From ba19bca21cb096919ca0dd261f569898ba30fcd5 Mon Sep 17 00:00:00 2001 From: Przemyslaw Roguski Date: Fri, 17 Jul 2026 14:34:11 +0200 Subject: [PATCH] mbp-1043: gate client_id injection on Entra ID provider The AzureClientIdRequestFilter in qtodo unconditionally injects client_id into OIDC token exchange requests. This breaks Keycloak's federated-jwt authenticator because it requires client_id to match the JWT sub claim (the SPIFFE ID), not the OIDC client ID. Set QTODO_OIDC_INJECT_CLIENT_ID=true only when the OIDC provider is entraid, keeping the filter inactive for Keycloak deployments. Depends-on: validatedpatterns-demos/qtodo (AzureClientIdRequestFilter must read qtodo.oidc.inject-client-id, defaulting to false) Co-authored-by: Cursor --- charts/qtodo/templates/app-config-env.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/charts/qtodo/templates/app-config-env.yaml b/charts/qtodo/templates/app-config-env.yaml index 6e3e6b86..7f285ad3 100644 --- a/charts/qtodo/templates/app-config-env.yaml +++ b/charts/qtodo/templates/app-config-env.yaml @@ -17,6 +17,7 @@ data: QUARKUS_OIDC_CREDENTIALS_JWT_TOKEN_PATH: "{{ .Values.app.oidc.clientAssertion.jwtTokenPath }}" {{- if eq .Values.app.oidc.provider "entraid" }} QUARKUS_OIDC_CREDENTIALS_JWT_AUDIENCE: "{{ include "qtodo.jwt.audience" . }}" + QTODO_OIDC_INJECT_CLIENT_ID: "true" {{- end }} {{- end }} {{- end }}