From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id B428F1FF146 for ; Tue, 09 Jun 2026 14:22:21 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 22AECF6DB; Tue, 9 Jun 2026 14:22:20 +0200 (CEST) From: Shannon Sterz To: pmg-devel@lists.proxmox.com Subject: [PATCH many v6 0/3] fix #5076: add support for open id audiences Date: Tue, 9 Jun 2026 14:22:11 +0200 Message-ID: <20260609122214.271422-1-s.sterz@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1781007690918 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.109 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 4D2GKRUPGBR3LPHR7KHU6VAJ6OASOFK6 X-Message-ID-Hash: 4D2GKRUPGBR3LPHR7KHU6VAJ6OASOFK6 X-MailFrom: s.sterz@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Mail Gateway development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: this series adapts the original patch series by Alexander Abraham [1]. below is the text of the original cover letter: > fix #5076: Added Open ID audiences > > This series adds support for handling Open ID audiences as described in bug > #5076. PVE's API schema was updated to accept an optional field, an array of > strings and the Rust code was also updated to accordingly handle any incoming > audiences and compare them to the realm config's audiences. In the realm > dialogue for adding an Open ID realm, a new field titled "Audiences" was added > so that users can save any audiences in their realm domains config file. essentially, some open id providers such as zitadel [2] may provide additional audiences that their id tokens are valid for instead of just the client id. these patches allow setting such additional audiences. if an audience that is not explicitly allowed is encountered, the id token is rejected as before. Changelog --------- changes since v5: * fix up an issue affecting the pmg patches regarding a false variable name (thanks @ Stoiko Ivanov) * drop patches that have already been applied changes since v4: * add patches to support audiences in proxmox-backup and proxmox-datacenter-manager as well * instead of the api type and configs taking an array, it will now take a string that is a list of audiences. this is more consistent with other parameters here. * rebased on current master. changes since v3: * rebased on current master * see the list of changes made by Shannon Sterz specified in each commit message [1]: https://lore.proxmox.com/pve-devel/20250603091256.40923-1-a.abraham@proxmox.com/ [2]: https://zitadel.com/ widget-toolkit: Shannon Sterz (1): fix #5076: ui: dc: add an optional "audiences" field for open id realms src/window/AuthEditOpenId.js | 9 +++++++++ 1 file changed, 9 insertions(+) pmg-api: Shannon Sterz (1): fix #5076: auth: openid: add support for an optional "audiences" field src/PMG/API2/OIDC.pm | 4 ++++ src/PMG/Auth/OIDC.pm | 9 +++++++++ 2 files changed, 13 insertions(+) pmg-api: Shannon Sterz (1): fix #5076: auth edit open id: add an optional audiences field js/AuthEditOIDC.js | 9 +++++++++ 1 file changed, 9 insertions(+) Summary over all repositories: 4 files changed, 31 insertions(+), 0 deletions(-) -- Generated by murpp 0.10.0