evaluate role in higher layer

internal/provider/oidc.go

@@ -3,6 +3,7 @@ package provider
 import (
 	"context"
 	"errors"
+  "fmt"
 
 	"github.com/coreos/go-oidc"
 	"golang.org/x/oauth2"
@@ -88,14 +89,14 @@ func (o *OIDC) ExchangeCode(redirectURI, code string) (string, error) {
 }
 
 // GetUser uses the given token and returns a complete provider.User object
-func (o *OIDC) GetUser(token string) (User, error) {
+func (o *OIDC) GetUser(token string) (User, Roles, error) {
 	var user User
   var roles Roles
 
 	// Parse & Verify ID Token
 	idToken, err := o.verifier.Verify(o.ctx, token)
 	if err != nil {
-		return user, err
+		return user, roles, err
 	}
 
 
@@ -103,16 +104,18 @@ func (o *OIDC) GetUser(token string) (User, error) {
 
 	// Extract custom claims
 	if err := idToken.Claims(&user); err != nil {
-		return user, err
+		return user, roles, err
 	}
 	o.log.WithField("user", user).Debug("getUser")
 
 	if err := idToken.Claims(&roles); err != nil {
-		return user, err
+		return user, roles, err
 	}
 	o.log.WithField("roles", roles).Debug("getUser")
+  for i, r := range roles.Roles {
+    o.log.Debug(fmt.Sprintf("%d, %s", i, r))
+  }
 
 
-  return user, errors.New("access denied")
-//	return user, nil
+	return user, roles, nil
 }