OpenIDConnect Invalid Audiences

[VEB]

I have configured OpenID Connect with proxmox to use Zitadel as the IDP.
Unfortunately proxmox's openidconnect implementation doesn't seem to support / expose the option to have multiple audiences in the access token response. See below:

pve pvedaemon[432956]: openid authentication failure; rhost=::ffff:192.168.189.227 msg=Failed to verify ID token: Invalid audiences: 207276223515066803 is not a trusted audience

This is because Zitadel adds the project id as an audience for each application / client.

I see where the exception is being logged here:

https://github.com/proxmox/proxmox-...c11f2a8b96611624c7075eb20a435/src/lib.rs#L219

which is from the openidconnect rust crate's source here (which explains that they explicitly throw errors for multiple audiences if not "trusted"):

https://github.com/ramosbugs/openid...33f0702950bbacca318c/src/verification.rs#L296

And as far as I can tell through a repo search, the calling code / script is here in proxmox:

https://github.com/proxmox/pve-acce...30fc99be90905f103/src/PVE/API2/OpenId.pm#L173

I am assuming this is likely something that proxmox needs to workaround or add extra "trusted" audiences to the claims.

Is this something that is likely to be addressed, or any known workarounds?

 

[julianderungs]

hey @VEB did you manage to solve the issue? got the same challenge with Zitadel and Proxmox OIDC. the request returns an array of audiences and therefore checking the Zitadel projectId instead of the appId ends up in a failure:

Failed to verify ID token: Invalid audiences: `PROJECT_ID` is not a trusted audience

 

[raphaeldias85]

I am facing the same issue. Not sure how to fix it.

 

[Hanlin Yang]

Encountered the same issue with IdP Kinde.

After some searching, I found there has already been a bug filed but without much progress as of now.

 

[raphaeldias85]

I am using authentik. It is working fine with a few tests. I guess I will stick with it.

 

[ilbarone87]

hey @VEB did you manage to solve the issue? got the same challenge with Zitadel and Proxmox OIDC. the request returns an array of audiences and therefore checking the Zitadel projectId instead of the appId ends up in a failure:

Failed to verify ID token: Invalid audiences: `PROJECT_ID` is not a trusted audience

Hello have you managed to implement this? I also would like to put zitadel in front of proxmox