Use custom domain for JWT token issuer and audience instead of hardcoded value

Author: tjementum

cloud-infrastructure/cluster/main-cluster.bicep

@@ -104,6 +104,7 @@ module keyVault '../modules/key-vault.bicep' = {
     subnetId: virtualNetwork.outputs.containerAppsSubnetId
     storageAccountId: diagnosticStorageAccount.outputs.storageAccountId
     workspaceId: existingLogAnalyticsWorkspace.id
+    domainName: domainName
   }
 }
 

cloud-infrastructure/modules/key-vault.bicep

@@ -5,6 +5,7 @@ param tenantId string
 param subnetId string
 param storageAccountId string
 param workspaceId string
+param domainName string = ''
 
 resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' = {
   name: name
@@ -119,19 +120,21 @@ resource authenticationTokenSigningKey 'Microsoft.KeyVault/vaults/keys@2023-07-0
   }
 }
 
+var tokenIssuerAndAudience = domainName != '' ? 'https://${domainName}' : 'PlatformPlatform'
+
 resource authenticationTokenIssuer 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {
   parent: keyVault
   name: 'authentication-token-issuer'
   properties: {
-    value: 'PlatformPlatform' // Consider using the domain name (https://app.your-company.net) or company name (Your Company) as the issuer
+    value: tokenIssuerAndAudience
   }
 }
 
 resource authenticationTokenAudience 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {
   parent: keyVault
   name: 'authentication-token-audience'
   properties: {
-    value: 'PlatformPlatform' // Consider using the domain name (https://product.your-company.net) or product name (product-name) as the audience
+    value: tokenIssuerAndAudience
   }
 }