Add OIDC custom claims configuration - #101
Merged
Merged
Conversation
Adds spec.config.auth.oidc.customClaims so an identity provider that already emits its own claim names or group naming scheme can be used without reshaping the IdP to Bindplane's defaults. Two groups of settings, both entirely optional: - Claim name overrides (groups, groupIds, roles, organizationAdmin, projects, defaultRole) rename the claims Bindplane reads on the ID token. - Group/role string overrides (orgAdminGroupName, projectsGroupPrefix, adminGroupName, userGroupName, viewerGroupName) change the strings Bindplane matches inside the groups and roles claims. Each field maps to a BINDPLANE_OIDC_CUSTOM_CLAIMS_* env var and is only emitted when set, so unset fields fall through to the server defaults. Requires Bindplane server v1.100.2 or later.
Goreleaser defaulted to prerelease: false and make_latest: true, so an rc or beta tag published as a normal release and displaced the stable release as "Latest". Set prerelease: auto so semver prerelease suffixes are detected, and gate make_latest on it.
jsirianni
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
spec.config.auth.oidc.customClaimsso Bindplane can read an IdP that already uses its own claim names or group naming scheme, instead of making the IdP match Bindplane defaults.Two sets of fields, all optional:
Claim names to read on the ID token:
groupsBINDPLANE_OIDC_CUSTOM_CLAIMS_GROUPSgroupsgroupIdsBINDPLANE_OIDC_CUSTOM_CLAIMS_GROUP_IDSgroup_idsrolesBINDPLANE_OIDC_CUSTOM_CLAIMS_ROLESrolesorganizationAdminBINDPLANE_OIDC_CUSTOM_CLAIMS_ORGANIZATION_ADMINbindplane_org_adminprojectsBINDPLANE_OIDC_CUSTOM_CLAIMS_PROJECTSbindplane_projectsdefaultRoleBINDPLANE_OIDC_CUSTOM_CLAIMS_DEFAULT_ROLEbindplane_default_roleStrings to match inside the groups and roles claims:
orgAdminGroupNameBINDPLANE_OIDC_CUSTOM_CLAIMS_ORG_ADMIN_GROUP_NAMEbindplane-org-adminprojectsGroupPrefixBINDPLANE_OIDC_CUSTOM_CLAIMS_PROJECTS_GROUP_PREFIXbindplane-projects-adminGroupNameBINDPLANE_OIDC_CUSTOM_CLAIMS_ADMIN_GROUP_NAMEbindplane-adminuserGroupNameBINDPLANE_OIDC_CUSTOM_CLAIMS_USER_GROUP_NAMEbindplane-userviewerGroupNameBINDPLANE_OIDC_CUSTOM_CLAIMS_VIEWER_GROUP_NAMEbindplane-viewerAn env var is only set when the field is populated, so anything left unset falls through to the server default. No validation was added — every field is a free-form string with no cross-field constraints.
The public OIDC docs page lists the YAML keys but not the env vars, so the names above were taken from the server config bindings and should be double checked in review.
Custom claims need Bindplane server v1.100.2 or later. The operator default is currently 1.98.1, so anyone using the default image needs to override
spec.versionfor this to do anything. Earlier servers ignore the env vars.Example:
Second commit is unrelated to the feature but needed for the rc. Goreleaser had no
prereleasesetting, so it defaulted to publishing every tag as a full release marked Latest. That means0.1.0-beta.0and0.1.0-beta.1each displaced the stable release at the time. Setprerelease: autoand gatedmake_lateston it. Verified on0.2.0-rc.1: the release shows as a prerelease and0.1.0is still Latest.Docs updated:
configuration.md(new Custom claims section plus TOC),security.md(noted these are claim names, not credentials, so no SecretRef variant),api.mdregenerated.Tests cover the helper directly (all fields, partial, empty, nil) and that custom claims reach the full OIDC env var set.
make test,make lint, andmake gosecall pass.Released as a prerelease for testing:
ghcr.io/observiq/bindplane-operator:0.2.0-rc.1