failed to parse token

[yossibalan-1]

We are using IAS JWT validation to verify that our JWTs are valid.

We have seen that many customers receive an error like this:                                                                                                                                                  
                                                                                                                                                                                                                
{"error":"failed to parse token: failed to decode value for key email: error reading next value: json: cannot unmarshal array into Go value of type                                                           
string","file":"server.go:1008","func":"main.(*Server).handleLoginFormAuthentication","level":"warning","msg":"IAS JWT cannot be parsed","time":"2026-08-25T23:44:17.923Z"}                                     
I looked at the IAS attribute mapping, and it seems that the customers added two fields to the mapping: Corporate and Identity values.                                                                          
                                                                                                                                                                                                                
For example:                                                                                                                                                                                                    

This is the trace:

s.iasMiddleware.ParseAndValidateJWT(iasJwtToken)
↓
vendor/cloud-security-client-go/auth/validator.go:22
NewToken(rawToken)
↓
vendor/cloud-security-client-go/auth/token.go:40
jwt.ParseString(encodedToken, jwt.WithToken(openid.New()))
↓
vendor/lestrrat-go/jwx/jwt/jwt.go:463
json.Unmarshal(payload, ctx.token) ← wraps error as "failed to parse token"
↓
vendor/lestrrat-go/jwx/jwt/openid/token_gen.go:970
stdToken.UnmarshalJSON(buf) ← iterates over all claims
↓
vendor/lestrrat-go/jwx/jwt/openid/token_gen.go:1036
json.AssignNextStringToken(&t.email, dec) ← fails: array ≠ string
↓
vendor/lestrrat-go/jwx/internal/json/json.go:45
dec.Decode(&val) ← ROOT CAUSE: strict string decoding

[yossibalan-1]

I got also an answer for IAS team IAS Team Feedback: Colleagues from the IAS team (Gabriel Freitas) confirmed that from an IAS perspective, maintaining both corporate and identity values is supported. Because the parsing failure occurs within the SAP Go library during server-side authentication processing in BAS, the issue requires review from the BAS / Security library development side. so do you think to fix it ?

[yossibalan-1]

⏺ You could replace openid.New() with jwt.New() in the vendored cloud-security-client-go/auth/token.go:40:

// before
decodedToken, err := jwt.ParseString(encodedToken, jwt.WithToken(openid.New()))

// after
decodedToken, err := jwt.ParseString(encodedToken, jwt.WithToken(jwt.New()))