IDToken: Reuse claims from authlib (#87437)

* bump authlib version

* Reuse claims from authlib

pkg/services/auth/idimpl/service.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/go-jose/go-jose/v3/jwt"
+	authnlib "github.com/grafana/authlib/authn"
 	"github.com/prometheus/client_golang/prometheus"
 	"golang.org/x/sync/singleflight"
 
@@ -79,20 +80,22 @@ func (s *Service) SignIdentity(ctx context.Context, id identity.Requester) (stri
 
 		now := time.Now()
 		claims := &auth.IDClaims{
-			Claims: jwt.Claims{
+			Claims: &jwt.Claims{
 				Issuer:   s.cfg.AppURL,
 				Audience: getAudience(id.GetOrgID()),
 				Subject:  getSubject(namespace.String(), identifier),
 				Expiry:   jwt.NewNumericDate(now.Add(tokenTTL)),
 				IssuedAt: jwt.NewNumericDate(now),
 			},
-			Namespace: s.nsMapper(id.GetOrgID()),
+			Rest: authnlib.IDTokenClaims{
+				Namespace: s.nsMapper(id.GetOrgID()),
+			},
 		}
 
 		if identity.IsNamespace(namespace, identity.NamespaceUser) {
-			claims.Email = id.GetEmail()
-			claims.EmailVerified = id.IsEmailVerified()
-			claims.AuthenticatedBy = id.GetAuthenticatedBy()
+			claims.Rest.Email = id.GetEmail()
+			claims.Rest.EmailVerified = id.IsEmailVerified()
+			claims.Rest.AuthenticatedBy = id.GetAuthenticatedBy()
 		}
 
 		token, err := s.signer.SignIDToken(ctx, claims)

pkg/services/auth/idimpl/service_test.go

@@ -56,7 +56,7 @@ func TestService_SignIdentity(t *testing.T) {
 			s, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.HS256, Key: key}, nil)
 			require.NoError(t, err)
 
-			token, err := jwt.Signed(s).Claims(claims).CompactSerialize()
+			token, err := jwt.Signed(s).Claims(claims.Claims).Claims(claims.Rest).CompactSerialize()
 			require.NoError(t, err)
 
 			return token, nil
@@ -87,7 +87,7 @@ func TestService_SignIdentity(t *testing.T) {
 		require.NoError(t, err)
 
 		claims := &auth.IDClaims{}
-		require.NoError(t, parsed.UnsafeClaimsWithoutVerification(&claims))
-		assert.Equal(t, login.AzureADAuthModule, claims.AuthenticatedBy)
+		require.NoError(t, parsed.UnsafeClaimsWithoutVerification(&claims.Claims, &claims.Rest))
+		assert.Equal(t, login.AzureADAuthModule, claims.Rest.AuthenticatedBy)
 	})
 }

pkg/services/auth/idimpl/signer.go

@@ -37,7 +37,7 @@ func (s *LocalSigner) SignIDToken(ctx context.Context, claims *auth.IDClaims) (s
 		return "", err
 	}
 
-	builder := jwt.Signed(signer).Claims(claims)
+	builder := jwt.Signed(signer).Claims(&claims.Rest).Claims(claims.Claims)
 
 	token, err := builder.CompactSerialize()
 	if err != nil {