Livio Spring 999e2bbc81 fix(jwt idp): manage and validate audience ...

# Which Problems Are Solved

While JWT IdPs typically require specific setups to exchange the JWT, any valid token issued would be accepted and there was no audience check. This could lead to potential misuse where a correctly signed token for another client / audience, would be accepted valid by the IdP.

# How the Problems Are Solved

- Added the possibility to manage the required audience (single string) on a JWT IdP. If set, the `aud` claim, must contain the configured string. If no audience is set on the provider, the claim is not validated (as is).

# Additional Changes

None

# Additional Context

None

(cherry picked from commit d184e976fc)

2026-06-15 16:06:55 +02:00

..

zitadel

fix(jwt idp): manage and validate audience

2026-06-15 16:06:55 +02:00

AGENTS.md

chore(agents): add agents files (#11497)

2026-02-27 10:11:22 +01:00

buf.lock

chore(console): buf stub build (#5215)

2023-02-17 14:09:11 +00:00

buf.yaml

fix: query organization directly from event store (#10463)

2025-08-12 11:47:00 +02:00