diff options
| author | omnom62 <omnom62@outlook.com> | 2026-08-14 16:06:57 +1000 |
|---|---|---|
| committer | John Estabrook <jestabro@vyos.io> | 2026-09-01 19:35:25 -0500 |
| commit | b8136290e326ba8a1879a3c55eea9e0a1303fedd (patch) | |
| tree | bec0c69fc2d1fab98484796bf14f7b4207de13d7 /interface-definitions/service_https.xml.in | |
| parent | 1832b2bb3e9948f8bf6dfb3be50fd10363bc3a38 (diff) | |
| download | vyos-1x-b8136290e326ba8a1879a3c55eea9e0a1303fedd.tar.gz vyos-1x-b8136290e326ba8a1879a3c55eea9e0a1303fedd.zip | |
http-api: T8989: add OAuth2/OIDC authentication for REST API
Add support for validating OIDC Bearer tokens issued by external identity
providers (Keycloak, Azure AD, Okta, Vault, etc.) against the configured
JWKS endpoint.
Configuration:
set service https api rest authentication oidc issuer <url>
set service https api rest authentication oidc jwks-url <url>
If jwks-url is not set, it is derived from the issuer URL using the
standard OpenID Connect discovery path.
Auth priority: mTLS -> VyOS JWT -> OIDC -> API key
Diffstat (limited to 'interface-definitions/service_https.xml.in')
| -rw-r--r-- | interface-definitions/service_https.xml.in | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/interface-definitions/service_https.xml.in b/interface-definitions/service_https.xml.in index d2cadeffe..0306ef1a1 100644 --- a/interface-definitions/service_https.xml.in +++ b/interface-definitions/service_https.xml.in @@ -81,6 +81,31 @@ </properties> <defaultValue>32</defaultValue> </leafNode> + <node name="oidc"> + <properties> + <help>OpenID Connect authentication</help> + </properties> + <children> + <leafNode name="issuer"> + <properties> + <help>OIDC issuer URL (must match iss claim in token)</help> + <valueHelp> + <format>url</format> + <description>OIDC issuer URL e.g. https://keycloak.example.com/realms/vyos</description> + </valueHelp> + </properties> + </leafNode> + <leafNode name="jwks-url"> + <properties> + <help>JWKS endpoint URL (if different from issuer discovery)</help> + <valueHelp> + <format>url</format> + <description>JWKS endpoint URL e.g. https://keycloak.example.com/realms/vyos/protocol/openid-connect/certs</description> + </valueHelp> + </properties> + </leafNode> + </children> + </node> </children> </node> </children> |