[PATCH proxmox v4 1/3] fix #5076: openid: add logic to handle OIDC audiences

[Shannon Sterz <s.sterz@proxmox.com>]

allows specifying multiple additionally allowed audiences. an open id
provider may include multiple audiences in its ID token. this allows
specifying all valid audiences, rejecting the token only if an invalid
audience is also included.

Originally-by: Alexander Abraham <a.abraham@proxmox.com>
[SS:
 * reformatted the code for clarity and to avoid unnecessary variables
   and parentheses
 * rephrased the commit message for style and clarity
]

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 proxmox-openid/src/lib.rs | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/proxmox-openid/src/lib.rs b/proxmox-openid/src/lib.rs
index 0388a8fa..a8cfd66f 100644
--- a/proxmox-openid/src/lib.rs
+++ b/proxmox-openid/src/lib.rs
@@ -95,6 +95,8 @@ pub struct OpenIdConfig {
     pub prompt: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub acr_values: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub audiences: Option<Vec<String>>,
 }
 
 pub struct OpenIdAuthenticator {
@@ -258,12 +260,27 @@ impl OpenIdAuthenticator {
             .request(&http_client)
             .map_err(|err| format_err!("Failed to contact token endpoint: {}", err))?;
 
-        let id_token_verifier: CoreIdTokenVerifier = self.client.id_token_verifier();
+        let verifier = &self
+            .client
+            .id_token_verifier()
+            .require_audience_match(true)
+            .set_other_audience_verifier_fn(|aud| {
+                if self.config.client_id == **aud {
+                    return true;
+                }
+
+                if let Some(allowed_audiences) = self.config.audiences.as_ref() {
+                    return allowed_audiences.contains(aud);
+                }
+
+                false
+            });
+
         let id_token_claims: &GenericIdTokenClaims = token_response
             .extra_fields()
             .id_token()
             .expect("Server did not return an ID token")
-            .claims(&id_token_verifier, &private_auth_state.nonce)
+            .claims(verifier, &private_auth_state.nonce)
             .map_err(|err| format_err!("Failed to verify ID token: {}", err))?;
 
         if !query_userinfo {
-- 
2.47.3