def validate_and_return_id_token(self, id_token):
        """
        Validates the id_token according to the steps at
        http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation.
        """
        client_id, _client_secret = self.get_key_and_secret()

        decode_kwargs = {
            'algorithms': ['HS256'],
            'audience': client_id,
            'issuer': self.ID_TOKEN_ISSUER,
            'key': self.setting('ID_TOKEN_DECRYPTION_KEY'),
            'options': {
                'verify_signature': True,
                'verify_exp': True,
                'verify_iat': True,
                'verify_aud': True,
                'verify_iss': True,
                'require_exp': True,
                'require_iat': True,
            },
        }
        decode_kwargs.update(self.setting('ID_TOKEN_JWT_DECODE_KWARGS', {}))

        try:
            # Decode the JWT and raise an error if the secret is invalid or
            # the response has expired.
            id_token = jwt_decode(id_token, **decode_kwargs)
        except InvalidTokenError as err:
            raise AuthTokenError(self, err)

        # Verify the token was issued within a specified amount of time
        iat_leeway = self.setting('ID_TOKEN_MAX_AGE', self.ID_TOKEN_MAX_AGE)
        utc_timestamp = timegm(datetime.datetime.utcnow().utctimetuple())
        if id_token['iat'] < (utc_timestamp - iat_leeway):
            raise AuthTokenError(self, 'Incorrect id_token: iat')

        # Validate the nonce to ensure the request was not modified
        nonce = id_token.get('nonce')
        if not nonce:
            raise AuthTokenError(self, 'Incorrect id_token: nonce')

        nonce_obj = self.get_nonce(nonce)
        if nonce_obj:
            self.remove_nonce(nonce_obj.id)
        else:
            raise AuthTokenError(self, 'Incorrect id_token: nonce')
        return id_token
dataset/ETHPy150Open omab/python-social-auth/social/backends/open_id.py/OpenIdConnectAuth.validate_and_return_id_token/original