Interpret bound claims value as a "matches any of" test if a list is provided

claims.go

@@ -96,8 +96,27 @@ func validateBoundClaims(logger log.Logger, boundClaims, allClaims map[string]in
 			return fmt.Errorf("claim %q is missing", claim)
 		}
 
-		if expValue != actValue {
-			return fmt.Errorf("claim %q does not match associated bound claim", claim)
+		var expVals []interface{}
+
+		switch v := expValue.(type) {
+		case []interface{}:
+			expVals = v
+		case string:
+			expVals = []interface{}{v}
+		default:
+			return fmt.Errorf("bound claim is not a string or list: %v", expValue)
+		}
+
+		found := false
+		for _, v := range expVals {
+			if actValue == v {
+				found = true
+				break
+			}
+		}
+
+		if !found {
+			return fmt.Errorf("claim %q does not match any associated bound claim values", claim)
 		}
 	}
 

claims_test.go

@@ -275,6 +275,40 @@ func TestValidateBoundClaims(t *testing.T) {
 			},
 			errExpected: true,
 		},
+		{
+			name: "valid - match alternates",
+			boundClaims: map[string]interface{}{
+				"email": []interface{}{"a", "b", "c"},
+				"color": "green",
+			},
+			allClaims: map[string]interface{}{
+				"email": "c",
+				"color": "green",
+			},
+			errExpected: false,
+		},
+		{
+			name: "invalid - no match alternates",
+			boundClaims: map[string]interface{}{
+				"email": []interface{}{"a", "b", "c"},
+				"color": "green",
+			},
+			allClaims: map[string]interface{}{
+				"email": "d",
+				"color": "green",
+			},
+			errExpected: true,
+		},
+		{
+			name: "invalid bound claim expected value",
+			boundClaims: map[string]interface{}{
+				"email": 42,
+			},
+			allClaims: map[string]interface{}{
+				"email": "d",
+			},
+			errExpected: true,
+		},
 	}
 	for _, tt := range tests {
 		if err := validateBoundClaims(hclog.NewNullLogger(), tt.boundClaims, tt.allClaims); (err != nil) != tt.errExpected {