From: Thomas Lamprecht <t.lamprecht@proxmox.com>
Date: Thu, 18 Nov 2021 16:01:04 +0000 (+0100)
Subject: openid: support configuring ACR values
X-Git-Url: https://git.proxmox.com/?p=pve-access-control.git;a=commitdiff_plain;h=bc9d11591ed7af8d37ceaba2fc648ec8c6d12c9c

openid: support configuring ACR values

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
---

diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm
index 02fa2b5..03a7a04 100644
--- a/src/PVE/API2/OpenId.pm
+++ b/src/PVE/API2/OpenId.pm
@@ -41,6 +41,10 @@ my $lookup_openid_auth = sub {
     my $scopes = $config->{'scopes'} // 'email profile';
     $openid_config->{scopes} = [ PVE::Tools::split_list($scopes) ];
 
+    if (defined(my $acr = $config->{'acr-values'})) {
+	$openid_config->{acr_values} = [ PVE::Tools::split_list($acr) ];
+    }
+
     my $openid = PVE::RS::OpenId->discover($openid_config, $redirect_url);
     return ($config, $openid);
 };
diff --git a/src/PVE/Auth/OpenId.pm b/src/PVE/Auth/OpenId.pm
index 0fbcde4..56904e6 100755
--- a/src/PVE/Auth/OpenId.pm
+++ b/src/PVE/Auth/OpenId.pm
@@ -56,6 +56,12 @@ sub properties {
 	    default => "email profile",
 	    optional => 1,
 	},
+	'acr-values' => {
+	    description => "Specifies the Authentication Context Class Reference values that the"
+		."Authorization Server is being requested to use for the Auth Request.",
+	    type => 'string', # format => 'some-safe-id-list', # FIXME: TODO
+	    optional => 1,
+	},
    };
 }
 
@@ -68,6 +74,7 @@ sub options {
 	"username-claim" => { optional => 1, fixed => 1 },
 	prompt => { optional => 1 },
 	scopes => { optional => 1 },
+	"acr-values" => { optional => 1 },
 	default => { optional => 1 },
 	comment => { optional => 1 },
     };