From b8136290e326ba8a1879a3c55eea9e0a1303fedd Mon Sep 17 00:00:00 2001 From: omnom62 Date: Fri, 14 Aug 2026 16:06:57 +1000 Subject: http-api: T8989: add OAuth2/OIDC authentication for REST API Add support for validating OIDC Bearer tokens issued by external identity providers (Keycloak, Azure AD, Okta, Vault, etc.) against the configured JWKS endpoint. Configuration: set service https api rest authentication oidc issuer set service https api rest authentication oidc jwks-url If jwks-url is not set, it is derived from the issuer URL using the standard OpenID Connect discovery path. Auth priority: mTLS -> VyOS JWT -> OIDC -> API key --- src/services/api/session.py | 2 ++ 1 file changed, 2 insertions(+) (limited to 'src/services/api/session.py') diff --git a/src/services/api/session.py b/src/services/api/session.py index 0b1c935c7..a50b692f0 100644 --- a/src/services/api/session.py +++ b/src/services/api/session.py @@ -42,3 +42,5 @@ class SessionState: self.rest_secret = None self.rest_secret_len = None self.rest_token_exp = None + self.oidc_issuer = None + self.oidc_jwks_uri = None -- cgit v1.2.3