Background
docs/superpowers/specs/2026-07-25-fence-auth-subsystem-design.md designs fence as a universal OIDC identity broker with an aspirational goal of flexible multi-IdP support (any client authenticating against any configured upstream IdP), with an explicit fallback to a single configured IdP if that flexibility adds too much implementation complexity.
The implementation plan (docs/superpowers/plans/2026-07-26-fence-auth-fence-module.md) took the single-IdP fallback: it scopes fence to Google only for the initial rollout of issue #127.
What's deferred
- Support for registering additional upstream IdPs (e.g. Okta) alongside Google.
fence's composite sub claim is currently hardcoded to a google: prefix; supporting additional IdPs means generalizing this to the actual upstream provider per authentication.- Any UI/CLI affordance for a user or client to select which upstream IdP to authenticate against, if more than one is configured.
Scope
Not scoped yet — this issue exists to track the deferred work, not to commit to a specific design. When picked up, revisit the original spec's multi-IdP section for the original design intent before planning.
Background
docs/superpowers/specs/2026-07-25-fence-auth-subsystem-design.mddesignsfenceas a universal OIDC identity broker with an aspirational goal of flexible multi-IdP support (any client authenticating against any configured upstream IdP), with an explicit fallback to a single configured IdP if that flexibility adds too much implementation complexity.The implementation plan (
docs/superpowers/plans/2026-07-26-fence-auth-fence-module.md) took the single-IdP fallback: it scopesfenceto Google only for the initial rollout of issue #127.What's deferred
fence's compositesubclaim is currently hardcoded to agoogle:prefix; supporting additional IdPs means generalizing this to the actual upstream provider per authentication.Scope
Not scoped yet — this issue exists to track the deferred work, not to commit to a specific design. When picked up, revisit the original spec's multi-IdP section for the original design intent before planning.