http-api: T8989: add OAuth2/OIDC authentication for REST API

Add support for validating OIDC Bearer tokens issued by external identity
providers (Keycloak, Azure AD, Okta, Vault, etc.) against the configured
JWKS endpoint.

Configuration:
  set service https api rest authentication oidc issuer <url>
  set service https api rest authentication oidc jwks-url <url>

If jwks-url is not set, it is derived from the issuer URL using the
standard OpenID Connect discovery path.

Auth priority: mTLS -> VyOS JWT -> OIDC -> API key

1 files changed, 9 insertions, 0 deletions

diff --git a/src/services/vyos-http-api-server b/src/services/vyos-http-api-server
index bdcf24e39..00fd42586 100755
--- a/src/services/vyos-http-api-server
+++ b/src/services/vyos-http-api-server
@@ -191,6 +191,15 @@ def initialization(session: SessionState, app: FastAPI = app):
                 session.rest_token_exp = int(auth['expiration'])
             if 'secret_length' in auth:
                 session.rest_secret_len = int(auth['secret_length'])
+            oidc = auth.get('oidc', {})
+            if isinstance(oidc, dict):
+                if 'issuer' in oidc:
+                    session.oidc_issuer = oidc['issuer']
+                if 'jwks_url' in oidc:
+                    session.oidc_jwks_uri = oidc['jwks_url']
+                elif 'issuer' in oidc:
+                    # Derive JWKS URI from issuer if not explicitly set
+                    session.oidc_jwks_uri = None  # will be resolved in token_auth
 
     graphql_config = server_config.get('graphql', {})
     session.origins = graphql_config.get('cors', {}).get('allow_origin', [])