From b8136290e326ba8a1879a3c55eea9e0a1303fedd Mon Sep 17 00:00:00 2001 From: omnom62 Date: Fri, 14 Aug 2026 16:06:57 +1000 Subject: http-api: T8989: add OAuth2/OIDC authentication for REST API Add support for validating OIDC Bearer tokens issued by external identity providers (Keycloak, Azure AD, Okta, Vault, etc.) against the configured JWKS endpoint. Configuration: set service https api rest authentication oidc issuer set service https api rest authentication oidc jwks-url If jwks-url is not set, it is derived from the issuer URL using the standard OpenID Connect discovery path. Auth priority: mTLS -> VyOS JWT -> OIDC -> API key --- src/services/vyos-http-api-server | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'src/services/vyos-http-api-server') diff --git a/src/services/vyos-http-api-server b/src/services/vyos-http-api-server index bdcf24e39..00fd42586 100755 --- a/src/services/vyos-http-api-server +++ b/src/services/vyos-http-api-server @@ -191,6 +191,15 @@ def initialization(session: SessionState, app: FastAPI = app): session.rest_token_exp = int(auth['expiration']) if 'secret_length' in auth: session.rest_secret_len = int(auth['secret_length']) + oidc = auth.get('oidc', {}) + if isinstance(oidc, dict): + if 'issuer' in oidc: + session.oidc_issuer = oidc['issuer'] + if 'jwks_url' in oidc: + session.oidc_jwks_uri = oidc['jwks_url'] + elif 'issuer' in oidc: + # Derive JWKS URI from issuer if not explicitly set + session.oidc_jwks_uri = None # will be resolved in token_auth graphql_config = server_config.get('graphql', {}) session.origins = graphql_config.get('cors', {}).get('allow_origin', []) -- cgit v1.2.3