dtsek commented on issue #11018: URL: https://github.com/apache/apisix/issues/11018#issuecomment-2006268040
After some deeper digging, it seems that indeed the audience claim is not validated against the client_id. I added a small enhancement in the PR above. I tried the code in our instance and it is working correctly. We currently add it as a custom plugin with the documentation provided in https://apisix.apache.org/docs/ingress-controller/next/tutorials/using-custom-plugins/ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
