Aggregate error logging on JWT chain failures

pkg/middleware/jwt_session.go

@@ -11,6 +11,7 @@ import (
 	middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
 	sessionsapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
 	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
+	"k8s.io/apimachinery/pkg/util/errors"
 )
 
 const jwtRegexFormat = `^ey[IJ][a-zA-Z0-9_-]*\.ey[IJ][a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+$`
@@ -80,15 +81,17 @@ func (j *jwtSessionLoader) getJwtSession(req *http.Request) (*sessionsapi.Sessio
 		return nil, err
 	}
 
+	errs := []error{fmt.Errorf("unable to verify jwt token: %q", req.Header.Get("Authorization"))}
 	for _, loader := range j.sessionLoaders {
 		session, err := loader.TokenToSession(req.Context(), token, loader.Verifier)
 		if err == nil {
 			return session, nil
+		} else {
+			errs = append(errs, err)
 		}
 	}
 
-	// TODO (@NickMeves) Aggregate error logs in the chain
-	return nil, fmt.Errorf("unable to verify jwt token: %q", req.Header.Get("Authorization"))
+	return nil, errors.NewAggregate(errs)
 }
 
 // findTokenFromHeader finds a valid JWT token from the Authorization header of a given request.

pkg/middleware/jwt_session_test.go

@@ -20,6 +20,7 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/ginkgo/extensions/table"
 	. "github.com/onsi/gomega"
+	k8serrors "k8s.io/apimachinery/pkg/util/errors"
 )
 
 type noOpKeySet struct {
@@ -232,8 +233,11 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
 			}),
 			Entry("Bearer <nonVerifiedToken>", getJWTSessionTableInput{
 				authorizationHeader: fmt.Sprintf("Bearer %s", nonVerifiedToken),
-				expectedErr:         errors.New("unable to verify jwt token: \"Bearer eyJfoobar.eyJfoobar.12345asdf\""),
-				expectedSession:     nil,
+				expectedErr: k8serrors.NewAggregate([]error{
+					errors.New("unable to verify jwt token: \"Bearer eyJfoobar.eyJfoobar.12345asdf\""),
+					errors.New("oidc: malformed jwt: illegal base64 data at input byte 8"),
+				}),
+				expectedSession: nil,
 			}),
 			Entry("Bearer <verifiedToken>", getJWTSessionTableInput{
 				authorizationHeader: fmt.Sprintf("Bearer %s", verifiedToken),
@@ -242,8 +246,11 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
 			}),
 			Entry("Basic Base64(<nonVerifiedToken>:) (No password)", getJWTSessionTableInput{
 				authorizationHeader: "Basic ZXlKZm9vYmFyLmV5SmZvb2Jhci4xMjM0NWFzZGY6",
-				expectedErr:         errors.New("unable to verify jwt token: \"Basic ZXlKZm9vYmFyLmV5SmZvb2Jhci4xMjM0NWFzZGY6\""),
-				expectedSession:     nil,
+				expectedErr: k8serrors.NewAggregate([]error{
+					errors.New("unable to verify jwt token: \"Basic ZXlKZm9vYmFyLmV5SmZvb2Jhci4xMjM0NWFzZGY6\""),
+					errors.New("oidc: malformed jwt: illegal base64 data at input byte 8"),
+				}),
+				expectedSession: nil,
 			}),
 			Entry("Basic Base64(<verifiedToken>:x-oauth-basic) (Sentinel password)", getJWTSessionTableInput{
 				authorizationHeader: fmt.Sprintf("Basic %s", verifiedTokenXOAuthBasicBase64),