@@ -229,6 +233,8 @@ func InitDefaultConfig() {
 	// Auth
 	AuthLocalEnabled.setDefault(true)
 	AuthOpenIDEnabled.setDefault(false)
+	AuthOpenIDProviders.setDefault(make([]interface{}, 0))

@@ -0,0 +115,4 @@
+	return auth.NewUserAuthTokenResponse(u, c)
+}
+
+func getOrCreateUser(cl *claims) (u *user.User, err error) {

@@ -0,0 +70,4 @@
+
+	// Parse the jwt from the identity-aware proxy using the correct key
+	tken, err := jwt.ParseWithClaims(token, &claims{}, func(unvalidatedToken *jwt.Token) (interface{}, error) {
+		// Only support either ECDSA or RSA signing methods

@@ -0,0 +73,4 @@
+		// Only support either ECDSA or RSA signing methods
+		if _, ok := unvalidatedToken.Method.(*jwt.SigningMethodECDSA); !ok {
+			if _, ok := unvalidatedToken.Method.(*jwt.SigningMethodRSA); !ok {
+				return nil, fmt.Errorf("Unexpected signing method: %v", unvalidatedToken.Header["alg"])

@@ -0,0 +83,4 @@
+		}
+
+		keys := keyset.LookupKeyID(keyID)
+		if len(keys) != 1 {

@@ -0,0 +187,4 @@
+}
+
+// Validates the claims in the jwt
+func (c claims) Valid() error {

@@ -0,0 +188,4 @@
+
+// Validates the claims in the jwt
+func (c claims) Valid() error {
+	// Validate that expiresAt and issuedAt are set and valid (with up to 1 minute of skew)

@@ -43,0 +78,4 @@
+// In these cases, AuthClaims may contain hints to the user identity,
+// but an outside source is the final source-of-truth for auth (e.g. Identity-Aware Proxy auth)
+type AuthProvider interface {
+	GetWebAuth(echo.Context, *AuthClaims) (web.Auth, error)

@@ -0,0 +39,4 @@
+}
+
+// ErrorCodeIAPTokenMissing holds the unique world-error code of this error
+const ErrorCodeIAPTokenMissing = 12001

@@ -0,0 +81,4 @@
+// @Produce json
+// @Success 200 {object} auth.Token
+// @Failure 500 {object} models.Message "Internal error"
+// @Router /auth/identityawareproxy/token [get]

@@ -0,0 +143,4 @@
+	skew := time.Minute
+	if !c.VerifyExpiresAt(now.Add(-skew).Unix(), true) {
+		delta := now.Sub(time.Unix(c.ExpiresAt, 0))
+		return fmt.Errorf("token is expired by %v", delta)

@@ -0,0 +16,4 @@
+
+package identityawareproxy
+
+// TODO test GetWebAuth()

@@ -0,0 +34,4 @@
+var TimeFunc = time.Now
+
+// Caches the public keys of the identity-aware proxy used to validate the auth data it sends
+type iapCache struct {