add

internal/config/config.go

@@ -15,6 +15,7 @@ import (
 	"math"
 	"net"
 	"net/netip"
+	"net/url"
 	"os"
 	"path/filepath"
 	"sort"
@@ -477,8 +478,13 @@ type API struct {
 }
 
 type Auth struct {
-	// Mode is "none", "apikey" or "basic".
+	// Mode is "none", "apikey", "basic" or "oidc".
 	Mode string `yaml:"mode"`
+	// OIDC settings validate access tokens issued by an external provider.
+	OIDCIssuer     string   `yaml:"oidc_issuer"`
+	OIDCAudience   string   `yaml:"oidc_audience"`
+	OIDCClientID   string   `yaml:"oidc_client_id"`
+	OIDCWriteRoles []string `yaml:"oidc_write_roles"`
 	// APIKeys grant full access.
 	APIKeys []string `yaml:"api_keys"`
 	// ReadOnlyAPIKeys may only call GET endpoints.
@@ -1152,9 +1158,9 @@ func (c *Config) Validate() error {
 		}
 	}
 	switch c.API.Auth.Mode {
-	case "none", "apikey", "basic":
+	case "none", "apikey", "basic", "oidc":
 	default:
-		add("api.auth.mode must be none, apikey or basic (got %q)", c.API.Auth.Mode)
+		add("api.auth.mode must be none, apikey, basic or oidc (got %q)", c.API.Auth.Mode)
 	}
 	if c.API.Auth.Mode == "apikey" && len(c.API.Auth.APIKeys) == 0 && !c.API.Auth.TrustLoopback {
 		add("api.auth.mode is apikey but api.auth.api_keys is empty and trust_loopback is false: the API would be unauthenticated")
@@ -1162,6 +1168,17 @@ func (c *Config) Validate() error {
 	if c.API.Auth.Mode == "basic" && c.API.Auth.Username == "" {
 		add("api.auth.mode is basic but api.auth.username is empty")
 	}
+	if c.API.Auth.Mode == "oidc" {
+		if c.API.Auth.OIDCIssuer == "" || c.API.Auth.OIDCAudience == "" || c.API.Auth.OIDCClientID == "" {
+			add("api.auth.mode is oidc and requires oidc_issuer, oidc_audience and oidc_client_id")
+		}
+		if c.API.Auth.OIDCIssuer != "" {
+			u, err := url.Parse(c.API.Auth.OIDCIssuer)
+			if err != nil || u.Scheme != "https" || u.Host == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" {
+				add("api.auth.oidc_issuer must be an HTTPS issuer URL")
+			}
+		}
+	}
 	if c.API.Auth.SessionTTL <= 0 {
 		add("api.auth.session_ttl must be > 0")
 	}
@@ -1290,6 +1307,8 @@ func (c *Config) HasAPIAuth() bool {
 		return len(c.API.Auth.APIKeys) > 0 || len(c.API.Auth.ReadOnlyAPIKeys) > 0 || !c.API.Auth.TrustLoopback
 	case "basic":
 		return true
+	case "oidc":
+		return true
 	}
 	return false
 }