Re: [PATCH many v5 0/8] fix #5076: add support for open id audiences

["Shannon Sterz" <s.sterz@proxmox.com>]

Superseded-by: https://lore.proxmox.com/pmg-devel/20260609122214.271422-3-s.sterz@proxmox.com/T/#u

On Thu Apr 23, 2026 at 3:35 PM CEST, Shannon Sterz wrote:
> this series adapts the original patch series by Alexander Abraham [1]. below is
> the text of the original cover letter:
>
>> fix #5076: Added Open ID audiences
>>
>> This series adds support for handling Open ID audiences as described in bug
>> #5076. PVE's API schema was updated to accept an optional field, an array of
>> strings and the Rust code was also updated to accordingly handle any incoming
>> audiences and compare them to the realm config's audiences. In the realm
>> dialogue for adding an Open ID realm, a new field titled "Audiences" was added
>> so that users can save any audiences in their realm domains config file.
>
> essentially, some open id providers such as zitadel [2] may provide additional
> audiences that their id tokens are valid for instead of just the client id.
> these patches allow setting such additional audiences. if an audience that is
> not explicitly allowed is encountered, the id token is rejected as before.
>
> Changelog
> ---------
>
> changes since v4:
>
> * add patches to support audiences in proxmox-backup and
>   proxmox-datacenter-manager as well
> * instead of the api type and configs taking an array, it will now take a string
>   that is a list of audiences. this is more consistent with other parameters
>   here.
> * rebased on current master.
>
> changes since v3:
>
> * rebased on current master
> * see the list of changes made by Shannon Sterz specified in each commit message
>
> [1]: https://lore.proxmox.com/pve-devel/20250603091256.40923-1-a.abraham@proxmox.com/
> [2]: https://zitadel.com/
>
>
> proxmox:
>
> Shannon Sterz (2):
>   fix #5076: openid: add logic to handle OIDC audiences
>   fix #5076: pbs-api-types: add audiences to open id realm config
>
>  pbs-api-types/src/openid.rs | 26 ++++++++++++++++++++++++++
>  proxmox-openid/src/lib.rs   | 21 +++++++++++++++++++--
>  2 files changed, 45 insertions(+), 2 deletions(-)
>
>
> access-control:
>
> Shannon Sterz (1):
>   fix #5076: auth: open id: add an optional "audiences" field
>
>  src/PVE/API2/OpenId.pm | 4 ++++
>  src/PVE/Auth/OpenId.pm | 9 +++++++++
>  2 files changed, 13 insertions(+)
>
>
> manager:
>
> Shannon Sterz (1):
>   fix #5076: ui: dc: add an optional "audiences" field for open id
>     realms
>
>  www/manager6/dc/AuthEditOpenId.js | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
>
> yew-comp:
>
> Shannon Sterz (1):
>   fix #5076: auth edit openid: add advanced  "audiences" field
>
>  src/auth_edit_openid.rs | 2 ++
>  1 file changed, 2 insertions(+)
>
>
> datacenter-manager:
>
> Shannon Sterz (1):
>   fix #5076: api-types/api: support audiences property for open id
>     realms
>
>  lib/pdm-api-types/src/openid.rs        | 30 +++++++++++++++++++++++++-
>  server/src/api/access/openid.rs        |  8 +++++++
>  server/src/api/config/access/openid.rs |  8 +++++++
>  3 files changed, 45 insertions(+), 1 deletion(-)
>
>
> backup:
>
> Shannon Sterz (1):
>   fix #5076: api: support audiences property for open id realms
>
>  src/api2/access/openid.rs        | 8 ++++++++
>  src/api2/config/access/openid.rs | 8 ++++++++
>  2 files changed, 16 insertions(+)
>
>
> widget-toolkit:
>
> Shannon Sterz (1):
>   fix #5076: ui: dc: add an optional "audiences" field for open id
>     realms
>
>  src/window/AuthEditOpenId.js | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
>
> Summary over all repositories:
>   12 files changed, 139 insertions(+), 3 deletions(-)