couper-examples test configuration edge failing

[johakoch]

See https://github.com/coupergateway/couper-examples/actions/workflows/test.yaml

This results from oidcConfig.GetIssuer() (creating a sync request for the OIDC configuration) now (after https://github.com/coupergateway/couper/pull/796) being in the path for couper verify:

• Verify.Execute()
• runtime.NewServerConfiguration()
• configureAccessControls()
• oauth2.NewOidcClient()
• oidcConfig.GetIssuer()

Another minor issue:

  issuer, err := oidcConfig.GetIssuer()
  if err != nil {
    return nil, errors.Oauth2.With(err)
                ^^^^^^^^^^^^^^^^^^^^^^^

If we keep the JWT parser being created in NewOidcClient(), err should not be wrapped here, as errors.Oauth2 is for runtime errors.

[johakoch]

@malud Would it be safe to ignore backend errors with couper verify?

[johakoch]

We could skip the "oidc" example directory for the usual verification and do a

docker-compose up --abort-on-container-exit

instead.

That would require creating different docker-compose.yaml files for the two image-tags to be checked.

[johakoch]

A way to solve this in couper itself: lazy-initialize the JWT parser for OIDC:

func NewOidcClient(evalCtx *hcl.EvalContext, oidcConfig *oidc.Config) (*OidcClient, error) {
	backends := oidcConfig.Backends()
	acClient, err := NewAuthCodeClient(evalCtx, oidcConfig, oidcConfig, backends["token_backend"])
	if err != nil {
		return nil, err
	}

	o := &OidcClient{
		AuthCodeClient: acClient,
		backends:       backends,
		config:         oidcConfig,
		// don't create JWT parser here
	}

// ...

func (o *OidcClient) getJwtParser() (*jwt.Parser, error) {
	if o.jwtParser == nil {
		issuer, err := o.config.GetIssuer()
		if err != nil {
			return nil, err
		}
		options := []jwt.ParserOption{
// ...
		}
		o.jwtParser = jwt.NewParser(options...)
	}
	return o.jwtParser, nil
}

// ...

func (o *OidcClient) validateTokenResponseData(ctx context.Context, tokenResponseData map[string]interface{}, hashedVerifierValue, verifierValue, accessToken string) error {
	idTokenString, ok := tokenResponseData["id_token"].(string)
	if !ok {
		return errors.Oauth2.Message("missing id_token in token response")
	}

	jwtParser, err := o.getJwtParser()
	if err != nil {
		return err
	}

	idTokenClaims := jwt.MapClaims{}
	_, err = jwtParser.ParseWithClaims(idTokenString, idTokenClaims, o.keyfunc)
// ...