Fix: Send audience as a single string in the JWT

acroca · acroca · commit 02b0f4774376 · 2025-12-10T10:43:42.000+01:00
Signed-off-by: Albert Callarisa &lt;albert@diagrid.io&gt;
diff --git a/common/component/kafka/sasl_oauthbearer_private_key_jwt.go b/common/component/kafka/sasl_oauthbearer_private_key_jwt.go
@@ -169,6 +169,9 @@ func (ts *OAuthTokenSourcePrivateKeyJWT) Token() (*sarama.AccessToken, error) {
 		return nil, fmt.Errorf("failed to build token: %w", err)
 	}
 
+	// Some IdPs require the audience to be set as a single string
+	token.Options().Enable(jwt.FlattenAudience)
+
 	var signOptions []jwt.Option
 	if ts.Kid != "" {
 		headers := jws.NewHeaders()

Original file line number	Diff line number	Diff line change
`@@ -169,6 +169,9 @@ func (ts OAuthTokenSourcePrivateKeyJWT) Token() (sarama.AccessToken, error) {`
`169`	`169`	`return nil, fmt.Errorf("failed to build token: %w", err)`
`170`	`170`	`}`
`171`	`171`
	`172`	`+ // Some IdPs require the audience to be set as a single string`
	`173`	`+ token.Options().Enable(jwt.FlattenAudience)`
	`174`	`+`
`172`	`175`	`var signOptions []jwt.Option`
`173`	`176`	`if ts.Kid != "" {`
`174`	`177`	`headers := jws.NewHeaders()`