Documentation: Add Descope as User Identity Provider

[antonsmolyanyy]

Summary

Adds a new identity provider guide for Descope at
content/docs/integrations/user-identity/descope.mdx.

The page covers:

• Create a Descope OIDC Application — walking through the Descope
  console (Federated Apps → Generic OIDC Application), noting where to
  find the Issuer URL (IdP Configuration) and the Client ID /
  Client Secret (SP Configuration, Confidential client). Includes
  three supporting screenshots under img/descope/.
• Configure Pomerium — Core config using idp_provider: oidc with
  the Descope issuer as idp_provider_url, shown in both config.yaml
  and environment-variable tabs.
• Role-Based Access Control and Custom Claims — how to authorize on
  Descope roles/permissions by requesting the descope.claims scope,
  with example claim/roles and claim/permissions policies, plus
  descope.custom_claims for custom claims (e.g. claim/department).
  No existing pages or shared components are changed; this is additive
  (one new .mdx file and three images).

AI disclosure

none, only the PR summary was written by AI ^

Checklist

• [y ] reference any related issues
• [ y] disclosed AI usage (or wrote "none") per AI_POLICY.md

[netlify]

👷 Deploy request for pomerium-docs pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	6d2d55e

[CLAassistant]

All committers have signed the CLA.

[greptile-apps]

Greptile Summary

This PR adds a new identity provider guide for Descope at content/docs/integrations/user-identity/descope.mdx, covering OIDC application setup, Pomerium configuration, and role/permission-based access control using Descope claims. It also adds "descope" to the spell-check dictionary in cspell.json.

• New Descope IdP guide: Walks through creating a Generic OIDC Application in the Descope console, capturing the Issuer URL, Client ID, and Client Secret, and configuring Pomerium's idp_provider: oidc with idp_provider_url pointing to the Descope issuer.
• Approved Domains step: Covers Descope's domain-based redirect URI validation (instead of per-URI allowlisting) with a caution note about empty-list behavior.
• RBAC and custom claims: Explains how to use descope.claims and descope.custom_claims scopes with claim/roles, claim/permissions, and custom claim policies.

Confidence Score: 5/5

• This is a purely additive documentation change — one new MDX guide and three images — with no modifications to existing pages or shared components.
• The new guide is well-structured, follows existing IdP guide conventions, and uses correct Pomerium OIDC config keys. The only finding is an editorial inconsistency in how the RBAC section describes scope setup relative to the Configure Pomerium section above it — no runtime behavior is affected.
• No files require special attention.

Important Files Changed

Filename	Overview
content/docs/integrations/user-identity/descope.mdx	New Descope IdP guide following existing patterns; one editorial inconsistency in scope guidance between sections
cspell.json	Adds "descope" to the custom dictionary — correct and necessary

Sequence Diagram

sequenceDiagram
    participant User
    participant Pomerium
    participant Descope

    User->>Pomerium: Access protected route
    Pomerium->>User: Redirect to Descope OIDC authorization endpoint
    User->>Descope: Authenticate (via configured Flow)
    Descope->>User: Authorization code + redirect to authenticate_service_url/oauth2/callback
    User->>Pomerium: Authorization code callback
    Pomerium->>Descope: Token exchange (client_id + client_secret)
    Descope->>Pomerium: ID token (with roles/permissions if descope.claims scope requested)
    Pomerium->>Pomerium: Evaluate policy (claim/roles, claim/permissions, claim/department)
    Pomerium->>User: Allow or deny access

Loading

_{Reviews (5): Last reviewed commit: "Merge pull request #1 from ssveta7ak/doc..." | Re-trigger Greptile}

[antonsmolyanyy]

Hello @kenjenkins, kindly following up on this PR, would really appreciate a review from you. Thank you!

[wasaga]

@antonsmolyanyy if your identity provider supports directory (users+group) sync, please feel free to contribute the driver in github.com/pomerium/datasource

[antonsmolyanyy]

@ssveta7ak are we able to merge this PR now?