Added option to disable access token hash verification

Author: MarcelCoding

README.md

@@ -59,7 +59,9 @@ services:
                                                  #    space seperated list of allowed actions (OPTIONAL), see
                                                  #    https://github.com/MarcelCoding/jitsi-openid/issues/122
     # - 'SCOPES=openid email jitsi'              # <- OpenID Scopes, space seperated list of scopes (OPTIONAL),
-                                                 # default: openid email
+                                                 #    default: openid email
+    # - 'VERIFY_ACCESS_TOKEN_HASH=false          # <- explicitly disable access token hash verification (OPTIONAL),
+                                                 #    default: true
     ports:
       - '3000:3000'
 

src/cfg.rs

@@ -25,6 +25,8 @@ pub(crate) struct Cfg {
   #[serde(default)]
   #[serde(deserialize_with = "string_array2")]
   pub(crate) scopes: Option<Vec<String>>,
+  #[serde(default)]
+  pub(crate) verify_access_token_hash: Option<bool>,
 }
 
 fn default_listen_addr() -> SocketAddr {

src/routes.rs

@@ -196,31 +196,33 @@ fn id_token_claims(
     }
   }
 
-  match claims.access_token_hash() {
-    Some(expected_access_token_hash) => {
-      let algorithm = id_token.signing_alg().map_err(|err| {
-        warn!(
-          "Authentication failed, UnsupportedSigningAlgorithm: {:?}",
-          err
-        );
-        UnsupportedSigningAlgorithm
-      })?;
-
-      let actual_access_token_hash =
-        AccessTokenHash::from_token(response.access_token(), &algorithm).map_err(|err| {
+  if config.verify_access_token_hash.unwrap_or(true) {
+    match claims.access_token_hash() {
+      Some(expected_access_token_hash) => {
+        let algorithm = id_token.signing_alg().map_err(|err| {
           warn!(
             "Authentication failed, UnsupportedSigningAlgorithm: {:?}",
             err
           );
           UnsupportedSigningAlgorithm
         })?;
 
-      if &actual_access_token_hash != expected_access_token_hash {
-        return Err(InvalidAccessToken);
+        let actual_access_token_hash =
+          AccessTokenHash::from_token(response.access_token(), &algorithm).map_err(|err| {
+            warn!(
+              "Authentication failed, UnsupportedSigningAlgorithm: {:?}",
+              err
+            );
+            UnsupportedSigningAlgorithm
+          })?;
+
+        if &actual_access_token_hash != expected_access_token_hash {
+          return Err(InvalidAccessToken);
+        }
       }
-    }
-    None => return Err(MissingAccessTokenHash),
-  };
+      None => return Err(MissingAccessTokenHash),
+    };
+  }
 
   let uid = match claims.preferred_username() {
     Some(name) => name.to_string(),