Validating JWT from multiple identity providers

I have been tasked recently with finding a way to validate JWT that can come from multiple different identity providers, in the same API. This tends to happen when companies buy each other and try to merge their products and user base. So, first, let's be clear about one thing: wrangling multiple IdPs is the path of pain. You would think that it would avoid painful migrations and get you up and running quickly, but you will pay a huge complexity tax when juggling users and roles from multiple systems interacting in your application.

Validating the JWT, though, is manageable, but I've not seen good advice on how to verify them when they were produced by multiple identity providers. So, let's find a good process for that.

nom 5 is here

nom, the Rust parser combinators library, is now available at version 5. This is the most mature version of nom. This is the one that feels "done". This is the parser library that I wanted when I started nom 5 years ago. It's here at last.

FOSS is free as in toilet

I am a bit dissatisfied with the use of the Tragedy of the commons to represent issues with free and open source software development. It is not an abstract resource that can be depleted when overused. It is not magically maintained if left alone.

No, pest is not faster than nom

As the main developer of nom, the Rust parser combinators library, I'm usually happy to see other parser libraries appear in Rust. The language's strengths play well in that space, and writing parsers is a nice way to explore it.

nom 4.0: faster, safer, simpler parsers

I'm delighted to announce that nom, the extremely fast Rust parser combinators library, has reached major version 4.