diff --git a/Lock/OptionBuildable.swift b/Lock/OptionBuildable.swift index cbf02eecc..576025306 100644 --- a/Lock/OptionBuildable.swift +++ b/Lock/OptionBuildable.swift @@ -91,6 +91,7 @@ internal extension OptionBuildable { guard !self.allow.isEmpty else { return UnrecoverableError.invalidOptions(cause: "Must allow at least one database mode") } guard !self.usernameStyle.isEmpty else { return UnrecoverableError.invalidOptions(cause: "Must specify at least one username style") } guard self.allow.contains(.Login) || self.closable || self.autoClose else { return UnrecoverableError.invalidOptions(cause: "Must enable autoclose or enable closable") } + guard self.oidcConformant || self.audience == nil else { return UnrecoverableError.invalidOptions(cause: "Must set OIDC-Conformant flag in Lock to use audience option") } return nil } } diff --git a/LockTests/OptionsSpec.swift b/LockTests/OptionsSpec.swift index 30d3f174a..7f0c18abc 100644 --- a/LockTests/OptionsSpec.swift +++ b/LockTests/OptionsSpec.swift @@ -128,6 +128,24 @@ class OptionsSpec: QuickSpec { expect(options.validate()).toNot(beNil()) } + it("should fail setting audience in non OIDC mode") { + options.oidcConformant = false + options.audience = "https://myapi.com" + expect(options.validate()).toNot(beNil()) + } + + it("should allow no audience in OIDC mode") { + options.oidcConformant = true + options.audience = nil + expect(options.validate()).to(beNil()) + } + + it("should allow audience in OIDC mode") { + options.oidcConformant = true + options.audience = "https://myapi.com" + expect(options.validate()).to(beNil()) + } + context("auto close") { it("should fail when autoclose is empty and no .Login allowed") {