setup the CA roots in the roundtripper if present

hashicorp · Aug 5, 2024 · 0dcddb9 · 0dcddb9
1 parent 8505aa6
commit 0dcddb9
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/path_config.go b/path_config.go
@@ -366,7 +366,7 @@ func (b *jwtAuthBackend) createProvider(config *jwtConfig) (*oidc.Provider, erro
 		supportedSigAlgs = []oidc.Alg{oidc.RS256}
 	}
 
-	opts := []oidc.Option{oidc.WithProviderCA(config.OIDCDiscoveryCAPEM)}
+	var opts []oidc.Option
 	if len(config.UnsupportedCriticalCertExtensions) > 0 {
 		var oids []asn1.ObjectIdentifier
 		for _, v := range config.UnsupportedCriticalCertExtensions {
@@ -397,6 +397,8 @@ func (b *jwtAuthBackend) createProvider(config *jwtConfig) (*oidc.Provider, erro
 
 		}
 		opts = append(opts, oidc.WithRoundTripper(ietripper))
+	} else if config.OIDCDiscoveryCAPEM != "" {
+		opts = append(opts, oidc.WithProviderCA(config.OIDCDiscoveryCAPEM))
 	}
 	c, err := oidc.NewConfig(config.OIDCDiscoveryURL, config.OIDCClientID,
 		oidc.ClientSecret(config.OIDCClientSecret), supportedSigAlgs, []string{},