diff --git a/claims.go b/claims.go index 8a125c70..72e6588e 100644 --- a/claims.go +++ b/claims.go @@ -128,7 +128,7 @@ func validateBoundClaims(logger log.Logger, boundClaims, allClaims map[string]in return nil } -// normalizeList takes a string or list and returns a list. This is useful when +// normalizeList takes a string, bool or list and returns a list. This is useful when // providers are expected to return a list (typically of strings) but reduce it // to a string type when the list count is 1. func normalizeList(raw interface{}) ([]interface{}, bool) { @@ -137,7 +137,7 @@ func normalizeList(raw interface{}) ([]interface{}, bool) { switch v := raw.(type) { case []interface{}: normalized = v - case string: + case string, bool: normalized = []interface{}{v} default: return nil, false diff --git a/claims_test.go b/claims_test.go index 631257aa..dfda6141 100644 --- a/claims_test.go +++ b/claims_test.go @@ -208,6 +208,16 @@ func TestValidateBoundClaims(t *testing.T) { }, errExpected: false, }, + { + name: "valid - boolean claim", + boundClaims: map[string]interface{}{ + "email_verified": []interface{}{false}, + }, + allClaims: map[string]interface{}{ + "email_verified": []interface{}{false}, + }, + errExpected: false, + }, { name: "valid - match within list", boundClaims: map[string]interface{}{ @@ -360,6 +370,17 @@ func TestValidateBoundClaims(t *testing.T) { }, errExpected: true, }, + { + name: "invalid bound claim expected boolean value", + boundClaims: map[string]interface{}{ + "email_verified": true, + }, + allClaims: map[string]interface{}{ + "email_verified": "true", + }, + errExpected: true, + }, + { name: "invalid received claim expected value", boundClaims: map[string]interface{}{