Add support for verifying issuer when using oidc

src/key_store.rs

@@ -40,7 +40,7 @@ impl KeyStore {
         url: &str,
         audience: &str,
     ) -> Result<Self, JwksError> {
-        let (jwks_uri, alg) = match client.get(url).send().await?.json::<Oidc>().await {
+        let (jwks_uri, alg, iss) = match client.get(url).send().await?.json::<Oidc>().await {
             Ok(oidc) => {
                 let jwks_uri = oidc.jwks_uri;
                 let alg = match &oidc.id_token_signing_alg_values_supported {
@@ -50,11 +50,11 @@ impl KeyStore {
                     },
                     _ => None,
                 };
-                (jwks_uri.to_string(), alg)
+                (jwks_uri.to_string(), alg, oidc.issuer)
             }
-            _ => (url.to_string(), None),
+            _ => (url.to_string(), None, None),
         };
-        let keys = Self::from_jwks_url(client, &jwks_uri, audience, alg).await?;
+        let keys = Self::from_jwks_url(client, &jwks_uri, audience, alg, iss).await?;
         Ok(Self {
             keys,
             when: Instant::now(),
@@ -66,6 +66,7 @@ impl KeyStore {
         jwks_url: &str,
         audience: &str,
         alg: Option<jsonwebtoken::Algorithm>,
+        issuer: Option<String>,
     ) -> Result<Keys, JwksError> {
         let jwks: jwk::JwkSet = client.get(jwks_url).send().await?.json().await?;
 
@@ -85,6 +86,9 @@ impl KeyStore {
                     let mut validation =
                         Validation::new(jwk.common.algorithm.or(alg).unwrap_or(DEFAULT_ALG));
                     validation.set_audience(&[audience.clone()]);
+                    if let Some(iss) = issuer.clone() {
+                        validation.set_issuer(&[iss]);
+                    };
 
                     keys.insert(
                         kid,
@@ -112,6 +116,7 @@ impl KeyStore {
 struct Oidc {
     jwks_uri: String,
     id_token_signing_alg_values_supported: Option<Vec<String>>,
+    issuer: Option<String>,
 }
 
 type Keys = HashMap<String, Jwk>;