[CLI-3479] Union of Pools Identity Provider

[Cynthia Qin (cqin-confluent)]

Release Notes

Breaking Changes

• PLACEHOLDER

New Features

• Add optional --identity-claim flag to confluent iam provider

Bug Fixes

• PLACEHOLDER

Checklist

• I have successfully built and used a custom CLI binary, without linter issues from this PR.
• I have clearly specified in the What section below whether this PR applies to Confluent Cloud, Confluent Platform, or both.
• I have verified this PR in Confluent Cloud pre-prod or production environment, if applicable.
• I have verified this PR in Confluent Platform on-premises environment, if applicable.
• I have attached manual CLI verification results or screenshots in the Test & Review section below.
• I have added appropriate CLI integration or unit tests for any new or updated commands and functionality.
• I confirm that this PR introduces no breaking changes or backward compatibility issues.
• I have indicated the potential customer impact if something goes wrong in the Blast Radius section below.
• I have put checkmarks below confirming that the feature associated with this PR is enabled in:
  • Confluent Cloud prod
  • Confluent Cloud stag
  • Confluent Platform
  • Check this box if the feature is enabled for certain organizations only

What

Add optional --identity-claim flag to IAM provider creation/update command that enables user to specify a JSON Web Token (JWT) claim for providers. This is for Confluent Cloud resource.

Blast Radius

None. This is an additive change, so no existing commands should be affected.

References

Feature Request 1-Pager

Product Design 1-Pager

Test & Review

Test and Verification Doc

[confluent-cla-assistant]

🎉 All Contributor License Agreements have been signed. Ready to merge.
_{Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.}

[Copilot]

Pull Request Overview

This pull request adds support for an "identity-claim" flag to the identity provider CLI commands for updating, creating, and listing identity providers.

• Introduces the "identity-claim" flag in update, create, and list commands.
• Updates the output structure to display the identity claim.
• Adjusts required flags for the update command.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
internal/iam/command_provider_update.go	Adds the "identity-claim" flag and updates flag requirements.
internal/iam/command_provider_list.go	Displays the identity claim in the list output.
internal/iam/command_provider_create.go	Adds the "identity-claim" flag and includes it in the creation payload.
internal/iam/command_provider.go	Extends the identity provider output struct with IdentityClaim.

Comments suppressed due to low confidence (1)

internal/iam/command_provider_create.go:66

• [nitpick] In the create command, the identity claim is always set on the payload even when an empty string is provided. Consider conditionally setting IdentityClaim (similar to the update command) to avoid unintentionally overwriting a default value when no identity claim is intended.

IdentityClaim: identityproviderv2.PtrString(identityClaim),

[Daniel Ayaz (danielayaz)]

Was the existing case where the --identity-claim flag isn't apart of the CLI command tested?