diff options
| author | omnom62 <omnom62@outlook.com> | 2026-08-19 17:49:59 +1000 |
|---|---|---|
| committer | John Estabrook <jestabro@vyos.io> | 2026-09-01 19:35:35 -0500 |
| commit | 34d1c5c87283cfe905b6925bc9181368d5cbdd0e (patch) | |
| tree | 03b292c5fe917d468c8ab378dd3e19024a86d2cc /src/conf_mode/service_https.py | |
| parent | b8136290e326ba8a1879a3c55eea9e0a1303fedd (diff) | |
| download | vyos-1x-34d1c5c87283cfe905b6925bc9181368d5cbdd0e.tar.gz vyos-1x-34d1c5c87283cfe905b6925bc9181368d5cbdd0e.zip | |
http-api: T8989: address OIDC review comments
- Use OpenID Connect discovery (/.well-known/openid-configuration) to
resolve JWKS URI when jwks-url is not explicitly configured
- Add optional audience validation via new oidc audience config node
- Require exp claim in OIDC tokens
- Reject jwks-url without issuer at commit time
Diffstat (limited to 'src/conf_mode/service_https.py')
| -rwxr-xr-x | src/conf_mode/service_https.py | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/conf_mode/service_https.py b/src/conf_mode/service_https.py index 093209304..52527ba63 100755 --- a/src/conf_mode/service_https.py +++ b/src/conf_mode/service_https.py @@ -117,6 +117,9 @@ def verify(https): raise ConfigError( 'CA certificate must be configured for mTLS client verification' ) + if dict_search('api.rest.authentication.oidc.jwks_url', https) is not None: + if dict_search('api.rest.authentication.oidc.issuer', https) is None: + raise ConfigError('OIDC issuer must be configured when jwks-url is set') # Check if server port is already in use by a different application listen_address = ['0.0.0.0'] |