[PR #4147] [CLOSED] Allow for multiple "aud" values #6315

New Issue

OVERLORD · 2026-02-05T10:29:06+03:00

OVERLORD commented

2026-02-05 10:29:06 +03:00

📋 Pull Request Information

Original PR: https://github.com/BookStackApp/BookStack/pull/4147
Author: @the-voidl
Created: 3/31/2023
Status: ❌ Closed

Base: development ← Head: fix-multiple-audiences

📝 Commits (3)

0332cda allow for multiple "aud" values
67dce75 comply with openid RFC
60af9de fix codestyle and typos

📊 Changes

1 file changed (+5 additions, -12 deletions)

View changed files

📝 app/Auth/Access/Oidc/OidcIdToken.php (+5 -12)

📄 Description

Our oidc authentication endpoint (zitadel) returns multiple audience fields for the user and places the expected value in azp.

In OidcIdToken.php you were assuming that there can only be one audience, while RCF 7519 does not.

I added a check that allows to use azp once there are multiple aud values available in the token and the client id is found therein.

An example payload of our oicd server looks like this...:

{
  "iss": "https://oicd.example.com",
  "aud": [
    "823417009781275377@oicd",  
    "593371374829733854@oicd",
    "298754342231354326@oicd",       <--- this one is the $clientId
    "207625234567516721@oicd",
    "111111111111111111"
  ],
  "azp": "298754342231354326@oicd",   <---
  "at_hash": "h4ivntmqlr3v43_svT",
  "c_hash": "iv43lw34n4312A7af$_Vzc",

  "amr": [
    "password",
    "pwd",
    "mfa",
    "user"
  ],
  "exp": 1680264155,
  "iat": 1680260555,
  "auth_time": 1680247938,
  "email": "my.email@example.com",
  "email_verified": true,
  "family_name": "Name",
  "given_name": "GivenName",
  "name": "GivenName Name",
  "nickname": "GivenName Name",
  "preferred_username": "my.email@example.com",
  "sub": "111111111111111111",
  "updated_at": 1680255197,
  "urn:zitadel:iam:org:project:roles": {
    "admin": {
      "12345": "oicd.example.com"
    },
    "user": {
      "12345": "oicd.example.com"
    } 
  } 
}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/BookStackApp/BookStack/pull/4147 **Author:** [@the-voidl](https://github.com/the-voidl) **Created:** 3/31/2023 **Status:** ❌ Closed **Base:** `development` ← **Head:** `fix-multiple-audiences` --- ### 📝 Commits (3) - [`0332cda`](https://github.com/BookStackApp/BookStack/commit/0332cda9f8541ac1225deb2d39b120ec62a980e9) allow for multiple "aud" values - [`67dce75`](https://github.com/BookStackApp/BookStack/commit/67dce75fc93c02a2065d1beff74df3deb39974ca) comply with openid RFC - [`60af9de`](https://github.com/BookStackApp/BookStack/commit/60af9de9db9857ab856be4990aaf615895e3339a) fix codestyle and typos ### 📊 Changes **1 file changed** (+5 additions, -12 deletions) <details> <summary>View changed files</summary> 📝 `app/Auth/Access/Oidc/OidcIdToken.php` (+5 -12) </details> ### 📄 Description Our oidc authentication endpoint (zitadel) returns multiple audience fields for the user and places the expected value in `azp`. In `OidcIdToken.php` you were assuming that there can only be one audience, while [RCF 7519](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.3) does not. I added a check that allows to use `azp` once there are multiple `aud` values available in the token and the client id is found therein. <details> <summary>An example payload of our oicd server looks like this...:</summary> ``` { "iss": "https://oicd.example.com", "aud": [ "823417009781275377@oicd", "593371374829733854@oicd", "298754342231354326@oicd", <--- this one is the $clientId "207625234567516721@oicd", "111111111111111111" ], "azp": "298754342231354326@oicd", <--- "at_hash": "h4ivntmqlr3v43_svT", "c_hash": "iv43lw34n4312A7af$_Vzc", "amr": [ "password", "pwd", "mfa", "user" ], "exp": 1680264155, "iat": 1680260555, "auth_time": 1680247938, "email": "my.email@example.com", "email_verified": true, "family_name": "Name", "given_name": "GivenName", "name": "GivenName Name", "nickname": "GivenName Name", "preferred_username": "my.email@example.com", "sub": "111111111111111111", "updated_at": 1680255197, "urn:zitadel:iam:org:project:roles": { "admin": { "12345": "oicd.example.com" }, "user": { "12345": "oicd.example.com" } } } ``` </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2026-02-05 10:29:06 +03:00

OVERLORD closed this issue

2026-02-05 10:29:07 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#6315