1

I try to protect an Axum application by using OpenID and Zitadel. I followed quite closely this quickstart and this authentication flow using PKCE. Everything works fine up until this line:

let claims = id_token.claims(&client.id_token_verifier(), &nonce)?;

It causes the following error:

InvalidAudience("213170295903617281 is not a trusted audience")'

The client allows me to disable the check by calling required_audience_match(false) which "solves" the problem. So obviously something with the audience seems to be wrong. I checked the source code and dumped the available data just before this line and got:

Audiences:
  Audience("213170295903617281")
  Audience("213170529090208001@mydemo")
Client ID: "213170529090208001@mydemo"

The client id is correct and the one I passed to my client. There is obviously a second one returned by Zitadel. I don't know where it comes from.

Reading the Rust code of the openidconnect crate I came to the impression that it will always fail if there are multiple audiences, which looks odd to me, but I might be missing something.

Looks to me like Zitadel and the openidconnect crate do not fully agree on how OpenID is supposed to work or I'm missing something I have to setup to make it work properly.

Can somebody explain the reason for the second audience and how it is supposed to be handled?

Achim
  • 15,415
  • 15
  • 80
  • 144

1 Answers1

1

I was having this exact problem. I noticed that the other audience was an exact match for the Zitadel resource ID of my project. Instead of using the default verifier or disabling the verifier, I called set_other_audience_verifier_fn, and passed it a function that checks if the audience is one of those two IDs. This solved my audience problem, though I now get an error about the signature verification ("NoMatchingKey"), so we'll see if I can successfully verify the token.

Ben Weinstein-Raun
  • 26
  • 2