Can not generate ID Token

[h-michael]

I tried to generate ID Token from service account for accessing the endpoint protected by IAP with following codes.

let audience = "AUDIENCE";
let creds = CredentialsFile::new_from_file("PATH TO SERVICE ACCOUNT JSON").await?;
let ts = google_cloud_auth::idtoken::IdTokenSourceConfig::new()
    .with_credentials(creds)
    .build(audience)
    .await?;

match ts.token().await {
    Ok(token) => Ok(token),
    Err(err) => Err(err.into()),
}

But I got JwtError(Error(InvalidAudience)).

I generated ID token with this bash script and I can pass IAP with that ID token.
Two ID token generated from Rust script and bash script were the same token.

I found the cause. That error happens this line.

google-cloud-rust/foundation/auth/src/token_source/mod.rs

Line 74 in 0ab379e

jsonwebtoken::decode::<ExpClaim>(self.id_token.as_str(), &decoding_key, &validation)?

This get_exp function calls jsonwebtoken::Validation::default().

google-cloud-rust/foundation/auth/src/token_source/mod.rs

Line 70 in 0ab379e

let mut validation = jsonwebtoken::Validation::default();

jsonwebtoken::Validation::default funciton calls jsonwebtoken::Validation::new function.
https://github.com/Keats/jsonwebtoken/blob/08601f727bea94b61e8d98901b63e43ae1bce350/src/validation.rs#L141

jsonwebtoken::Validation::new function sets jsonwebtoken::Validation.validate_aud trueandjsonwebtoken::Validation.aud None`.
https://github.com/Keats/jsonwebtoken/blob/08601f727bea94b61e8d98901b63e43ae1bce350/src/validation.rs#L98-L104

So get_exp function always passes this branch.
https://github.com/Keats/jsonwebtoken/blob/08601f727bea94b61e8d98901b63e43ae1bce350/src/validation.rs#L289-L291

I think there are two options to resolve this issue.

1. set jsonwebtoken::Validation.aud to expected audience
2. set jsonwebtoken::Validation.validate_aud as false

Which do you think is better?

Thank you.

[yoshidan]

Thanks for your report!

1. set jsonwebtoken::Validation.aud to expected audience

Since the expected Audience should be a valid one, we think this is the better choice.