auth: add new optional OIDCDisableUserInfo setting for OIDC auth provider (#19566)

Add new optional `OIDCDisableUserInfo` setting for OIDC auth provider which
disables a request to the identity provider to get OIDC UserInfo.

This option is helpful when your identity provider doesn't send any additional
claims from the UserInfo endpoint, such as Microsoft AD FS OIDC Provider:

> The AD FS UserInfo endpoint always returns the subject claim as specified in the
> OpenID standards. AD FS doesn't support additional claims requested via the
> UserInfo endpoint

Fixes #19318
This commit is contained in:
Egor Mikhailov
2024-01-09 21:41:46 +03:00
committed by GitHub
parent c875f3e49a
commit 18f49e015f
10 changed files with 34 additions and 3 deletions

View File

@@ -63,6 +63,11 @@ The table below shows this endpoint's support for
- `OIDCClientSecret` `(string: <required>)` - The OAuth client secret
configured with your OIDC provider.
- `OIDCDisableUserInfo` `(bool: false)` - When set to `true`, Nomad will not make
a request to the identity provider to get OIDC UserInfo. You may wish to set this
if your identity provider doesn't send any additional claims from the UserInfo
endpoint.
- `OIDCScopes` `(array<string>)` - List of OIDC scopes.
- `BoundAudiences` `(array<string>)` - List of aud claims that are valid for
@@ -228,6 +233,11 @@ queries](/nomad/api-docs#blocking-queries) and [required ACLs](/nomad/api-docs#a
- `OIDCClientSecret` `(string: "")` - The OAuth client secret
configured with your OIDC provider.
- `OIDCDisableUserInfo` `(bool: false)` - When set to `true`, Nomad will not make
a request to the identity provider to get OIDC UserInfo. You may wish to set this
if your identity provider doesn't send any additional claims from the UserInfo
endpoint.
- `OIDCScopes` `(array<string>)` - List of OIDC scopes.
- `BoundAudiences` `(array<string>)` - List of aud claims that are valid for