fix(okta): accept client_id as valid audience for ID token verification

Author: an0nym21

keep/identitymanager/identity_managers/okta/okta_authverifier.py

@@ -98,12 +98,17 @@ def _verify_bearer_token(self, token: str = Depends(oauth2_scheme)) -> Authentic
             # Get the signing key directly from the JWT
             signing_key = self.jwks_client.get_signing_key_from_jwt(token).key
 
+            # Build accepted audiences: always include client_id (ID token aud)
+            # and optionally the configured OKTA_AUDIENCE (access token aud).
+            audiences = [self.okta_client_id] if self.okta_client_id else []
+            if self.okta_audience and self.okta_audience != self.okta_client_id:
+                audiences.append(self.okta_audience)
             # Decode and verify the token
             payload = jwt.decode(
                 token,
                 key=signing_key,
                 algorithms=["RS256"],
-                audience=self.okta_audience or self.okta_client_id,
+                audience=audiences or None,
                 issuer=self.okta_issuer,
                 options={"verify_exp": True}
             )