[PATCH proxmox-backup v5 7/8] fix #5076: api: support audiences property for open id realms

Shannon Sterz
2026-04-23T13:37:04Z

to allow for better compatability with open id providers, support the
audiences field for open id realms. users can specify which audiences
are trusted in addition to the client-id.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
src/api2/access/openid.rs | 8 ++++++++
src/api2/config/access/openid.rs | 8 ++++++++
2 files changed, 16 insertions(+)

diff --git a/src/api2/access/openid.rs b/src/api2/access/openid.rs
index cb94b0e18..818bcb555 100644
--- a/src/api2/access/openid.rs
+++ b/src/api2/access/openid.rs
@@ -50,6 +50,13 @@ fn openid_authenticator(
);
}

+ let audiences = realm_config.audiences.as_ref().map(|list| {
+ list.split(|c: char| c == ',' || c == ';' || char::is_ascii_whitespace(&c))
+ .filter(|s| !s.is_empty())
+ .map(String::from)
+ .collect()
+ });
+
let config = OpenIdConfig {
issuer_url: realm_config.issuer_url.clone(),
client_id: realm_config.client_id.clone(),
@@ -57,6 +64,7 @@ fn openid_authenticator(
prompt: realm_config.prompt.clone(),
scopes: Some(scopes),
acr_values,
+ audiences,
};
OpenIdAuthenticator::discover(&config, redirect_url)
}
diff --git a/src/api2/config/access/openid.rs b/src/api2/config/access/openid.rs
index ab05bfb68..b71e4dae6 100644
--- a/src/api2/config/access/openid.rs
+++ b/src/api2/config/access/openid.rs
@@ -159,6 +159,8 @@ pub enum DeletableProperty {
Prompt,
/// Delete the acr_values property
AcrValues,
+ /// Delete the audiences property
+ Audiences,
}

#[api(
@@ -231,6 +233,9 @@ pub fn update_openid_realm(
DeletableProperty::AcrValues => {
config.acr_values = None;
}
+ DeletableProperty::Audiences => {
+ config.audiences = None;
+ }
}
}
}
@@ -273,6 +278,9 @@ pub fn update_openid_realm(
if update.acr_values.is_some() {
config.acr_values = update.acr_values;
}
+ if update.audiences.is_some() {
+ config.audiences = update.audiences;
+ }

domains.set_data(&realm, "openid", &config)?;

--
2.47.3