Identity configuration

Paths in the tables are relative to [oidc] or [identity]. Check parsing and cross-field rules with gdsgate doctor --config <PATH> --json. See the sign-in guide.

[oidc]

Used by: Authority, Client.

External OIDC identity provider. With issuer and client_id set, Authority verifies identity tokens against the provider's signing keys (JWKS), and gdsgate login runs the device flow against it. Unset: the built-in development issuer is used (HS256; the client creates a local token). For development only.

Key	Type	Default	Purpose
issuer	string	unset	Issuer base URL, for example https://idp.example.com/realms/gdsgate. Discovery is fetched from <issuer>/.well-known/openid-configuration. The token's iss claim must be identical to it.
client_id	string	unset	OAuth client id registered for gdsgate at the identity provider.
audience	string	client_id	Expected aud claim.
id_token_signing_algs	array of string	all supported asymmetric algorithms (RS256/384/512, PS256/384/512, ES256, ES384, EdDSA)	Allowed id_token signing algorithms. Checked against the provider's id_token_signing_alg_values_supported at discovery and against the token header alg at validation. HS* is always refused.
display_name_claims	array of string	["preferred_username", "email"]	Claims to take a display name from, in order; the first string claim present is used. Authority stores the name with the subject at each sign-in. authority audit list shows the name in place of the subject (--json shows both) and accepts it in --actor. The audit chain stores only the subject. authority forget-user removes a name. [] stores no names.
jwks_refresh_secs	u64	3600	Interval at which Authority re-fetches the JWKS; provider key rotation needs no restart. A token with an unknown key also triggers a fetch. 0 disables the periodic refresh.
request_timeout_secs	u64	15	Timeout for each HTTP call to the provider (discovery, JWKS, device code, token exchange), covering connect and read.
allow_insecure_http	bool	false	Allow http:// provider URLs. For a loopback development provider only; each http:// call is logged at WARN.

[oidc]
issuer    = "https://idp.example.com/realms/gdsgate"
client_id = "gdsgate"
# audience defaults to client_id
# restrict to the algorithms your provider uses:
id_token_signing_algs = ["RS256"]

Issuer must match exactly

The configured issuer, the issuer the provider advertises in its discovery document, and the iss claim of every token must all be byte-identical. Reach the provider by a single hostname from every node and every client.

[identity]

Used by: Authority.

Checks on identity claims (the token's sub and groups, and Kubernetes impersonation values).

Key	Type	Default	Purpose
allow_system_groups	bool	false	Allow values starting with system:, and kubernetes-admin / cluster-admin. These map to privileged Kubernetes built-in roles. When on, each occurrence is logged at WARN.
max_length	usize	253	Maximum length in bytes of one value (sub or one group).
max_groups	usize	64	Maximum groups per identity. Limits the certificate's group list and the impersonation headers.

[identity]
allow_system_groups = false
max_groups          = 64

A token whose sub or groups contain a value starting with gdsgate- is refused; no key changes this. The prefix is reserved for names the cluster issues: gdsgate-admin and gdsgate-provisioner (control-plane certificates), gdsgate-connector, gdsgate-proxy, gdsgate-workload (nodes), and gdsgate-break-glass (break-glass rule). Map provider claims to names without this prefix.