Verify provider tokens
A step of the Cloud application tree on Gradus, in the Security area: Secrets, auth, TLS, input.
Check the provider's tokens in your own service and create a local user at first sign-in, so the product never depends on the provider's ids.
One option of Sign-in: Hosted identity provider. The others: Passwords you own.
Usually comes after: Connect an identity provider.
Prompt for your AI assistant
Read the sign-in decision record in docs/decisions and the users and identities model. Using the provider's maintained server library, add a middleware that checks every token's signature, issuer, audience and expiry and copes with key rotation. Turn the provider's subject into your own user: at first sign-in create a user and an identity, and after that look them up by provider and subject. Keep the address and its verified flag on the identity as the provider reports them. If the provider offers webhooks for deleted users and changed addresses, add them and verify their signatures. Test an expired token, a wrong audience and a valid one, and make sure handlers see only the product's own user id.This is https://gradus.kazet.blog/tree/cloud-application/step/verify-provider-tokens as plain HTML. In a browser the page also lets you mark the step forged and copy a message for your AI assistant.