Merge pull request #58544 from ericchiang/oidc-v2

Godeps/Godeps.json

@@ -895,24 +895,8 @@
 			"Rev": "95a726a27e09030f9ccbd9982a1508f5a6d25ada"
 		},
 		{
-			"ImportPath": "github.com/coreos/go-oidc/http",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
-		},
-		{
-			"ImportPath": "github.com/coreos/go-oidc/jose",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
-		},
-		{
-			"ImportPath": "github.com/coreos/go-oidc/key",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
-		},
-		{
-			"ImportPath": "github.com/coreos/go-oidc/oauth2",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
-		},
-		{
-			"ImportPath": "github.com/coreos/go-oidc/oidc",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
+			"ImportPath": "github.com/coreos/go-oidc",
+			"Rev": "065b426bd41667456c1a924468f507673629c46b"
 		},
 		{
 			"ImportPath": "github.com/coreos/go-semver/semver",
@@ -954,21 +938,6 @@
 			"Rev": "fa29b1d70f0beaddd4c7021607cc3c3be8ce94b8"
 		},
 		{
-			"ImportPath": "github.com/coreos/pkg/health",
-			"Comment": "v2-8-gfa29b1d",
-			"Rev": "fa29b1d70f0beaddd4c7021607cc3c3be8ce94b8"
-		},
-		{
-			"ImportPath": "github.com/coreos/pkg/httputil",
-			"Comment": "v2-8-gfa29b1d",
-			"Rev": "fa29b1d70f0beaddd4c7021607cc3c3be8ce94b8"
-		},
-		{
-			"ImportPath": "github.com/coreos/pkg/timeutil",
-			"Comment": "v2-8-gfa29b1d",
-			"Rev": "fa29b1d70f0beaddd4c7021607cc3c3be8ce94b8"
-		},
-		{
 			"ImportPath": "github.com/coreos/rkt/api/v1alpha",
 			"Comment": "v1.25.0",
 			"Rev": "ec37f3cb649bfb72408906e7cbf330e4aeda1075"
@@ -2481,6 +2450,14 @@
 			"Rev": "d8ed2627bdf02c080bf22230dbb337003b7aba2d"
 		},
 		{
+			"ImportPath": "github.com/pquerna/cachecontrol",
+			"Rev": "0dec1b30a0215bb68605dfc568e8855066c9202d"
+		},
+		{
+			"ImportPath": "github.com/pquerna/cachecontrol/cacheobject",
+			"Rev": "0dec1b30a0215bb68605dfc568e8855066c9202d"
+		},
+		{
 			"ImportPath": "github.com/prometheus/client_golang/prometheus",
 			"Comment": "v0.8.0-83-ge7e9030",
 			"Rev": "e7e903064f5e9eb5da98208bae10b475d4db0f8c"

cmd/kube-apiserver/app/options/options_test.go

@@ -210,6 +210,7 @@ func TestAddFlags(t *testing.T) {
 			BootstrapToken: &kubeoptions.BootstrapTokenAuthenticationOptions{},
 			OIDC: &kubeoptions.OIDCAuthenticationOptions{
 				UsernameClaim: "sub",
+				SigningAlgs:   []string{"RS256"},
 			},
 			PasswordFile:  &kubeoptions.PasswordFileAuthenticationOptions{},
 			RequestHeader: &apiserveroptions.RequestHeaderAuthenticationOptions{},

hack/.golint_failures

@@ -604,7 +604,6 @@ staging/src/k8s.io/apiserver/pkg/util/wsstream
 staging/src/k8s.io/apiserver/plugin/pkg/audit/log
 staging/src/k8s.io/apiserver/plugin/pkg/authenticator/password/passwordfile
 staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc
-staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testing
 staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/tokentest
 staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/webhook
 staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook
@@ -672,7 +671,6 @@ staging/src/k8s.io/client-go/kubernetes/typed/storage/v1alpha1
 staging/src/k8s.io/client-go/kubernetes/typed/storage/v1alpha1/fake
 staging/src/k8s.io/client-go/kubernetes/typed/storage/v1beta1
 staging/src/k8s.io/client-go/kubernetes/typed/storage/v1beta1/fake
-staging/src/k8s.io/client-go/plugin/pkg/auth/authenticator/token/oidc/testing
 staging/src/k8s.io/client-go/plugin/pkg/client/auth/oidc
 staging/src/k8s.io/client-go/rest
 staging/src/k8s.io/client-go/rest/fake

pkg/kubeapiserver/authenticator/config.go

@@ -58,6 +58,7 @@ type AuthenticatorConfig struct {
 	OIDCUsernamePrefix          string
 	OIDCGroupsClaim             string
 	OIDCGroupsPrefix            string
+	OIDCSigningAlgs             []string
 	ServiceAccountKeyFiles      []string
 	ServiceAccountLookup        bool
 	WebhookTokenAuthnConfigFile string
@@ -143,7 +144,7 @@ func (config AuthenticatorConfig) New() (authenticator.Request, *spec.SecurityDe
 	// simply returns an error, the OpenID Connect plugin may query the provider to
 	// update the keys, causing performance hits.
 	if len(config.OIDCIssuerURL) > 0 && len(config.OIDCClientID) > 0 {
-		oidcAuth, err := newAuthenticatorFromOIDCIssuerURL(config.OIDCIssuerURL, config.OIDCClientID, config.OIDCCAFile, config.OIDCUsernameClaim, config.OIDCUsernamePrefix, config.OIDCGroupsClaim, config.OIDCGroupsPrefix)
+		oidcAuth, err := newAuthenticatorFromOIDCIssuerURL(config.OIDCIssuerURL, config.OIDCClientID, config.OIDCCAFile, config.OIDCUsernameClaim, config.OIDCUsernamePrefix, config.OIDCGroupsClaim, config.OIDCGroupsPrefix, config.OIDCSigningAlgs)
 		if err != nil {
 			return nil, nil, err
 		}
@@ -235,7 +236,7 @@ func newAuthenticatorFromTokenFile(tokenAuthFile string) (authenticator.Token, e
 }
 
 // newAuthenticatorFromOIDCIssuerURL returns an authenticator.Token or an error.
-func newAuthenticatorFromOIDCIssuerURL(issuerURL, clientID, caFile, usernameClaim, usernamePrefix, groupsClaim, groupsPrefix string) (authenticator.Token, error) {
+func newAuthenticatorFromOIDCIssuerURL(issuerURL, clientID, caFile, usernameClaim, usernamePrefix, groupsClaim, groupsPrefix string, signingAlgs []string) (authenticator.Token, error) {
 	const noUsernamePrefix = "-"
 
 	if usernamePrefix == "" && usernameClaim != "email" {
@@ -251,14 +252,15 @@ func newAuthenticatorFromOIDCIssuerURL(issuerURL, clientID, caFile, usernameClai
 		usernamePrefix = ""
 	}
 
-	tokenAuthenticator, err := oidc.New(oidc.OIDCOptions{
-		IssuerURL:      issuerURL,
-		ClientID:       clientID,
-		CAFile:         caFile,
-		UsernameClaim:  usernameClaim,
-		UsernamePrefix: usernamePrefix,
-		GroupsClaim:    groupsClaim,
-		GroupsPrefix:   groupsPrefix,
+	tokenAuthenticator, err := oidc.New(oidc.Options{
+		IssuerURL:            issuerURL,
+		ClientID:             clientID,
+		CAFile:               caFile,
+		UsernameClaim:        usernameClaim,
+		UsernamePrefix:       usernamePrefix,
+		GroupsClaim:          groupsClaim,
+		GroupsPrefix:         groupsPrefix,
+		SupportedSigningAlgs: signingAlgs,
 	})
 	if err != nil {
 		return nil, err

pkg/kubeapiserver/options/authentication.go

@@ -61,6 +61,7 @@ type OIDCAuthenticationOptions struct {
 	UsernamePrefix string
 	GroupsClaim    string
 	GroupsPrefix   string
+	SigningAlgs    []string
 }
 
 type PasswordFileAuthenticationOptions struct {
@@ -208,6 +209,10 @@ func (s *BuiltInAuthenticationOptions) AddFlags(fs *pflag.FlagSet) {
 			"If provided, all groups will be prefixed with this value to prevent conflicts with "+
 			"other authentication strategies.")
 
+		fs.StringSliceVar(&s.OIDC.SigningAlgs, "oidc-signing-algs", []string{"RS256"}, ""+
+			"Comma-separated list of allowed JOSE asymmetric signing algorithms. JWTs with a "+
+			"'alg' header value not in this list will be rejected. "+
+			"Values are defined by RFC 7518 https://tools.ietf.org/html/rfc7518#section-3.1.")
 	}
 
 	if s.PasswordFile != nil {
@@ -272,6 +277,7 @@ func (s *BuiltInAuthenticationOptions) ToAuthenticationConfig() authenticator.Au
 		ret.OIDCIssuerURL = s.OIDC.IssuerURL
 		ret.OIDCUsernameClaim = s.OIDC.UsernameClaim
 		ret.OIDCUsernamePrefix = s.OIDC.UsernamePrefix
+		ret.OIDCSigningAlgs = s.OIDC.SigningAlgs
 	}
 
 	if s.PasswordFile != nil {

staging/BUILD

@@ -166,7 +166,6 @@ filegroup(
         "//staging/src/k8s.io/client-go/listers/storage/v1alpha1:all-srcs",
         "//staging/src/k8s.io/client-go/listers/storage/v1beta1:all-srcs",
         "//staging/src/k8s.io/client-go/pkg/version:all-srcs",
-        "//staging/src/k8s.io/client-go/plugin/pkg/auth/authenticator/token/oidc/testing:all-srcs",
         "//staging/src/k8s.io/client-go/plugin/pkg/client/auth:all-srcs",
         "//staging/src/k8s.io/client-go/rest:all-srcs",
         "//staging/src/k8s.io/client-go/scale:all-srcs",

staging/src/k8s.io/apiserver/Godeps/Godeps.json

@@ -327,24 +327,8 @@
 			"Rev": "95a726a27e09030f9ccbd9982a1508f5a6d25ada"
 		},
 		{
-			"ImportPath": "github.com/coreos/go-oidc/http",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
-		},
-		{
-			"ImportPath": "github.com/coreos/go-oidc/jose",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
-		},
-		{
-			"ImportPath": "github.com/coreos/go-oidc/key",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
-		},
-		{
-			"ImportPath": "github.com/coreos/go-oidc/oauth2",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
-		},
-		{
-			"ImportPath": "github.com/coreos/go-oidc/oidc",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
+			"ImportPath": "github.com/coreos/go-oidc",
+			"Rev": "065b426bd41667456c1a924468f507673629c46b"
 		},
 		{
 			"ImportPath": "github.com/coreos/go-semver/semver",
@@ -363,18 +347,6 @@
 			"Rev": "fa29b1d70f0beaddd4c7021607cc3c3be8ce94b8"
 		},
 		{
-			"ImportPath": "github.com/coreos/pkg/health",
-			"Rev": "fa29b1d70f0beaddd4c7021607cc3c3be8ce94b8"
-		},
-		{
-			"ImportPath": "github.com/coreos/pkg/httputil",
-			"Rev": "fa29b1d70f0beaddd4c7021607cc3c3be8ce94b8"
-		},
-		{
-			"ImportPath": "github.com/coreos/pkg/timeutil",
-			"Rev": "fa29b1d70f0beaddd4c7021607cc3c3be8ce94b8"
-		},
-		{
 			"ImportPath": "github.com/davecgh/go-spew/spew",
 			"Rev": "782f4967f2dc4564575ca782fe2d04090b5faca8"
 		},
@@ -559,6 +531,14 @@
 			"Rev": "d8ed2627bdf02c080bf22230dbb337003b7aba2d"
 		},
 		{
+			"ImportPath": "github.com/pquerna/cachecontrol",
+			"Rev": "0dec1b30a0215bb68605dfc568e8855066c9202d"
+		},
+		{
+			"ImportPath": "github.com/pquerna/cachecontrol/cacheobject",
+			"Rev": "0dec1b30a0215bb68605dfc568e8855066c9202d"
+		},
+		{
 			"ImportPath": "github.com/prometheus/client_golang/prometheus",
 			"Rev": "e7e903064f5e9eb5da98208bae10b475d4db0f8c"
 		},
@@ -615,6 +595,14 @@
 			"Rev": "81e90905daefcd6fd217b62423c0908922eadb30"
 		},
 		{
+			"ImportPath": "golang.org/x/crypto/ed25519",
+			"Rev": "81e90905daefcd6fd217b62423c0908922eadb30"
+		},
+		{
+			"ImportPath": "golang.org/x/crypto/ed25519/internal/edwards25519",
+			"Rev": "81e90905daefcd6fd217b62423c0908922eadb30"
+		},
+		{
 			"ImportPath": "golang.org/x/crypto/nacl/secretbox",
 			"Rev": "81e90905daefcd6fd217b62423c0908922eadb30"
 		},
@@ -671,6 +659,14 @@
 			"Rev": "1c05540f6879653db88113bc4a2b70aec4bd491f"
 		},
 		{
+			"ImportPath": "golang.org/x/oauth2",
+			"Rev": "a6bd8cefa1811bd24b86f8902872e4e8225f74c4"
+		},
+		{
+			"ImportPath": "golang.org/x/oauth2/internal",
+			"Rev": "a6bd8cefa1811bd24b86f8902872e4e8225f74c4"
+		},
+		{
 			"ImportPath": "golang.org/x/sys/unix",
 			"Rev": "95c6576299259db960f6c5b9b69ea52422860fce"
 		},
@@ -815,6 +811,18 @@
 			"Rev": "20b71e5b60d756d3d2f80def009790325acc2b23"
 		},
 		{
+			"ImportPath": "gopkg.in/square/go-jose.v2",
+			"Rev": "f8f38de21b4dcd69d0413faf231983f5fd6634b1"
+		},
+		{
+			"ImportPath": "gopkg.in/square/go-jose.v2/cipher",
+			"Rev": "f8f38de21b4dcd69d0413faf231983f5fd6634b1"
+		},
+		{
+			"ImportPath": "gopkg.in/square/go-jose.v2/json",
+			"Rev": "f8f38de21b4dcd69d0413faf231983f5fd6634b1"
+		},
+		{
 			"ImportPath": "gopkg.in/yaml.v2",
 			"Rev": "670d4cfef0544295bc27a114dbac37980d83185a"
 		},

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/BUILD

@@ -9,12 +9,12 @@ load(
 go_test(
     name = "go_default_test",
     srcs = ["oidc_test.go"],
+    data = glob(["testdata/**"]),
     embed = [":go_default_library"],
     deps = [
-        "//vendor/github.com/coreos/go-oidc/jose:go_default_library",
-        "//vendor/github.com/coreos/go-oidc/oidc:go_default_library",
+        "//vendor/github.com/coreos/go-oidc:go_default_library",
+        "//vendor/gopkg.in/square/go-jose.v2:go_default_library",
         "//vendor/k8s.io/apiserver/pkg/authentication/user:go_default_library",
-        "//vendor/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testing:go_default_library",
     ],
 )
 
@@ -23,11 +23,10 @@ go_library(
     srcs = ["oidc.go"],
     importpath = "k8s.io/apiserver/plugin/pkg/authenticator/token/oidc",
     deps = [
-        "//vendor/github.com/coreos/go-oidc/jose:go_default_library",
-        "//vendor/github.com/coreos/go-oidc/oidc:go_default_library",
+        "//vendor/github.com/coreos/go-oidc:go_default_library",
         "//vendor/github.com/golang/glog:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/util/net:go_default_library",
-        "//vendor/k8s.io/apimachinery/pkg/util/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/wait:go_default_library",
         "//vendor/k8s.io/apiserver/pkg/authentication/user:go_default_library",
         "//vendor/k8s.io/client-go/util/cert:go_default_library",
     ],
@@ -42,9 +41,6 @@ filegroup(
 
 filegroup(
     name = "all-srcs",
-    srcs = [
-        ":package-srcs",
-        "//staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testing:all-srcs",
-    ],
+    srcs = [":package-srcs"],
     tags = ["automanaged"],
 )

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testdata/ecdsa_1.pem

+-----BEGIN EC PRIVATE KEY-----
+MIHcAgEBBEIAvxtZy9aI/lEt6LVLIhVrWLSwmlMFThU/nZUPr88nA5yKzJMyKbW/
+QA+umam9YtO78WwzriTGC9qwW6+t+liXrcCgBwYFK4EEACOhgYkDgYYABAGzIO9n
+tdTx6oVg1O59ljYP4FHY9RNUy+wHeXFnB6fo9asGg9jwLMg/iX0F+whFkllQjNLf
+kKp/9ATWQHrzSbzuqwB9UU5zfQ3ulhMwEBpxbM6aSi1HyYtc5pQn7KB6h1VXiuQK
+CIj4kVYHClZuKz0om/XAJL4vWVDwJqDBN6m9Yi9ZLQ==
+-----END EC PRIVATE KEY-----

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testdata/ecdsa_2.pem

+-----BEGIN EC PRIVATE KEY-----
+MIHcAgEBBEIBtxiwrrDmi1U+NxClUKIr2cvmL6PPLxjAULjPuORt0AWbqKakphSJ
+43VmIbPBBCuLnN2PuVS9N8jLDlR1KUnnFSGgBwYFK4EEACOhgYkDgYYABAEgshGY
+Oflwnz2SQOWIkvSPmijMhS4nWmLYedR2H/Dg9c9nuiyQqL3XpqkPnQQwqOgcXjMT
+hTec2tiLcRS3Gj02yQEpe/6Do6if4K4cQ9KsNtVHsn0bibsqLtRuvI7xUu9JJAs7
+vSLNUtmxVzFo4s4spnIjLT71uz1Vag/NrKwot7cz4g==
+-----END EC PRIVATE KEY-----

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testdata/ecdsa_3.pem

+-----BEGIN EC PRIVATE KEY-----
+MIHcAgEBBEIAQTHP4V93rz1w1D+jF1Jvx5QHzkQQIYxbN1LPuvQjEoplQrjZ4Qiu
+h9mKK6DBCaDlfSos+wnTOlZH1z1tpa9soPOgBwYFK4EEACOhgYkDgYYABAFn+QOY
+a937Lp+WO1S+zJU9ITnzdvjqQtD/TjtJPQsllV8rD0QNXZb/pLFQFZtDEehiZKEu
+WA0REGNs+rVMO63YZAAyDMwZTz87ulH23OR6EaoyDp9qEPx7kpxgaJqeIztla2t8
+SLVpv/FPR92E/OmguT6sFI5mP0AhV8UVlLYuHaovnw==
+-----END EC PRIVATE KEY-----

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testdata/gen.sh

+#!/bin/bash -e
+
+# Copyright 2018 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+rm *.pem
+
+for N in `seq 1 3`; do
+    ssh-keygen -t rsa -b 2048 -f rsa_$N.pem -N ''
+done
+
+for N in `seq 1 3`; do
+    ssh-keygen -t ecdsa -b 521 -f ecdsa_$N.pem -N ''
+done
+
+rm *.pub

