Preflight Checklist
Problem Description
We are performing machine authentication by exchanging a Google access token (from an impersonated service account) for a dex-issued JWT, as in these docs.
The Google connector does not appear to support token exchange, but the OIDC connector configured with Google does.
The limitation of using the OIDC connector is that we cannot get group claims; it appears that the Google connector handles those as a special case.
Proposed Solution
Support token exchange in the Google connector. I think it should be possible given that token exchange is possible with Google via the OIDC connector, and would enable group claims when doing so.
Alternatives Considered
No response
Additional Information
It looks like this requires an implementation of TokenIdentityConnector in the Google connector.
Preflight Checklist
Problem Description
We are performing machine authentication by exchanging a Google access token (from an impersonated service account) for a dex-issued JWT, as in these docs.
The Google connector does not appear to support token exchange, but the OIDC connector configured with Google does.
The limitation of using the OIDC connector is that we cannot get group claims; it appears that the Google connector handles those as a special case.
Proposed Solution
Support token exchange in the Google connector. I think it should be possible given that token exchange is possible with Google via the OIDC connector, and would enable group claims when doing so.
Alternatives Considered
No response
Additional Information
It looks like this requires an implementation of
TokenIdentityConnectorin the Google connector.