[PATCH access-control v5 3/8] fix #5076: auth: open id: add an optional "audiences" field

Shannon Sterz
2026-04-23T13:36:04Z

adds an optional "audiences" field to the open id configuration
schema. "audiences" is a list of additionally accepted audiences that
an open id provider may include.

Originally-by: Alexander Abraham <a.abraham@proxmox.com>
[SS:
* rephrased the commit message for style and clarity
* adjusted the parameter description to be clearer
* adjusted the schema definition to accept a string instead of an
array to be more consistent with other parameters here
* removed changes that only reformatted unrelated code
]

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
src/PVE/API2/OpenId.pm | 4 ++++
src/PVE/Auth/OpenId.pm | 9 +++++++++
2 files changed, 13 insertions(+)

diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm
index cccd615..429cb3a 100644
--- a/src/PVE/API2/OpenId.pm
+++ b/src/PVE/API2/OpenId.pm
@@ -46,6 +46,10 @@ my $lookup_openid_auth = sub {
$openid_config->{acr_values} = [PVE::Tools::split_list($acr)];
}

+ if (defined(my $audiences = $config->{'audiences'})) {
+ $openid_config->{audiences} = [PVE::Tools::split_list($audiences)];
+ }
+
my $openid = PVE::RS::OpenId->discover($openid_config, $redirect_url);
return ($config, $openid);
};
diff --git a/src/PVE/Auth/OpenId.pm b/src/PVE/Auth/OpenId.pm
index 2209040..86c91bd 100755
--- a/src/PVE/Auth/OpenId.pm
+++ b/src/PVE/Auth/OpenId.pm
@@ -92,6 +92,14 @@ sub properties {
default => 1,
optional => 1,
},
+ 'audiences' => {
+ description =>
+ "A list of audiences that the OpenID Issuer may include that are accepted in "
+ . "addition to 'client-id'.",
+ type => 'string',
+ pattern => '^[^\x00-\x1F\x7F <>#"]*$', # Prohibit characters not allowed in URI RFC 2396.
+ optional => 1,
+ },
};
}

@@ -108,6 +116,7 @@ sub options {
prompt => { optional => 1 },
scopes => { optional => 1 },
"acr-values" => { optional => 1 },
+ audiences => { optional => 1 },
default => { optional => 1 },
comment => { optional => 1 },
"query-userinfo" => { optional => 1 },
--
2.47.3