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testdata/rsa_1.pem

+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEA0pXWMYjWRjBEds/fKj/u9r2E6SIDx0J+TAg+eyVeR20Ky9jZ
+mIXW5zSxE/EKpNQpiBWm1e6G9kmhMuqjr7g455S7E+3rD3OVkdTT6SU5AKBNSFoR
+XUd+G/YJEtRzrpEYNtEJHkxUxWuyfCHblHSt+wsrE6t0DccCqC87lKQiGb/QfC8u
+P6ZS99SCjKBEFp1fZvyNkYwStFc2OH5fBGPXXb6SNsquvDeKX9NeWjXkmxDkbOg2
+kSkel4s/zw5KwcW3JzERfEcLStrDQ8fRbJ1C3uC088sUk4q4APQmKI/8FTvJe431
+Vne9sOSptphiqCjlR+Knja58rc/vt4TkSPZf2wIDAQABAoIBAQDO3UgjMtOi8Wlf
++YW1IEbjdXrp9XMWu9gLYpHWMPgzXAeeBfCDJv7b8uP8ve2By7TcrMBOKVnE+MF0
+nhCb3nFv9KftxOsDK70DG7nrrpgXaGFisK+cHU3hs8hoCfF1y6yotKGrdLpVkR0t
+Wak1ZYU/NlJjqSqBGj0e7/8sXivtc7oME8tBBRBCEa8OqPqaelCInfFF1rX5vmxX
+pQjPpZoA+vroSJy8SYE0N5oqtGwOPT+9rVuDOL10eaMbGUcssZl8ofwuvzOYPMW4
+KFSVtvdtKnACq94Qy6XQbK5hZbZXSpzxANKq8SFyG2N1wOlpu/ktdXqkyDs08AZY
+c/KkpXspAoGBAPdC73GOZn/hxzkwZ2Dl+S9rgrLT3VbeuhMp6GXSdiT+f9babMuw
+HlYw6uULmvL1gD/0GmyWrHopPFJxodBG5SlwYS5wl49slcxeKCjK26vbNfK2eCbu
+9uMtED4dN/5NlaXF4hqy/FmSyaFhQT+5hvx8n/zvLsgpuSQ+SCiDAHMfAoGBANoH
+FCZeCWzzUFhObYG9wxGJ9FBPQa0htafIYEgTwezlKPsrfXfCTnVg1lLkr6Z4IwYQ
+9VufJZNAc5V0X9H/ceyKJYxhQ+E01NEVzVpoK8fOC4yCYSYtbJnqkOUQzZJzkjFT
+mNcIa8o4UrBOWzMhMQa0AOZH4VrbtZDCZhid+hfFAoGAAbKh9kOmDIa+WXQtoYqy
+tVKlqRivUmNhH7SP9fMGAKcGtbD2QkfJTYo0crIrtDNfWBETBV/be1NBKMfC9q0l
+8azl3e3D/KYgOTEEUZNjAsEUk8AQ/yNw6opqrCKDOenKd0LulIRaGztYyxTh39Ak
+TyOD7bauuY0fylHrKOwNWr0CgYEAsVZ0o0h1rjKyNUGFfLQWyFtHZ1Mv/lye3tvy
+xG2dnMxAaxvSr+hR3NNpQH9WB7dL9ZExoNZvv7f6y6OelLaLuXQcWnR6u+E3AOIU
+5+Y3RgtoBV+/GUh1PzQ1qrviGa77SDfQ54an9hGd4F27fHkQ4XzkBmqM+FQg+J/G
+X1uPomkCgYBo4ZBEA20Wvf1k2iWOVdfsxZNeOLxwcN5x89dAvm0v6RHg2NMy+XKw
+Rj+YRuudFdxfg39J/V/Md9qsvjW+4FthD8GhgPs22dksV+7j6ApWkYTmIKG4rmh3
+RhHOr6uLg9BeShnlvMMaMJKf2eA7SaVtmuS6uBGgEUNaa3qEBq0R+Q==
+-----END RSA PRIVATE KEY-----

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testdata/rsa_2.pem

+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAxmLv1fqjacxZu5jyfQzytwjdt9/BBDzPM6G+R92YvsB7o2FH
+ISiySbT8pyj7wGUgDvBdc9+GT3thf2pKGl/THaYJCLbh90GXVMTTak8Najqp2Qod
+kxIpjSOBgukmd0LUtUVGKJg7YTEqsxAUmn9mfFiUZ6ixHr0U2NAXu7TF4dw7C9bt
+ORi9DKDfUhEiV3Vcyrc5d/9VdmWG6fs/kq0B/6AboiSIIGAKSugNi4BgV7rNZYwZ
+37UT72CW28TQQuuAtmTgXWMkfeWZiQKD1P8Nl1byORpgivp2A+2pMNlcLuogVhGY
+TIZstbeMqoPyLW57GitWDg1tbakwJdCR23gCKQIDAQABAoIBACZmDf//1FNtD01F
+TGIx+GS/HZMyhvyX/I8E1ny4gpEhVo0IDil35BJqKqD8SMYzjKH3mk8MS8Xknrl3
+zEIQnB9X/NWn+FLQakcpFba0+GbAVhHBaHoIAOzlm3LIR/67e8peTzcaSBwG1Tn1
+eddxo1ecGZV6zFWjyX4xwPY/BjIyA/b1LewqIK6W/I4u3RwtEzqANV9ddVbFH53e
+Y+i2X1HVuLm0LETsX4jB/G/ZDP6Y101gOwPFddm+h1ixZ2jrAkyTbvYL5ukIsU8Z
+okIEZsd6nv08YN+LOXOPh0CxvgHI347RDzgfbDmHGqq8gh20+wLP/MV+dOiBBAJT
+RfnoFcUCgYEA8SpMW64CNhRkH3Nv5A5ffSOa7NqiN7OdNEswgcgkAbjR5YsTATPg
+p9iWqGcEodX1FWjnL2NLMdMvYxh4MwMCACIa8FQ2/RDEwViaVjxcOK64MIvyvnNq
+NObx8pMClUBXWF/llxxTR+/CJWRdCABBm56lQPuuX/qEi/xqybHPcAcCgYEA0pb9
+FGmGhDXl3bG3zNNIim+FuqG0xQoIjVPwdvkMI30h/ii6qs3jxwHlw6KBf8AI9wI+
+bWbzhwcYVkS6It0Yj4q/mqOVHi89frrAQygsJkMQkdl8WiWwPeiiIdsHYTUcBv5+
+i6YLs8ycnzMeFAxg8kuxrq6mm3yW6u5CuInsEE8CgYAWXqUMj/x2hbevzyZe0hJ7
+ahURyUnovsljM2JBd44XdsxJbXgK0YQSLZ3z6vJcDJuaK8vd8mjkK0GnAHsNyEak
+OoWjKzyahrapdI2EWD75pwNAxYpzrgL4+z8QECDaNUik0uhZ9u+mqY+ppkCW4Gc1
+hyau+2l2T6eB0J0bLloeewKBgQC+fZn8JuBpI6AEg8ew3cYWg37CLZgpTEQkIzO3
+StyyFXT0RL9l1cwerha6ensNphX16e+yYpgTIlXfY1fERZ776RQcu7Adl7nWsvNL
+TEFzcuLAK60SlljwB0jxuwDX64SoxviNNewL/iAG2eRxWikvw0y8qHtI1tBlPpTX
+/NqufQKBgD1jAPRgu+IN9IDXoqnMiXbSfrVsJ1ndyPCRBq4dfvawcbEDTZfkiid0
+aNrdRoOETfLCynAcG6o6uS3+2sumzXLrMNr8MDF8NEa2Rh8nN3IjZqESV4CNgaV6
+JhAlWFp+AvYv6N1iHK52nNAFiX/cfaMpWTUKqk2Z4VZCr5qhLUVs
+-----END RSA PRIVATE KEY-----

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testdata/rsa_3.pem

+-----BEGIN RSA PRIVATE KEY-----
+MIIEpgIBAAKCAQEA1uO3LV0wHadHjQb8U8KGUpzlZTyBHlinL7lF5yKk2hXOyssT
+Z0UVF6ofPq/L+ZN5VkTb1FJWMEBiX1BgXlboDdYKAYTl1QaeEQrfrAM4gp2FdWS4
+fMUuagFdVXs8T2J4GGPEE83ybwz/YEM3p83Qojifvx/IjVtuHCMkUpcj92scjsCY
+EeSKRjJicVBmJ1RK0ShEorHhnYmokKYsPl41mV5VdmWZOtmPK4jV05cBfg7eC7yI
+cwwYhowLkYvd9d9H74otK5tD7KTxFG6JJ0N5zwf6XBRcXBWKstfOOZ5Qgo9z0Tkm
+n3Klp9vwun25aaA1MlSSByByiCb7qvS8jhqMkQIDAQABAoIBAQCjN58AU9GiFFai
+ZXXuYMgJo6YRON2RoSCLfRv9LTEtfHbvTUPVooEc0lidEoXJcRwuTGr0X/2a9KxD
+XRd1UGk9aR98e+bd4QLaSvoM+v1HKEIgInqGOnbAiXzM2qe6XD5/t/dMW5cShjrK
+cQOq7wbS0FN1pbx8sb92m7KREL9+wnXuOCHYtublRf7arsMkaZcpSBBaI+raMaZR
+dUC+LmalIvR8+dNegducwWsdE8/Vh+xq97ZbNFlyut3JOvfuHmaAOvUsX/4touj2
+dDkJmvzvmpTBG888t+6hv9eKWaacsTAKuPLThRBD53coTEvHK8iic9fOok65y5Bn
+nFP/irUpAoGBAPUsPoAPwcNajZX/E4XeG/2eV+IHMxYR9gJwBzpoUfwHr5mR54HK
+POia/z7/M2KVV9kMWBlbTumIHSEylEEDCCKNNIe1gHBxQ7uGuaf+vVXpVgjBigUz
+7oiCjb5RdjevfiyudX/z0B9IQSI9djCXebifEHKpUxAOmU3oP0SEMULLAoGBAOBh
+G+fDouMU7QN93NG0hssu44yc7xQhb7VLB+isrEQASVG2xWkd3iDrdRxwHAHZqxFd
+4DRzDTFC7yeR+FEbVVkWQRaeDwFJM1zmRTXsYjBkK49GNzB4QEtHvPouuxMAQ4UD
+zJ9a3LEDSs867R7XEbNF8j9NC9z0vk7w9bHTA1aTAoGBAODUUQBY8sQ1zy8lOf8B
+/sMmKMti9Mshb2su1sIOFli7p6F5tkZEcnSQZs+bccDO2T92XXfrTsNDigr+egvg
+Pt6IhQqKPB1hEM7wLmLLbU9Sag4fhXVd+TmAF4HW7EUGjvtkhOXwbQOy2+ANYswO
+rJXMcGXltwE7kgRqnVI0s4PfAoGBALUrM5Dq0bZwyv6qvYVFMiEUdv6uKAwlA0Fq
+l7Qy19UANjMYVEUPrK7/7stLahHEYu/e0I0I6HoCBX/5yHoUi9Emut88N/ld1W8J
+LpDfkFhqSRGiLCWisqcWAWwwFzS8XcgkzS9N+iui8OBqP9NK7CvIKlUaLJ33r0Gm
+JXuzWVqpAoGBAIQ8+YuvFfyhwXuWwQbzxVpWRURH0FRu8KfFIkFFbdyht6leYXuj
+uxcrcHWzkEPSLO22BoJX8ECHq4LadAIjkkpr5GCikKCF+r/bq50RnECqvfoJ629J
+gA87C8cLU3dXmSYd+vSg6icZyncTmXyyEV0dqoUGJ2M33kE6hYAbc/ic
+-----END RSA PRIVATE KEY-----

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testing/BUILD

-package(default_visibility = ["//visibility:public"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = ["provider.go"],
-    importpath = "k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testing",
-    deps = [
-        "//vendor/github.com/coreos/go-oidc/jose:go_default_library",
-        "//vendor/github.com/coreos/go-oidc/key:go_default_library",
-        "//vendor/github.com/coreos/go-oidc/oidc:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-)

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/testing/provider.go

-/*
-Copyright 2016 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package testing
-
-import (
-	"bytes"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/tls"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/json"
-	"encoding/pem"
-	"fmt"
-	"io/ioutil"
-	"math/big"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"os"
-	"path"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/coreos/go-oidc/jose"
-	"github.com/coreos/go-oidc/key"
-	"github.com/coreos/go-oidc/oidc"
-)
-
-// NewOIDCProvider provides a bare minimum OIDC IdP Server useful for testing.
-func NewOIDCProvider(t *testing.T, issuerPath string) *OIDCProvider {
-	privKey, err := key.GeneratePrivateKey()
-	if err != nil {
-		t.Fatalf("Cannot create OIDC Provider: %v", err)
-		return nil
-	}
-
-	op := &OIDCProvider{
-		Mux:        http.NewServeMux(),
-		PrivKey:    privKey,
-		issuerPath: issuerPath,
-	}
-
-	op.Mux.HandleFunc(path.Join(issuerPath, "/.well-known/openid-configuration"), op.handleConfig)
-	op.Mux.HandleFunc(path.Join(issuerPath, "/keys"), op.handleKeys)
-
-	return op
-}
-
-type OIDCProvider struct {
-	Mux        *http.ServeMux
-	PCFG       oidc.ProviderConfig
-	PrivKey    *key.PrivateKey
-	issuerPath string
-}
-
-func (op *OIDCProvider) ServeTLSWithKeyPair(cert, key string) (*httptest.Server, error) {
-	srv := httptest.NewUnstartedServer(op.Mux)
-
-	srv.TLS = &tls.Config{Certificates: make([]tls.Certificate, 1)}
-	var err error
-	srv.TLS.Certificates[0], err = tls.LoadX509KeyPair(cert, key)
-	if err != nil {
-		return nil, fmt.Errorf("Cannot load cert/key pair: %v", err)
-	}
-	srv.StartTLS()
-
-	// The issuer's URL is extended by an optional path. This ensures that the plugin can
-	// handle issuers that use a non-root path for discovery (see kubernetes/kubernetes#29749).
-	srv.URL = srv.URL + op.issuerPath
-
-	u, err := url.Parse(srv.URL)
-	if err != nil {
-		return nil, err
-	}
-	pathFor := func(p string) *url.URL {
-		u2 := *u // Shallow copy.
-		u2.Path = path.Join(u2.Path, p)
-		return &u2
-	}
-
-	op.PCFG = oidc.ProviderConfig{
-		Issuer:                  u,
-		AuthEndpoint:            pathFor("/auth"),
-		TokenEndpoint:           pathFor("/token"),
-		KeysEndpoint:            pathFor("/keys"),
-		ResponseTypesSupported:  []string{"code"},
-		SubjectTypesSupported:   []string{"public"},
-		IDTokenSigningAlgValues: []string{"RS256"},
-	}
-	return srv, nil
-}
-
-func (op *OIDCProvider) handleConfig(w http.ResponseWriter, req *http.Request) {
-	b, err := json.Marshal(&op.PCFG)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
-		return
-	}
-	w.Header().Set("Content-Type", "application/json")
-	w.Write(b)
-}
-
-func (op *OIDCProvider) handleKeys(w http.ResponseWriter, req *http.Request) {
-	keys := struct {
-		Keys []jose.JWK `json:"keys"`
-	}{
-		Keys: []jose.JWK{op.PrivKey.JWK()},
-	}
-
-	b, err := json.Marshal(keys)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
-		return
-	}
-
-	w.Header().Set("Cache-Control", fmt.Sprintf("public, max-age=%d", int(time.Hour.Seconds())))
-	w.Header().Set("Expires", time.Now().Add(time.Hour).Format(time.RFC1123))
-	w.Header().Set("Content-Type", "application/json")
-	w.Write(b)
-}
-
-// generateSelfSignedCert generates a self-signed cert/key pairs and writes to the certPath/keyPath.
-// This method is mostly identical to crypto.GenerateSelfSignedCert except for the 'IsCA' and 'KeyUsage'
-// in the certificate template. (Maybe we can merge these two methods).
-func GenerateSelfSignedCert(t *testing.T, host, certPath, keyPath string) {
-	priv, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	template := x509.Certificate{
-		SerialNumber: big.NewInt(1),
-		Subject: pkix.Name{
-			CommonName: fmt.Sprintf("%s@%d", host, time.Now().Unix()),
-		},
-		NotBefore: time.Now(),
-		NotAfter:  time.Now().Add(time.Hour * 24 * 365),
-
-		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		BasicConstraintsValid: true,
-		IsCA: true,
-	}
-
-	if ip := net.ParseIP(host); ip != nil {
-		template.IPAddresses = append(template.IPAddresses, ip)
-	} else {
-		template.DNSNames = append(template.DNSNames, host)
-	}
-
-	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Generate cert
-	certBuffer := bytes.Buffer{}
-	if err := pem.Encode(&certBuffer, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
-		t.Fatal(err)
-	}
-
-	// Generate key
-	keyBuffer := bytes.Buffer{}
-	if err := pem.Encode(&keyBuffer, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)}); err != nil {
-		t.Fatal(err)
-	}
-
-	// Write cert
-	if err := os.MkdirAll(filepath.Dir(certPath), os.FileMode(0755)); err != nil {
-		t.Fatal(err)
-	}
-	if err := ioutil.WriteFile(certPath, certBuffer.Bytes(), os.FileMode(0644)); err != nil {
-		t.Fatal(err)
-	}
-
-	// Write key
-	if err := os.MkdirAll(filepath.Dir(keyPath), os.FileMode(0755)); err != nil {
-		t.Fatal(err)
-	}
-	if err := ioutil.WriteFile(keyPath, keyBuffer.Bytes(), os.FileMode(0600)); err != nil {
-		t.Fatal(err)
-	}
-}

staging/src/k8s.io/client-go/Godeps/Godeps.json

@@ -31,38 +31,6 @@
 			"Rev": "d4e6b95c12a08b4de2d48b45d5b4d594e5d32fab"
 		},
 		{
-			"ImportPath": "github.com/coreos/go-oidc/http",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
-		},
-		{
-			"ImportPath": "github.com/coreos/go-oidc/jose",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
-		},
-		{
-			"ImportPath": "github.com/coreos/go-oidc/key",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
-		},
-		{
-			"ImportPath": "github.com/coreos/go-oidc/oauth2",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
-		},
-		{
-			"ImportPath": "github.com/coreos/go-oidc/oidc",
-			"Rev": "a4973d9a4225417aecf5d450a9522f00c1f7130f"
-		},
-		{
-			"ImportPath": "github.com/coreos/pkg/health",
-			"Rev": "fa29b1d70f0beaddd4c7021607cc3c3be8ce94b8"
-		},
-		{
-			"ImportPath": "github.com/coreos/pkg/httputil",
-			"Rev": "fa29b1d70f0beaddd4c7021607cc3c3be8ce94b8"
-		},
-		{
-			"ImportPath": "github.com/coreos/pkg/timeutil",
-			"Rev": "fa29b1d70f0beaddd4c7021607cc3c3be8ce94b8"
-		},
-		{
 			"ImportPath": "github.com/davecgh/go-spew/spew",
 			"Rev": "782f4967f2dc4564575ca782fe2d04090b5faca8"
 		},
@@ -179,10 +147,6 @@
 			"Rev": "6633656539c1639d9d78127b7d47c622b5d7b6dc"
 		},
 		{
-			"ImportPath": "github.com/jonboulle/clockwork",
-			"Rev": "72f9bd7c4e0c2a40055ab3d0f09654f730cce982"
-		},
-		{
 			"ImportPath": "github.com/json-iterator/go",
 			"Rev": "13f86432b882000a51c6e610c620974462691a97"
 		},

staging/src/k8s.io/client-go/plugin/pkg/auth/authenticator/token/oidc/testing/BUILD

