[PATCH pmg-api v5] fix #5076: auth: openid: add support for an optional "audiences" field

[Shannon Sterz <s.sterz@proxmox.com>]

adds an optional "audiences" field to the open id configuration
schema. "audiences" is a list of additionally accepted audiences that
an open id provider may include.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/PMG/API2/OIDC.pm | 4 ++++
 src/PMG/Auth/OIDC.pm | 9 +++++++++
 2 files changed, 13 insertions(+)

diff --git a/src/PMG/API2/OIDC.pm b/src/PMG/API2/OIDC.pm
index 7ea8f8c..8cbfc98 100644
--- a/src/PMG/API2/OIDC.pm
+++ b/src/PMG/API2/OIDC.pm
@@ -46,6 +46,10 @@ my $lookup_oidc_auth = sub {
         $oidc_config->{acr_values} = [PVE::Tools::split_list($acr)];
     }
 
+    if (defined(my $audiences = $config->{'audiences'})) {
+	$openid_config->{audiences} = [PVE::Tools::split_list($audiences)];
+    }
+
     my $oidc = Proxmox::RS::OIDC->discover($oidc_config, $redirect_url);
     return ($config, $oidc);
 };
diff --git a/src/PMG/Auth/OIDC.pm b/src/PMG/Auth/OIDC.pm
index be57afb..993466e 100755
--- a/src/PMG/Auth/OIDC.pm
+++ b/src/PMG/Auth/OIDC.pm
@@ -129,6 +129,14 @@ sub properties {
             pattern => qr/^[a-zA-Z0-9._:-]+$/,
             optional => 1,
         },
+        'audiences' => {
+            description =>
+                "A list of audiences that the OpenID Issuer may include that are accepted in "
+                . "addition to 'client-id'.",
+            type => 'string', # format => 'some-safe-id-list', # FIXME: TODO
+            pattern => qr/^[a-zA-Z0-9._:-]+$/,
+            optional => 1,
+        },
     };
 }
 
@@ -144,6 +152,7 @@ sub options {
         prompt => { optional => 1 },
         scopes => { optional => 1 },
         'acr-values' => { optional => 1 },
+        audiences => { optional => 1 },
         default => { optional => 1 },
         comment => { optional => 1 },
     };
-- 
2.47.3