[PATCH access-control v4 2/3] fix #5076: auth: open id: add an optional "audiences" field

[Shannon Sterz <s.sterz@proxmox.com>]

adds an optional "audiences" field to the open id configuration
schema. "audiences" is a list of additionally accepted audiences that
an open id provider may include.

Originally-by: Alexander Abraham <a.abraham@proxmox.com>
[SS:
 * rephrased the commit message for style and clarity
 * adjusted the parameter description to be clearer
 * removed a validation pattern that was incorrect and set a
   maxLength for members of the "audiences" array
 * removed changes that only reformatted unrelated code
]

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/PVE/API2/OpenId.pm |  4 ++++
 src/PVE/Auth/OpenId.pm | 12 ++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm
index cccd615..58ffd81 100644
--- a/src/PVE/API2/OpenId.pm
+++ b/src/PVE/API2/OpenId.pm
@@ -46,6 +46,10 @@ my $lookup_openid_auth = sub {
         $openid_config->{acr_values} = [PVE::Tools::split_list($acr)];
     }
 
+    if (defined(my $audiences = $config->{'audiences'})) {
+        $openid_config->{audiences} = $config->{'audiences'};
+    }
+
     my $openid = PVE::RS::OpenId->discover($openid_config, $redirect_url);
     return ($config, $openid);
 };
diff --git a/src/PVE/Auth/OpenId.pm b/src/PVE/Auth/OpenId.pm
index 2209040..2467263 100755
--- a/src/PVE/Auth/OpenId.pm
+++ b/src/PVE/Auth/OpenId.pm
@@ -92,6 +92,17 @@ sub properties {
             default => 1,
             optional => 1,
         },
+        'audiences' => {
+            description =>
+                "A list of audiences that the OpenID Issuer may include that are accepted in "
+                . "addition to 'client-id'.",
+            type => 'array',
+            'items' => {
+                type => 'string',
+                optional => 1,
+                maxLength => 256,
+            },
+        },
     };
 }
 
@@ -108,6 +119,7 @@ sub options {
         prompt => { optional => 1 },
         scopes => { optional => 1 },
         "acr-values" => { optional => 1 },
+        audiences => { optional => 1 },
         default => { optional => 1 },
         comment => { optional => 1 },
         "query-userinfo" => { optional => 1 },
-- 
2.47.3