[PATCH proxmox-backup v5 7/8] fix #5076: api: support audiences property for open id realms

[Shannon Sterz <s.sterz@proxmox.com>]

to allow for better compatability with open id providers, support the
audiences field for open id realms. users can specify which audiences
are trusted in addition to the client-id.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/api2/access/openid.rs        | 8 ++++++++
 src/api2/config/access/openid.rs | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/src/api2/access/openid.rs b/src/api2/access/openid.rs
index cb94b0e18..818bcb555 100644
--- a/src/api2/access/openid.rs
+++ b/src/api2/access/openid.rs
@@ -50,6 +50,13 @@ fn openid_authenticator(
         );
     }
 
+    let audiences = realm_config.audiences.as_ref().map(|list| {
+        list.split(|c: char| c == ',' || c == ';' || char::is_ascii_whitespace(&c))
+            .filter(|s| !s.is_empty())
+            .map(String::from)
+            .collect()
+    });
+
     let config = OpenIdConfig {
         issuer_url: realm_config.issuer_url.clone(),
         client_id: realm_config.client_id.clone(),
@@ -57,6 +64,7 @@ fn openid_authenticator(
         prompt: realm_config.prompt.clone(),
         scopes: Some(scopes),
         acr_values,
+        audiences,
     };
     OpenIdAuthenticator::discover(&config, redirect_url)
 }
diff --git a/src/api2/config/access/openid.rs b/src/api2/config/access/openid.rs
index ab05bfb68..b71e4dae6 100644
--- a/src/api2/config/access/openid.rs
+++ b/src/api2/config/access/openid.rs
@@ -159,6 +159,8 @@ pub enum DeletableProperty {
     Prompt,
     /// Delete the acr_values property
     AcrValues,
+    /// Delete the audiences property
+    Audiences,
 }
 
 #[api(
@@ -231,6 +233,9 @@ pub fn update_openid_realm(
                 DeletableProperty::AcrValues => {
                     config.acr_values = None;
                 }
+                DeletableProperty::Audiences => {
+                    config.audiences = None;
+                }
             }
         }
     }
@@ -273,6 +278,9 @@ pub fn update_openid_realm(
     if update.acr_values.is_some() {
         config.acr_values = update.acr_values;
     }
+    if update.audiences.is_some() {
+        config.audiences = update.audiences;
+    }
 
     domains.set_data(&realm, "openid", &config)?;
 
-- 
2.47.3