From 34d1c5c87283cfe905b6925bc9181368d5cbdd0e Mon Sep 17 00:00:00 2001 From: omnom62 Date: Wed, 19 Aug 2026 17:49:59 +1000 Subject: http-api: T8989: address OIDC review comments - Use OpenID Connect discovery (/.well-known/openid-configuration) to resolve JWKS URI when jwks-url is not explicitly configured - Add optional audience validation via new oidc audience config node - Require exp claim in OIDC tokens - Reject jwks-url without issuer at commit time --- src/conf_mode/service_https.py | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src/conf_mode/service_https.py') diff --git a/src/conf_mode/service_https.py b/src/conf_mode/service_https.py index 093209304..52527ba63 100755 --- a/src/conf_mode/service_https.py +++ b/src/conf_mode/service_https.py @@ -117,6 +117,9 @@ def verify(https): raise ConfigError( 'CA certificate must be configured for mTLS client verification' ) + if dict_search('api.rest.authentication.oidc.jwks_url', https) is not None: + if dict_search('api.rest.authentication.oidc.issuer', https) is None: + raise ConfigError('OIDC issuer must be configured when jwks-url is set') # Check if server port is already in use by a different application listen_address = ['0.0.0.0'] -- cgit v1.2.3