Tencent/WeKnora · error

id_token verification failed: %w

Error message

id_token verification failed: %w

What it means

Wrapper around the jwt parser failure when verifying an OIDC id_token. The wrapped cause covers expired tokens, wrong issuer/audience, unknown kid, bad signature, or missing expiration. Login via OIDC fails for this token only.

Source

Thrown at internal/application/service/user.go:1972

	}

	keyFunc := func(token *jwt.Token) (interface{}, error) {
		if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {
			return nil, fmt.Errorf("unexpected id_token signing method: %v", token.Header["alg"])
		}
		kid, _ := token.Header["kid"].(string)
		return jwks.rsaKeyForKid(kid)
	}

	claims := jwt.MapClaims{}
	if _, err := jwt.NewParser(
		jwt.WithValidMethods([]string{"RS256", "RS384", "RS512"}),
		jwt.WithExpirationRequired(),
		jwt.WithLeeway(oidcIDTokenLeeway),
		jwt.WithIssuer(strings.TrimSpace(cfg.IssuerURL)),
		jwt.WithAudience(strings.TrimSpace(cfg.ClientID)),
	).ParseWithClaims(idToken, claims, keyFunc); err != nil {
		return nil, fmt.Errorf("id_token verification failed: %w", err)
	}
	verified := map[string]interface{}(claims)
	if strings.TrimSpace(extractClaimAsString(verified, "sub")) == "" {
		return nil, errors.New("id_token missing sub claim")
	}
	return verified, nil
}

func extractClaimAsString(claims map[string]interface{}, key string) string {
	key = strings.TrimSpace(key)
	if key == "" {
		return ""
	}
	value, ok := claims[key]
	if !ok || value == nil {
		return ""
	}
	switch v := value.(type) {

View on GitHub (pinned to 988cbb0330)

Solutions

1. Read the wrapped cause: expiry vs issuer/audience vs signature
2. Ensure the IdP's clock and leeway settings align (oidcIDTokenLeeway)
3. Verify client_id and issuer_url match the token's aud/iss claims
4. Refresh the JWKS cache if keys were rotated

When it happens

Trigger: Thrown at internal/application/service/user.go:1972 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/2b76c14ea5e57945. Report an issue: GitHub.