docs(sso): document extra_settings.identifier_field and the claim picker - #202
Open
tonybart1337 wants to merge 8 commits into
Open
docs(sso): document extra_settings.identifier_field and the claim picker#202tonybart1337 wants to merge 8 commits into
tonybart1337 wants to merge 8 commits into
Conversation
Names the claim carrying the user identifier when the provider sends neither email nor upn. Covers the yaml form, the ordered-list form, where the setting lives in Instance settings, and why the advertised claim list is a starting point rather than a guarantee. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
claims_supported declares support; it does not guarantee a claim is implemented, released to the client, or populated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A returning user is matched by the resolved value alone, and the account is found before a new one would be created — so two people sharing the claim value share one account, with no error and no log line. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…warning The setting names where the account login comes from. Also documents the second consequence — changing it later leaves existing users on accounts they no longer match — and stops suggesting upn, which Microsoft documents as mutable and reusable. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The value is what a returning user is matched by, not only the account login. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents the OpenID identifier claim added in supervisely/main!1971 (supervisely/issues#6060).
Covers the
openid.ymlform, the ordered-list form, the equivalent in Instance settings → Authorization → Open ID authorization → EDIT, and why the advertised claim list is a starting point rather than a guarantee — a provider can advertise a claim it does not send to a given client, which is exactly the case that prompted this.🤖 Generated with Claude Code