// GetClaims() returns a token's claims, allowing
// you to check the values to make sure they match
326739
func GetClaims(token string) map[string]interface{} {
	// decode the token
	dec, err := newDecoded(token)
	if err != nil {
		return nil
	}

	// base64 decode payload
	payload, err := base64.RawURLEncoding.DecodeString(dec.payload)
	if err != nil {
		return nil
	}

	dst := map[string]interface{}{}
	err = json.Unmarshal(payload, &dst)
	if err != nil {
		return nil
	}

	return dst

}
973287
func ClaimLeaseOps(
	namespace, name, holder, writer, collection string,
	globalTime time.Time, duration time.Duration,
) ([]txn.Op, error) {
	ops, _, err := claimLeaseOps(
		namespace, name, holder, writer, collection,
		globalTime, duration,
	)
	return ops, errors.Trace(err)
}
144908
func (c Claims) Get(key string) interface{} {
	return jwt.Claims(c).Get(key)
}
42660
func (c *Corpus) ForeachClaim(permaNode blob.Ref, at time.Time, fn func(*camtypes.Claim) bool) {
	pm, ok := c.permanodes[permaNode]
	if !ok {
		return
	}
	for _, cl := range pm.Claims {
		if !at.IsZero() && cl.Date.After(at) {
			continue
		}
		if !fn(cl) {
			return
		}
	}
}
213685
func (p *Processor) DecodeUserClaims(name, userToken string, certs []*x509.Certificate, r *http.Request) ([]string, bool, string, error) {

	switch p.userAuthorizationType {
	case policy.UserAuthorizationMutualTLS, policy.UserAuthorizationJWT:
		// First parse any incoming certificates and retrieve attributes from them.
		// This is used in case of client authorization with certificates.
		attributes := []string{}
		for _, cert := range certs {
			attributes = append(attributes, "CN="+cert.Subject.CommonName)
			for _, email := range cert.EmailAddresses {
				attributes = append(attributes, "Email="+email)
			}
			for _, org := range cert.Subject.Organization {
				attributes = append(attributes, "O="+org)
			}
			for _, org := range cert.Subject.OrganizationalUnit {
				attributes = append(attributes, "OU="+org)
			}
		}

		if p.userAuthorizationType == policy.UserAuthorizationJWT && p.userTokenHandler != nil {
			jwtAttributes, _, _, err := p.userTokenHandler.Validate(r.Context(), userToken)
			if err != nil {
				return attributes, false, userToken, fmt.Errorf("Unable to decode JWT: %s", err)
			}
			attributes = append(attributes, jwtAttributes...)
		}

		return attributes, false, userToken, nil

	case policy.UserAuthorizationOIDC:
		// Now we can parse the user claims.
		if p.userTokenHandler == nil {
			zap.L().Error("Internal Server Error: OIDC User Token Handler not configured")
			return []string{}, false, userToken, nil
		}
		return p.userTokenHandler.Validate(r.Context(), userToken)
	default:
		return []string{}, false, userToken, nil
	}
}
249121
func Get(r *http.Request) (claims map[string]interface{}, ok bool) {
	c, ok := context.GetOk(r, context_key)
	if !ok {
		return claims, ok
	}
	claims, castOk := c.(map[string]interface{})
	return claims, castOk
}
848397
func (c *Client) GetAccounts(accessToken string) (resp GetAccountsResponse, err error) {
	options := GetAccountsOptions{
		AccountIDs: []string{},
	}
	return c.GetAccountsWithOptions(accessToken, options)
}
1316287
func (a *authenticator) getTokenFor(credentials *credentials) (string, int, error) {
	name, errCode, err := a.validateCredentials(credentials)
	if err != nil {
		return "", errCode, err
	}
	claims := jwt.StandardClaims{
		Audience:  name,
		ExpiresAt: a.expTime.Nanoseconds(),
	}
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	tokenString, err := token.SignedString([]byte(signature))
	if err != nil {
		return "", http.StatusInternalServerError, fmt.Errorf("500 internal server error: failed to sign token: %v", err)
	}
	a.userDb.SetLoginTime(name)
	a.log.Debugf("user %s was logged in", name)

	return tokenString, 0, nil
}
1133559
func (mc MongoClient) getRegistrations(q bson.M) ([]models.Registration, error) {
	s := mc.getSessionCopy()
	defer s.Close()

	var regs []models.Registration
	err := s.DB(mc.database.Name).C(db.ExportCollection).Find(q).All(&regs)
	if err != nil {
		return []models.Registration{}, errorMap(err)
	}

	return regs, nil
}
270043
func (c *Client) GetBalances(accessToken string) (resp GetBalancesResponse, err error) {
	options := GetBalancesOptions{
		AccountIDs: []string{},
	}
	return c.GetBalancesWithOptions(accessToken, options)
}
1358208
func (p *NullPKI) KeyAndClaims(pkey []byte) (interface{}, []string, error) {
	return jwt.UnsafeAllowNoneSignatureType, []string{}, nil
}
348567
func (l *Client) GetAuths() ([]*Auth, error) {
	res := ApiResp{}
	data := []*Auth{}

