[PATCH access-control v5 3/8] fix #5076: auth: open id: add an optional "audiences" field

[Shannon Sterz <s.sterz@proxmox.com>]

adds an optional "audiences" field to the open id configuration
schema. "audiences" is a list of additionally accepted audiences that
an open id provider may include.

Originally-by: Alexander Abraham <a.abraham@proxmox.com>
[SS:
 * rephrased the commit message for style and clarity
 * adjusted the parameter description to be clearer
 * adjusted the schema definition to accept a string instead of an
   array to be more consistent with other parameters here
 * removed changes that only reformatted unrelated code
]

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/PVE/API2/OpenId.pm | 4 ++++
 src/PVE/Auth/OpenId.pm | 9 +++++++++
 2 files changed, 13 insertions(+)

diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm
index cccd615..429cb3a 100644
--- a/src/PVE/API2/OpenId.pm
+++ b/src/PVE/API2/OpenId.pm
@@ -46,6 +46,10 @@ my $lookup_openid_auth = sub {
         $openid_config->{acr_values} = [PVE::Tools::split_list($acr)];
     }
 
+    if (defined(my $audiences = $config->{'audiences'})) {
+        $openid_config->{audiences} = [PVE::Tools::split_list($audiences)];
+    }
+
     my $openid = PVE::RS::OpenId->discover($openid_config, $redirect_url);
     return ($config, $openid);
 };
diff --git a/src/PVE/Auth/OpenId.pm b/src/PVE/Auth/OpenId.pm
index 2209040..86c91bd 100755
--- a/src/PVE/Auth/OpenId.pm
+++ b/src/PVE/Auth/OpenId.pm
@@ -92,6 +92,14 @@ sub properties {
             default => 1,
             optional => 1,
         },
+        'audiences' => {
+            description =>
+                "A list of audiences that the OpenID Issuer may include that are accepted in "
+                . "addition to 'client-id'.",
+            type => 'string',
+            pattern => '^[^\x00-\x1F\x7F <>#"]*$', # Prohibit characters not allowed in URI RFC 2396.
+            optional => 1,
+        },
     };
 }
 
@@ -108,6 +116,7 @@ sub options {
         prompt => { optional => 1 },
         scopes => { optional => 1 },
         "acr-values" => { optional => 1 },
+        audiences => { optional => 1 },
         default => { optional => 1 },
         comment => { optional => 1 },
         "query-userinfo" => { optional => 1 },
-- 
2.47.3