refactor: allow additional authorized parties in the tokenlogin endpoint

[Copilot]

The tokenlogin endpoint only validated ID tokens issued for the configured scicat OIDC client. Public IdP clients (e.g. a Keycloak public client) could not be used because their azp claim wouldn't match.

Changes

• src/config/configuration.ts: Added additionalAuthorizedParties to the oidc config block, parsed from a new OIDC_ADDITIONAL_AUTHORIZED_PARTIES env var (comma-separated list of client IDs).
• src/common/openid-client/openid-client.service.ts: Passes additionalAuthorizedParties as the third argument to new issuer.Client() when configured, enabling validation of tokens where azp is a public client but aud includes the scicat client.

Example

OIDC_ADDITIONAL_AUTHORIZED_PARTIES=my-public-client

Tokens of the following shape will now be accepted:

{
  "aud": "scicat-client-id",
  "azp": "my-public-client"
}

Multiple clients are supported via comma-separation: client1,client2.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• scarf.sh
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node ./report.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Allow additional client(s) in tokenlogin endpoint</issue_title>
<issue_description>For the new tokenlogin endpoint to work with public clients, we need to either change the client_id or allow additional clients. I am in favour of the latter because it seems simpler and doesn't step too far outside of the established mechanism.

All that is required is to add an additional authorised party like so: (in src/common/openid-client/openid-client.service.ts)

      this.client = new issuer.Client({
          client_id: this.oidcConfig.clientID,
          client_secret: this.oidcConfig.clientSecret,
        },
        undefined,
        {
          additionalAuthorizedParties: [publicClientId]
        });

where publicClientId is the ID of the public IdP client.

With this change, scicat will allow ID tokens from that public client as long as the audience (aud) includes the scicat client:

{
    aud: [this.oidcConfig.clientID, ...],
    azp: publicClientId,
    ...
}

Keycloak (and probably other OAuth providers) can be configured to create tokens like this.

I tested this with my little setup and it works. But I did not propose a complete solution here because I don't know how to add extra config options.

Originally posted by @jl-wynen in #2531 (comment)
</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Allow additional client(s) in tokenlogin endpoint #2582

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[nitrosx]

Non blocking comment.

[nitrosx]

I wonder if it would make more sense to have this json blob in a separate file?

[minottic]

maybe I am misunderstanding something, but to me the BE will fail whenever started without a valid OIDC issuer, see here

[Junjiequan]

@minottic Could you elaborate a bit? is the test or the change in this PR is causing the issue. If I remember correctly it's either not to provide issuer or provide only correct issuer

[minottic]

yes, sorry. I meant that all tests not run with the compose file that you added in this PR will fail if I am not wrong, as npm run start:test run alone would create the oidc service which would try to ping localhost:8080. Could we maybe move the test.js to jest-e2e where we could mock the call to the issuer? Or do in the same way we do with elastic