oicd_audience removal

backend/app/auth.py

@@ -11,8 +11,11 @@ from pydantic import BaseModel, BaseSettings, Field, HttpUrl
 security = HTTPBearer(auto_error=False)
 
 class Settings(BaseSettings):
+    # OIDC issuer (discovery URL root)
     oidc_issuer: HttpUrl = Field(..., env="OIDC_ISSUER")
-    oidc_audience: str = Field(..., env="OIDC_AUDIENCE")
+    # Optional audience: if set the backend will validate the token 'aud' claim.
+    # If omitted, audience validation is skipped (use with caution).
+    oidc_audience: Optional[str] = Field(None, env="OIDC_AUDIENCE")
     oidc_client_id: str = Field(..., env="OIDC_CLIENT_ID")
     oidc_client_secret: Optional[str] = Field(None, env="OIDC_CLIENT_SECRET")
     oidc_verify_iss: bool = Field(True, env="OIDC_VERIFY_ISS")
@@ -79,13 +82,18 @@ async def validate_token(credentials: HTTPAuthorizationCredentials = Security(se
     key = get_signing_key(token)
     public_key = jwk.construct(key)
     try:
-        verified = jwt.decode(
-            token,
-            public_key,
-            algorithms=[key.get("alg", "RS256")],
-            audience=settings.oidc_audience,
-            issuer=str(settings.oidc_issuer) if settings.oidc_verify_iss else None,
-        )
+        # Only pass `audience` to the decoder if configured. Some providers
+        # (or local development setups) may not include the aud claim in a
+        # way that matches your API identifier; in that case leave
+        # `OIDC_AUDIENCE` unset and the audience check will be skipped.
+        jwt_kwargs = {
+            "algorithms": [key.get("alg", "RS256")],
+            "issuer": str(settings.oidc_issuer) if settings.oidc_verify_iss else None,
+        }
+        if settings.oidc_audience:
+            jwt_kwargs["audience"] = settings.oidc_audience
+
+        verified = jwt.decode(token, public_key, **jwt_kwargs)
     except JWTError as exc:
         raise HTTPException(status_code=401, detail="Invalid or expired token") from exc