-package(default_visibility = ["//visibility:public"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = ["provider.go"],
-    importpath = "k8s.io/client-go/plugin/pkg/auth/authenticator/token/oidc/testing",
-    deps = [
-        "//vendor/github.com/coreos/go-oidc/jose:go_default_library",
-        "//vendor/github.com/coreos/go-oidc/key:go_default_library",
-        "//vendor/github.com/coreos/go-oidc/oidc:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-)

staging/src/k8s.io/client-go/plugin/pkg/auth/authenticator/token/oidc/testing/provider.go

-/*
-Copyright 2016 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package testing
-
-import (
-	"bytes"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/tls"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/json"
-	"encoding/pem"
-	"fmt"
-	"io/ioutil"
-	"math/big"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"os"
-	"path"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/coreos/go-oidc/jose"
-	"github.com/coreos/go-oidc/key"
-	"github.com/coreos/go-oidc/oidc"
-)
-
-// NewOIDCProvider provides a bare minimum OIDC IdP Server useful for testing.
-func NewOIDCProvider(t *testing.T, issuerPath string) *OIDCProvider {
-	privKey, err := key.GeneratePrivateKey()
-	if err != nil {
-		t.Fatalf("Cannot create OIDC Provider: %v", err)
-		return nil
-	}
-
-	op := &OIDCProvider{
-		Mux:        http.NewServeMux(),
-		PrivKey:    privKey,
-		issuerPath: issuerPath,
-	}
-
-	op.Mux.HandleFunc(path.Join(issuerPath, "/.well-known/openid-configuration"), op.handleConfig)
-	op.Mux.HandleFunc(path.Join(issuerPath, "/keys"), op.handleKeys)
-
-	return op
-}
-
-type OIDCProvider struct {
-	Mux        *http.ServeMux
-	PCFG       oidc.ProviderConfig
-	PrivKey    *key.PrivateKey
-	issuerPath string
-}
-
-func (op *OIDCProvider) ServeTLSWithKeyPair(cert, key string) (*httptest.Server, error) {
-	srv := httptest.NewUnstartedServer(op.Mux)
-
-	srv.TLS = &tls.Config{Certificates: make([]tls.Certificate, 1)}
-	var err error
-	srv.TLS.Certificates[0], err = tls.LoadX509KeyPair(cert, key)
-	if err != nil {
-		return nil, fmt.Errorf("Cannot load cert/key pair: %v", err)
-	}
-	srv.StartTLS()
-
-	// The issuer's URL is extended by an optional path. This ensures that the plugin can
-	// handle issuers that use a non-root path for discovery (see kubernetes/kubernetes#29749).
-	srv.URL = srv.URL + op.issuerPath
-
-	u, err := url.Parse(srv.URL)
-	if err != nil {
-		return nil, err
-	}
-	pathFor := func(p string) *url.URL {
-		u2 := *u // Shallow copy.
-		u2.Path = path.Join(u2.Path, p)
-		return &u2
-	}
-
-	op.PCFG = oidc.ProviderConfig{
-		Issuer:                  u,
-		AuthEndpoint:            pathFor("/auth"),
-		TokenEndpoint:           pathFor("/token"),
-		KeysEndpoint:            pathFor("/keys"),
-		ResponseTypesSupported:  []string{"code"},
-		SubjectTypesSupported:   []string{"public"},
-		IDTokenSigningAlgValues: []string{"RS256"},
-	}
-	return srv, nil
-}
-
-func (op *OIDCProvider) handleConfig(w http.ResponseWriter, req *http.Request) {
-	b, err := json.Marshal(&op.PCFG)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
-		return
-	}
-	w.Header().Set("Content-Type", "application/json")
-	w.Write(b)
-}
-
-func (op *OIDCProvider) handleKeys(w http.ResponseWriter, req *http.Request) {
-	keys := struct {
-		Keys []jose.JWK `json:"keys"`
-	}{
-		Keys: []jose.JWK{op.PrivKey.JWK()},
-	}
-
-	b, err := json.Marshal(keys)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
-		return
-	}
-
-	w.Header().Set("Cache-Control", fmt.Sprintf("public, max-age=%d", int(time.Hour.Seconds())))
-	w.Header().Set("Expires", time.Now().Add(time.Hour).Format(time.RFC1123))
-	w.Header().Set("Content-Type", "application/json")
-	w.Write(b)
-}
-
-// generateSelfSignedCert generates a self-signed cert/key pairs and writes to the certPath/keyPath.
-// This method is mostly identical to crypto.GenerateSelfSignedCert except for the 'IsCA' and 'KeyUsage'
-// in the certificate template. (Maybe we can merge these two methods).
-func GenerateSelfSignedCert(t *testing.T, host, certPath, keyPath string) {
-	priv, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	template := x509.Certificate{
-		SerialNumber: big.NewInt(1),
-		Subject: pkix.Name{
-			CommonName: fmt.Sprintf("%s@%d", host, time.Now().Unix()),
-		},
-		NotBefore: time.Now(),
-		NotAfter:  time.Now().Add(time.Hour * 24 * 365),
-
-		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		BasicConstraintsValid: true,
-		IsCA: true,
-	}
-
-	if ip := net.ParseIP(host); ip != nil {
-		template.IPAddresses = append(template.IPAddresses, ip)
-	} else {
-		template.DNSNames = append(template.DNSNames, host)
-	}
-
-	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Generate cert
-	certBuffer := bytes.Buffer{}
-	if err := pem.Encode(&certBuffer, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
-		t.Fatal(err)
-	}
-
-	// Generate key
-	keyBuffer := bytes.Buffer{}
-	if err := pem.Encode(&keyBuffer, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)}); err != nil {
-		t.Fatal(err)
-	}
-
-	// Write cert
-	if err := os.MkdirAll(filepath.Dir(certPath), os.FileMode(0755)); err != nil {
-		t.Fatal(err)
-	}
-	if err := ioutil.WriteFile(certPath, certBuffer.Bytes(), os.FileMode(0644)); err != nil {
-		t.Fatal(err)
-	}
-
-	// Write key
-	if err := os.MkdirAll(filepath.Dir(keyPath), os.FileMode(0755)); err != nil {
-		t.Fatal(err)
-	}
-	if err := ioutil.WriteFile(keyPath, keyBuffer.Bytes(), os.FileMode(0600)); err != nil {
-		t.Fatal(err)
-	}
-}

vendor/BUILD

@@ -119,11 +119,7 @@ filegroup(
         "//vendor/github.com/coreos/etcd/store:all-srcs",
         "//vendor/github.com/coreos/etcd/version:all-srcs",
         "//vendor/github.com/coreos/etcd/wal:all-srcs",
-        "//vendor/github.com/coreos/go-oidc/http:all-srcs",
-        "//vendor/github.com/coreos/go-oidc/jose:all-srcs",
-        "//vendor/github.com/coreos/go-oidc/key:all-srcs",
-        "//vendor/github.com/coreos/go-oidc/oauth2:all-srcs",
-        "//vendor/github.com/coreos/go-oidc/oidc:all-srcs",
+        "//vendor/github.com/coreos/go-oidc:all-srcs",
         "//vendor/github.com/coreos/go-semver/semver:all-srcs",
         "//vendor/github.com/coreos/go-systemd/daemon:all-srcs",
         "//vendor/github.com/coreos/go-systemd/dbus:all-srcs",
@@ -132,9 +128,6 @@ filegroup(
         "//vendor/github.com/coreos/go-systemd/util:all-srcs",
         "//vendor/github.com/coreos/pkg/capnslog:all-srcs",
         "//vendor/github.com/coreos/pkg/dlopen:all-srcs",
-        "//vendor/github.com/coreos/pkg/health:all-srcs",
-        "//vendor/github.com/coreos/pkg/httputil:all-srcs",
-        "//vendor/github.com/coreos/pkg/timeutil:all-srcs",
         "//vendor/github.com/coreos/rkt/api/v1alpha:all-srcs",
         "//vendor/github.com/cpuguy83/go-md2man/md2man:all-srcs",
         "//vendor/github.com/cyphar/filepath-securejoin:all-srcs",
@@ -314,6 +307,7 @@ filegroup(
         "//vendor/github.com/pkg/errors:all-srcs",
         "//vendor/github.com/pkg/sftp:all-srcs",
         "//vendor/github.com/pmezard/go-difflib/difflib:all-srcs",
+        "//vendor/github.com/pquerna/cachecontrol:all-srcs",
         "//vendor/github.com/prometheus/client_golang/prometheus:all-srcs",
         "//vendor/github.com/prometheus/client_model/go:all-srcs",
         "//vendor/github.com/prometheus/common/expfmt:all-srcs",

vendor/github.com/coreos/go-oidc/.gitignore

+/bin
+/gopath

vendor/github.com/coreos/go-oidc/.travis.yml

+language: go
+
+go:
+  - 1.7.5
+  - 1.8
+
+install:
+ - go get -v -t github.com/coreos/go-oidc/...
+ - go get golang.org/x/tools/cmd/cover
+ - go get github.com/golang/lint/golint
+
+script:
+ - ./test
+
+notifications:
+  email: false

vendor/github.com/coreos/go-oidc/oauth2/BUILD → vendor/github.com/coreos/go-oidc/BUILD

@@ -3,13 +3,18 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library")
 go_library(
     name = "go_default_library",
     srcs = [
-        "doc.go",
-        "error.go",
-        "oauth2.go",
+        "jose.go",
+        "jwks.go",
+        "oidc.go",
+        "verify.go",
     ],
-    importpath = "github.com/coreos/go-oidc/oauth2",
+    importpath = "github.com/coreos/go-oidc",
     visibility = ["//visibility:public"],
-    deps = ["//vendor/github.com/coreos/go-oidc/http:go_default_library"],
+    deps = [
+        "//vendor/github.com/pquerna/cachecontrol:go_default_library",
+        "//vendor/golang.org/x/oauth2:go_default_library",
+        "//vendor/gopkg.in/square/go-jose.v2:go_default_library",
+    ],
 )
 
 filegroup(

vendor/github.com/coreos/go-oidc/CONTRIBUTING.md

+# How to Contribute
+
+CoreOS projects are [Apache 2.0 licensed](LICENSE) and accept contributions via
+GitHub pull requests.  This document outlines some of the conventions on
+development workflow, commit message formatting, contact points and other
+resources to make it easier to get your contribution accepted.
+
+# Certificate of Origin
+
+By contributing to this project you agree to the Developer Certificate of
+Origin (DCO). This document was created by the Linux Kernel community and is a
+simple statement that you, as a contributor, have the legal right to make the
+contribution. See the [DCO](DCO) file for details.
+
+# Email and Chat
+
+The project currently uses the general CoreOS email list and IRC channel:
+- Email: [coreos-dev](https://groups.google.com/forum/#!forum/coreos-dev)
+- IRC: #[coreos](irc://irc.freenode.org:6667/#coreos) IRC channel on freenode.org
+
+Please avoid emailing maintainers found in the MAINTAINERS file directly. They
+are very busy and read the mailing lists.
+
+## Getting Started
+
+- Fork the repository on GitHub
+- Read the [README](README.md) for build and test instructions
+- Play with the project, submit bugs, submit patches!
+
+## Contribution Flow
+
+This is a rough outline of what a contributor's workflow looks like:
+
+- Create a topic branch from where you want to base your work (usually master).
+- Make commits of logical units.
+- Make sure your commit messages are in the proper format (see below).
+- Push your changes to a topic branch in your fork of the repository.
+- Make sure the tests pass, and add any new tests as appropriate.
+- Submit a pull request to the original repository.
+
+Thanks for your contributions!
+
+### Format of the Commit Message
+
+We follow a rough convention for commit messages that is designed to answer two
+questions: what changed and why. The subject line should feature the what and
+the body of the commit should describe the why.
+
+```
+scripts: add the test-cluster command
+
+this uses tmux to setup a test cluster that you can easily kill and
+start for debugging.
+
+Fixes #38
+```
+
+The format can be described more formally as follows:
+
+```
+<subsystem>: <what changed>
+<BLANK LINE>
+<why this change was made>
+<BLANK LINE>
+<footer>
+```
+
+The first line is the subject and should be no longer than 70 characters, the
+second line is always blank, and other lines should be wrapped at 80 characters.
+This allows the message to be easier to read on GitHub as well as in various
+git tools.

vendor/github.com/coreos/go-oidc/DCO

+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+660 York Street, Suite 102,
+San Francisco, CA 94110 USA
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.

vendor/github.com/coreos/go-oidc/MAINTAINERS

+Bobby Rullo <bobby.rullo@coreos.com> (@bobbyrullo)
+Ed Rooth <ed.rooth@coreos.com> (@sym3tri)
+Eric Chiang <eric.chiang@coreos.com> (@ericchiang)

vendor/github.com/coreos/go-oidc/README.md

+# go-oidc
+
+[![GoDoc](https://godoc.org/github.com/coreos/go-oidc?status.svg)](https://godoc.org/github.com/coreos/go-oidc)
+[![Build Status](https://travis-ci.org/coreos/go-oidc.png?branch=master)](https://travis-ci.org/coreos/go-oidc)
+
+## OpenID Connect support for Go
+
+This package enables OpenID Connect support for the [golang.org/x/oauth2](https://godoc.org/golang.org/x/oauth2) package.
+
+```go
+provider, err := oidc.NewProvider(ctx, "https://accounts.google.com")
+if err != nil {
+    // handle error
+}
+
+// Configure an OpenID Connect aware OAuth2 client.
+oauth2Config := oauth2.Config{
+    ClientID:     clientID,
+    ClientSecret: clientSecret,
+    RedirectURL:  redirectURL,
+
+    // Discovery returns the OAuth2 endpoints.
+    Endpoint: provider.Endpoint(),
+
+    // "openid" is a required scope for OpenID Connect flows.
+    Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
+}
+```
+
+OAuth2 redirects are unchanged.
+
+```go
+func handleRedirect(w http.ResponseWriter, r *http.Request) {
+    http.Redirect(w, r, oauth2Config.AuthCodeURL(state), http.StatusFound)
+}
+```
+
+The on responses, the provider can be used to verify ID Tokens.
+
+```go
+var verifier = provider.Verifier(&oidc.Config{ClientID: clientID})
+
+func handleOAuth2Callback(w http.ResponseWriter, r *http.Request) {
+    // Verify state and errors.
+
+    oauth2Token, err := oauth2Config.Exchange(ctx, r.URL.Query().Get("code"))
+    if err != nil {
+        // handle error
+    }
+
+    // Extract the ID Token from OAuth2 token.
+    rawIDToken, ok := oauth2Token.Extra("id_token").(string)
+    if !ok {
+        // handle missing token
+    }
+
+    // Parse and verify ID Token payload.
+    idToken, err := verifier.Verify(ctx, rawIDToken)
+    if err != nil {
+        // handle error
+    }
+
+    // Extract custom claims
+    var claims struct {
+        Email    string `json:"email"`
+        Verified bool   `json:"email_verified"`
+    }
+    if err := idToken.Claims(&claims); err != nil {
+        // handle error
+    }
+}
+```

vendor/github.com/coreos/go-oidc/code-of-conduct.md

+## CoreOS Community Code of Conduct
+
+### Contributor Code of Conduct
+
+As contributors and maintainers of this project, and in the interest of
+fostering an open and welcoming community, we pledge to respect all people who
+contribute through reporting issues, posting feature requests, updating
+documentation, submitting pull requests or patches, and other activities.
+
+We are committed to making participation in this project a harassment-free
+experience for everyone, regardless of level of experience, gender, gender
+identity and expression, sexual orientation, disability, personal appearance,
+body size, race, ethnicity, age, religion, or nationality.
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery
+* Personal attacks
+* Trolling or insulting/derogatory comments
+* Public or private harassment
+* Publishing others' private information, such as physical or electronic addresses, without explicit permission
+* Other unethical or unprofessional conduct.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct. By adopting this Code of Conduct,
+project maintainers commit themselves to fairly and consistently applying these
+principles to every aspect of managing this project. Project maintainers who do
+not follow or enforce the Code of Conduct may be permanently removed from the
+project team.
+
+This code of conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community.
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting a project maintainer, Brandon Philips
+<brandon.philips@coreos.com>, and/or Rithu John <rithu.john@coreos.com>.
+
+This Code of Conduct is adapted from the Contributor Covenant
+(http://contributor-covenant.org), version 1.2.0, available at
+http://contributor-covenant.org/version/1/2/0/
+
+### CoreOS Events Code of Conduct
+
+CoreOS events are working conferences intended for professional networking and
+collaboration in the CoreOS community. Attendees are expected to behave
+according to professional standards and in accordance with their employer’s
+policies on appropriate workplace behavior.
+
+While at CoreOS events or related social networking opportunities, attendees
+should not engage in discriminatory or offensive speech or actions including
+but not limited to gender, sexuality, race, age, disability, or religion.
+Speakers should be especially aware of these concerns.
+
+CoreOS does not condone any statements by speakers contrary to these standards.
+CoreOS reserves the right to deny entrance and/or eject from an event (without
+refund) any individual found to be engaging in discriminatory or offensive
+speech or actions.
+
+Please bring any concerns to the immediate attention of designated on-site
+staff, Brandon Philips <brandon.philips@coreos.com>, and/or Rithu John <rithu.john@coreos.com>.

vendor/github.com/coreos/go-oidc/http/client.go

-package http
-
-import "net/http"
-
-type Client interface {
-	Do(*http.Request) (*http.Response, error)
-}

vendor/github.com/coreos/go-oidc/http/doc.go

-// Package http is DEPRECATED. Use net/http instead.
-package http

vendor/github.com/coreos/go-oidc/http/http.go

-package http
-
-import (
-	"encoding/base64"
-	"encoding/json"
-	"errors"
-	"log"
-	"net/http"
-	"net/url"
-	"path"
-	"strconv"
-	"strings"
-	"time"
-)
-
-func WriteError(w http.ResponseWriter, code int, msg string) {
-	e := struct {
-		Error string `json:"error"`
-	}{
-		Error: msg,
-	}
-	b, err := json.Marshal(e)
-	if err != nil {
-		log.Printf("go-oidc: failed to marshal %#v: %v", e, err)
-		code = http.StatusInternalServerError
-		b = []byte(`{"error":"server_error"}`)
-	}
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(code)
-	w.Write(b)
-}
-
-// BasicAuth parses a username and password from the request's
-// Authorization header. This was pulled from golang master:
-// https://codereview.appspot.com/76540043
-func BasicAuth(r *http.Request) (username, password string, ok bool) {
-	auth := r.Header.Get("Authorization")
-	if auth == "" {
-		return
-	}
-
-	if !strings.HasPrefix(auth, "Basic ") {
-		return
-	}
-	c, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(auth, "Basic "))
-	if err != nil {
-		return
-	}
-	cs := string(c)
-	s := strings.IndexByte(cs, ':')
-	if s < 0 {
-		return
-	}
-	return cs[:s], cs[s+1:], true
-}
-
-func cacheControlMaxAge(hdr string) (time.Duration, bool, error) {
-	for _, field := range strings.Split(hdr, ",") {
-		parts := strings.SplitN(strings.TrimSpace(field), "=", 2)
-		k := strings.ToLower(strings.TrimSpace(parts[0]))
-		if k != "max-age" {
-			continue
-		}
-
-		if len(parts) == 1 {
-			return 0, false, errors.New("max-age has no value")
-		}
-
-		v := strings.TrimSpace(parts[1])
-		if v == "" {
-			return 0, false, errors.New("max-age has empty value")
-		}
-
-		age, err := strconv.Atoi(v)
-		if err != nil {
-			return 0, false, err
-		}
-
-		if age <= 0 {
-			return 0, false, nil
-		}
-
-		return time.Duration(age) * time.Second, true, nil
-	}
-
-	return 0, false, nil
-}
-
-func expires(date, expires string) (time.Duration, bool, error) {
-	if date == "" || expires == "" {
-		return 0, false, nil
-	}
-
-	var te time.Time
-	var err error
-	if expires == "0" {
-		return 0, false, nil
-	}
-	te, err = time.Parse(time.RFC1123, expires)
-	if err != nil {
-		return 0, false, err
-	}
-
-	td, err := time.Parse(time.RFC1123, date)
-	if err != nil {
-		return 0, false, err
-	}
-
-	ttl := te.Sub(td)
-
-	// headers indicate data already expired, caller should not
-	// have to care about this case
-	if ttl <= 0 {
-		return 0, false, nil
-	}
-
-	return ttl, true, nil
-}
-
-func Cacheable(hdr http.Header) (time.Duration, bool, error) {
-	ttl, ok, err := cacheControlMaxAge(hdr.Get("Cache-Control"))
-	if err != nil || ok {
-		return ttl, ok, err
-	}
-
-	return expires(hdr.Get("Date"), hdr.Get("Expires"))
-}
-
-// MergeQuery appends additional query values to an existing URL.
-func MergeQuery(u url.URL, q url.Values) url.URL {
-	uv := u.Query()
-	for k, vs := range q {
-		for _, v := range vs {
-			uv.Add(k, v)
-		}
-	}
-	u.RawQuery = uv.Encode()
-	return u
-}
-
-// NewResourceLocation appends a resource id to the end of the requested URL path.
-func NewResourceLocation(reqURL *url.URL, id string) string {
-	var u url.URL
-	u = *reqURL
-	u.Path = path.Join(u.Path, id)
-	u.RawQuery = ""
-	u.Fragment = ""
-	return u.String()
-}
-
-// CopyRequest returns a clone of the provided *http.Request.
-// The returned object is a shallow copy of the struct and a
-// deep copy of its Header field.
-func CopyRequest(r *http.Request) *http.Request {
-	r2 := *r
-	r2.Header = make(http.Header)
-	for k, s := range r.Header {
-		r2.Header[k] = s
-	}
-	return &r2
-}

vendor/github.com/coreos/go-oidc/http/url.go

-package http
-
-import (
-	"errors"
-	"net/url"
-)
-
-// ParseNonEmptyURL checks that a string is a parsable URL which is also not empty
-// since `url.Parse("")` does not return an error. Must contian a scheme and a host.
-func ParseNonEmptyURL(u string) (*url.URL, error) {
-	if u == "" {
-		return nil, errors.New("url is empty")
-	}
-
-	ur, err := url.Parse(u)
-	if err != nil {
-		return nil, err
-	}
-
-	if ur.Scheme == "" {
-		return nil, errors.New("url scheme is empty")
-	}
-
-	if ur.Host == "" {
-		return nil, errors.New("url host is empty")
-	}
-
-	return ur, nil
-}

vendor/github.com/coreos/go-oidc/jose.go

+// +build !golint
+
+// Don't lint this file. We don't want to have to add a comment to each constant.
+
+package oidc
+
+const (
+	// JOSE asymmetric signing algorithm values as defined by RFC 7518
+	//
+	// see: https://tools.ietf.org/html/rfc7518#section-3.1
+	RS256 = "RS256" // RSASSA-PKCS-v1.5 using SHA-256
+	RS384 = "RS384" // RSASSA-PKCS-v1.5 using SHA-384
+	RS512 = "RS512" // RSASSA-PKCS-v1.5 using SHA-512
+	ES256 = "ES256" // ECDSA using P-256 and SHA-256
+	ES384 = "ES384" // ECDSA using P-384 and SHA-384
+	ES512 = "ES512" // ECDSA using P-521 and SHA-512
+	PS256 = "PS256" // RSASSA-PSS using SHA256 and MGF1-SHA256
+	PS384 = "PS384" // RSASSA-PSS using SHA384 and MGF1-SHA384
+	PS512 = "PS512" // RSASSA-PSS using SHA512 and MGF1-SHA512
+)

vendor/github.com/coreos/go-oidc/jose/BUILD

-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "claims.go",
-        "doc.go",
-        "jose.go",
-        "jwk.go",
-        "jws.go",
-        "jwt.go",
-        "sig.go",
-        "sig_rsa.go",
-    ],
-    importpath = "github.com/coreos/go-oidc/jose",
-    visibility = ["//visibility:public"],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)

vendor/github.com/coreos/go-oidc/jose/claims.go

-package jose
-
-import (
-	"encoding/json"
-	"fmt"
-	"math"
-	"time"
-)
-
-type Claims map[string]interface{}
-
-func (c Claims) Add(name string, value interface{}) {
-	c[name] = value
-}
-
-func (c Claims) StringClaim(name string) (string, bool, error) {
-	cl, ok := c[name]
-	if !ok {
-		return "", false, nil
-	}
-
-	v, ok := cl.(string)
-	if !ok {
-		return "", false, fmt.Errorf("unable to parse claim as string: %v", name)
-	}
-
-	return v, true, nil
-}
-
-func (c Claims) StringsClaim(name string) ([]string, bool, error) {
-	cl, ok := c[name]
-	if !ok {
-		return nil, false, nil
-	}
-
-	if v, ok := cl.([]string); ok {
-		return v, true, nil
-	}
-
-	// When unmarshaled, []string will become []interface{}.
-	if v, ok := cl.([]interface{}); ok {
-		var ret []string
-		for _, vv := range v {
-			str, ok := vv.(string)
-			if !ok {
-				return nil, false, fmt.Errorf("unable to parse claim as string array: %v", name)
-			}
-			ret = append(ret, str)
-		}
-		return ret, true, nil
-	}
-
-	return nil, false, fmt.Errorf("unable to parse claim as string array: %v", name)
-}
-
-func (c Claims) Int64Claim(name string) (int64, bool, error) {
-	cl, ok := c[name]
-	if !ok {
-		return 0, false, nil
-	}
-
-	v, ok := cl.(int64)
-	if !ok {
-		vf, ok := cl.(float64)
-		if !ok {
-			return 0, false, fmt.Errorf("unable to parse claim as int64: %v", name)
-		}
-		v = int64(vf)
-	}
-
-	return v, true, nil
-}
-
-func (c Claims) Float64Claim(name string) (float64, bool, error) {
-	cl, ok := c[name]
-	if !ok {
-		return 0, false, nil
-	}
-
-	v, ok := cl.(float64)
-	if !ok {
-		vi, ok := cl.(int64)
-		if !ok {
-			return 0, false, fmt.Errorf("unable to parse claim as float64: %v", name)
-		}
-		v = float64(vi)
-	}
-
-	return v, true, nil
-}
-
-func (c Claims) TimeClaim(name string) (time.Time, bool, error) {
-	v, ok, err := c.Float64Claim(name)
-	if !ok || err != nil {
-		return time.Time{}, ok, err
-	}
-
-	s := math.Trunc(v)
-	ns := (v - s) * math.Pow(10, 9)
-	return time.Unix(int64(s), int64(ns)).UTC(), true, nil
-}
-
-func decodeClaims(payload []byte) (Claims, error) {
-	var c Claims
-	if err := json.Unmarshal(payload, &c); err != nil {
-		return nil, fmt.Errorf("malformed JWT claims, unable to decode: %v", err)
-	}
-	return c, nil
-}
-
-func marshalClaims(c Claims) ([]byte, error) {
-	b, err := json.Marshal(c)
-	if err != nil {
-		return nil, err
-	}
-	return b, nil
-}
-
-func encodeClaims(c Claims) (string, error) {
-	b, err := marshalClaims(c)
-	if err != nil {
-		return "", err
-	}
-
-	return encodeSegment(b), nil
-}

vendor/github.com/coreos/go-oidc/jose/doc.go

-// Package jose is DEPRECATED. Use gopkg.in/square/go-jose.v2 instead.
-package jose

vendor/github.com/coreos/go-oidc/jose/jose.go

-package jose
-
-import (
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"strings"
-)
-
-const (
-	HeaderMediaType    = "typ"
-	HeaderKeyAlgorithm = "alg"
-	HeaderKeyID        = "kid"
-)
-
-const (
-	// Encryption Algorithm Header Parameter Values for JWS
-	// See: https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40#page-6
-	AlgHS256 = "HS256"
-	AlgHS384 = "HS384"
-	AlgHS512 = "HS512"
-	AlgRS256 = "RS256"
-	AlgRS384 = "RS384"
-	AlgRS512 = "RS512"
-	AlgES256 = "ES256"
-	AlgES384 = "ES384"
-	AlgES512 = "ES512"
-	AlgPS256 = "PS256"
-	AlgPS384 = "PS384"
-	AlgPS512 = "PS512"
-	AlgNone  = "none"
-)
-
-const (
-	// Algorithm Header Parameter Values for JWE
-	// See: https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40#section-4.1
-	AlgRSA15            = "RSA1_5"
-	AlgRSAOAEP          = "RSA-OAEP"
-	AlgRSAOAEP256       = "RSA-OAEP-256"
-	AlgA128KW           = "A128KW"
-	AlgA192KW           = "A192KW"
-	AlgA256KW           = "A256KW"
-	AlgDir              = "dir"
-	AlgECDHES           = "ECDH-ES"
-	AlgECDHESA128KW     = "ECDH-ES+A128KW"
-	AlgECDHESA192KW     = "ECDH-ES+A192KW"
-	AlgECDHESA256KW     = "ECDH-ES+A256KW"
-	AlgA128GCMKW        = "A128GCMKW"
-	AlgA192GCMKW        = "A192GCMKW"
-	AlgA256GCMKW        = "A256GCMKW"
-	AlgPBES2HS256A128KW = "PBES2-HS256+A128KW"
-	AlgPBES2HS384A192KW = "PBES2-HS384+A192KW"
-	AlgPBES2HS512A256KW = "PBES2-HS512+A256KW"
-)
-
-const (
-	// Encryption Algorithm Header Parameter Values for JWE
-	// See: https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40#page-22
-	EncA128CBCHS256 = "A128CBC-HS256"
-	EncA128CBCHS384 = "A128CBC-HS384"
-	EncA256CBCHS512 = "A256CBC-HS512"
-	EncA128GCM      = "A128GCM"
-	EncA192GCM      = "A192GCM"
-	EncA256GCM      = "A256GCM"
-)
-
-type JOSEHeader map[string]string
-
-func (j JOSEHeader) Validate() error {
-	if _, exists := j[HeaderKeyAlgorithm]; !exists {
-		return fmt.Errorf("header missing %q parameter", HeaderKeyAlgorithm)
-	}
-
-	return nil
-}
-
-func decodeHeader(seg string) (JOSEHeader, error) {
-	b, err := decodeSegment(seg)
-	if err != nil {
-		return nil, err
-	}
-
-	var h JOSEHeader
-	err = json.Unmarshal(b, &h)
-	if err != nil {
-		return nil, err
-	}
-
-	return h, nil
-}
-
-func encodeHeader(h JOSEHeader) (string, error) {
-	b, err := json.Marshal(h)
-	if err != nil {
-		return "", err
-	}
-
-	return encodeSegment(b), nil
-}
-
-// Decode JWT specific base64url encoding with padding stripped
-func decodeSegment(seg string) ([]byte, error) {
-	if l := len(seg) % 4; l != 0 {
-		seg += strings.Repeat("=", 4-l)
-	}
-	return base64.URLEncoding.DecodeString(seg)
-}
-
-// Encode JWT specific base64url encoding with padding stripped
-func encodeSegment(seg []byte) string {
-	return strings.TrimRight(base64.URLEncoding.EncodeToString(seg), "=")
-}

vendor/github.com/coreos/go-oidc/jose/jwk.go

-package jose
-
-import (
-	"bytes"
-	"encoding/base64"
-	"encoding/binary"
-	"encoding/json"
-	"math/big"
-	"strings"
-)
-
-// JSON Web Key
-// https://tools.ietf.org/html/draft-ietf-jose-json-web-key-36#page-5
-type JWK struct {
-	ID       string
-	Type     string
-	Alg      string
-	Use      string
-	Exponent int
-	Modulus  *big.Int
-	Secret   []byte
-}
-
-type jwkJSON struct {
-	ID       string `json:"kid"`
-	Type     string `json:"kty"`
-	Alg      string `json:"alg"`
-	Use      string `json:"use"`
-	Exponent string `json:"e"`
-	Modulus  string `json:"n"`
-}
-
-func (j *JWK) MarshalJSON() ([]byte, error) {
-	t := jwkJSON{
-		ID:       j.ID,
-		Type:     j.Type,
-		Alg:      j.Alg,
-		Use:      j.Use,
-		Exponent: encodeExponent(j.Exponent),
-		Modulus:  encodeModulus(j.Modulus),
-	}
-
-	return json.Marshal(&t)
-}
-
-func (j *JWK) UnmarshalJSON(data []byte) error {
-	var t jwkJSON
-	err := json.Unmarshal(data, &t)
-	if err != nil {
-		return err
-	}
-
-	e, err := decodeExponent(t.Exponent)
-	if err != nil {
-		return err
-	}
-
-	n, err := decodeModulus(t.Modulus)
-	if err != nil {
-		return err
-	}
-
-	j.ID = t.ID
-	j.Type = t.Type
-	j.Alg = t.Alg
-	j.Use = t.Use
-	j.Exponent = e
-	j.Modulus = n
-
-	return nil
-}
-
-type JWKSet struct {
-	Keys []JWK `json:"keys"`
-}
-
-func decodeExponent(e string) (int, error) {
-	decE, err := decodeBase64URLPaddingOptional(e)
-	if err != nil {
-		return 0, err
-	}
-	var eBytes []byte
-	if len(decE) < 8 {
-		eBytes = make([]byte, 8-len(decE), 8)
-		eBytes = append(eBytes, decE...)
-	} else {
-		eBytes = decE
-	}
-	eReader := bytes.NewReader(eBytes)
-	var E uint64
-	err = binary.Read(eReader, binary.BigEndian, &E)
-	if err != nil {
-		return 0, err
-	}
-	return int(E), nil
-}
-
-func encodeExponent(e int) string {
-	b := make([]byte, 8)
-	binary.BigEndian.PutUint64(b, uint64(e))
-	var idx int
-	for ; idx < 8; idx++ {
-		if b[idx] != 0x0 {
-			break
-		}
-	}
-	return base64.RawURLEncoding.EncodeToString(b[idx:])
-}
-
-// Turns a URL encoded modulus of a key into a big int.
-func decodeModulus(n string) (*big.Int, error) {
-	decN, err := decodeBase64URLPaddingOptional(n)
-	if err != nil {
-		return nil, err
-	}
-	N := big.NewInt(0)
-	N.SetBytes(decN)
-	return N, nil
-}
-
-func encodeModulus(n *big.Int) string {
-	return base64.RawURLEncoding.EncodeToString(n.Bytes())
-}
-
-// decodeBase64URLPaddingOptional decodes Base64 whether there is padding or not.
-// The stdlib version currently doesn't handle this.
-// We can get rid of this is if this bug:
-//   https://github.com/golang/go/issues/4237
-// ever closes.
-func decodeBase64URLPaddingOptional(e string) ([]byte, error) {
-	if m := len(e) % 4; m != 0 {
-		e += strings.Repeat("=", 4-m)
-	}
-	return base64.URLEncoding.DecodeString(e)
-}

vendor/github.com/coreos/go-oidc/jose/jws.go

-package jose
-
-import (
-	"fmt"
-	"strings"
-)
-
-type JWS struct {
-	RawHeader  string
-	Header     JOSEHeader
-	RawPayload string
-	Payload    []byte
-	Signature  []byte
-}
-
-// Given a raw encoded JWS token parses it and verifies the structure.
-func ParseJWS(raw string) (JWS, error) {
-	parts := strings.Split(raw, ".")
-	if len(parts) != 3 {
-		return JWS{}, fmt.Errorf("malformed JWS, only %d segments", len(parts))
-	}
-
-	rawSig := parts[2]
-	jws := JWS{
-		RawHeader:  parts[0],
-		RawPayload: parts[1],
-	}
-
-	header, err := decodeHeader(jws.RawHeader)
-	if err != nil {
-		return JWS{}, fmt.Errorf("malformed JWS, unable to decode header, %s", err)
-	}
-	if err = header.Validate(); err != nil {
-		return JWS{}, fmt.Errorf("malformed JWS, %s", err)
-	}
-	jws.Header = header
-
-	payload, err := decodeSegment(jws.RawPayload)
-	if err != nil {
-		return JWS{}, fmt.Errorf("malformed JWS, unable to decode payload: %s", err)
-	}
-	jws.Payload = payload
-
-	sig, err := decodeSegment(rawSig)
-	if err != nil {
-		return JWS{}, fmt.Errorf("malformed JWS, unable to decode signature: %s", err)
-	}
-	jws.Signature = sig
-
-	return jws, nil
-}

vendor/github.com/coreos/go-oidc/jose/jwt.go

-package jose
-
-import "strings"
-
-type JWT JWS
-
-func ParseJWT(token string) (jwt JWT, err error) {
-	jws, err := ParseJWS(token)
-	if err != nil {
-		return
-	}
-
-	return JWT(jws), nil
-}
-
-func NewJWT(header JOSEHeader, claims Claims) (jwt JWT, err error) {
-	jwt = JWT{}
-
-	jwt.Header = header
-	jwt.Header[HeaderMediaType] = "JWT"
-
-	claimBytes, err := marshalClaims(claims)
-	if err != nil {
-		return
-	}
-	jwt.Payload = claimBytes
-
-	eh, err := encodeHeader(header)
-	if err != nil {
-		return
-	}
-	jwt.RawHeader = eh
-
-	ec, err := encodeClaims(claims)
-	if err != nil {
-		return
-	}
-	jwt.RawPayload = ec
-
-	return
-}
-
-func (j *JWT) KeyID() (string, bool) {
-	kID, ok := j.Header[HeaderKeyID]
-	return kID, ok
-}
-
-func (j *JWT) Claims() (Claims, error) {
-	return decodeClaims(j.Payload)
-}
-
-// Encoded data part of the token which may be signed.
-func (j *JWT) Data() string {
-	return strings.Join([]string{j.RawHeader, j.RawPayload}, ".")
-}
-
-// Full encoded JWT token string in format: header.claims.signature
-func (j *JWT) Encode() string {
-	d := j.Data()
-	s := encodeSegment(j.Signature)
-	return strings.Join([]string{d, s}, ".")
-}
-
-func NewSignedJWT(claims Claims, s Signer) (*JWT, error) {
-	header := JOSEHeader{
-		HeaderKeyAlgorithm: s.Alg(),
-		HeaderKeyID:        s.ID(),
-	}
-
-	jwt, err := NewJWT(header, claims)
-	if err != nil {
-		return nil, err
-	}
-
-	sig, err := s.Sign([]byte(jwt.Data()))
-	if err != nil {
-		return nil, err
-	}
-	jwt.Signature = sig
-
-	return &jwt, nil
-}

