k-space/dex
Archived
11
0
Fork 0
Code Issues Pull Requests Packages Projects Activity

Add groupsClaimMapping to the OIDC connector

Browse Source 
The groupsClaimMapping setting allows one to specify which claim to pull
group information from the OIDC provider.  Previously it assumed group
information was always in the "groups" claim, but that isn't the case
for many OIDC providers (such as AWS Cognito using the "cognito:groups"
claim instead)

Signed-off-by: Scott Lemmon <slemmon@aurora.tech>
Signed-off-by: Rui Yang <ruiya@vmware.com>
This commit is contained in:
Scott Lemmon
2020-08-07 15:06:14 -07:00
committed by Rui Yang
parent 61312e726e
commit a783667c57
2 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Documentation/connectors/oidc.md
View File

@@ -73,6 +73,10 @@ connectors:
# This can be overridden with the below option
# insecureEnableGroups: true
# If an OIDC provider uses a different claim name than the standard "groups" claim to provide group information
# the claim to use can be specified
# groupsClaimMapping: "cognito:groups"
# When enabled, the OpenID Connector will query the UserInfo endpoint for additional claims. UserInfo claims
# take priority over claims returned by the IDToken. This option should be used when the IDToken doesn't contain
# all the claims requested.