Update docs

docs/_static/env-vars/frontend_configvars.md

@@ -1,5 +1,5 @@
 
-2026-09-16-00-09-50
+2026-09-17-00-07-57
 
 ## Deprecation Notice
 

docs/_static/env-vars/proxy.yaml

@@ -172,6 +172,7 @@ policies:
     skip_x_access_token: false
 additional_policies: []
 oidc:
+  audiences: []
   issuer: https://localhost:9200
   insecure: false
   access_token_verify_method: jwt

docs/_static/env-vars/proxy_configvars.md

@@ -23,6 +23,7 @@
 |`OC_REVA_GATEWAY`| 1.0.0 |string|`The CS3 gateway endpoint.`|`"eu.opencloud.api.gateway"`|
 |`OC_GRPC_CLIENT_TLS_MODE`| 1.0.0 |string|`TLS mode for grpc connection to the go-micro based grpc services. Possible values are 'off', 'insecure' and 'on'. 'off': disables transport security for the clients. 'insecure' allows using transport security, but disables certificate verification (to be used with the autogenerated self-signed certificates). 'on' enables transport security, including server certificate verification.`|`""`|
 |`OC_GRPC_CLIENT_TLS_CACERT`| 1.0.0 |string|`Path/File name for the root CA certificate (in PEM format) used to validate TLS server certificates of the go-micro based grpc services.`|`""`|
+|`PROXY_OIDC_AUDIENCES`| next |[]string|`Optional comma-separated list of allowed audiences for OIDC access tokens. Empty disables audience validation for compatibility. Configuring audiences is recommended for production and requires PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=jwt. Tokens must contain at least one exactly matching, case-sensitive audience in their aud claim.`|`"[]"`|
 |`OC_URL`<br/>`OC_OIDC_ISSUER`<br/>`PROXY_OIDC_ISSUER`| 1.0.0 |string|`URL of the OIDC issuer. It defaults to URL of the builtin IDP.`|`"https://localhost:9200"`|
 |`OC_INSECURE`<br/>`PROXY_OIDC_INSECURE`| 1.0.0 |bool|`Disable TLS certificate validation for connections to the IDP. Note that this is not recommended for production environments.`|`"false"`|
 |`PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD`| 1.0.0 |string|`Sets how OIDC access tokens should be verified. Possible values are 'none' and 'jwt'. When using 'none', no special validation apart from using it for accessing the IDP's userinfo endpoint will be done. When using 'jwt', it tries to parse the access token as a jwt token and verifies the signature using the keys published on the IDP's 'jwks_uri'.`|`"jwt"`|

docs/_static/env-vars/proxy_readme.md

@@ -11,6 +11,7 @@ The proxy service is the only service communicating to the outside and needs the
 ## Table of Contents
 
 * [Authentication](#authentication)
+  * [OIDC Access Token Audiences](#oidc-access-token-audiences)
 * [Configuring Routes](#configuring-routes)
 * [Automatic User and Group Provisioning](#automatic-user-and-group-provisioning)
   * [Prequisites](#prequisites)
@@ -40,6 +41,72 @@ The following request authentication schemes are implemented:
 -   Signed URL
 -   Public Share Token
 