vendor/github.com/coreos/go-oidc/jose/sig.go

-package jose
-
-import (
-	"fmt"
-)
-
-type Verifier interface {
-	ID() string
-	Alg() string
-	Verify(sig []byte, data []byte) error
-}
-
-type Signer interface {
-	Verifier
-	Sign(data []byte) (sig []byte, err error)
-}
-
-func NewVerifier(jwk JWK) (Verifier, error) {
-	if jwk.Type != "RSA" {
-		return nil, fmt.Errorf("unsupported key type %q", jwk.Type)
-	}
-
-	return NewVerifierRSA(jwk)
-}

vendor/github.com/coreos/go-oidc/jose/sig_rsa.go

-package jose
-
-import (
-	"crypto"
-	"crypto/rand"
-	"crypto/rsa"
-	"fmt"
-)
-
-type VerifierRSA struct {
-	KeyID     string
-	Hash      crypto.Hash
-	PublicKey rsa.PublicKey
-}
-
-type SignerRSA struct {
-	PrivateKey rsa.PrivateKey
-	VerifierRSA
-}
-
-func NewVerifierRSA(jwk JWK) (*VerifierRSA, error) {
-	if jwk.Alg != "" && jwk.Alg != "RS256" {
-		return nil, fmt.Errorf("unsupported key algorithm %q", jwk.Alg)
-	}
-
-	v := VerifierRSA{
-		KeyID: jwk.ID,
-		PublicKey: rsa.PublicKey{
-			N: jwk.Modulus,
-			E: jwk.Exponent,
-		},
-		Hash: crypto.SHA256,
-	}
-
-	return &v, nil
-}
-
-func NewSignerRSA(kid string, key rsa.PrivateKey) *SignerRSA {
-	return &SignerRSA{
-		PrivateKey: key,
-		VerifierRSA: VerifierRSA{
-			KeyID:     kid,
-			PublicKey: key.PublicKey,
-			Hash:      crypto.SHA256,
-		},
-	}
-}
-
-func (v *VerifierRSA) ID() string {
-	return v.KeyID
-}
-
-func (v *VerifierRSA) Alg() string {
-	return "RS256"
-}
-
-func (v *VerifierRSA) Verify(sig []byte, data []byte) error {
-	h := v.Hash.New()
-	h.Write(data)
-	return rsa.VerifyPKCS1v15(&v.PublicKey, v.Hash, h.Sum(nil), sig)
-}
-
-func (s *SignerRSA) Sign(data []byte) ([]byte, error) {
-	h := s.Hash.New()
-	h.Write(data)
-	return rsa.SignPKCS1v15(rand.Reader, &s.PrivateKey, s.Hash, h.Sum(nil))
-}

vendor/github.com/coreos/go-oidc/jwks.go

+package oidc
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/pquerna/cachecontrol"
+	jose "gopkg.in/square/go-jose.v2"
+)
+
+// keysExpiryDelta is the allowed clock skew between a client and the OpenID Connect
+// server.
+//
+// When keys expire, they are valid for this amount of time after.
+//
+// If the keys have not expired, and an ID Token claims it was signed by a key not in
+// the cache, if and only if the keys expire in this amount of time, the keys will be
+// updated.
+const keysExpiryDelta = 30 * time.Second
+
+// NewRemoteKeySet returns a KeySet that can validate JSON web tokens by using HTTP
+// GETs to fetch JSON web token sets hosted at a remote URL. This is automatically
+// used by NewProvider using the URLs returned by OpenID Connect discovery, but is
+// exposed for providers that don't support discovery or to prevent round trips to the
+// discovery URL.
+//
+// The returned KeySet is a long lived verifier that caches keys based on cache-control
+// headers. Reuse a common remote key set instead of creating new ones as needed.
+//
+// The behavior of the returned KeySet is undefined once the context is canceled.
+func NewRemoteKeySet(ctx context.Context, jwksURL string) KeySet {
+	return newRemoteKeySet(ctx, jwksURL, time.Now)
+}
+
+func newRemoteKeySet(ctx context.Context, jwksURL string, now func() time.Time) *remoteKeySet {
+	if now == nil {
+		now = time.Now
+	}
+	return &remoteKeySet{jwksURL: jwksURL, ctx: ctx, now: now}
+}
+
+type remoteKeySet struct {
+	jwksURL string
+	ctx     context.Context
+	now     func() time.Time
+
+	// guard all other fields
+	mu sync.Mutex
+
+	// inflight suppresses parallel execution of updateKeys and allows
+	// multiple goroutines to wait for its result.
+	inflight *inflight
+
+	// A set of cached keys and their expiry.
+	cachedKeys []jose.JSONWebKey
+	expiry     time.Time
+}
+
+// inflight is used to wait on some in-flight request from multiple goroutines.
+type inflight struct {
+	doneCh chan struct{}
+
+	keys []jose.JSONWebKey
+	err  error
+}
+
+func newInflight() *inflight {
+	return &inflight{doneCh: make(chan struct{})}
+}
+
+// wait returns a channel that multiple goroutines can receive on. Once it returns
+// a value, the inflight request is done and result() can be inspected.
+func (i *inflight) wait() <-chan struct{} {
+	return i.doneCh
+}
+
+// done can only be called by a single goroutine. It records the result of the
+// inflight request and signals other goroutines that the result is safe to
+// inspect.
+func (i *inflight) done(keys []jose.JSONWebKey, err error) {
+	i.keys = keys
+	i.err = err
+	close(i.doneCh)
+}
+
+// result cannot be called until the wait() channel has returned a value.
+func (i *inflight) result() ([]jose.JSONWebKey, error) {
+	return i.keys, i.err
+}
+
+func (r *remoteKeySet) VerifySignature(ctx context.Context, jwt string) ([]byte, error) {
+	jws, err := jose.ParseSigned(jwt)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: malformed jwt: %v", err)
+	}
+	return r.verify(ctx, jws)
+}
+
+func (r *remoteKeySet) verify(ctx context.Context, jws *jose.JSONWebSignature) ([]byte, error) {
+	// We don't support JWTs signed with multiple signatures.
+	keyID := ""
+	for _, sig := range jws.Signatures {
+		keyID = sig.Header.KeyID
+		break
+	}
+
+	keys, expiry := r.keysFromCache()
+
+	// Don't check expiry yet. This optimizes for when the provider is unavailable.
+	for _, key := range keys {
+		if keyID == "" || key.KeyID == keyID {
+			if payload, err := jws.Verify(&key); err == nil {
+				return payload, nil
+			}
+		}
+	}
+
+	if !r.now().Add(keysExpiryDelta).After(expiry) {
+		// Keys haven't expired, don't refresh.
+		return nil, errors.New("failed to verify id token signature")
+	}
+
+	keys, err := r.keysFromRemote(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("fetching keys %v", err)
+	}
+
+	for _, key := range keys {
+		if keyID == "" || key.KeyID == keyID {
+			if payload, err := jws.Verify(&key); err == nil {
+				return payload, nil
+			}
+		}
+	}
+	return nil, errors.New("failed to verify id token signature")
+}
+
+func (r *remoteKeySet) keysFromCache() (keys []jose.JSONWebKey, expiry time.Time) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.cachedKeys, r.expiry
+}
+
+// keysFromRemote syncs the key set from the remote set, records the values in the
+// cache, and returns the key set.
+func (r *remoteKeySet) keysFromRemote(ctx context.Context) ([]jose.JSONWebKey, error) {
+	// Need to lock to inspect the inflight request field.
+	r.mu.Lock()
+	// If there's not a current inflight request, create one.
+	if r.inflight == nil {
+		r.inflight = newInflight()
+
+		// This goroutine has exclusive ownership over the current inflight
+		// request. It releases the resource by nil'ing the inflight field
+		// once the goroutine is done.
+		go func() {
+			// Sync keys and finish inflight when that's done.
+			keys, expiry, err := r.updateKeys()
+
+			r.inflight.done(keys, err)
+
+			// Lock to update the keys and indicate that there is no longer an
+			// inflight request.
+			r.mu.Lock()
+			defer r.mu.Unlock()
+
+			if err == nil {
+				r.cachedKeys = keys
+				r.expiry = expiry
+			}
+
+			// Free inflight so a different request can run.
+			r.inflight = nil
+		}()
+	}
+	inflight := r.inflight
+	r.mu.Unlock()
+
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case <-inflight.wait():
+		return inflight.result()
+	}
+}
+
+func (r *remoteKeySet) updateKeys() ([]jose.JSONWebKey, time.Time, error) {
+	req, err := http.NewRequest("GET", r.jwksURL, nil)
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("oidc: can't create request: %v", err)
+	}
+
+	resp, err := doRequest(r.ctx, req)
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("oidc: get keys failed %v", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("unable to read response body: %v", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, time.Time{}, fmt.Errorf("oidc: get keys failed: %s %s", resp.Status, body)
+	}
+
+	var keySet jose.JSONWebKeySet
+	err = unmarshalResp(resp, body, &keySet)
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("oidc: failed to decode keys: %v %s", err, body)
+	}
+
+	// If the server doesn't provide cache control headers, assume the
+	// keys expire immediately.
+	expiry := r.now()
+
+	_, e, err := cachecontrol.CachableResponse(req, resp, cachecontrol.Options{})
+	if err == nil && e.After(expiry) {
+		expiry = e
+	}
+	return keySet.Keys, expiry, nil
+}

vendor/github.com/coreos/go-oidc/key/BUILD

-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "doc.go",
-        "key.go",
-        "manager.go",
-        "repo.go",
-        "rotate.go",
-        "sync.go",
-    ],
-    importpath = "github.com/coreos/go-oidc/key",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//vendor/github.com/coreos/go-oidc/jose:go_default_library",
-        "//vendor/github.com/coreos/pkg/health:go_default_library",
-        "//vendor/github.com/coreos/pkg/timeutil:go_default_library",
-        "//vendor/github.com/jonboulle/clockwork:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)

vendor/github.com/coreos/go-oidc/key/doc.go

-// Package key is DEPRECATED. Use github.com/coreos/go-oidc instead.
-package key

vendor/github.com/coreos/go-oidc/key/key.go

-package key
-
-import (
-	"crypto/rand"
-	"crypto/rsa"
-	"encoding/hex"
-	"encoding/json"
-	"io"
-	"time"
-
-	"github.com/coreos/go-oidc/jose"
-)
-
-func NewPublicKey(jwk jose.JWK) *PublicKey {
-	return &PublicKey{jwk: jwk}
-}
-
-type PublicKey struct {
-	jwk jose.JWK
-}
-
-func (k *PublicKey) MarshalJSON() ([]byte, error) {
-	return json.Marshal(&k.jwk)
-}
-
-func (k *PublicKey) UnmarshalJSON(data []byte) error {
-	var jwk jose.JWK
-	if err := json.Unmarshal(data, &jwk); err != nil {
-		return err
-	}
-	k.jwk = jwk
-	return nil
-}
-
-func (k *PublicKey) ID() string {
-	return k.jwk.ID
-}
-
-func (k *PublicKey) Verifier() (jose.Verifier, error) {
-	return jose.NewVerifierRSA(k.jwk)
-}
-
-type PrivateKey struct {
-	KeyID      string
-	PrivateKey *rsa.PrivateKey
-}
-
-func (k *PrivateKey) ID() string {
-	return k.KeyID
-}
-
-func (k *PrivateKey) Signer() jose.Signer {
-	return jose.NewSignerRSA(k.ID(), *k.PrivateKey)
-}
-
-func (k *PrivateKey) JWK() jose.JWK {
-	return jose.JWK{
-		ID:       k.KeyID,
-		Type:     "RSA",
-		Alg:      "RS256",
-		Use:      "sig",
-		Exponent: k.PrivateKey.PublicKey.E,
-		Modulus:  k.PrivateKey.PublicKey.N,
-	}
-}
-
-type KeySet interface {
-	ExpiresAt() time.Time
-}
-
-type PublicKeySet struct {
-	keys      []PublicKey
-	index     map[string]*PublicKey
-	expiresAt time.Time
-}
-
-func NewPublicKeySet(jwks []jose.JWK, exp time.Time) *PublicKeySet {
-	keys := make([]PublicKey, len(jwks))
-	index := make(map[string]*PublicKey)
-	for i, jwk := range jwks {
-		keys[i] = *NewPublicKey(jwk)
-		index[keys[i].ID()] = &keys[i]
-	}
-	return &PublicKeySet{
-		keys:      keys,
-		index:     index,
-		expiresAt: exp,
-	}
-}
-
-func (s *PublicKeySet) ExpiresAt() time.Time {
-	return s.expiresAt
-}
-
-func (s *PublicKeySet) Keys() []PublicKey {
-	return s.keys
-}
-
-func (s *PublicKeySet) Key(id string) *PublicKey {
-	return s.index[id]
-}
-
-type PrivateKeySet struct {
-	keys        []*PrivateKey
-	ActiveKeyID string
-	expiresAt   time.Time
-}
-
-func NewPrivateKeySet(keys []*PrivateKey, exp time.Time) *PrivateKeySet {
-	return &PrivateKeySet{
-		keys:        keys,
-		ActiveKeyID: keys[0].ID(),
-		expiresAt:   exp.UTC(),
-	}
-}
-
-func (s *PrivateKeySet) Keys() []*PrivateKey {
-	return s.keys
-}
-
-func (s *PrivateKeySet) ExpiresAt() time.Time {
-	return s.expiresAt
-}
-
-func (s *PrivateKeySet) Active() *PrivateKey {
-	for i, k := range s.keys {
-		if k.ID() == s.ActiveKeyID {
-			return s.keys[i]
-		}
-	}
-
-	return nil
-}
-
-type GeneratePrivateKeyFunc func() (*PrivateKey, error)
-
-func GeneratePrivateKey() (*PrivateKey, error) {
-	pk, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		return nil, err
-	}
-	keyID := make([]byte, 20)
-	if _, err := io.ReadFull(rand.Reader, keyID); err != nil {
-		return nil, err
-	}
-
-	k := PrivateKey{
-		KeyID:      hex.EncodeToString(keyID),
-		PrivateKey: pk,
-	}
-
-	return &k, nil
-}

vendor/github.com/coreos/go-oidc/key/manager.go

-package key
-
-import (
-	"errors"
-	"time"
-
-	"github.com/jonboulle/clockwork"
-
-	"github.com/coreos/go-oidc/jose"
-	"github.com/coreos/pkg/health"
-)
-
-type PrivateKeyManager interface {
-	ExpiresAt() time.Time
-	Signer() (jose.Signer, error)
-	JWKs() ([]jose.JWK, error)
-	PublicKeys() ([]PublicKey, error)
-
-	WritableKeySetRepo
-	health.Checkable
-}
-
-func NewPrivateKeyManager() PrivateKeyManager {
-	return &privateKeyManager{
-		clock: clockwork.NewRealClock(),
-	}
-}
-
-type privateKeyManager struct {
-	keySet *PrivateKeySet
-	clock  clockwork.Clock
-}
-
-func (m *privateKeyManager) ExpiresAt() time.Time {
-	if m.keySet == nil {
-		return m.clock.Now().UTC()
-	}
-
-	return m.keySet.ExpiresAt()
-}
-
-func (m *privateKeyManager) Signer() (jose.Signer, error) {
-	if err := m.Healthy(); err != nil {
-		return nil, err
-	}
-
-	return m.keySet.Active().Signer(), nil
-}
-
-func (m *privateKeyManager) JWKs() ([]jose.JWK, error) {
-	if err := m.Healthy(); err != nil {
-		return nil, err
-	}
-
-	keys := m.keySet.Keys()
-	jwks := make([]jose.JWK, len(keys))
-	for i, k := range keys {
-		jwks[i] = k.JWK()
-	}
-	return jwks, nil
-}
-
-func (m *privateKeyManager) PublicKeys() ([]PublicKey, error) {
-	jwks, err := m.JWKs()
-	if err != nil {
-		return nil, err
-	}
-	keys := make([]PublicKey, len(jwks))
-	for i, jwk := range jwks {
-		keys[i] = *NewPublicKey(jwk)
-	}
-	return keys, nil
-}
-
-func (m *privateKeyManager) Healthy() error {
-	if m.keySet == nil {
-		return errors.New("private key manager uninitialized")
-	}
-
-	if len(m.keySet.Keys()) == 0 {
-		return errors.New("private key manager zero keys")
-	}
-
-	if m.keySet.ExpiresAt().Before(m.clock.Now().UTC()) {
-		return errors.New("private key manager keys expired")
-	}
-
-	return nil
-}
-
-func (m *privateKeyManager) Set(keySet KeySet) error {
-	privKeySet, ok := keySet.(*PrivateKeySet)
-	if !ok {
-		return errors.New("unable to cast to PrivateKeySet")
-	}
-
-	m.keySet = privKeySet
-	return nil
-}

vendor/github.com/coreos/go-oidc/key/repo.go

-package key
-
-import (
-	"errors"
-	"sync"
-)
-
-var ErrorNoKeys = errors.New("no keys found")
-
-type WritableKeySetRepo interface {
-	Set(KeySet) error
-}
-
-type ReadableKeySetRepo interface {
-	Get() (KeySet, error)
-}
-
-type PrivateKeySetRepo interface {
-	WritableKeySetRepo
-	ReadableKeySetRepo
-}
-
-func NewPrivateKeySetRepo() PrivateKeySetRepo {
-	return &memPrivateKeySetRepo{}
-}
-
-type memPrivateKeySetRepo struct {
-	mu  sync.RWMutex
-	pks PrivateKeySet
-}
-
-func (r *memPrivateKeySetRepo) Set(ks KeySet) error {
-	pks, ok := ks.(*PrivateKeySet)
-	if !ok {
-		return errors.New("unable to cast to PrivateKeySet")
-	} else if pks == nil {
-		return errors.New("nil KeySet")
-	}
-
-	r.mu.Lock()
-	defer r.mu.Unlock()
-
-	r.pks = *pks
-	return nil
-}
-
-func (r *memPrivateKeySetRepo) Get() (KeySet, error) {
-	r.mu.RLock()
-	defer r.mu.RUnlock()
-
-	if r.pks.keys == nil {
-		return nil, ErrorNoKeys
-	}
-	return KeySet(&r.pks), nil
-}

