K8s: use contexthandler in standalone handler chain (#90102)

pkg/setting/setting_jwt.go

@@ -2,6 +2,10 @@ package setting
 
 import "time"
 
+const (
+	extJWTAccessTokenExpectAudience = "grafana"
+)
+
 type AuthJWTSettings struct {
 	// JWT Auth
 	Enabled                 bool
@@ -29,6 +33,7 @@ type ExtJWTSettings struct {
 	Enabled      bool
 	ExpectIssuer string
 	JWKSUrl      string
+	Audiences    []string
 }
 
 func (cfg *Cfg) readAuthExtJWTSettings() {
@@ -36,6 +41,9 @@ func (cfg *Cfg) readAuthExtJWTSettings() {
 	jwtSettings := ExtJWTSettings{}
 	jwtSettings.Enabled = authExtendedJWT.Key("enabled").MustBool(false)
 	jwtSettings.JWKSUrl = authExtendedJWT.Key("jwks_url").MustString("")
+	// for Grafana, this is hard coded, but we leave it as a configurable param for other use-cases
+	jwtSettings.Audiences = []string{extJWTAccessTokenExpectAudience}
+
 	cfg.ExtJWTAuth = jwtSettings
 }