vyos-1x.git/src/services/api/rest, branch rolling

Merge pull request #5491 from omnom62/T8989-hotfix-oidc_aud_validation

2026-09-29T19:07:04+00:00

http-api: T8989: Hotfix to enforce audience validation if OIDC is configured

https: T8989: Hotfix to enforce audience settings with OIDC is configured

2026-09-28T20:58:05+00:00

op-mode: T9354: replace "reset connection" with "reconnect interface"

2026-09-25T19:02:06+00:00

"connect interface" and "disconnect interface" cannot be combined to restart a dialer interface when the CLI session runs over that very interface, yet the command which does cover it was filed under an unrelated top-level node and was hard to find. It is now "reconnect interface ", mirroring the existing connect and disconnect commands. "reset connection" is removed, no alias is kept. The removed command was reachable through the REST API as a "reset" path. A dedicated "/reconnect" endpoint takes its place, so the operation stays available to API consumers.

http-api: T8989: address Copilot review comments

2026-09-02T00:35:35+00:00

- Remove fallback 'oidc-client' identity - tokens without sub/client_id are now rejected - Suppress OIDC validation error details from stdout - Cache discovered JWKS URI back to session to avoid per-request discovery - token_op now accepts X-API-Key header alongside form field - Reset REST/OIDC session attributes on SIGHUP reload to prevent stale config persisting after nodes are removed

http-api: T8989: fix routers.py regressions from initial commit

2026-09-02T00:35:35+00:00

- Restore mask_dict/config_dict variable names in _execute_configure_op (shadowing of Config object was causing potential crash on delete ops) - Fix load_section_tree() call to pass correct 3 arguments - Pass data.destructive to merge_config() to preserve destructive behavior

http-api: T8989: set bounded timeout for OIDC discovery request

2026-09-02T00:35:35+00:00

http-api: T8989: address OIDC review comments

2026-09-02T00:35:35+00:00

- Use OpenID Connect discovery (/.well-known/openid-configuration) to resolve JWKS URI when jwks-url is not explicitly configured - Add optional audience validation via new oidc audience config node - Require exp claim in OIDC tokens - Reject jwks-url without issuer at commit time

http-api: T8989: add OAuth2/OIDC authentication for REST API

2026-09-02T00:35:25+00:00

Add support for validating OIDC Bearer tokens issued by external identity providers (Keycloak, Azure AD, Okta, Vault, etc.) against the configured JWKS endpoint. Configuration: set service https api rest authentication oidc issuer set service https api rest authentication oidc jwks-url If jwks-url is not set, it is derived from the issuer URL using the standard OpenID Connect discovery path. Auth priority: mTLS -> VyOS JWT -> OIDC -> API key

http-api: T8989: address review comments

2026-08-26T18:33:34+00:00

- Make ApiModel.key optional to allow Bearer/X-API-Key/mTLS auth without requiring a dummy key field in the request body - Add thread safety to REST token secret initialization - Cast rest_token_exp and rest_secret_len to int on load - Use defensive dict.get() for authentication config access

http-api: T8989: Update src/services/api/rest/libs/token_auth.py

2026-08-26T18:33:34+00:00

Co-authored-by: Viacheslav Hletenko