vyos-1x.git/src/services/api/rest/libs, branch rolling

https: T8989: Hotfix to enforce audience settings with OIDC is configured

2026-09-28T20:58:05+00:00

http-api: T8989: address Copilot review comments

2026-09-02T00:35:35+00:00

- Remove fallback 'oidc-client' identity - tokens without sub/client_id are now rejected - Suppress OIDC validation error details from stdout - Cache discovered JWKS URI back to session to avoid per-request discovery - token_op now accepts X-API-Key header alongside form field - Reset REST/OIDC session attributes on SIGHUP reload to prevent stale config persisting after nodes are removed

http-api: T8989: set bounded timeout for OIDC discovery request

2026-09-02T00:35:35+00:00

http-api: T8989: address OIDC review comments

2026-09-02T00:35:35+00:00

- Use OpenID Connect discovery (/.well-known/openid-configuration) to resolve JWKS URI when jwks-url is not explicitly configured - Add optional audience validation via new oidc audience config node - Require exp claim in OIDC tokens - Reject jwks-url without issuer at commit time

http-api: T8989: add OAuth2/OIDC authentication for REST API

2026-09-02T00:35:25+00:00

Add support for validating OIDC Bearer tokens issued by external identity providers (Keycloak, Azure AD, Okta, Vault, etc.) against the configured JWKS endpoint. Configuration: set service https api rest authentication oidc issuer set service https api rest authentication oidc jwks-url If jwks-url is not set, it is derived from the issuer URL using the standard OpenID Connect discovery path. Auth priority: mTLS -> VyOS JWT -> OIDC -> API key

http-api: T8989: address review comments

2026-08-26T18:33:34+00:00

- Make ApiModel.key optional to allow Bearer/X-API-Key/mTLS auth without requiring a dummy key field in the request body - Add thread safety to REST token secret initialization - Cast rest_token_exp and rest_secret_len to int on load - Use defensive dict.get() for authentication config access

http-api: T8989: Update src/services/api/rest/libs/token_auth.py

2026-08-26T18:33:34+00:00

Co-authored-by: Viacheslav Hletenko

http-api: T8989: add REST Bearer token authentication

2026-08-26T18:33:34+00:00

Add JWT Bearer token support to the REST API, as an additional authentication method alongside the existing form-field key and X-API-Key header. - New POST /token endpoint mints a JWT for a valid API key - auth_required() accepts Authorization: Bearer alongside existing key/X-API-Key auth - New config nodes: service https api rest authentication {expiration, secret-length} (defaults: 3600s / 32 bytes) - REST tokens use an independent signing secret from GraphQL's, since GraphQL may not be enabled on all deployments and the two subsystems have different expiry requirements - nginx location regex updated to allow /token - service_https.py default-value merge generalized to also apply to the rest node, not just graphql, so REST authentication defaults populate correctly on commit