From bc9d11591ed7af8d37ceaba2fc648ec8c6d12c9c Mon Sep 17 00:00:00 2001 From: Thomas Lamprecht Date: Thu, 18 Nov 2021 17:01:04 +0100 Subject: [PATCH] openid: support configuring ACR values Signed-off-by: Thomas Lamprecht --- src/PVE/API2/OpenId.pm | 4 ++++ src/PVE/Auth/OpenId.pm | 7 +++++++ 2 files changed, 11 insertions(+) diff --git a/src/PVE/API2/OpenId.pm b/src/PVE/API2/OpenId.pm index 02fa2b5..03a7a04 100644 --- a/src/PVE/API2/OpenId.pm +++ b/src/PVE/API2/OpenId.pm @@ -41,6 +41,10 @@ my $lookup_openid_auth = sub { my $scopes = $config->{'scopes'} // 'email profile'; $openid_config->{scopes} = [ PVE::Tools::split_list($scopes) ]; + if (defined(my $acr = $config->{'acr-values'})) { + $openid_config->{acr_values} = [ PVE::Tools::split_list($acr) ]; + } + my $openid = PVE::RS::OpenId->discover($openid_config, $redirect_url); return ($config, $openid); }; diff --git a/src/PVE/Auth/OpenId.pm b/src/PVE/Auth/OpenId.pm index 0fbcde4..56904e6 100755 --- a/src/PVE/Auth/OpenId.pm +++ b/src/PVE/Auth/OpenId.pm @@ -56,6 +56,12 @@ sub properties { default => "email profile", optional => 1, }, + 'acr-values' => { + description => "Specifies the Authentication Context Class Reference values that the" + ."Authorization Server is being requested to use for the Auth Request.", + type => 'string', # format => 'some-safe-id-list', # FIXME: TODO + optional => 1, + }, }; } @@ -68,6 +74,7 @@ sub options { "username-claim" => { optional => 1, fixed => 1 }, prompt => { optional => 1 }, scopes => { optional => 1 }, + "acr-values" => { optional => 1 }, default => { optional => 1 }, comment => { optional => 1 }, }; -- 2.39.2