From 9fc366529267f8338f9ead2a0741688a86e91332 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9CNaeel=E2=80=9D?= <tazet@narod.ru>
Date: Tue, 9 Jun 2026 22:17:23 +0400
Subject: [PATCH] =?UTF-8?q?bump=200.5.32=20=E2=80=94=20remove=20audience?=
 =?UTF-8?q?=20check=20from=20JWT=20verify?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 package.json | 2 +-
 src/auth.js  | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index 8dbb1fe..fed6a1f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ipwhitelist",
-  "version": "0.5.31",
+  "version": "0.5.32",
   "description": "IP WhiteList microservice for cloud provider",
   "main": "server.js",
   "scripts": {
diff --git a/src/auth.js b/src/auth.js
index f8fc4f3..c276f41 100644
--- a/src/auth.js
+++ b/src/auth.js
@@ -241,9 +241,8 @@ function verifyOidcToken(token) {
 
   const pem = crypto.createPublicKey({ key, format: 'jwk' }).export({ type: 'spki', format: 'pem' });
   // Проверяем issuer — защита от токенов других realm.
-  // audience проверяем только если задан KC_CLIENT_ID (для OIDC-режима).
+  // audience не проверяем — не все KC-клиенты корректно выставляют aud claim.
   const opts = { algorithms: ['RS256'], issuer: KC_BASE_URL };
-  if (KC_CLIENT_ID) opts.audience = KC_CLIENT_ID;
   return jwt.verify(token, pem, opts);
 }