Refactor the code that rejects for wrong audience

[Leo6Leo]

Currently we have multiple places which validate the OIDC audience of an incoming request. E.g.:

eventing/pkg/channel/event_receiver.go

Lines 248 to 269 in 256a41d

	/// Here we do the OIDC audience verification
	features := feature.FromContext(ctx)
	if features.IsOIDCAuthentication() {
	r.logger.Debug("OIDC authentication is enabled")
	token := auth.GetJWTFromHeader(request.Header)
	if token == "" {
	r.logger.Warn(fmt.Sprintf("No JWT in %s header provided while feature %s is enabled", auth.AuthHeaderKey, feature.OIDCAuthentication))
	response.WriteHeader(nethttp.StatusUnauthorized)
	return
	}
	if _, err := r.tokenVerifier.VerifyJWT(ctx, token, r.audience); err != nil {
	r.logger.Warn("no valid JWT provided", zap.Error(err))
	response.WriteHeader(nethttp.StatusUnauthorized)
	return
	}
	r.logger.Debug("Request contained a valid JWT. Continuing...")
	} else {
	r.logger.Debug("OIDC authentication is disabled")
	}

eventing/pkg/broker/ingress/ingress_handler.go

Lines 227 to 251 in 79bb385

	features := feature.FromContext(ctx)
	if features.IsOIDCAuthentication() {
	h.Logger.Debug("OIDC authentication is enabled")
	if broker.Status.Address.Audience == nil {
	h.Logger.Warn(fmt.Sprintf("Audience of broker %s/%s must not be nil, while feature %s is enabled", broker.Name, broker.Namespace, feature.OIDCAuthentication))
	writer.WriteHeader(http.StatusInternalServerError)
	return
	}
	token := auth.GetJWTFromHeader(request.Header)
	if token == "" {
	h.Logger.Warn(fmt.Sprintf("No JWT in %s header provided while feature %s is enabled", auth.AuthHeaderKey, feature.OIDCAuthentication))
	writer.WriteHeader(http.StatusUnauthorized)
	return
	}
	if _, err := h.tokenVerifier.VerifyJWT(ctx, token, *broker.Status.Address.Audience); err != nil {
	h.Logger.Warn("no valid JWT provided", zap.Error(err))
	writer.WriteHeader(http.StatusUnauthorized)
	return
	}
	h.Logger.Debug("Request contained a valid JWT. Continuing...")
	}

or

eventing/pkg/broker/filter/filter_handler.go

Lines 211 to 228 in 79bb385

	features := feature.FromContext(ctx)
	if features.IsOIDCAuthentication() {
	h.logger.Debug("OIDC authentication is enabled")
	token := auth.GetJWTFromHeader(request.Header)
	if token == "" {
	h.logger.Warn(fmt.Sprintf("No JWT in %s header provided while feature %s is enabled", auth.AuthHeaderKey, feature.OIDCAuthentication))
	writer.WriteHeader(http.StatusUnauthorized)
	return
	}
	if _, err := h.tokenVerifier.VerifyJWT(ctx, token, FilterAudience); err != nil {
	h.logger.Warn("no valid JWT provided", zap.Error(err))
	writer.WriteHeader(http.StatusUnauthorized)
	return
	}
	h.logger.Debug("Request contained a valid JWT. Continuing...")
	}

(and maybe others).

As they all have a similar logic, this could be refactored into a common method and reused.

Originally posted by @Cali0707 in #7449 (comment)

[Leo6Leo]

/assign

[Cali0707]

/triage accepted