[PATCH many v5 0/8] fix #5076: add support for open id audiences

[Shannon Sterz <s.sterz@proxmox.com>]

this series adapts the original patch series by Alexander Abraham [1]. below is
the text of the original cover letter:

> fix #5076: Added Open ID audiences
>
> This series adds support for handling Open ID audiences as described in bug
> #5076. PVE's API schema was updated to accept an optional field, an array of
> strings and the Rust code was also updated to accordingly handle any incoming
> audiences and compare them to the realm config's audiences. In the realm
> dialogue for adding an Open ID realm, a new field titled "Audiences" was added
> so that users can save any audiences in their realm domains config file.

essentially, some open id providers such as zitadel [2] may provide additional
audiences that their id tokens are valid for instead of just the client id.
these patches allow setting such additional audiences. if an audience that is
not explicitly allowed is encountered, the id token is rejected as before.

Changelog
---------

changes since v4:

* add patches to support audiences in proxmox-backup and
  proxmox-datacenter-manager as well
* instead of the api type and configs taking an array, it will now take a string
  that is a list of audiences. this is more consistent with other parameters 
  here.
* rebased on current master.

changes since v3:

* rebased on current master
* see the list of changes made by Shannon Sterz specified in each commit message

[1]: https://lore.proxmox.com/pve-devel/20250603091256.40923-1-a.abraham@proxmox.com/
[2]: https://zitadel.com/


proxmox:

Shannon Sterz (2):
  fix #5076: openid: add logic to handle OIDC audiences
  fix #5076: pbs-api-types: add audiences to open id realm config

 pbs-api-types/src/openid.rs | 26 ++++++++++++++++++++++++++
 proxmox-openid/src/lib.rs   | 21 +++++++++++++++++++--
 2 files changed, 45 insertions(+), 2 deletions(-)


access-control:

Shannon Sterz (1):
  fix #5076: auth: open id: add an optional "audiences" field

 src/PVE/API2/OpenId.pm | 4 ++++
 src/PVE/Auth/OpenId.pm | 9 +++++++++
 2 files changed, 13 insertions(+)


manager:

Shannon Sterz (1):
  fix #5076: ui: dc: add an optional "audiences" field for open id
    realms

 www/manager6/dc/AuthEditOpenId.js | 9 +++++++++
 1 file changed, 9 insertions(+)


yew-comp:

Shannon Sterz (1):
  fix #5076: auth edit openid: add advanced  "audiences" field

 src/auth_edit_openid.rs | 2 ++
 1 file changed, 2 insertions(+)


datacenter-manager:

Shannon Sterz (1):
  fix #5076: api-types/api: support audiences property for open id
    realms

 lib/pdm-api-types/src/openid.rs        | 30 +++++++++++++++++++++++++-
 server/src/api/access/openid.rs        |  8 +++++++
 server/src/api/config/access/openid.rs |  8 +++++++
 3 files changed, 45 insertions(+), 1 deletion(-)


backup:

Shannon Sterz (1):
  fix #5076: api: support audiences property for open id realms

 src/api2/access/openid.rs        | 8 ++++++++
 src/api2/config/access/openid.rs | 8 ++++++++
 2 files changed, 16 insertions(+)


widget-toolkit:

Shannon Sterz (1):
  fix #5076: ui: dc: add an optional "audiences" field for open id
    realms

 src/window/AuthEditOpenId.js | 9 +++++++++
 1 file changed, 9 insertions(+)


Summary over all repositories:
  12 files changed, 139 insertions(+), 3 deletions(-)

-- 
Generated by murpp 0.10.0