From 34d1c5c87283cfe905b6925bc9181368d5cbdd0e Mon Sep 17 00:00:00 2001
From: omnom62 <omnom62@outlook.com>
Date: Wed, 19 Aug 2026 17:49:59 +1000
Subject: http-api: T8989: address OIDC review comments

- Use OpenID Connect discovery (/.well-known/openid-configuration) to
  resolve JWKS URI when jwks-url is not explicitly configured
- Add optional audience validation via new oidc audience config node
- Require exp claim in OIDC tokens
- Reject jwks-url without issuer at commit time
---
 interface-definitions/service_https.xml.in | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'interface-definitions/service_https.xml.in')

diff --git a/interface-definitions/service_https.xml.in b/interface-definitions/service_https.xml.in
index 0306ef1a1..3881c4b49 100644
--- a/interface-definitions/service_https.xml.in
+++ b/interface-definitions/service_https.xml.in
@@ -104,6 +104,15 @@
                               </valueHelp>
                             </properties>
                           </leafNode>
+                          <leafNode name="audience">
+                            <properties>
+                              <help>Expected audience claim in OIDC tokens</help>
+                              <valueHelp>
+                                <format>txt</format>
+                                <description>Audience value e.g. vyos-api or account</description>
+                              </valueHelp>
+                            </properties>
+                          </leafNode>
                         </children>
                       </node>
                     </children>
-- 
cgit v1.2.3