	// make the request
	err := l.Get(authListEndpoint, nil, nil, &res, &data)
	if err != nil {
		return data, err
	}

	return data, nil
}
689375
func Tokens() []string {
	tokens := make([]string, 0, len(BtcIndices)+len(DcrExchanges))
	var token string
	for token = range BtcIndices {
		tokens = append(tokens, token)
	}
	for token = range DcrExchanges {
		tokens = append(tokens, token)
	}
	return tokens
}
516864
func (a *AuthServer) getClaims(oidcClient *oidc.Client, issuerURL string, scope []string, code string) (jose.Claims, error) {
	var err error

	oac, err := oidcClient.OAuthClient()
	if err != nil {
		return nil, trace.Wrap(err)
	}

	t, err := oac.RequestToken(oauth2.GrantTypeAuthCode, code)
	if err != nil {
		return nil, trace.Wrap(err)
	}

	idTokenClaims, err := claimsFromIDToken(oidcClient, t.IDToken)
	if err != nil {
		log.Debugf("Unable to fetch OIDC ID token claims: %v.", err)
		return nil, trace.Wrap(err)
	}
	log.Debugf("OIDC ID Token claims: %v.", idTokenClaims)

	userInfoClaims, err := claimsFromUserInfo(oidcClient, issuerURL, t.AccessToken)
	if err != nil {
		if trace.IsNotFound(err) {
			log.Debugf("OIDC provider doesn't offer UserInfo endpoint. Returning token claims: %v.", idTokenClaims)
			return idTokenClaims, nil
		}
		log.Debugf("Unable to fetch UserInfo claims: %v.", err)
		return nil, trace.Wrap(err)
	}
	log.Debugf("UserInfo claims: %v.", userInfoClaims)

	// make sure that the subject in the userinfo claim matches the subject in
	// the id token otherwise there is the possibility of a token substitution attack.
	// see section 16.11 of the oidc spec for more details.
	var idsub string
	var uisub string
	var exists bool
	if idsub, exists, err = idTokenClaims.StringClaim("sub"); err != nil || !exists {
		log.Debugf("Unable to extract OIDC sub claim from ID token.")
		return nil, trace.Wrap(err)
	}
	if uisub, exists, err = userInfoClaims.StringClaim("sub"); err != nil || !exists {
		log.Debugf("Unable to extract OIDC sub claim from UserInfo.")
		return nil, trace.Wrap(err)
	}
	if idsub != uisub {
		log.Debugf("OIDC claim subjects don't match '%v' != '%v'.", idsub, uisub)
		return nil, trace.BadParameter("invalid subject in UserInfo")
	}

	claims, err := mergeClaims(idTokenClaims, userInfoClaims)
	if err != nil {
		log.Debugf("Unable to merge OIDC claims: %v.", err)
		return nil, trace.Wrap(err)
	}

	// for GSuite users, fetch extra data from the proprietary google API
	// only if scope includes admin groups readonly scope
	if issuerURL == teleport.GSuiteIssuerURL && utils.SliceContainsStr(scope, teleport.GSuiteGroupsScope) {
		email, _, err := claims.StringClaim("email")
		if err != nil {
			return nil, trace.Wrap(err)
		}
		gsuiteClaims, err := a.claimsFromGSuite(oidcClient, issuerURL, email, t.AccessToken)
		if err != nil {
			if !trace.IsNotFound(err) {
				return nil, trace.Wrap(err)
			}
			log.Debugf("Found no GSuite claims.")
		} else {
			if gsuiteClaims != nil {
				log.Debugf("Got GSuiteclaims: %v.", gsuiteClaims)
			}
			claims, err = mergeClaims(claims, gsuiteClaims)
			if err != nil {
				return nil, trace.Wrap(err)
			}
		}
	}

	return claims, nil
}
1155893
func GetClaimNames(claims jose.Claims) []string {
	var out []string
	for claim := range claims {
		out = append(out, claim)
	}
	return out
}
920840
func checkClaimsFromToken(r *http.Request, cred auth.Credentials) (map[string]interface{}, APIErrorCode) {
	token := getSessionToken(r)
	if token != "" && cred.AccessKey == "" {
		return nil, ErrNoAccessKey
	}
	if subtle.ConstantTimeCompare([]byte(token), []byte(cred.SessionToken)) != 1 {
		return nil, ErrInvalidToken
	}
	claims, err := getClaimsFromToken(r)
	if err != nil {
		return nil, toAPIErrorCode(context.Background(), err)
	}
	return claims, ErrNone
}
384835
func getClaimStatusForLogging(claim *v1.PersistentVolumeClaim) string {
	bound := metav1.HasAnnotation(claim.ObjectMeta, annBindCompleted)
	boundByController := metav1.HasAnnotation(claim.ObjectMeta, annBoundByController)

	return fmt.Sprintf("phase: %s, bound to: %q, bindCompleted: %v, boundByController: %v", claim.Status.Phase, claim.Spec.VolumeName, bound, boundByController)
}