You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/external-auth-fields.adoc
+45-1Lines changed: 45 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,7 +17,36 @@ The following table lists all available OIDC provider parameters for direct auth
17
17
|Description
18
18
19
19
|`claimMappings`
20
-
|Configures the rules to be used by the Kubernetes API server for translating claims in a JWT token, issued by the identity provider, to a cluster identity.
20
+
|Configures the rules to be used by the Kubernetes API server for translating claims in a JSON web token (JWT), issued by the identity provider, to a cluster identity.
21
+
22
+
|`claimMappings.extra`
23
+
|An optional field for configuring the mappings used to construct the extra attribute for the cluster identity. When omitted, no extra attributes will be present on the cluster identity. Key values for extra mappings must be unique. A maximum of 32 extra attribute mappings may be provided.
24
+
25
+
|`claimMappings.extra.key`
26
+
a|A required field that specifies the string to use as the extra attribute key. The following restrictions apply:
27
+
28
+
* Key must be a domain-prefix path (e.g `example.org/foo`).
29
+
* Key must not exceed 510 characters in length.
30
+
* Key must contain the `/` character, separating the domain and path characters.
31
+
* Key must not be empty.
32
+
* The domain portion of the key (string of characters before the `/`) must be a valid RFC1123 subdomain.
33
+
* It must not exceed 253 characters in length.
34
+
* It must start and end with an alphanumeric character.
35
+
* It must only contain lower case alphanumeric characters and `-` or `.`.
36
+
* It must not use the reserved domains, or be subdomains of, `kubernetes.io`, `k8s.io`, and `openshift.io`.
37
+
* The path portion of the key (string of characters after the `/`) must not be empty and must consist of at least one alphanumeric character, percent-encoded octets, `-`, `.`, `_`, `~`, `!`, `$`, `&`, `'`, `(`, `)`, `*`, `+`, `,`, `;`, `=`, and `:`.
38
+
* Domain portion of the key must not exceed 256 characters in length.
39
+
40
+
|`claimMappings.extra.valueExpression`
41
+
a|A required field to specify the CEL expression to extract the extra attribute value from claims of a JWT token. The `valueExpression` field must produce a string or string array value. The following restrictions apply:
42
+
43
+
* CEL expressions that return "", [], and null are treated as the extra mapping not being present.
44
+
* Empty string values within an array are filtered out. For example, [`one`, ``, `three`] becomes [`one`, `three`].
45
+
* CEL expressions have access to the token claims through a CEL variable, `claims`.
46
+
* `claims` is a map of claim names to claim values. For example, the `sub` claim value can be accessed as `claims.sub`.
47
+
* Nested claims can be accessed using dot notation (`claims.foo.bar`).
48
+
* The `valueExpression` value must not exceed 1024 characters in length.
49
+
* The `valueExpression` value must not be empty.
21
50
22
51
|`claimMappings.groups`
23
52
|Configures how the groups of a cluster identity should be constructed from the claims in a JWT token issued by the identity provider. When referencing a claim, if the claim is present in the JWT token, its value must be a comma-separated list of groups.
@@ -28,6 +57,21 @@ The following table lists all available OIDC provider parameters for direct auth
28
57
|`claimMappings.groups.prefix`
29
58
|Configures the prefix that is applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes.
30
59
60
+
|`claimMappings.uid`
61
+
| An optional field for configuring the claim mapping used to construct the UID for the cluster identity. When omitted, this means the user has no opinion and the platform is left to choose a default, which is subject to change over time. The current default is to use the `sub` claim.
62
+
63
+
|`claimMappings.uid.claim`
64
+
|An optional field for specifying the JWT token claim that is used in the mapping. The value of this claim will be assigned to the field in which this mapping is associated. To specify the claim, use a single string value for `uid.claim`.
65
+
66
+
You must set either `claim` or `expression`. Do not specify `claim` when `expression` is set. The value of `claim` must be at least 1 character and must not exceed 256 characters in length.
67
+
68
+
|`claimMappings.uid.expression`
69
+
|An optional field for specifying a CEL expression that produces a string value from JWT token claims. When using `uid.expression` the expression must result in a single string value.
70
+
71
+
CEL expressions have access to the token claims through a CEL variable, `claims`. The `claims` variable is a map of claim names to claim values. For example, you can access the `sub` claim value as `claims.sub`. Nested claims can be accessed using dot notation for example, `claims.foo.bar`.
72
+
73
+
You must set either `claim` or `expression`. Do not specify `expression` when `claim` is set. The value of `expression` must be at least 1 character and must not exceed 1024 characters in length.
74
+
31
75
|`claimMappings.username`
32
76
|Configures how the username of a cluster identity should be constructed from the claims in a JWT token issued by the identity provider.
0 commit comments