feat(login): use new IDP templates (#5315)

The login uses the new template based IDPs with backwards compatibility for old IDPs

internal/idp/providers/jwt/session.go

@@ -2,7 +2,13 @@ package jwt
 
 import (
 	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"time"
 
+	"github.com/zitadel/logging"
+	"github.com/zitadel/oidc/v2/pkg/client/rp"
 	"github.com/zitadel/oidc/v2/pkg/oidc"
 	"golang.org/x/text/language"
 
@@ -11,8 +17,14 @@ import (
 
 var _ idp.Session = (*Session)(nil)
 
+var (
+	ErrNoTokens     = errors.New("no tokens provided")
+	ErrInvalidToken = errors.New("invalid tokens provided")
+)
+
 // Session is the [idp.Session] implementation for the JWT provider
 type Session struct {
+	*Provider
 	AuthURL string
 	Tokens  *oidc.Tokens
 }
@@ -28,9 +40,48 @@ func (s *Session) FetchUser(ctx context.Context) (user idp.User, err error) {
 	if s.Tokens == nil {
 		return nil, ErrNoTokens
 	}
+	s.Tokens.IDTokenClaims, err = s.validateToken(ctx, s.Tokens.IDToken)
+	if err != nil {
+		return nil, err
+	}
 	return &User{s.Tokens.IDTokenClaims}, nil
 }
 
+func (s *Session) validateToken(ctx context.Context, token string) (oidc.IDTokenClaims, error) {
+	logging.Debug("begin token validation")
+	// TODO: be able to specify them in the template: https://github.com/zitadel/zitadel/issues/5322
+	offset := 3 * time.Second
+	maxAge := time.Hour
+	claims := oidc.EmptyIDTokenClaims()
+	payload, err := oidc.ParseToken(token, claims)
+	if err != nil {
+		return nil, fmt.Errorf("%w: malformed jwt payload: %v", ErrInvalidToken, err)
+	}
+
+	if err = oidc.CheckIssuer(claims, s.Provider.issuer); err != nil {
+		return nil, fmt.Errorf("%w: invalid issuer: %v", ErrInvalidToken, err)
+	}
+
+	logging.Debug("begin signature validation")
+	keySet := rp.NewRemoteKeySet(http.DefaultClient, s.Provider.keysEndpoint)
+	if err = oidc.CheckSignature(ctx, token, payload, claims, nil, keySet); err != nil {
+		return nil, fmt.Errorf("%w: invalid signature: %v", ErrInvalidToken, err)
+	}
+
+	if !claims.GetExpiration().IsZero() {
+		if err = oidc.CheckExpiration(claims, offset); err != nil {
+			return nil, fmt.Errorf("%w: expired: %v", ErrInvalidToken, err)
+		}
+	}
+
+	if !claims.GetIssuedAt().IsZero() {
+		if err = oidc.CheckIssuedAt(claims, maxAge, offset); err != nil {
+			return nil, fmt.Errorf("%w: %v", ErrInvalidToken, err)
+		}
+	}
+	return claims, nil
+}
+
 type User struct {
 	oidc.IDTokenClaims
 }