From b8136290e326ba8a1879a3c55eea9e0a1303fedd Mon Sep 17 00:00:00 2001
From: omnom62 <omnom62@outlook.com>
Date: Fri, 14 Aug 2026 16:06:57 +1000
Subject: http-api: T8989: add OAuth2/OIDC authentication for REST API

Add support for validating OIDC Bearer tokens issued by external identity
providers (Keycloak, Azure AD, Okta, Vault, etc.) against the configured
JWKS endpoint.

Configuration:
  set service https api rest authentication oidc issuer <url>
  set service https api rest authentication oidc jwks-url <url>

If jwks-url is not set, it is derived from the issuer URL using the
standard OpenID Connect discovery path.

Auth priority: mTLS -> VyOS JWT -> OIDC -> API key
---
 interface-definitions/service_https.xml.in | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

(limited to 'interface-definitions')

diff --git a/interface-definitions/service_https.xml.in b/interface-definitions/service_https.xml.in
index d2cadeffe..0306ef1a1 100644
--- a/interface-definitions/service_https.xml.in
+++ b/interface-definitions/service_https.xml.in
@@ -81,6 +81,31 @@
                         </properties>
                         <defaultValue>32</defaultValue>
                       </leafNode>
+                      <node name="oidc">
+                        <properties>
+                          <help>OpenID Connect authentication</help>
+                        </properties>
+                        <children>
+                          <leafNode name="issuer">
+                            <properties>
+                              <help>OIDC issuer URL (must match iss claim in token)</help>
+                              <valueHelp>
+                                <format>url</format>
+                                <description>OIDC issuer URL e.g. https://keycloak.example.com/realms/vyos</description>
+                              </valueHelp>
+                            </properties>
+                          </leafNode>
+                          <leafNode name="jwks-url">
+                            <properties>
+                              <help>JWKS endpoint URL (if different from issuer discovery)</help>
+                              <valueHelp>
+                                <format>url</format>
+                                <description>JWKS endpoint URL e.g. https://keycloak.example.com/realms/vyos/protocol/openid-connect/certs</description>
+                              </valueHelp>
+                            </properties>
+                          </leafNode>
+                        </children>
+                      </node>
                     </children>
                   </node>
                 </children>
-- 
cgit v1.2.3