�[38;5;243m 1�[0m �[38;5;249mfix(security): skip JWT audience check when audience is empty�[0m

�[38;5;243m   2�[0m
�[38;5;243m   3�[0m   �[38;5;249mKeycloak often issues aud=account unless a mapper is configured; empty�[0m
�[38;5;243m   4�[0m   �[38;5;249mJWTConfig.audience must not enable verify_aud.�[0m
�[38;5;243m   5�[0m

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: piotrlaczkowski

src/agentomatic/security/jwt_auth.py

@@ -214,6 +214,12 @@ async def dispatch(self, request: Request, call_next: Any) -> Response:
                 decode_kwargs["issuer"] = self._config.issuer
             if self._config.audience:
                 decode_kwargs["audience"] = self._config.audience
+            else:
+                # Empty audience → do not enforce ``aud`` (Keycloak often
+                # issues ``aud=account`` unless a mapper is configured).
+                opts = dict(decode_kwargs.get("options") or {})
+                opts["verify_aud"] = False
+                decode_kwargs["options"] = opts
 
             claims: dict[str, Any] = _jwt_lib.decode(token, **decode_kwargs)  # type: ignore[union-attr]
         except ExpiredSignatureError: