Organization ID not present in kubectl auth whoami

[scotwells]

What task were you trying to complete?

Running kubectl auth whoami to check whether I'm authenticated with Datum Cloud.

Describe the usability issue

The two fields included in the extra section read datumctl instead of the organization UID or the organization ID the user is authenticated as.

zacharysmith@Zacharys-MacBook-Pro-3 ~ % kubectl auth whoami
ATTRIBUTE                                                VALUE
Username                                                 zsmith@datum.net
Groups                                                   [system:authenticated]
Extra: authentication.datum.net/datum-organization-uid   [datumctl]
Extra: authentication.kubernetes.io/credential-id        [JTI=0feaa0fe-918d-421a-858d-7ad308924336]
Extra: resourcemanager.datumapis.com/organization-id     [datumctl]

Why was this confusing or difficult for you?

Expecting to see the organization UID / resource ID value.

What did you expect to happen instead? (Optional)

No response

Do you have any suggestions for improvement? (Optional)

No response

Relevant URL or Section of the Application (Optional)

No response

Attachments / Screenshots (Optional)

No response

[joshlreese]

This appears to have been a side effect of executing % datumctl auth update-kubeconfig --organization datumctl personal-org-guytim, which used datumctl as the organization ID and not personal-org-guytim.

We could improve the datumctl auth update-kubeconfig command by fetching the org (or project) resource that the user is attempting to update their kubeconfig with to confirm they have access to it prior to updating the config file.

We may also want to explore if the whoami handler in the API server should validate access to the provided organization ID before returning a response.