Merge pull request #5491 from omnom62/T8989-hotfix-oidc_aud_validation

http-api: T8989: Hotfix to enforce audience validation if OIDC is configured

1 files changed, 24 insertions, 2 deletions

diff --git a/src/conf_mode/service_https.py b/src/conf_mode/service_https.py
index d10825ab5..10e0afe49 100755
--- a/src/conf_mode/service_https.py
+++ b/src/conf_mode/service_https.py
@@ -121,6 +121,15 @@ def verify(https):
         if dict_search('api.rest.authentication.oidc.issuer', https) is None:
             raise ConfigError('OIDC issuer must be configured when jwks-url is set')
 
+    if dict_search('api.rest.authentication.oidc.issuer', https) is not None:
+        if dict_search('api.rest.authentication.oidc.audience', https) is None:
+            raise ConfigError(
+                'OIDC audience must be configured when issuer is set. '
+                'Without it, any valid token issued by the trusted issuer '
+                'for a different application would be accepted, granting '
+                'full API privileges to an unrelated token holder.'
+            )
+
     # Check if server port is already in use by a different application
     listen_address = ['0.0.0.0']
     port = int(https['port'])
@@ -160,9 +169,18 @@ def verify(https):
         # If only key-based methods are enabled,
         # fail the commit if no valid key configurations are found
         mtls_auth = dict_search('certificates.verify_client', https) is not None
-        if (not valid_keys_exist) and (not jwt_auth) and (not mtls_auth):
+        oidc_auth = (
+            dict_search('api.rest.authentication.oidc.issuer', https) is not None
+        )
+        if (
+            (not valid_keys_exist)
+            and (not jwt_auth)
+            and (not mtls_auth)
+            and (not oidc_auth)
+        ):
             raise ConfigError(
-                'At least one HTTPS API key is required unless GraphQL token or mTLS authentication is enabled!'
+                'At least one HTTPS API key is required unless GraphQL token, '
+                'mTLS, or OIDC authentication is enabled!'
             )
 
         if (not valid_keys_exist) and jwt_auth:
@@ -171,6 +189,10 @@ def verify(https):
             Warning(
                 'API keys are not configured: only mTLS client certificate authentication will be available for the REST API!'
             )
+        if (not valid_keys_exist) and oidc_auth and not jwt_auth and not mtls_auth:
+            Warning(
+                'API keys are not configured: only OIDC authentication will be available for the REST API!'
+            )
 
     return None