vendor/github.com/coreos/go-oidc/key/rotate.go

-package key
-
-import (
-	"errors"
-	"log"
-	"time"
-
-	ptime "github.com/coreos/pkg/timeutil"
-	"github.com/jonboulle/clockwork"
-)
-
-var (
-	ErrorPrivateKeysExpired = errors.New("private keys have expired")
-)
-
-func NewPrivateKeyRotator(repo PrivateKeySetRepo, ttl time.Duration) *PrivateKeyRotator {
-	return &PrivateKeyRotator{
-		repo: repo,
-		ttl:  ttl,
-
-		keep:        2,
-		generateKey: GeneratePrivateKey,
-		clock:       clockwork.NewRealClock(),
-	}
-}
-
-type PrivateKeyRotator struct {
-	repo        PrivateKeySetRepo
-	generateKey GeneratePrivateKeyFunc
-	clock       clockwork.Clock
-	keep        int
-	ttl         time.Duration
-}
-
-func (r *PrivateKeyRotator) expiresAt() time.Time {
-	return r.clock.Now().UTC().Add(r.ttl)
-}
-
-func (r *PrivateKeyRotator) Healthy() error {
-	pks, err := r.privateKeySet()
-	if err != nil {
-		return err
-	}
-
-	if r.clock.Now().After(pks.ExpiresAt()) {
-		return ErrorPrivateKeysExpired
-	}
-
-	return nil
-}
-
-func (r *PrivateKeyRotator) privateKeySet() (*PrivateKeySet, error) {
-	ks, err := r.repo.Get()
-	if err != nil {
-		return nil, err
-	}
-
-	pks, ok := ks.(*PrivateKeySet)
-	if !ok {
-		return nil, errors.New("unable to cast to PrivateKeySet")
-	}
-	return pks, nil
-}
-
-func (r *PrivateKeyRotator) nextRotation() (time.Duration, error) {
-	pks, err := r.privateKeySet()
-	if err == ErrorNoKeys {
-		return 0, nil
-	}
-	if err != nil {
-		return 0, err
-	}
-
-	now := r.clock.Now()
-
-	// Ideally, we want to rotate after half the TTL has elapsed.
-	idealRotationTime := pks.ExpiresAt().Add(-r.ttl / 2)
-
-	// If we are past the ideal rotation time, rotate immediatly.
-	return max(0, idealRotationTime.Sub(now)), nil
-}
-
-func max(a, b time.Duration) time.Duration {
-	if a > b {
-		return a
-	}
-	return b
-}
-
-func (r *PrivateKeyRotator) Run() chan struct{} {
-	attempt := func() {
-		k, err := r.generateKey()
-		if err != nil {
-			log.Printf("go-oidc: failed generating signing key: %v", err)
-			return
-		}
-
-		exp := r.expiresAt()
-		if err := rotatePrivateKeys(r.repo, k, r.keep, exp); err != nil {
-			log.Printf("go-oidc: key rotation failed: %v", err)
-			return
-		}
-	}
-
-	stop := make(chan struct{})
-	go func() {
-		for {
-			var nextRotation time.Duration
-			var sleep time.Duration
-			var err error
-			for {
-				if nextRotation, err = r.nextRotation(); err == nil {
-					break
-				}
-				sleep = ptime.ExpBackoff(sleep, time.Minute)
-				log.Printf("go-oidc: error getting nextRotation, retrying in %v: %v", sleep, err)
-				time.Sleep(sleep)
-			}
-
-			select {
-			case <-r.clock.After(nextRotation):
-				attempt()
-			case <-stop:
-				return
-			}
-		}
-	}()
-
-	return stop
-}
-
-func rotatePrivateKeys(repo PrivateKeySetRepo, k *PrivateKey, keep int, exp time.Time) error {
-	ks, err := repo.Get()
-	if err != nil && err != ErrorNoKeys {
-		return err
-	}
-
-	var keys []*PrivateKey
-	if ks != nil {
-		pks, ok := ks.(*PrivateKeySet)
-		if !ok {
-			return errors.New("unable to cast to PrivateKeySet")
-		}
-		keys = pks.Keys()
-	}
-
-	keys = append([]*PrivateKey{k}, keys...)
-	if l := len(keys); l > keep {
-		keys = keys[0:keep]
-	}
-
-	nks := PrivateKeySet{
-		keys:        keys,
-		ActiveKeyID: k.ID(),
-		expiresAt:   exp,
-	}
-
-	return repo.Set(KeySet(&nks))
-}

vendor/github.com/coreos/go-oidc/key/sync.go

-package key
-
-import (
-	"errors"
-	"log"
-	"time"
-
-	"github.com/jonboulle/clockwork"
-
-	"github.com/coreos/pkg/timeutil"
-)
-
-func NewKeySetSyncer(r ReadableKeySetRepo, w WritableKeySetRepo) *KeySetSyncer {
-	return &KeySetSyncer{
-		readable: r,
-		writable: w,
-		clock:    clockwork.NewRealClock(),
-	}
-}
-
-type KeySetSyncer struct {
-	readable ReadableKeySetRepo
-	writable WritableKeySetRepo
-	clock    clockwork.Clock
-}
-
-func (s *KeySetSyncer) Run() chan struct{} {
-	stop := make(chan struct{})
-	go func() {
-		var failing bool
-		var next time.Duration
-		for {
-			exp, err := syncKeySet(s.readable, s.writable, s.clock)
-			if err != nil || exp == 0 {
-				if !failing {
-					failing = true
-					next = time.Second
-				} else {
-					next = timeutil.ExpBackoff(next, time.Minute)
-				}
-				if exp == 0 {
-					log.Printf("Synced to already expired key set, retrying in %v: %v", next, err)
-
-				} else {
-					log.Printf("Failed syncing key set, retrying in %v: %v", next, err)
-				}
-			} else {
-				failing = false
-				next = exp / 2
-			}
-
-			select {
-			case <-s.clock.After(next):
-				continue
-			case <-stop:
-				return
-			}
-		}
-	}()
-
-	return stop
-}
-
-func Sync(r ReadableKeySetRepo, w WritableKeySetRepo) (time.Duration, error) {
-	return syncKeySet(r, w, clockwork.NewRealClock())
-}
-
-// syncKeySet copies the keyset from r to the KeySet at w and returns the duration in which the KeySet will expire.
-// If keyset has already expired, returns a zero duration.
-func syncKeySet(r ReadableKeySetRepo, w WritableKeySetRepo, clock clockwork.Clock) (exp time.Duration, err error) {
-	var ks KeySet
-	ks, err = r.Get()
-	if err != nil {
-		return
-	}
-
-	if ks == nil {
-		err = errors.New("no source KeySet")
-		return
-	}
-
-	if err = w.Set(ks); err != nil {
-		return
-	}
-
-	now := clock.Now()
-	if ks.ExpiresAt().After(now) {
-		exp = ks.ExpiresAt().Sub(now)
-	}
-	return
-}

vendor/github.com/coreos/go-oidc/oauth2/doc.go

-// Package oauth2 is DEPRECATED. Use golang.org/x/oauth instead.
-package oauth2

vendor/github.com/coreos/go-oidc/oauth2/error.go

-package oauth2
-
-const (
-	ErrorAccessDenied            = "access_denied"
-	ErrorInvalidClient           = "invalid_client"
-	ErrorInvalidGrant            = "invalid_grant"
-	ErrorInvalidRequest          = "invalid_request"
-	ErrorServerError             = "server_error"
-	ErrorUnauthorizedClient      = "unauthorized_client"
-	ErrorUnsupportedGrantType    = "unsupported_grant_type"
-	ErrorUnsupportedResponseType = "unsupported_response_type"
-)
-
-type Error struct {
-	Type        string `json:"error"`
-	Description string `json:"error_description,omitempty"`
-	State       string `json:"state,omitempty"`
-}
-
-func (e *Error) Error() string {
-	if e.Description != "" {
-		return e.Type + ": " + e.Description
-	}
-	return e.Type
-}
-
-func NewError(typ string) *Error {
-	return &Error{Type: typ}
-}

vendor/github.com/coreos/go-oidc/oidc/BUILD

-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "client.go",
-        "doc.go",
-        "identity.go",
-        "interface.go",
-        "key.go",
-        "provider.go",
-        "transport.go",
-        "util.go",
-        "verification.go",
-    ],
-    importpath = "github.com/coreos/go-oidc/oidc",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//vendor/github.com/coreos/go-oidc/http:go_default_library",
-        "//vendor/github.com/coreos/go-oidc/jose:go_default_library",
-        "//vendor/github.com/coreos/go-oidc/key:go_default_library",
-        "//vendor/github.com/coreos/go-oidc/oauth2:go_default_library",
-        "//vendor/github.com/coreos/pkg/timeutil:go_default_library",
-        "//vendor/github.com/jonboulle/clockwork:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)

vendor/github.com/coreos/go-oidc/oidc/doc.go

-// Package oidc is DEPRECATED. Use github.com/coreos/go-oidc instead.
-package oidc

vendor/github.com/coreos/go-oidc/oidc/identity.go

-package oidc
-
-import (
-	"errors"
-	"time"
-
-	"github.com/coreos/go-oidc/jose"
-)
-
-type Identity struct {
-	ID        string
-	Name      string
-	Email     string
-	ExpiresAt time.Time
-}
-
-func IdentityFromClaims(claims jose.Claims) (*Identity, error) {
-	if claims == nil {
-		return nil, errors.New("nil claim set")
-	}
-
-	var ident Identity
-	var err error
-	var ok bool
-
-	if ident.ID, ok, err = claims.StringClaim("sub"); err != nil {
-		return nil, err
-	} else if !ok {
-		return nil, errors.New("missing required claim: sub")
-	}
-
-	if ident.Email, _, err = claims.StringClaim("email"); err != nil {
-		return nil, err
-	}
-
-	exp, ok, err := claims.TimeClaim("exp")
-	if err != nil {
-		return nil, err
-	} else if ok {
-		ident.ExpiresAt = exp
-	}
-
-	return &ident, nil
-}

vendor/github.com/coreos/go-oidc/oidc/interface.go

-package oidc
-
-type LoginFunc func(ident Identity, sessionKey string) (redirectURL string, err error)

vendor/github.com/coreos/go-oidc/oidc/key.go

-package oidc
-
-import (
-	"encoding/json"
-	"errors"
-	"net/http"
-	"time"
-
-	phttp "github.com/coreos/go-oidc/http"
-	"github.com/coreos/go-oidc/jose"
-	"github.com/coreos/go-oidc/key"
-)
-
-// DefaultPublicKeySetTTL is the default TTL set on the PublicKeySet if no
-// Cache-Control header is provided by the JWK Set document endpoint.
-const DefaultPublicKeySetTTL = 24 * time.Hour
-
-// NewRemotePublicKeyRepo is responsible for fetching the JWK Set document.
-func NewRemotePublicKeyRepo(hc phttp.Client, ep string) *remotePublicKeyRepo {
-	return &remotePublicKeyRepo{hc: hc, ep: ep}
-}
-
-type remotePublicKeyRepo struct {
-	hc phttp.Client
-	ep string
-}
-
-// Get returns a PublicKeySet fetched from the JWK Set document endpoint. A TTL
-// is set on the Key Set to avoid it having to be re-retrieved for every
-// encryption event. This TTL is typically controlled by the endpoint returning
-// a Cache-Control header, but defaults to 24 hours if no Cache-Control header
-// is found.
-func (r *remotePublicKeyRepo) Get() (key.KeySet, error) {
-	req, err := http.NewRequest("GET", r.ep, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	resp, err := r.hc.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	var d struct {
-		Keys []jose.JWK `json:"keys"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&d); err != nil {
-		return nil, err
-	}
-
-	if len(d.Keys) == 0 {
-		return nil, errors.New("zero keys in response")
-	}
-
-	ttl, ok, err := phttp.Cacheable(resp.Header)
-	if err != nil {
-		return nil, err
-	}
-	if !ok {
-		ttl = DefaultPublicKeySetTTL
-	}
-
-	exp := time.Now().UTC().Add(ttl)
-	ks := key.NewPublicKeySet(d.Keys, exp)
-	return ks, nil
-}

vendor/github.com/coreos/go-oidc/oidc/transport.go

-package oidc
-
-import (
-	"fmt"
-	"net/http"
-	"sync"
-
-	phttp "github.com/coreos/go-oidc/http"
-	"github.com/coreos/go-oidc/jose"
-)
-
-type TokenRefresher interface {
-	// Verify checks if the provided token is currently valid or not.
-	Verify(jose.JWT) error
-
-	// Refresh attempts to authenticate and retrieve a new token.
-	Refresh() (jose.JWT, error)
-}
-
-type ClientCredsTokenRefresher struct {
-	Issuer     string
-	OIDCClient *Client
-}
-
-func (c *ClientCredsTokenRefresher) Verify(jwt jose.JWT) (err error) {
-	_, err = VerifyClientClaims(jwt, c.Issuer)
-	return
-}
-
-func (c *ClientCredsTokenRefresher) Refresh() (jwt jose.JWT, err error) {
-	if err = c.OIDCClient.Healthy(); err != nil {
-		err = fmt.Errorf("unable to authenticate, unhealthy OIDC client: %v", err)
-		return
-	}
-
-	jwt, err = c.OIDCClient.ClientCredsToken([]string{"openid"})
-	if err != nil {
-		err = fmt.Errorf("unable to verify auth code with issuer: %v", err)
-		return
-	}
-
-	return
-}
-
-type AuthenticatedTransport struct {
-	TokenRefresher
-	http.RoundTripper
-
-	mu  sync.Mutex
-	jwt jose.JWT
-}
-
-func (t *AuthenticatedTransport) verifiedJWT() (jose.JWT, error) {
-	t.mu.Lock()
-	defer t.mu.Unlock()
-
-	if t.TokenRefresher.Verify(t.jwt) == nil {
-		return t.jwt, nil
-	}
-
-	jwt, err := t.TokenRefresher.Refresh()
-	if err != nil {
-		return jose.JWT{}, fmt.Errorf("unable to acquire valid JWT: %v", err)
-	}
-
-	t.jwt = jwt
-	return t.jwt, nil
-}
-
-// SetJWT sets the JWT held by the Transport.
-// This is useful for cases in which you want to set an initial JWT.
-func (t *AuthenticatedTransport) SetJWT(jwt jose.JWT) {
-	t.mu.Lock()
-	defer t.mu.Unlock()
-
-	t.jwt = jwt
-}
-
-func (t *AuthenticatedTransport) RoundTrip(r *http.Request) (*http.Response, error) {
-	jwt, err := t.verifiedJWT()
-	if err != nil {
-		return nil, err
-	}
-
-	req := phttp.CopyRequest(r)
-	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", jwt.Encode()))
-	return t.RoundTripper.RoundTrip(req)
-}

vendor/github.com/coreos/go-oidc/oidc/util.go

-package oidc
-
-import (
-	"crypto/rand"
-	"encoding/base64"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"net/url"
-	"strings"
-	"time"
-
-	"github.com/coreos/go-oidc/jose"
-)
-
-// RequestTokenExtractor funcs extract a raw encoded token from a request.
-type RequestTokenExtractor func(r *http.Request) (string, error)
-
-// ExtractBearerToken is a RequestTokenExtractor which extracts a bearer token from a request's
-// Authorization header.
-func ExtractBearerToken(r *http.Request) (string, error) {
-	ah := r.Header.Get("Authorization")
-	if ah == "" {
-		return "", errors.New("missing Authorization header")
-	}
-
-	if len(ah) <= 6 || strings.ToUpper(ah[0:6]) != "BEARER" {
-		return "", errors.New("should be a bearer token")
-	}
-
-	val := ah[7:]
-	if len(val) == 0 {
-		return "", errors.New("bearer token is empty")
-	}
-
-	return val, nil
-}
-
-// CookieTokenExtractor returns a RequestTokenExtractor which extracts a token from the named cookie in a request.
-func CookieTokenExtractor(cookieName string) RequestTokenExtractor {
-	return func(r *http.Request) (string, error) {
-		ck, err := r.Cookie(cookieName)
-		if err != nil {
-			return "", fmt.Errorf("token cookie not found in request: %v", err)
-		}
-
-		if ck.Value == "" {
-			return "", errors.New("token cookie found but is empty")
-		}
-
-		return ck.Value, nil
-	}
-}
-
-func NewClaims(iss, sub string, aud interface{}, iat, exp time.Time) jose.Claims {
-	return jose.Claims{
-		// required
-		"iss": iss,
-		"sub": sub,
-		"aud": aud,
-		"iat": iat.Unix(),
-		"exp": exp.Unix(),
-	}
-}
-
-func GenClientID(hostport string) (string, error) {
-	b, err := randBytes(32)
-	if err != nil {
-		return "", err
-	}
-
-	var host string
-	if strings.Contains(hostport, ":") {
-		host, _, err = net.SplitHostPort(hostport)
-		if err != nil {
-			return "", err
-		}
-	} else {
-		host = hostport
-	}
-
-	return fmt.Sprintf("%s@%s", base64.URLEncoding.EncodeToString(b), host), nil
-}
-
-func randBytes(n int) ([]byte, error) {
-	b := make([]byte, n)
-	got, err := rand.Read(b)
-	if err != nil {
-		return nil, err
-	} else if n != got {
-		return nil, errors.New("unable to generate enough random data")
-	}
-	return b, nil
-}
-
-// urlEqual checks two urls for equality using only the host and path portions.
-func urlEqual(url1, url2 string) bool {
-	u1, err := url.Parse(url1)
-	if err != nil {
-		return false
-	}
-	u2, err := url.Parse(url2)
-	if err != nil {
-		return false
-	}
-
-	return strings.ToLower(u1.Host+u1.Path) == strings.ToLower(u2.Host+u2.Path)
-}

