diff options
| author | omnom62 <omnom62@outlook.com> | 2026-08-14 16:06:57 +1000 |
|---|---|---|
| committer | John Estabrook <jestabro@vyos.io> | 2026-09-01 19:35:25 -0500 |
| commit | b8136290e326ba8a1879a3c55eea9e0a1303fedd (patch) | |
| tree | bec0c69fc2d1fab98484796bf14f7b4207de13d7 /src/services/api/session.py | |
| parent | 1832b2bb3e9948f8bf6dfb3be50fd10363bc3a38 (diff) | |
| download | vyos-1x-b8136290e326ba8a1879a3c55eea9e0a1303fedd.tar.gz vyos-1x-b8136290e326ba8a1879a3c55eea9e0a1303fedd.zip | |
http-api: T8989: add OAuth2/OIDC authentication for REST API
Add support for validating OIDC Bearer tokens issued by external identity
providers (Keycloak, Azure AD, Okta, Vault, etc.) against the configured
JWKS endpoint.
Configuration:
set service https api rest authentication oidc issuer <url>
set service https api rest authentication oidc jwks-url <url>
If jwks-url is not set, it is derived from the issuer URL using the
standard OpenID Connect discovery path.
Auth priority: mTLS -> VyOS JWT -> OIDC -> API key
Diffstat (limited to 'src/services/api/session.py')
| -rw-r--r-- | src/services/api/session.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/services/api/session.py b/src/services/api/session.py index 0b1c935c7..a50b692f0 100644 --- a/src/services/api/session.py +++ b/src/services/api/session.py @@ -42,3 +42,5 @@ class SessionState: self.rest_secret = None self.rest_secret_len = None self.rest_token_exp = None + self.oidc_issuer = None + self.oidc_jwks_uri = None |