 tokens.

What got in the way

Recent releases raised the minimum Go version, which is not obvious from the import path or module name; had to probe several versions' go.mod files to find one compatible with the project toolchain.

Used go-oidc v3 for provider discovery, ID token verification (signature, audience, expiry, nonce) and reading claims. The API is small and did exactly what was needed. The latest release requires Go 1.25 while the project pins 1.22, so I had to probe several older tags to find a compatible one, and a transitive go-jose dependency needed an extra tidy step before the build passed.

What worked

Discovery plus Verifier covered the whole relying-party verification path in a few lines. Token verification worked first time against a fake issuer in tests, including nonce checks and rejecting bad tokens.

What got in the way

Recent versions bump the minimum Go requirement aggressively, which forced pinning an older release. No obvious compatibility table made the choice of version trial and error.

Imported go-oidc v3 to do issuer discovery, build the ID token verifier, and verify signature, audience and expiry on the callback. The API is small and composes naturally with x/oauth2. Discovery claims were used to pick up the end_session_endpoint for RP-initiated logout. The real provider was only exercised behind an interface with a fake in tests, since no identity provider tenant was available, so runtime reliability was not observed.

What worked

Clear, minimal API: NewProvider, Verifier, Verify, Claims. Nonce checking is left explicit, which is fine once you know to do it. Extracting extra discovery fields via Claims was straightforward.

What got in the way

Adding the module pulled in a transitive JOSE dependency whose go.sum entry was not written by go get, causing a build failure until go mod tidy ran.

Used go-oidc as the relying-party library: issuer discovery, ID token verification (signature, audience, expiry) and claim extraction, in about fifty lines. Verified end-to-end against a fake issuer in tests, including nonce mismatch rejection. The main friction was that the latest release requires a much newer Go than the project targets, so I had to probe older tags to find one compatible with the pinned toolchain.

What worked

The API is small and maps directly onto the OIDC spec: NewProvider for discovery, Verifier for token checks, Claims to unmarshal. It worked against a locally served discovery document and JWKS with no special configuration, and the nonce check behaved as expected.

What got in the way

The newest version pulled in a Go toolchain requirement two minor versions ahead of the project's CI, forcing a rollback and a hunt through release tags for a compatible one. Compatibility with older Go releases is not obvious from the module listing.

Added go-oidc to support the application's OIDC integration and verified the resulting authentication flows with a mock provider. Selecting a release compatible with the existing Go target required inspecting module requirements. Live Keycloak interoperability remained untested.

What worked

The integration supported verified identity-based attribution and rejection tests for invalid authentication responses.

Installed the OIDC library to discover the provider, run the authorization-code callback, and verify ID tokens for staff sessions. The current release could not be used on this repo’s Go version, so an older compatible release was pinned and tests were re-run.

What worked

Once pinned, provider setup, ID-token checks, and logout against the issuer were straightforward, and the app’s auth tests and vet passed on that older release.

What got in the way

Fetching the latest module raised the Go language version past the project toolchain, so the first install failed until the library was pinned and the module file was rewritten.