Support internal KeyCape OIDC endpoints

src/user_engine/oidc.py

@@ -35,12 +35,14 @@ class OIDCClient:
         client_id: str,
         redirect_uri: str,
         audience: str,
+        backend_url: str | None = None,
         session_ttl: int = 3600,
     ) -> None:
         self.issuer = issuer.rstrip("/")
         self.client_id = client_id
         self.redirect_uri = redirect_uri
         self.audience = audience
+        self.backend_url = (backend_url or issuer).rstrip("/")
         self.session_ttl = session_ttl
         self.pending: dict[str, PendingLogin] = {}
         self.sessions: dict[str, BrowserSession] = {}
@@ -75,7 +77,7 @@ class OIDCClient:
             }
         ).encode()
         request = Request(
-            f"{self.issuer}/token",
+            f"{self.backend_url}/token",
             data=form,
             headers={"Content-Type": "application/x-www-form-urlencoded"},
             method="POST",
@@ -107,7 +109,7 @@ class OIDCClient:
             import jwt
         except ImportError as exc:  # pragma: no cover
             raise RuntimeError("install user-engine[oidc] for OIDC login") from exc
-        jwks = jwt.PyJWKClient(f"{self.issuer}/jwks")
+        jwks = jwt.PyJWKClient(f"{self.backend_url}/jwks")
         key = jwks.get_signing_key_from_jwt(token)
         claims = jwt.decode(
             token,

src/user_engine/runtime.py

@@ -49,6 +49,7 @@ def create_application() -> PortalApplication:
             client_id=_required("USER_ENGINE_OIDC_CLIENT_ID"),
             redirect_uri=_required("USER_ENGINE_OIDC_REDIRECT_URI"),
             audience=_required("USER_ENGINE_OIDC_AUDIENCE"),
+            backend_url=os.environ.get("USER_ENGINE_OIDC_BACKEND_URL"),
         ),
     )