+### OIDC Access Token Audiences
+
+For production deployments, **enable audience validation** so that OpenCloud only
+accepts access tokens intended for it. This is especially relevant when the same
+identity provider serves several applications: without this check, an otherwise
+valid token issued for another application can also be accepted by OpenCloud.
+
+Set the allowed audiences as a comma-separated environment variable:
+
+```console
+PROXY_OIDC_AUDIENCES=opencloud,opencloud-api
+PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=jwt
+```
+
+Alternatively, configure the list in `proxy.yaml`:
+
+```yaml
+oidc:
+  audiences:
+    - opencloud
+    - opencloud-api
+  access_token_verify_method: jwt
+```
+
+These audience values are examples. Configure your identity provider to include
+the intended OpenCloud resource audience in the **access tokens** issued to all
+relevant clients, including web, desktop and mobile clients. Adding an audience
+only to an ID token or a Userinfo response does not satisfy this check.
+
+The built-in IDP sets the access token's `aud` to the client ID of the
+authenticated client. It does not support configuring a separate resource
+audience. When using this IDP, list the client IDs of all OpenCloud clients you
+use in `PROXY_OIDC_AUDIENCES`, including web, desktop and mobile clients. Setting
+this proxy option does not change the tokens issued by the IDP.
+
+For other IDPs, please refer to their documentation for proper support for the `aud` claim. For Keycloak see e.g.: [Keycloak's audience support documentation](https://www.keycloak.org/docs/latest/server_admin/#audience-support)
+
+An access token must contain at least one exactly matching, case-sensitive value
+in its `aud` claim. Both strings, such as `"aud": "opencloud"`, and arrays, such as
+`"aud": ["another-api", "opencloud"]`, are supported. Tokens with missing, empty,
+malformed or exclusively nonmatching audiences receive HTTP 401 on protected
+routes. Configured audiences require JWT verification; combining a nonempty list
+with `access_token_verify_method: none` prevents startup. List entries must not be
+empty or consist only of whitespace.
+
+The default list is empty, which disables audience validation to preserve
+compatibility with existing identity provider configurations. An explicitly empty
+`PROXY_OIDC_AUDIENCES` overrides any YAML list and disables the check; `audiences: []`
+does the same in YAML. When OIDC is active, JWT verification is enabled and the
+audience check is disabled, the proxy logs one startup warning, subject to the
+configured log level. No audience warning is logged when
+`access_token_verify_method` is `none`.
+
+Restart the proxy after changing the configuration and apply the same policy to
+all proxy instances. The signed access token, including its audience when
+configured, is verified on a Userinfo cache miss. Cache hits reuse the cached
+claims without verifying the token again or requesting Userinfo. Existing entries
+in a shared or persistent cache can remain valid under the previous audience
+configuration until they expire. Clear the Userinfo cache after updating all
+proxy instances if the new policy must take effect immediately.
+
+The disabled default is a compatibility decision. It does not relax the
+[audience validation requirement in RFC 9068, Section 4](https://www.rfc-editor.org/rfc/rfc9068.html#name-validating-jwt-access-token):
+a resource server following that JWT access token profile must reject tokens
+whose audience does not identify the resource server.
+
 ## Configuring Routes
 
 The proxy handles routing to all endpoints that OpenCloud offers. The currently availabe default routes can be found [in the code](https://github.com/opencloud-eu/opencloud/blob/main/services/proxy/pkg/config/defaults/defaultconfig.go). Changing or adding routes can be necessary when writing own OpenCloud extensions.
@@ -258,6 +325,9 @@ The default `role_claim` (or `PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM`) is `roles`. The
 
 In a production deployment, you want to have basic authentication (`PROXY_ENABLE_BASIC_AUTH`) disabled which is the default state. You also want to setup a firewall to only allow requests to the proxy service or the reverse proxy if you have one. Requests to the other services should be blocked by the firewall.
 
+Configure `PROXY_OIDC_AUDIENCES` as described in [OIDC Access Token Audiences](#oidc-access-token-audiences).
+Enabling this check is strongly recommended for production deployments.
+
 ### Content Security Policy
 
 For OpenCloud, external resources like an IDP (e.g. Keycloak) or when using web office documents or web apps, require defining a CSP. If not defined, the referenced services will not work.

docs/_static/env-vars/storage-users_configvars.md

@@ -1,5 +1,5 @@
 
-2026-09-16-00-09-50
+2026-09-17-00-07-57
 
 ## Deprecation Notice
 

docs/_static/env-vars/web_configvars.md

@@ -1,5 +1,5 @@
 
-2026-09-16-00-09-50
+2026-09-17-00-07-57
 
 ## Deprecation Notice