You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/en/docs/reference/config-api/apiserver-config.v1alpha1.md
+3-1
Original file line number
Diff line number
Diff line change
@@ -400,7 +400,9 @@ If username.expression is set, the expression must produce a string value.
400
400
If username.expression uses 'claims.email', then 'claims.email_verified' must be used in
401
401
username.expression or extra[<em>].valueExpression or claimValidationRules[</em>].expression.
402
402
An example claim validation rule expression that matches the validation automatically
403
-
applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true)'.</p>
403
+
applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true) == true'. By explicitly comparing
404
+
the value to true, we let type-checking see the result will be a boolean, and to make sure a non-boolean email_verified
405
+
claim will be caught at runtime.</p>
404
406
<p>In the flag based approach, the --oidc-username-claim and --oidc-username-prefix are optional. If --oidc-username-claim is not set,
405
407
the default value is "sub". For the authentication config, there is no defaulting for claim or prefix. The claim and prefix must be set explicitly.
406
408
For claim, if --oidc-username-claim was not set with legacy flag approach, configure username.claim="sub" in the authentication config.
Copy file name to clipboardExpand all lines: content/en/docs/reference/config-api/apiserver-config.v1beta1.md
+3-1
Original file line number
Diff line number
Diff line change
@@ -333,7 +333,9 @@ If username.expression is set, the expression must produce a string value.
333
333
If username.expression uses 'claims.email', then 'claims.email_verified' must be used in
334
334
username.expression or extra[<em>].valueExpression or claimValidationRules[</em>].expression.
335
335
An example claim validation rule expression that matches the validation automatically
336
-
applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true)'.</p>
336
+
applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true) == true'. By explicitly comparing
337
+
the value to true, we let type-checking see the result will be a boolean, and to make sure a non-boolean email_verified
338
+
claim will be caught at runtime.</p>
337
339
<p>In the flag based approach, the --oidc-username-claim and --oidc-username-prefix are optional. If --oidc-username-claim is not set,
338
340
the default value is "sub". For the authentication config, there is no defaulting for claim or prefix. The claim and prefix must be set explicitly.
339
341
For claim, if --oidc-username-claim was not set with legacy flag approach, configure username.claim="sub" in the authentication config.
0 commit comments