vendor/github.com/coreos/go-oidc/oidc/verification.go

-package oidc
-
-import (
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/jonboulle/clockwork"
-
-	"github.com/coreos/go-oidc/jose"
-	"github.com/coreos/go-oidc/key"
-)
-
-func VerifySignature(jwt jose.JWT, keys []key.PublicKey) (bool, error) {
-	jwtBytes := []byte(jwt.Data())
-	for _, k := range keys {
-		v, err := k.Verifier()
-		if err != nil {
-			return false, err
-		}
-		if v.Verify(jwt.Signature, jwtBytes) == nil {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-// containsString returns true if the given string(needle) is found
-// in the string array(haystack).
-func containsString(needle string, haystack []string) bool {
-	for _, v := range haystack {
-		if v == needle {
-			return true
-		}
-	}
-	return false
-}
-
-// Verify claims in accordance with OIDC spec
-// http://openid.net/specs/openid-connect-basic-1_0.html#IDTokenValidation
-func VerifyClaims(jwt jose.JWT, issuer, clientID string) error {
-	now := time.Now().UTC()
-
-	claims, err := jwt.Claims()
-	if err != nil {
-		return err
-	}
-
-	ident, err := IdentityFromClaims(claims)
-	if err != nil {
-		return err
-	}
-
-	if ident.ExpiresAt.Before(now) {
-		return errors.New("token is expired")
-	}
-
-	// iss REQUIRED. Issuer Identifier for the Issuer of the response.
-	// The iss value is a case sensitive URL using the https scheme that contains scheme,
-	// host, and optionally, port number and path components and no query or fragment components.
-	if iss, exists := claims["iss"].(string); exists {
-		if !urlEqual(iss, issuer) {
-			return fmt.Errorf("invalid claim value: 'iss'. expected=%s, found=%s.", issuer, iss)
-		}
-	} else {
-		return errors.New("missing claim: 'iss'")
-	}
-
-	// iat REQUIRED. Time at which the JWT was issued.
-	// Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z
-	// as measured in UTC until the date/time.
-	if _, exists := claims["iat"].(float64); !exists {
-		return errors.New("missing claim: 'iat'")
-	}
-
-	// aud REQUIRED. Audience(s) that this ID Token is intended for.
-	// It MUST contain the OAuth 2.0 client_id of the Relying Party as an audience value.
-	// It MAY also contain identifiers for other audiences. In the general case, the aud
-	// value is an array of case sensitive strings. In the common special case when there
-	// is one audience, the aud value MAY be a single case sensitive string.
-	if aud, ok, err := claims.StringClaim("aud"); err == nil && ok {
-		if aud != clientID {
-			return fmt.Errorf("invalid claims, 'aud' claim and 'client_id' do not match, aud=%s, client_id=%s", aud, clientID)
-		}
-	} else if aud, ok, err := claims.StringsClaim("aud"); err == nil && ok {
-		if !containsString(clientID, aud) {
-			return fmt.Errorf("invalid claims, cannot find 'client_id' in 'aud' claim, aud=%v, client_id=%s", aud, clientID)
-		}
-	} else {
-		return errors.New("invalid claim value: 'aud' is required, and should be either string or string array")
-	}
-
-	return nil
-}
-
-// VerifyClientClaims verifies all the required claims are valid for a "client credentials" JWT.
-// Returns the client ID if valid, or an error if invalid.
-func VerifyClientClaims(jwt jose.JWT, issuer string) (string, error) {
-	claims, err := jwt.Claims()
-	if err != nil {
-		return "", fmt.Errorf("failed to parse JWT claims: %v", err)
-	}
-
-	iss, ok, err := claims.StringClaim("iss")
-	if err != nil {
-		return "", fmt.Errorf("failed to parse 'iss' claim: %v", err)
-	} else if !ok {
-		return "", errors.New("missing required 'iss' claim")
-	} else if !urlEqual(iss, issuer) {
-		return "", fmt.Errorf("'iss' claim does not match expected issuer, iss=%s", iss)
-	}
-
-	sub, ok, err := claims.StringClaim("sub")
-	if err != nil {
-		return "", fmt.Errorf("failed to parse 'sub' claim: %v", err)
-	} else if !ok {
-		return "", errors.New("missing required 'sub' claim")
-	}
-
-	if aud, ok, err := claims.StringClaim("aud"); err == nil && ok {
-		if aud != sub {
-			return "", fmt.Errorf("invalid claims, 'aud' claim and 'sub' claim do not match, aud=%s, sub=%s", aud, sub)
-		}
-	} else if aud, ok, err := claims.StringsClaim("aud"); err == nil && ok {
-		if !containsString(sub, aud) {
-			return "", fmt.Errorf("invalid claims, cannot find 'sud' in 'aud' claim, aud=%v, sub=%s", aud, sub)
-		}
-	} else {
-		return "", errors.New("invalid claim value: 'aud' is required, and should be either string or string array")
-	}
-
-	now := time.Now().UTC()
-	exp, ok, err := claims.TimeClaim("exp")
-	if err != nil {
-		return "", fmt.Errorf("failed to parse 'exp' claim: %v", err)
-	} else if !ok {
-		return "", errors.New("missing required 'exp' claim")
-	} else if exp.Before(now) {
-		return "", fmt.Errorf("token already expired at: %v", exp)
-	}
-
-	return sub, nil
-}
-
-type JWTVerifier struct {
-	issuer   string
-	clientID string
-	syncFunc func() error
-	keysFunc func() []key.PublicKey
-	clock    clockwork.Clock
-}
-
-func NewJWTVerifier(issuer, clientID string, syncFunc func() error, keysFunc func() []key.PublicKey) JWTVerifier {
-	return JWTVerifier{
-		issuer:   issuer,
-		clientID: clientID,
-		syncFunc: syncFunc,
-		keysFunc: keysFunc,
-		clock:    clockwork.NewRealClock(),
-	}
-}
-
-func (v *JWTVerifier) Verify(jwt jose.JWT) error {
-	// Verify claims before verifying the signature. This is an optimization to throw out
-	// tokens we know are invalid without undergoing an expensive signature check and
-	// possibly a re-sync event.
-	if err := VerifyClaims(jwt, v.issuer, v.clientID); err != nil {
-		return fmt.Errorf("oidc: JWT claims invalid: %v", err)
-	}
-
-	ok, err := VerifySignature(jwt, v.keysFunc())
-	if err != nil {
-		return fmt.Errorf("oidc: JWT signature verification failed: %v", err)
-	} else if ok {
-		return nil
-	}
-
-	if err = v.syncFunc(); err != nil {
-		return fmt.Errorf("oidc: failed syncing KeySet: %v", err)
-	}
-
-	ok, err = VerifySignature(jwt, v.keysFunc())
-	if err != nil {
-		return fmt.Errorf("oidc: JWT signature verification failed: %v", err)
-	} else if !ok {
-		return errors.New("oidc: unable to verify JWT signature: no matching keys")
-	}
-
-	return nil
-}

vendor/github.com/coreos/go-oidc/test

+#!/bin/bash
+
+set -e
+
+# Filter out any files with a !golint build tag.
+LINTABLE=$( go list -tags=golint -f '
+  {{- range $i, $file := .GoFiles -}}
+    {{ $file }} {{ end }}
+  {{ range $i, $file := .TestGoFiles -}}
+    {{ $file }} {{ end }}' github.com/coreos/go-oidc )
+
+go test -v -i -race github.com/coreos/go-oidc/...
+go test -v -race github.com/coreos/go-oidc/...
+golint -set_exit_status $LINTABLE
+go vet github.com/coreos/go-oidc/...
+go build -v ./example/...

vendor/github.com/coreos/go-oidc/verify.go

+package oidc
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"golang.org/x/oauth2"
+	jose "gopkg.in/square/go-jose.v2"
+)
+
+const (
+	issuerGoogleAccounts         = "https://accounts.google.com"
+	issuerGoogleAccountsNoScheme = "accounts.google.com"
+)
+
+// KeySet is a set of publc JSON Web Keys that can be used to validate the signature
+// of JSON web tokens. This is expected to be backed by a remote key set through
+// provider metadata discovery or an in-memory set of keys delivered out-of-band.
+type KeySet interface {
+	// VerifySignature parses the JSON web token, verifies the signature, and returns
+	// the raw payload. Header and claim fields are validated by other parts of the
+	// package. For example, the KeySet does not need to check values such as signature
+	// algorithm, issuer, and audience since the IDTokenVerifier validates these values
+	// independently.
+	//
+	// If VerifySignature makes HTTP requests to verify the token, it's expected to
+	// use any HTTP client associated with the context through ClientContext.
+	VerifySignature(ctx context.Context, jwt string) (payload []byte, err error)
+}
+
+// IDTokenVerifier provides verification for ID Tokens.
+type IDTokenVerifier struct {
+	keySet KeySet
+	config *Config
+	issuer string
+}
+
+// NewVerifier returns a verifier manually constructed from a key set and issuer URL.
+//
+// It's easier to use provider discovery to construct an IDTokenVerifier than creating
+// one directly. This method is intended to be used with provider that don't support
+// metadata discovery, or avoiding round trips when the key set URL is already known.
+//
+// This constructor can be used to create a verifier directly using the issuer URL and
+// JSON Web Key Set URL without using discovery:
+//
+//		keySet := oidc.NewRemoteKeySet(ctx, "https://www.googleapis.com/oauth2/v3/certs")
+//		verifier := oidc.NewVerifier("https://accounts.google.com", keySet, config)
+//
+// Since KeySet is an interface, this constructor can also be used to supply custom
+// public key sources. For example, if a user wanted to supply public keys out-of-band
+// and hold them statically in-memory:
+//
+//		// Custom KeySet implementation.
+//		keySet := newStatisKeySet(publicKeys...)
+//
+//		// Verifier uses the custom KeySet implementation.
+//		verifier := oidc.NewVerifier("https://auth.example.com", keySet, config)
+//
+func NewVerifier(issuerURL string, keySet KeySet, config *Config) *IDTokenVerifier {
+	return &IDTokenVerifier{keySet: keySet, config: config, issuer: issuerURL}
+}
+
+// Config is the configuration for an IDTokenVerifier.
+type Config struct {
+	// Expected audience of the token. For a majority of the cases this is expected to be
+	// the ID of the client that initialized the login flow. It may occasionally differ if
+	// the provider supports the authorizing party (azp) claim.
+	//
+	// If not provided, users must explicitly set SkipClientIDCheck.
+	ClientID string
+	// If specified, only this set of algorithms may be used to sign the JWT.
+	//
+	// Since many providers only support RS256, SupportedSigningAlgs defaults to this value.
+	SupportedSigningAlgs []string
+
+	// If true, no ClientID check performed. Must be true if ClientID field is empty.
+	SkipClientIDCheck bool
+	// If true, token expiry is not checked.
+	SkipExpiryCheck bool
+
+	// Time function to check Token expiry. Defaults to time.Now
+	Now func() time.Time
+}
+
+// Verifier returns an IDTokenVerifier that uses the provider's key set to verify JWTs.
+//
+// The returned IDTokenVerifier is tied to the Provider's context and its behavior is
+// undefined once the Provider's context is canceled.
+func (p *Provider) Verifier(config *Config) *IDTokenVerifier {
+	return NewVerifier(p.issuer, p.remoteKeySet, config)
+}
+
+func parseJWT(p string) ([]byte, error) {
+	parts := strings.Split(p, ".")
+	if len(parts) < 2 {
+		return nil, fmt.Errorf("oidc: malformed jwt, expected 3 parts got %d", len(parts))
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return nil, fmt.Errorf("oidc: malformed jwt payload: %v", err)
+	}
+	return payload, nil
+}
+
+func contains(sli []string, ele string) bool {
+	for _, s := range sli {
+		if s == ele {
+			return true
+		}
+	}
+	return false
+}
+
+// Verify parses a raw ID Token, verifies it's been signed by the provider, preforms
+// any additional checks depending on the Config, and returns the payload.
+//
+// Verify does NOT do nonce validation, which is the callers responsibility.
+//
+// See: https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
+//
+//    oauth2Token, err := oauth2Config.Exchange(ctx, r.URL.Query().Get("code"))
+//    if err != nil {
+//        // handle error
+//    }
+//
+//    // Extract the ID Token from oauth2 token.
+//    rawIDToken, ok := oauth2Token.Extra("id_token").(string)
+//    if !ok {
+//        // handle error
+//    }
+//
+//    token, err := verifier.Verify(ctx, rawIDToken)
+//
+func (v *IDTokenVerifier) Verify(ctx context.Context, rawIDToken string) (*IDToken, error) {
+	jws, err := jose.ParseSigned(rawIDToken)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: malformed jwt: %v", err)
+	}
+
+	// Throw out tokens with invalid claims before trying to verify the token. This lets
+	// us do cheap checks before possibly re-syncing keys.
+	payload, err := parseJWT(rawIDToken)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: malformed jwt: %v", err)
+	}
+	var token idToken
+	if err := json.Unmarshal(payload, &token); err != nil {
+		return nil, fmt.Errorf("oidc: failed to unmarshal claims: %v", err)
+	}
+
+	t := &IDToken{
+		Issuer:          token.Issuer,
+		Subject:         token.Subject,
+		Audience:        []string(token.Audience),
+		Expiry:          time.Time(token.Expiry),
+		IssuedAt:        time.Time(token.IssuedAt),
+		Nonce:           token.Nonce,
+		AccessTokenHash: token.AtHash,
+		claims:          payload,
+	}
+
+	// Check issuer.
+	if t.Issuer != v.issuer {
+		// Google sometimes returns "accounts.google.com" as the issuer claim instead of
+		// the required "https://accounts.google.com". Detect this case and allow it only
+		// for Google.
+		//
+		// We will not add hooks to let other providers go off spec like this.
+		if !(v.issuer == issuerGoogleAccounts && t.Issuer == issuerGoogleAccountsNoScheme) {
+			return nil, fmt.Errorf("oidc: id token issued by a different provider, expected %q got %q", v.issuer, t.Issuer)
+		}
+	}
+
+	// If a client ID has been provided, make sure it's part of the audience. SkipClientIDCheck must be true if ClientID is empty.
+	//
+	// This check DOES NOT ensure that the ClientID is the party to which the ID Token was issued (i.e. Authorized party).
+	if !v.config.SkipClientIDCheck {
+		if v.config.ClientID != "" {
+			if !contains(t.Audience, v.config.ClientID) {
+				return nil, fmt.Errorf("oidc: expected audience %q got %q", v.config.ClientID, t.Audience)
+			}
+		} else {
+			return nil, fmt.Errorf("oidc: invalid configuration, clientID must be provided or SkipClientIDCheck must be set")
+		}
+	}
+
+	// If a SkipExpiryCheck is false, make sure token is not expired.
+	if !v.config.SkipExpiryCheck {
+		now := time.Now
+		if v.config.Now != nil {
+			now = v.config.Now
+		}
+
+		if t.Expiry.Before(now()) {
+			return nil, fmt.Errorf("oidc: token is expired (Token Expiry: %v)", t.Expiry)
+		}
+	}
+
+	switch len(jws.Signatures) {
+	case 0:
+		return nil, fmt.Errorf("oidc: id token not signed")
+	case 1:
+	default:
+		return nil, fmt.Errorf("oidc: multiple signatures on id token not supported")
+	}
+
+	sig := jws.Signatures[0]
+	supportedSigAlgs := v.config.SupportedSigningAlgs
+	if len(supportedSigAlgs) == 0 {
+		supportedSigAlgs = []string{RS256}
+	}
+
+	if !contains(supportedSigAlgs, sig.Header.Algorithm) {
+		return nil, fmt.Errorf("oidc: id token signed with unsupported algorithm, expected %q got %q", supportedSigAlgs, sig.Header.Algorithm)
+	}
+
+	t.sigAlgorithm = sig.Header.Algorithm
+
+	gotPayload, err := v.keySet.VerifySignature(ctx, rawIDToken)
+	if err != nil {
+		return nil, fmt.Errorf("failed to verify signature: %v", err)
+	}
+
+	// Ensure that the payload returned by the square actually matches the payload parsed earlier.
+	if !bytes.Equal(gotPayload, payload) {
+		return nil, errors.New("oidc: internal error, payload parsed did not match previous payload")
+	}
+
+	return t, nil
+}
+
+// Nonce returns an auth code option which requires the ID Token created by the
+// OpenID Connect provider to contain the specified nonce.
+func Nonce(nonce string) oauth2.AuthCodeOption {
+	return oauth2.SetAuthURLParam("nonce", nonce)
+}

vendor/github.com/coreos/pkg/health/BUILD

-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "go_default_library",
-    srcs = ["health.go"],
-    importpath = "github.com/coreos/pkg/health",
-    visibility = ["//visibility:public"],
-    deps = ["//vendor/github.com/coreos/pkg/httputil:go_default_library"],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)

vendor/github.com/coreos/pkg/health/README.md

-health
-====
-
-A simple framework for implementing an HTTP health check endpoint on servers.
-
-Users implement their `health.Checkable` types, and create a `health.Checker`, from which they can get an `http.HandlerFunc` using `health.Checker.MakeHealthHandlerFunc`.
-
-### Documentation
-
-For more details, visit the docs on [gopkgdoc](http://godoc.org/github.com/coreos/pkg/health)
-

vendor/github.com/coreos/pkg/health/health.go

-package health
-
-import (
-	"expvar"
-	"fmt"
-	"log"
-	"net/http"
-
-	"github.com/coreos/pkg/httputil"
-)
-
-// Checkables should return nil when the thing they are checking is healthy, and an error otherwise.
-type Checkable interface {
-	Healthy() error
-}
-
-// Checker provides a way to make an endpoint which can be probed for system health.
-type Checker struct {
-	// Checks are the Checkables to be checked when probing.
-	Checks []Checkable
-
-	// Unhealthyhandler is called when one or more of the checks are unhealthy.
-	// If not provided DefaultUnhealthyHandler is called.
-	UnhealthyHandler UnhealthyHandler
-
-	// HealthyHandler is called when all checks are healthy.
-	// If not provided, DefaultHealthyHandler is called.
-	HealthyHandler http.HandlerFunc
-}
-
-func (c Checker) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	unhealthyHandler := c.UnhealthyHandler
-	if unhealthyHandler == nil {
-		unhealthyHandler = DefaultUnhealthyHandler
-	}
-
-	successHandler := c.HealthyHandler
-	if successHandler == nil {
-		successHandler = DefaultHealthyHandler
-	}
-
-	if r.Method != "GET" {
-		w.Header().Set("Allow", "GET")
-		w.WriteHeader(http.StatusMethodNotAllowed)
-		return
-	}
-
-	if err := Check(c.Checks); err != nil {
-		unhealthyHandler(w, r, err)
-		return
-	}
-
-	successHandler(w, r)
-}
-
-type UnhealthyHandler func(w http.ResponseWriter, r *http.Request, err error)
-
-type StatusResponse struct {
-	Status  string                 `json:"status"`
-	Details *StatusResponseDetails `json:"details,omitempty"`
-}
-
-type StatusResponseDetails struct {
-	Code    int    `json:"code,omitempty"`
-	Message string `json:"message,omitempty"`
-}
-
-func Check(checks []Checkable) (err error) {
-	errs := []error{}
-	for _, c := range checks {
-		if e := c.Healthy(); e != nil {
-			errs = append(errs, e)
-		}
-	}
-
-	switch len(errs) {
-	case 0:
-		err = nil
-	case 1:
-		err = errs[0]
-	default:
-		err = fmt.Errorf("multiple health check failure: %v", errs)
-	}
-
-	return
-}
-
-func DefaultHealthyHandler(w http.ResponseWriter, r *http.Request) {
-	err := httputil.WriteJSONResponse(w, http.StatusOK, StatusResponse{
-		Status: "ok",
-	})
-	if err != nil {
-		// TODO(bobbyrullo): replace with logging from new logging pkg,
-		// once it lands.
-		log.Printf("Failed to write JSON response: %v", err)
-	}
-}
-
-func DefaultUnhealthyHandler(w http.ResponseWriter, r *http.Request, err error) {
-	writeErr := httputil.WriteJSONResponse(w, http.StatusInternalServerError, StatusResponse{
-		Status: "error",
-		Details: &StatusResponseDetails{
-			Code:    http.StatusInternalServerError,
-			Message: err.Error(),
-		},
-	})
-	if writeErr != nil {
-		// TODO(bobbyrullo): replace with logging from new logging pkg,
-		// once it lands.
-		log.Printf("Failed to write JSON response: %v", err)
-	}
-}
-
-// ExpvarHandler is copied from https://golang.org/src/expvar/expvar.go, where it's sadly unexported.
-func ExpvarHandler(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "application/json; charset=utf-8")
-	fmt.Fprintf(w, "{\n")
-	first := true
-	expvar.Do(func(kv expvar.KeyValue) {
-		if !first {
-			fmt.Fprintf(w, ",\n")
-		}
-		first = false
-		fmt.Fprintf(w, "%q: %s", kv.Key, kv.Value)
-	})
-	fmt.Fprintf(w, "\n}\n")
-}

vendor/github.com/coreos/pkg/httputil/README.md

-httputil
-====
-
-Common code for dealing with HTTP.
-
-Includes:
-
-* Code for returning JSON responses.
-
-### Documentation
-
-Visit the docs on [gopkgdoc](http://godoc.org/github.com/coreos/pkg/httputil)
-

vendor/github.com/coreos/pkg/httputil/cookie.go

-package httputil
-
-import (
-	"net/http"
-	"time"
-)
-
-// DeleteCookies effectively deletes all named cookies
-// by wiping all data and setting to expire immediately.
-func DeleteCookies(w http.ResponseWriter, cookieNames ...string) {
-	for _, n := range cookieNames {
-		c := &http.Cookie{
-			Name:    n,
-			Value:   "",
-			Path:    "/",
-			MaxAge:  -1,
-			Expires: time.Time{},
-		}
-		http.SetCookie(w, c)
-	}
-}

vendor/github.com/coreos/pkg/httputil/json.go

-package httputil
-
-import (
-	"encoding/json"
-	"net/http"
-)
-
-const (
-	JSONContentType = "application/json"
-)
-
-func WriteJSONResponse(w http.ResponseWriter, code int, resp interface{}) error {
-	enc, err := json.Marshal(resp)
-	if err != nil {
-		w.WriteHeader(http.StatusInternalServerError)
-		return err
-	}
-
-	w.Header().Set("Content-Type", JSONContentType)
-	w.WriteHeader(code)
-
-	_, err = w.Write(enc)
-	if err != nil {
-		return err
-	}
-	return nil
-}

vendor/github.com/coreos/pkg/timeutil/BUILD

-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
-go_library(
-    name = "go_default_library",
-    srcs = ["backoff.go"],
-    importpath = "github.com/coreos/pkg/timeutil",
-    visibility = ["//visibility:public"],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)

vendor/github.com/coreos/pkg/timeutil/backoff.go

-package timeutil
-
-import (
-	"time"
-)
-
-func ExpBackoff(prev, max time.Duration) time.Duration {
-	if prev == 0 {
-		return time.Second
-	}
-	if prev > max/2 {
-		return max
-	}
-	return 2 * prev
-}

vendor/github.com/pquerna/cachecontrol/.travis.yml

+language: go
+
+install:
+  - go get -d -v ./...
+  - go get -u github.com/stretchr/testify/require
+
+go:
+  - 1.7
+  - 1.8
+  - tip

vendor/github.com/coreos/go-oidc/http/BUILD → vendor/github.com/pquerna/cachecontrol/BUILD

@@ -3,13 +3,12 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library")
 go_library(
     name = "go_default_library",
     srcs = [
-        "client.go",
+        "api.go",
         "doc.go",
-        "http.go",
-        "url.go",
     ],
-    importpath = "github.com/coreos/go-oidc/http",
+    importpath = "github.com/pquerna/cachecontrol",
     visibility = ["//visibility:public"],
+    deps = ["//vendor/github.com/pquerna/cachecontrol/cacheobject:go_default_library"],
 )
 
 filegroup(
@@ -21,7 +20,10 @@ filegroup(
 
 filegroup(
     name = "all-srcs",
-    srcs = [":package-srcs"],
+    srcs = [
+        ":package-srcs",
+        "//vendor/github.com/pquerna/cachecontrol/cacheobject:all-srcs",
+    ],
     tags = ["automanaged"],
     visibility = ["//visibility:public"],
 )

vendor/github.com/pquerna/cachecontrol/README.md

+# cachecontrol: HTTP Caching Parser and Interpretation
+
+[![GoDoc](https://godoc.org/github.com/pquerna/cachecontrol?status.svg)](https://godoc.org/github.com/pquerna/cachecontrol)[![Build Status](https://travis-ci.org/pquerna/cachecontrol.svg?branch=master)](https://travis-ci.org/pquerna/cachecontrol)
+
+ 
+
+`cachecontrol` implements [RFC 7234](http://tools.ietf.org/html/rfc7234) __Hypertext Transfer Protocol (HTTP/1.1): Caching__.  It does this by parsing the `Cache-Control` and other headers, providing information about requests and responses -- but `cachecontrol` does not implement an actual cache backend, just the control plane to make decisions about if a particular response is cachable.
+
+# Usage
+
+`cachecontrol.CachableResponse` returns an array of [reasons](https://godoc.org/github.com/pquerna/cachecontrol/cacheobject#Reason) why a response should not be cached and when it expires.  In the case that `len(reasons) == 0`, the response is cachable according to the RFC.  However, some people want non-compliant caches for various business use cases, so each reason is specifically named, so if your cache wants to cache `POST` requests, it can easily do that, but still be RFC compliant in other situations.
+
+# Examples
+
+## Can you cache Example.com?
+
+```go
+package main
+
+import (
+	"github.com/pquerna/cachecontrol"
+
+	"fmt"
+	"io/ioutil"
+	"net/http"
+)
+
+func main() {
+	req, _ := http.NewRequest("GET", "http://www.example.com/", nil)
+
+	res, _ := http.DefaultClient.Do(req)
+	_, _ = ioutil.ReadAll(res.Body)
+
+	reasons, expires, _ := cachecontrol.CachableResponse(req, res, cachecontrol.Options{})
+
+	fmt.Println("Reasons to not cache: ", reasons)
+	fmt.Println("Expiration: ", expires.String())
+}
+```
+
+## Can I use this in a high performance caching server?
+
+`cachecontrol` is divided into two packages: `cachecontrol` with a high level API, and a lower level `cacheobject` package.  Use [Object](https://godoc.org/github.com/pquerna/cachecontrol/cacheobject#Object) in a high performance use case where you have previously parsed headers containing dates or would like to avoid memory allocations.
+
+```go
+package main
+
+import (
+	"github.com/pquerna/cachecontrol/cacheobject"
+
+	"fmt"
+	"io/ioutil"
+	"net/http"
+)
+
+func main() {
+	req, _ := http.NewRequest("GET", "http://www.example.com/", nil)
+
+	res, _ := http.DefaultClient.Do(req)
+	_, _ = ioutil.ReadAll(res.Body)
+
+	reqDir, _ := cacheobject.ParseRequestCacheControl(req.Header.Get("Cache-Control"))
+
+	resDir, _ := cacheobject.ParseResponseCacheControl(res.Header.Get("Cache-Control"))
+	expiresHeader, _ := http.ParseTime(res.Header.Get("Expires"))
+	dateHeader, _ := http.ParseTime(res.Header.Get("Date"))
+	lastModifiedHeader, _ := http.ParseTime(res.Header.Get("Last-Modified"))
+
+	obj := cacheobject.Object{
+		RespDirectives:         resDir,
+		RespHeaders:            res.Header,
+		RespStatusCode:         res.StatusCode,
+		RespExpiresHeader:      expiresHeader,
+		RespDateHeader:         dateHeader,
+		RespLastModifiedHeader: lastModifiedHeader,
+
+		ReqDirectives: reqDir,
+		ReqHeaders:    req.Header,
+		ReqMethod:     req.Method,
+
+		NowUTC: time.Now().UTC(),
+	}
+	rv := cacheobject.ObjectResults{}
+
+	cacheobject.CachableObject(&obj, &rv)
+	cacheobject.ExpirationObject(&obj, &rv)
+
+	fmt.Println("Errors: ", rv.OutErr)
+	fmt.Println("Reasons to not cache: ", rv.OutReasons)
+	fmt.Println("Warning headers to add: ", rv.OutWarnings)
+	fmt.Println("Expiration: ", rv.OutExpirationTime.String())
+}
+```
+
+## Improvements, bugs, adding features, and taking cachecontrol new directions!
+
+Please [open issues in Github](https://github.com/pquerna/cachecontrol/issues) for ideas, bugs, and general thoughts.  Pull requests are of course preferred :)
+
+# Credits
+
+`cachecontrol` has recieved significant contributions from:
+
+* [Paul Querna](https://github.com/pquerna) 
+
+## License
+
+`cachecontrol` is licensed under the [Apache License, Version 2.0](./LICENSE)

vendor/github.com/pquerna/cachecontrol/api.go

+/**
+ *  Copyright 2015 Paul Querna
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package cachecontrol
+
+import (
+	"github.com/pquerna/cachecontrol/cacheobject"
+
+	"net/http"
+	"time"
+)
+
+type Options struct {
+	// Set to True for a prviate cache, which is not shared amoung users (eg, in a browser)
+	// Set to False for a "shared" cache, which is more common in a server context.
+	PrivateCache bool
+}
+
+// Given an HTTP Request, the future Status Code, and an ResponseWriter,
+// determine the possible reasons a response SHOULD NOT be cached.
+func CachableResponseWriter(req *http.Request,
+	statusCode int,
+	resp http.ResponseWriter,
+	opts Options) ([]cacheobject.Reason, time.Time, error) {
+	return cacheobject.UsingRequestResponse(req, statusCode, resp.Header(), opts.PrivateCache)
+}
+
+// Given an HTTP Request and Response, determine the possible reasons a response SHOULD NOT
+// be cached.
+func CachableResponse(req *http.Request,
+	resp *http.Response,
+	opts Options) ([]cacheobject.Reason, time.Time, error) {
+	return cacheobject.UsingRequestResponse(req, resp.StatusCode, resp.Header, opts.PrivateCache)
+}

vendor/github.com/coreos/pkg/httputil/BUILD → vendor/github.com/pquerna/cachecontrol/cacheobject/BUILD

@@ -3,10 +3,13 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library")
 go_library(
     name = "go_default_library",
     srcs = [
-        "cookie.go",
-        "json.go",
+        "directive.go",
+        "lex.go",
+        "object.go",
+        "reasons.go",
+        "warning.go",
     ],
-    importpath = "github.com/coreos/pkg/httputil",
+    importpath = "github.com/pquerna/cachecontrol/cacheobject",
     visibility = ["//visibility:public"],
 )
 

vendor/github.com/pquerna/cachecontrol/cacheobject/lex.go

+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cacheobject
+
+// This file deals with lexical matters of HTTP
+
+func isSeparator(c byte) bool {
+	switch c {
+	case '(', ')', '<', '>', '@', ',', ';', ':', '\\', '"', '/', '[', ']', '?', '=', '{', '}', ' ', '\t':
+		return true
+	}
+	return false
+}
+
+func isCtl(c byte) bool { return (0 <= c && c <= 31) || c == 127 }
+
+func isChar(c byte) bool { return 0 <= c && c <= 127 }
+
+func isAnyText(c byte) bool { return !isCtl(c) }
+
+func isQdText(c byte) bool { return isAnyText(c) && c != '"' }
+
+func isToken(c byte) bool { return isChar(c) && !isCtl(c) && !isSeparator(c) }
+
+// Valid escaped sequences are not specified in RFC 2616, so for now, we assume
+// that they coincide with the common sense ones used by GO. Malformed
+// characters should probably not be treated as errors by a robust (forgiving)
+// parser, so we replace them with the '?' character.
+func httpUnquotePair(b byte) byte {
+	// skip the first byte, which should always be '\'
+	switch b {
+	case 'a':
+		return '\a'
+	case 'b':
+		return '\b'
+	case 'f':
+		return '\f'
+	case 'n':
+		return '\n'
+	case 'r':
+		return '\r'
+	case 't':
+		return '\t'
+	case 'v':
+		return '\v'
+	case '\\':
+		return '\\'
+	case '\'':
+		return '\''
+	case '"':
+		return '"'
+	}
+	return '?'
+}
+
+// raw must begin with a valid quoted string. Only the first quoted string is
+// parsed and is unquoted in result. eaten is the number of bytes parsed, or -1
+// upon failure.
+func httpUnquote(raw string) (eaten int, result string) {
+	buf := make([]byte, len(raw))
+	if raw[0] != '"' {
+		return -1, ""
+	}
+	eaten = 1
+	j := 0 // # of bytes written in buf
+	for i := 1; i < len(raw); i++ {
+		switch b := raw[i]; b {
+		case '"':
+			eaten++
+			buf = buf[0:j]
+			return i + 1, string(buf)
+		case '\\':
+			if len(raw) < i+2 {
+				return -1, ""
+			}
+			buf[j] = httpUnquotePair(raw[i+1])
+			eaten += 2
+			j++
+			i++
+		default:
+			if isQdText(b) {
+				buf[j] = b
+			} else {
+				buf[j] = '?'
+			}
+			eaten++
+			j++
+		}
+	}
+	return -1, ""
+}

vendor/github.com/pquerna/cachecontrol/cacheobject/reasons.go

+/**
+ *  Copyright 2015 Paul Querna
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package cacheobject
+
+// Repersents a potential Reason to not cache an object.
+//
+// Applications may wish to ignore specific reasons, which will make them non-RFC
+// compliant, but this type gives them specific cases they can choose to ignore,
+// making them compliant in as many cases as they can.
+type Reason int
+
+const (
+
+	// The request method was POST and an Expiration header was not supplied.
+	ReasonRequestMethodPOST Reason = iota
+
+	// The request method was PUT and PUTs are not cachable.
+	ReasonRequestMethodPUT
+
+	// The request method was DELETE and DELETEs are not cachable.
+	ReasonRequestMethodDELETE
+
+	// The request method was CONNECT and CONNECTs are not cachable.
+	ReasonRequestMethodCONNECT
+
+	// The request method was OPTIONS and OPTIONS are not cachable.
+	ReasonRequestMethodOPTIONS
+
+	// The request method was TRACE and TRACEs are not cachable.
+	ReasonRequestMethodTRACE
+
+	// The request method was not recognized by cachecontrol, and should not be cached.
+	ReasonRequestMethodUnkown
+
+	// The request included an Cache-Control: no-store header
+	ReasonRequestNoStore
+
+	// The request included an Authorization header without an explicit Public or Expiration time: http://tools.ietf.org/html/rfc7234#section-3.2
+	ReasonRequestAuthorizationHeader
+
+	// The response included an Cache-Control: no-store header
+	ReasonResponseNoStore
+
+	// The response included an Cache-Control: private header and this is not a Private cache
+	ReasonResponsePrivate
+
+	// The response failed to meet at least one of the conditions specified in RFC 7234 section 3: http://tools.ietf.org/html/rfc7234#section-3
+	ReasonResponseUncachableByDefault
+)
+
+func (r Reason) String() string {
+	switch r {
+	case ReasonRequestMethodPOST:
+		return "ReasonRequestMethodPOST"
+	case ReasonRequestMethodPUT:
+		return "ReasonRequestMethodPUT"
+	case ReasonRequestMethodDELETE:
+		return "ReasonRequestMethodDELETE"
+	case ReasonRequestMethodCONNECT:
+		return "ReasonRequestMethodCONNECT"
+	case ReasonRequestMethodOPTIONS:
+		return "ReasonRequestMethodOPTIONS"
+	case ReasonRequestMethodTRACE:
+		return "ReasonRequestMethodTRACE"
+	case ReasonRequestMethodUnkown:
+		return "ReasonRequestMethodUnkown"
+	case ReasonRequestNoStore:
+		return "ReasonRequestNoStore"
+	case ReasonRequestAuthorizationHeader:
+		return "ReasonRequestAuthorizationHeader"
+	case ReasonResponseNoStore:
+		return "ReasonResponseNoStore"
+	case ReasonResponsePrivate:
+		return "ReasonResponsePrivate"
+	case ReasonResponseUncachableByDefault:
+		return "ReasonResponseUncachableByDefault"
+	}
+
+	panic(r)
+}

vendor/github.com/pquerna/cachecontrol/cacheobject/warning.go

+/**
+ *  Copyright 2015 Paul Querna
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package cacheobject
+
+import (
+	"fmt"
+	"net/http"
+	"time"
+)
+
+// Repersents an HTTP Warning: http://tools.ietf.org/html/rfc7234#section-5.5
+type Warning int
+
+const (
+	// Response is Stale
+	// A cache SHOULD generate this whenever the sent response is stale.
+	WarningResponseIsStale Warning = 110
+
+	// Revalidation Failed
+	// A cache SHOULD generate this when sending a stale
+	// response because an attempt to validate the response failed, due to an
+	// inability to reach the server.
+	WarningRevalidationFailed Warning = 111
+
+	// Disconnected Operation
+	// A cache SHOULD generate this if it is intentionally disconnected from
+	// the rest of the network for a period of time.
+	WarningDisconnectedOperation Warning = 112
+
+	// Heuristic Expiration
+	//
+	// A cache SHOULD generate this if it heuristically chose a freshness
+	// lifetime greater than 24 hours and the response's age is greater than
+	// 24 hours.
+	WarningHeuristicExpiration Warning = 113
+
+	// Miscellaneous Warning
+	//
+	// The warning text can include arbitrary information to be presented to
+	// a human user or logged.  A system receiving this warning MUST NOT
+	// take any automated action, besides presenting the warning to the
+	// user.
+	WarningMiscellaneousWarning Warning = 199
+
+	// Transformation Applied
+	//
+	// This Warning code MUST be added by a proxy if it applies any
+	// transformation to the representation, such as changing the
+	// content-coding, media-type, or modifying the representation data,
+	// unless this Warning code already appears in the response.
+	WarningTransformationApplied Warning = 214
+
+	// Miscellaneous Persistent Warning
+	//
+	// The warning text can include arbitrary information to be presented to
+	// a human user or logged.  A system receiving this warning MUST NOT
+	// take any automated action.
+	WarningMiscellaneousPersistentWarning Warning = 299
+)
+
+func (w Warning) HeaderString(agent string, date time.Time) string {
+	if agent == "" {
+		agent = "-"
+	} else {
+		// TODO(pquerna): this doesn't escape agent if it contains bad things.
+		agent = `"` + agent + `"`
+	}
+	return fmt.Sprintf(`%d %s "%s" %s`, w, agent, w.String(), date.Format(http.TimeFormat))
+}
+
+func (w Warning) String() string {
+	switch w {
+	case WarningResponseIsStale:
+		return "Response is Stale"
+	case WarningRevalidationFailed:
+		return "Revalidation Failed"
+	case WarningDisconnectedOperation:
+		return "Disconnected Operation"
+	case WarningHeuristicExpiration:
+		return "Heuristic Expiration"
+	case WarningMiscellaneousWarning:
+		// TODO(pquerna): ideally had a better way to override this one code.
+		return "Miscellaneous Warning"
+	case WarningTransformationApplied:
+		return "Transformation Applied"
+	case WarningMiscellaneousPersistentWarning:
+		// TODO(pquerna): same as WarningMiscellaneousWarning
+		return "Miscellaneous Persistent Warning"
+	}
+
+	panic(w)
+}

vendor/github.com/pquerna/cachecontrol/doc.go

+/**
+ *  Copyright 2015 Paul Querna
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+// Package cachecontrol implements the logic for HTTP Caching
+//
+// Deciding if an HTTP Response can be cached is often harder
+// and more bug prone than an actual cache storage backend.
+// cachecontrol provides a simple interface to determine if
+// request and response pairs are cachable as defined under
+// RFC 7234 http://tools.ietf.org/html/rfc7234
+package cachecontrol