Bound OIDC discovery with a client timeout and failure backoff

internal/testsupport/oidc.go

@@ -45,6 +45,18 @@ func NewOIDCIssuer() *OIDCIssuer {
 // Token signs a token for aud and sub. Pass a nil key to use the issuer's own;
 // expiry is relative to now.
 func (o *OIDCIssuer) Token(key *rsa.PrivateKey, aud, sub string, expiry time.Duration) string {
+	now := time.Now()
+	return o.Sign(key, jwt.Claims{
+		Issuer:   o.URL,
+		Subject:  sub,
+		Audience: jwt.Audience{aud},
+		IssuedAt: jwt.NewNumericDate(now.Add(-time.Minute)),
+		Expiry:   jwt.NewNumericDate(now.Add(expiry)),
+	})
+}
+
+// Sign signs arbitrary claims with RS256. Pass a nil key to use the issuer's own.
+func (o *OIDCIssuer) Sign(key *rsa.PrivateKey, claims jwt.Claims) string {
 	if key == nil {
 		key = o.key
 	}
@@ -53,14 +65,7 @@ func (o *OIDCIssuer) Token(key *rsa.PrivateKey, aud, sub string, expiry time.Dur
 	if err != nil {
 		panic(err)
 	}
-	now := time.Now()
-	tok, err := jwt.Signed(sig).Claims(jwt.Claims{
-		Issuer:   o.URL,
-		Subject:  sub,
-		Audience: jwt.Audience{aud},
-		IssuedAt: jwt.NewNumericDate(now.Add(-time.Minute)),
-		Expiry:   jwt.NewNumericDate(now.Add(expiry)),
-	}).Serialize()
+	tok, err := jwt.Signed(sig).Claims(claims).Serialize()
 	if err != nil {
 		panic(err)
 	}