A new multi-tenant SaaS application at ServiceNow needs robust authentication and authorization. As a cloud engineer, how would you leverage cloud-native identity services to design a secure and scalable solution?

import jwt
import requests
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend

def get_public_keys(jwks_url):
    # Fetch the JSON Web Key Set from the IdP's discovery endpoint
    try:
        response = requests.get(jwks_url)
        response.raise_for_status() # Raise an exception for HTTP errors
        jwks = response.json()
        keys = {}
        for jwk in jwks["keys"]:
            # Reconstruct public key for verification
            # This typically involves converting JWK to PEM format
            # For simplicity, actual conversion logic omitted for brevity
            pass # Placeholder for actual key conversion
        return keys
    except requests.exceptions.RequestException as e:
        print(f"Error fetching JWKS: {e}")
        return {}

def validate_jwt_token(token, jwks_url, audience, issuer):
    # In a real app, keys would be cached. This fetches them every time.
    public_keys = get_public_keys(jwks_url)
    if not public_keys:
        return None # Failed to fetch keys

    try:
        # Decode and verify the token using one of the public keys
        decoded_token = jwt.decode(
            token,
            public_keys,
            algorithms=["RS256"], # Example algorithm
            audience=audience,
            issuer=issuer,
            options={
                "require_exp": True,
                "verify_signature": True,
                "verify_exp": True
            }
        )
        return decoded_token
    except jwt.ExpiredSignatureError:
        print("Token has expired")
    except jwt.InvalidTokenError as e:
        print(f"Invalid token: {e}")
    return None

# Example Usage (replace with actual values)
if __name__ == "__main__":
    # This JWKS URL would come from your IdP's discovery endpoint
    IDP_JWKS_URL = "https://cognito-idp.us-east-1.amazonaws.com/<USER_POOL_ID>/.well-known/jwks.json"
    APP_AUDIENCE = "<YOUR_APP_CLIENT_ID>"
    TOKEN_ISSUER = "https://cognito-idp.us-east-1.amazonaws.com/<USER_POOL_ID>"
    
    # A mock JWT token (replace with a real one for testing)
    # This token is NOT valid, it's just a placeholder for structure.
    MOCK_JWT_TOKEN = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"

    # Simulate fetching and converting keys (simplified)
    class MockKey:
        def __init__(self):
            self.key_data = {
                "kid": "mock_key_id",
                "kty": "RSA",
                "n": "mock_n_value", # Base64Url encoded modulus
                "e": "AQAB" # Base64Url encoded exponent
            }
        def public_bytes(self, encoding, format):
            return b"-----BEGIN PUBLIC KEY-----...-----END PUBLIC KEY-----" # Mock PEM format

    def mock_get_public_keys(jwks_url):
        return {"mock_key_id": MockKey()}

    # Override actual get_public_keys with mock for demonstration
    import sys
    if "pytest" not in sys.modules: # Avoid mocking in actual test runs if this was part of a suite
        get_public_keys = mock_get_public_keys

    valid_payload = validate_jwt_token(MOCK_JWT_TOKEN, IDP_JWKS_URL, APP_AUDIENCE, TOKEN_ISSUER)

    if valid_payload:
        print("Token is valid. Payload:", valid_payload)
        print("User ID:", valid_payload.get("sub"))
        print("Tenant ID (example claim):", valid_payload.get("custom:tenant_id"))
    else:
        print("Token validation failed.")