diff options
| author | omnom62 <omnom62@outlook.com> | 2026-08-19 17:49:59 +1000 |
|---|---|---|
| committer | John Estabrook <jestabro@vyos.io> | 2026-09-01 19:35:35 -0500 |
| commit | 34d1c5c87283cfe905b6925bc9181368d5cbdd0e (patch) | |
| tree | 03b292c5fe917d468c8ab378dd3e19024a86d2cc /interface-definitions/service_https.xml.in | |
| parent | b8136290e326ba8a1879a3c55eea9e0a1303fedd (diff) | |
| download | vyos-1x-34d1c5c87283cfe905b6925bc9181368d5cbdd0e.tar.gz vyos-1x-34d1c5c87283cfe905b6925bc9181368d5cbdd0e.zip | |
http-api: T8989: address OIDC review comments
- Use OpenID Connect discovery (/.well-known/openid-configuration) to
resolve JWKS URI when jwks-url is not explicitly configured
- Add optional audience validation via new oidc audience config node
- Require exp claim in OIDC tokens
- Reject jwks-url without issuer at commit time
Diffstat (limited to 'interface-definitions/service_https.xml.in')
| -rw-r--r-- | interface-definitions/service_https.xml.in | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/interface-definitions/service_https.xml.in b/interface-definitions/service_https.xml.in index 0306ef1a1..3881c4b49 100644 --- a/interface-definitions/service_https.xml.in +++ b/interface-definitions/service_https.xml.in @@ -104,6 +104,15 @@ </valueHelp> </properties> </leafNode> + <leafNode name="audience"> + <properties> + <help>Expected audience claim in OIDC tokens</help> + <valueHelp> + <format>txt</format> + <description>Audience value e.g. vyos-api or account</description> + </valueHelp> + </properties> + </leafNode> </children> </node> </children> |