[PATCH proxmox v5 2/8] fix #5076: pbs-api-types: add audiences to open id realm config

Shannon Sterz
2026-04-23T13:36:11Z

pbs-api-types/src/openid.rs | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)

diff --git a/pbs-api-types/src/openid.rs b/pbs-api-types/src/openid.rs
index 0333272b..739f6c89 100644
--- a/pbs-api-types/src/openid.rs
+++ b/pbs-api-types/src/openid.rs
@@ -42,6 +42,26 @@ pub const OPENID_ACR_LIST_SCHEMA: Schema = StringSchema::new("OpenID ACR List")
.format(&OPENID_ACR_LIST_FORMAT)
.schema();

+pub const OPENID_AUDIENCE_FORMAT: ApiStringFormat = ApiStringFormat::Pattern(&GENERIC_URI_REGEX);
+
+pub const OPENID_AUDIENCE_SCHEMA: Schema = StringSchema::new("OpenID audience.")
+ .format(&OPENID_AUDIENCE_FORMAT)
+ .max_length(256)
+ .schema();
+
+pub const OPENID_AUDIENCE_ARRAY_SCHEMA: Schema = ArraySchema::new(
+ "A list of OpenID audiences that is allowed in addition to the 'client-id'.",
+ &OPENID_AUDIENCE_SCHEMA,
+)
+.schema();
+
+pub const OPENID_AUDIENCE_LIST_FORMAT: ApiStringFormat =
+ ApiStringFormat::PropertyString(&OPENID_AUDIENCE_ARRAY_SCHEMA);
+
+pub const OPENID_AUDIENCE_LIST_SCHEMA: Schema = StringSchema::new("OpenID audience list.")
+ .format(&OPENID_AUDIENCE_LIST_FORMAT)
+ .schema();
+
pub const OPENID_USERNAME_CLAIM_SCHEMA: Schema = StringSchema::new(
"Use the value of this attribute/claim as unique user name. It \
is up to the identity provider to guarantee the uniqueness. The \
@@ -70,6 +90,10 @@ pub const OPENID_USERNAME_CLAIM_SCHEMA: Schema = StringSchema::new(
schema: OPENID_ACR_LIST_SCHEMA,
optional: true,
},
+ audiences: {
+ schema: OPENID_AUDIENCE_LIST_SCHEMA,
+ optional: true,
+ },
prompt: {
description: "OpenID Prompt",
type: String,
@@ -109,6 +133,8 @@ pub struct OpenIdRealmConfig {
#[serde(skip_serializing_if = "Option::is_none")]
pub acr_values: Option<String>,
#[serde(skip_serializing_if = "Option::is_none")]
+ pub audiences: Option<String>,
+ #[serde(skip_serializing_if = "Option::is_none")]
pub prompt: Option<String>,
/// OpenID Client Key
#[serde(skip_serializing_if = "Option::is_none")]
--
2.47.3