docs: document the OAuth2 additional audiences setting - #67
Merged
Conversation
Add `additional_audiences` to the OAuth2/OIDC config values and describe when it is needed: providers such as Zitadel issue ID tokens whose `aud` claim lists more than the client ID, which Kellnr rejects by default. Cover the two points a reader trips over: the configured client ID must still appear in `aud`, and the environment variable takes a comma-separated list.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents the
oauth2.additional_audiencessetting added in kellnr/kellnr#1357 (chart support in kellnr/helm#93).Config values
A
ConfigCardin the OAuth2/OIDC table, between Client Secret and Scopes to match the order of the settings struct: TOML key,KELLNR_OAUTH2__ADDITIONAL_AUDIENCES, default[].Multiple Audiences
A prose block in the OAuth2 setup section, after Identity Provider Setup and before User Provisioning. Providers such as Zitadel issue ID tokens whose
audclaim lists several audiences rather than the client ID alone, which Kellnr rejects by default because every audience named in a token can present that token to Kellnr.It covers the two points a reader trips over:
client_idmust still appear inaud; the allowlist only covers the additional entriesNothing needed elsewhere
The CLI flag table lists only a handful of notable flags and already states that every config value has a matching
--section-keyargument. The Helm section links to the chart repository rather than documenting individual values.Verification
npm run type-check,npm run lintandnpm run buildall pass.npm run test:unitexits 1 with "No test files found", which is pre-existing: the repository has no test files.Unrelated observation
Running the build regenerates
public/rss.xmlwith a large diff, because the committed copy is stale and missing the 6.8.0 changelog entry. I reverted it to keep this change focused, butpublic/rss.xmlonmainis out of sync withsrc/data/changelog.jsonand deserves a separate look.