Identity configuration

The flat configuration hub remains the compatibility route. This page is the canonical source-checked field reference for its family, including nested tables and list rows.

Paths in the tables are relative to [oidc] or [identity]. Each row gives the serde type and source default or unset meaning; issuer credentials and mapping material stay outside committed TOML. Check parsing and identity cross-field rules with gdsgate doctor --config <PATH> --json, then follow the sign-in guide.

[oidc]

Used by: Authority, Client.

External OIDC identity provider. With issuer and client_id set, Authority verifies identity tokens against the provider's published signing keys (JWKS) and gdsgate login runs the device flow against it. Unset, the built-in development issuer is used (HS256, with the client minting a local dev token), for development only.

Key	Type	Default	Purpose
issuer	string	unset	Issuer base URL, for example https://idp.example.com/realms/gdsgate. Discovery is fetched from <issuer>/.well-known/openid-configuration. The token's iss claim must equal this exactly.
client_id	string	unset	OAuth client id registered for gdsgate at the identity provider.
audience	string	client_id	Expected aud claim.
id_token_signing_algs	array of string	all asymmetric JWA algs jsonwebtoken supports (RS256/384/512, PS256/384/512, ES256, ES384, EdDSA)	id_token signing-algorithm whitelist. Cross-checked against the IdP's id_token_signing_alg_values_supported at discovery, and against the token's header alg at validation. Symmetric HS* is always rejected at parse time, as an algorithm-confusion guard.
jwks_refresh_secs	u64	3600	How often Authority re-fetches the provider's JWKS; the trust set is hot-swapped on each refresh, so key rotation needs no restart. A refetch also fires on demand when a token names an unknown key. 0 disables the periodic refresh.
request_timeout_secs	u64	15	Per-request timeout for HTTP calls to the provider (discovery, JWKS, device-code, token exchange). Bounds connect and read so a slow provider cannot wedge Authority at boot.
allow_insecure_http	bool	false	Allow http:// for provider URLs. Off by default, since a plaintext JWKS fetch is compromisable by an on-path attacker. Turn it on only for a loopback dev provider; each http:// call is logged at WARN.

[oidc]
issuer    = "https://idp.example.com/realms/gdsgate"
client_id = "gdsgate"
# audience defaults to client_id when unset
# id_token_signing_algs defaults to every asymmetric JWA alg; narrow it
# to your IdP's actual policy to harden:
id_token_signing_algs = ["RS256"]

Issuer must match exactly

The configured issuer, the issuer the provider advertises in its discovery document, and the iss claim of every token must all be byte-identical. Reach the provider by a single hostname from every node and every client.

[identity]

Used by: Authority.

How identity claims (the token's sub and groups, and Kubernetes impersonation values) are sanitized before use.

Key	Type	Default	Purpose
allow_system_groups	bool	false	Allow claim and impersonation values starting with system:, or the bare kubernetes-admin / cluster-admin. Off by default, since they map to privileged Kubernetes built-in roles with no auditable policy binding. When on, each occurrence is logged at WARN.
max_length	usize	253	Maximum length, in bytes, of one sanitized value (sub or a single group). 253 is the Kubernetes DNS-label convention the apiserver accepts.
max_groups	usize	64	Maximum number of group memberships per identity. Caps the certificate's group list and the number of impersonation headers.

[identity]
# Defaults are the safe choice. Override only with reason.
allow_system_groups = false
max_groups          = 64

The gdsgate- namespace is the cluster's own. A token whose sub or whose groups carry a value starting with gdsgate- is refused, and no key turns that off. Those are the names the cluster issues to itself: gdsgate-admin and gdsgate-provisioner behind the control-plane certificates, gdsgate-connector / gdsgate-proxy / gdsgate-workload behind the nodes, and gdsgate-break-glass for the break-glass rule. A Cedar principal id says nothing about how it was proved, so a provider that emitted gdsgate-admin as a sub would hand a person the identity of the control-plane certificate, and one that emitted gdsgate-break-glass as a group would hand out the permit that probe relies on. Map the claim to a name of your own; the group people hold is yours to choose, and only the gdsgate- prefix is taken.