diff --git a/.env.example b/.env.example index 23777fe26..d0435c746 100644 --- a/.env.example +++ b/.env.example @@ -442,6 +442,8 @@ OPENID_REQUIRED_ROLE_PARAMETER_PATH= OPENID_USERNAME_CLAIM= # Set to determine which user info property returned from OpenID Provider to store as the User's name OPENID_NAME_CLAIM= +# Optional audience parameter for OpenID authorization requests +OPENID_AUDIENCE= OPENID_BUTTON_LABEL= OPENID_IMAGE_URL= diff --git a/api/strategies/openidStrategy.js b/api/strategies/openidStrategy.js index 605f0b054..f2151f3df 100644 --- a/api/strategies/openidStrategy.js +++ b/api/strategies/openidStrategy.js @@ -104,6 +104,14 @@ class CustomOpenIDStrategy extends OpenIDStrategy { if (options?.state && !params.has('state')) { params.set('state', options.state); } + + if (process.env.OPENID_AUDIENCE) { + params.set('audience', process.env.OPENID_AUDIENCE); + logger.debug( + `[openidStrategy] Adding audience to authorization request: ${process.env.OPENID_AUDIENCE}`, + ); + } + return params; } }