wonderwall-forward-auth: add zitadel project id as aud

Co-authored-by: Trong Huu Nguyen <trong.huu.nguyen@nav.no>

charts/wonderwall-forward-auth/Feature.yaml

@@ -7,6 +7,10 @@ values:
     computed:
       template: |
         {{ .Env.wonderwall_forward_auth_zitadel_client_id | quote }}
+  openid.extraAudience:
+    computed:
+      template: |
+        {{ .Env.wonderwall_forward_auth_zitadel_project_id | quote }}
   openid.clientSecret:
     required: true
     computed:

charts/wonderwall-forward-auth/templates/secret.yaml

@@ -17,6 +17,7 @@ stringData:
   WONDERWALL_OPENID_PROVIDER: "openid"
   WONDERWALL_OPENID_CLIENT_ID: "{{ .Values.openid.clientID | required ".Values.openid.clientID is required." }}"
   WONDERWALL_OPENID_CLIENT_SECRET: "{{ .Values.openid.clientSecret | required ".Values.openid.clientSecret is required." }}"
+  WONDERWALL_OPENID_AUDIENCES: "{{ .Values.openid.extraAudience }}"
   WONDERWALL_OPENID_WELL_KNOWN_URL: "{{ .Values.openid.wellKnownURL | required ".Values.openid.wellKnownURL is required." }}"
   WONDERWALL_ENCRYPTION_KEY: "{{ .Values.session.cookieEncryptionKey | required ".Values.session.cookieEncryptionKey is required." }}"
   WONDERWALL_REDIS_URI: "redis://{{ .Values.valkey.fullnameOverride }}-primary:6379"

charts/wonderwall-forward-auth/values.yaml

@@ -22,6 +22,7 @@ ingressClassName: nais-ingress-fa
 openid:
   clientID:
   clientSecret:
+  extraAudience:
   wellKnownURL: https://auth.nais.io/.well-known/openid-configuration
 session:
   maxLifetime: 10h