FR: Add trusted_audiences OIDC config for providers with multi-audience tokens (Zitadel) #2226

New issue

Open

opened 2026-09-11 13:01:18 +00:00 by ebbez · 0 comments

ebbez commented

2026-09-11 13:01:18 +00:00

What new feature do you want to see? What problem does it solve?

Problem

Continuwuity's OIDC implementation rejects ID tokens that contain additional values in the aud claim beyond the configured client_id. This breaks compatibility with OIDC providers that include extra audience entries by design.

Error:

continuwuity_server  |   2026-09-02T08:51:31.269964Z ERROR conduwuit_service::oidc: Failed to verify id token claims: Invalid audiences: `<project id> or <another (application, present in the same project as c10y)'s id>` is not a trusted audience
continuwuity_server  |     at src/service/oidc/mod.rs:295 on conduwuit:worker ThreadId(6)
continuwuity_server  |     in tower_sessions::service::call

Affected provider: Zitadel - an open-source OIDC provider popular in self-hosted environments, with a special structure requiring applications to always be placed in a Project (a set of applications sharing roles/ACL/B2B invited organisations). Zitadel always includes the project ID alongside the client ID in the aud claim for all project-scoped applications. This is by design and cannot currently be disabled.

The same issue affects other tools that use the openidconnect-rs crate with default audience validation, including Proxmox VE.

Suggested Fix

The openidconnect-rs crate's IdTokenVerifier supports set_other_audience_verifier_fn to accept additional audience values. This can be used to add a config option to Continuwuity's OIDC (delegated auth) configuration, to add other trusted audiences to the id_token_verifier().

Additional context

https://matrix.to/#/!c10y-N9TQGHzj6Ne3OKqn-MEO8EhfRWrD3-CD-W9AEM/$q_QqRhMZE61pembyEgUHA5v-ckbP-_8QTKrA9xG0hL8?via=continuwuity.org&via=matrix.org&via=continuwuity.rocks and all my messages after that could be relevant and may contain more specifics

### What new feature do you want to see? What problem does it solve? ## Problem Continuwuity's OIDC implementation rejects ID tokens that contain additional values in the `aud` claim beyond the configured `client_id`. This breaks compatibility with OIDC providers that include extra audience entries by design. **Error:** ``` continuwuity_server | 2026-09-02T08:51:31.269964Z ERROR conduwuit_service::oidc: Failed to verify id token claims: Invalid audiences: `<project id> or <another (application, present in the same project as c10y)'s id>` is not a trusted audience continuwuity_server | at src/service/oidc/mod.rs:295 on conduwuit:worker ThreadId(6) continuwuity_server | in tower_sessions::service::call ``` **Affected provider:** [Zitadel](https://zitadel.com/) - an open-source OIDC provider popular in self-hosted environments, with a special structure requiring applications to always be placed in a _Project_ (a set of applications sharing roles/ACL/B2B invited organisations). Zitadel always includes the project ID alongside the client ID in the `aud` claim for all project-scoped applications. This is by design and [cannot currently be disabled](https://github.com/zitadel/zitadel/issues/9200). The same issue affects other tools that use the `openidconnect-rs` crate with default audience validation, including [Proxmox VE](https://forum.proxmox.com/threads/workaround-for-zitadel.176804/). ## Suggested Fix The `openidconnect-rs` crate's [`IdTokenVerifier`](https://docs.rs/openidconnect/latest/openidconnect/struct.IdTokenVerifier.html) supports [`set_other_audience_verifier_fn`](https://docs.rs/openidconnect/latest/openidconnect/struct.IdTokenVerifier.html#method.set_other_audience_verifier_fn) to accept additional audience values. This can be used to add a config option to Continuwuity's OIDC (delegated auth) configuration, to add other trusted audiences to the id_token_verifier(). ### Further reading - Source of most of this issue's text: https://github.com/rustdesk/rustdesk-server-pro/issues/937 - [Vaultwarden](https://github.com/dani-garcia/vaultwarden) solved this same issue by adding an `SSO_AUDIENCE_TRUSTED` environment variable ([dani-garcia/vaultwarden#6650](https://github.com/dani-garcia/vaultwarden/issues/6650)). ### Additional context - https://matrix.to/#/!c10y-N9TQGHzj6Ne3OKqn-MEO8EhfRWrD3-CD-W9AEM/$q_QqRhMZE61pembyEgUHA5v-ckbP-_8QTKrA9xG0hL8?via=continuwuity.org&via=matrix.org&via=continuwuity.rocks and all my messages after that could be relevant and may contain more specifics

ebbez added the

Enhancement

Status

Needs Investigation

labels

2026-09-11 13:01:18 +00:00