code: func userFromIDToken(c context.Context, token string, cfg *Settings, discovery *discoveryDoc) (uid string, u *auth.User, err error) {
  	// Validate the discovery doc has necessary fields to proceed.
  	switch {
  	case discovery.Issuer == "":
  		return "", nil, errors.New("openid: bad discovery doc, empty issuer")
  	case discovery.JwksURI == "":
  		return "", nil, errors.New("openid: bad discovery doc, empty jwks_uri")
  	}
  
  	// Grab the signing keys needed to verify the token. This is almost always
  	// hitting the local process cache and thus must be fast.
  	signingKeys, err := discovery.signingKeys(c)
  	if err != nil {
  		return "", nil, err
  	}
  
  	// Unpack the ID token to grab the user information from it.
  	verifiedToken, err := VerifyIDToken(c, token, signingKeys, discovery.Issuer, cfg.ClientID)
  	if err != nil {
  		return "", nil, err
  	}
  
  	// Ignore non https:// URLs for pictures. We serve all pages over HTTPS and
  	// don't want to break this rule just for a pretty picture.
  	picture := verifiedToken.Picture
  	if picture != "" && !strings.HasPrefix(picture, "https://") {
  		picture = ""
  	}
  
  	// Build the identity string from the email. This essentially validates it.
  	id, err := identity.MakeIdentity("user:" + verifiedToken.Email)
  	if err != nil {
  		return "", nil, err
  	}
  
  	return verifiedToken.Sub, &auth.User{
  		Identity: id,
  		Email:    verifiedToken.Email,
  		Name:     verifiedToken.Name,
  		Picture:  picture,
  	}, nil
  }
docs: // userFromIDToken validates the ID token and extracts user information from it.