Skip to content

Add customGroupClaimName option for using user-info endpoint #15803

@okzw999

Description

@okzw999

We would like to apply customGroupClaimName setting to the response from user-info endpoint. This allows SSO login users to be assigned to groups, which are obtained from the user-info endpoint of the OIDC provider and defined as a custom claim name(not groups).
https://argo-workflows.readthedocs.io/en/latest/argo-server-sso/#custom-claims

Use Cases

This feature is useful in cases where the login user information obtained from the OIDC provider is structured as follows:

  • id_token of ` the oauth2 token does not include group information.
  • User information obtained from the endpoint specified in userInfoPath includes group information under a specific claim name other than groups.

Currently, the specification of the information we obtain from our OIDC provider is structured in this way, so even when viewing the UserInfo in the UI, no groups are set.
Image

By applying the customGroupClaimName option to the information from the user-info endpoint, it becomes possible to flexibly adapt to the specifications of the OIDC provider.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions