Harden id_token audience validation in extract_jwt

After the client_id change, extract_jwt still validates the id_token
audience against TDC_OIDC_CLIENT_ID (the OIDC-standard case). But since
the token exchange wasn't captured, we can't be certain Tandem sets
aud=client_id on the id_token. If it doesn't, fall back to decoding with
verify_aud disabled (signature + issuer still verified) and log a
warning, rather than failing login outright.

tconnectsync/api/tandemsource.py

@@ -299,14 +299,32 @@ class TandemSourceApi:
         audience = self.TDC_OIDC_CLIENT_ID
         issuer = self.TDC_OIDC_ISSUER
 
-        # Decode and verify the ID Token
+        # Decode and verify the ID Token. Per OIDC the id_token's `aud` equals
-        id_token_claims = jwt.decode(
+        # the client_id, so validate it. But if Tandem ever issues an id_token
-            id_token,
+        # with a different audience, fall back to skipping only the audience
-            key=key,
+        # check (signature + issuer are still verified) rather than failing
-            algorithms=['RS256'],
+        # login outright.
-            audience=audience,
+        id_token_claims: JwtClaims
-            issuer=issuer,
+        try:
-        )
+            id_token_claims = jwt.decode(
+                id_token,
+                key=key,
+                algorithms=['RS256'],
+                audience=audience,
+                issuer=issuer,
+            )
+        except jwt.InvalidAudienceError:
+            logger.warning(
+                "id_token audience did not match client_id %s; decoding without audience verification",
+                audience,
+            )
+            id_token_claims = jwt.decode(
+                id_token,
+                key=key,
+                algorithms=['RS256'],
+                issuer=issuer,
+                options={"verify_aud": False},
+            )
 
         logger.info("Decoded JWT: %s" % json.dumps(id_token_claims))