oauth: authorization requests now properly set the code token subject

jwt/claims.go

@@ -8,6 +8,7 @@ import (
 
 type ClaimsCarrier map[string]interface{}
 
+// TODO NewClaimsCarrier should require a request object instead
 func NewClaimsCarrier(id, issuer, subject, audience string, expiresAt, notBefore, issuedAt time.Time) ClaimsCarrier {
 	return ClaimsCarrier{
 		"sub": subject,

oauth/handler/handler.go

@@ -246,9 +246,10 @@ func (h *Handler) AuthorizeHandler(w http.ResponseWriter, r *http.Request) {
 		subject := session.GetRemoteSubject()
 		user, err := h.Connections.FindByRemoteSubject(provider.GetID(), subject)
 		if err == pkg.ErrNotFound {
+			// The subject is not linked to any account.
+
 			if h.SignUpLocation == "" {
-				// The subject is not linked to any account.
-				http.Error(w, "Provided token is not linked to any existing account.", http.StatusUnauthorized)
+				http.Error(w, "No sign up location is set. Please contact your admin.", http.StatusInternalServerError)
 				return
 			}
 
@@ -257,6 +258,7 @@ func (h *Handler) AuthorizeHandler(w http.ResponseWriter, r *http.Request) {
 				http.Error(w, fmt.Sprintf("Could not parse redirect URL: %s", err), http.StatusInternalServerError)
 				return
 			}
+
 			query := redirect.Query()
 			query.Add("access_token", session.GetToken().AccessToken)
 			query.Add("refresh_token", session.GetToken().RefreshToken)
@@ -277,7 +279,7 @@ func (h *Handler) AuthorizeHandler(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		ar.UserData = jwt.NewClaimsCarrier(uuid.New(), user.GetLocalSubject(), h.Issuer, h.Audience, time.Now().Add(time.Duration(ar.Expiration)*time.Second), time.Now(), time.Now())
+		ar.UserData = jwt.NewClaimsCarrier(uuid.New(), h.Issuer, user.GetLocalSubject(), h.Audience, time.Now().Add(time.Duration(ar.Expiration)*time.Second), time.Now(), time.Now())
 		ar.Authorized = true
 		h.server.FinishAuthorizeRequest(resp, r, ar)
 	}