-
Notifications
You must be signed in to change notification settings - Fork 3.5k
Add customGroupClaimName option for using user-info endpoint #15803
Description
We would like to apply customGroupClaimName setting to the response from user-info endpoint. This allows SSO login users to be assigned to groups, which are obtained from the user-info endpoint of the OIDC provider and defined as a custom claim name(not groups).
https://argo-workflows.readthedocs.io/en/latest/argo-server-sso/#custom-claims
Use Cases
This feature is useful in cases where the login user information obtained from the OIDC provider is structured as follows:
id_tokenof ` the oauth2 token does not include group information.- User information obtained from the endpoint specified in
userInfoPathincludes group information under a specific claim name other thangroups.
Currently, the specification of the information we obtain from our OIDC provider is structured in this way, so even when viewing the UserInfo in the UI, no groups are set.

By applying the customGroupClaimName option to the information from the user-info endpoint, it becomes possible to flexibly adapt to the specifications of the OIDC provider.