I’m trying to set up an elixir application that uses OpenID connect for authentication. I don’t want to roll my own security so I am using the most popular library openid_connect which looks to be supported by Dockyard, or at least it’s on their github.

The instructions to use the library and verify the token are as follows.

Verify the JWT

The JWT is encrypted and it should always be verified with the JSON Web Keys (JWK) for the provider:

{:ok, claims} = OpenIDConnect.verify(:google, tokens["id_token"])

The claims is a payload with the information from the scopes you requested of the provider.

Read the claims and set your app’s user session

Now that you have the claims payload you can use the user data to identify and set the user’s session state for your app.
Setting your app’s session state is outside the scope of this library.

There are additional checks of an id_token that are required if using the implicit flow that are not performed by the verify function. Full list is available here. Final: OpenID Connect Core 1.0 incorporating errata set 2

Does anyone have a setup that does perform all the checks. Either code example or library form?