insecureSkipEmailVerifiedInsecureSkipEmailVerified allows to skip the verification of the “email_verified” claim in ID tokens.
+userIDClaimUserIDClaim is the claim to be used as user ID.
+extraConfigExtraClaims contains additional configuration for extra claims.
++(Appears on: +OIDCConfig) +
+| Field | +Description | +
|---|---|
insecureSkipEmailVerifiedbool diff --git a/docs/reference/api/openapi.yaml b/docs/reference/api/openapi.yaml index fa5585217..d3a5e6f14 100755 --- a/docs/reference/api/openapi.yaml +++ b/docs/reference/api/openapi.yaml @@ -669,13 +669,21 @@ components: - key - name type: object - insecureSkipEmailVerified: - default: false - description: InsecureSkipEmailVerified allows to skip the verification of the "email_verified" claim in ID tokens. - enum: - - true - - false - type: boolean + extraConfig: + description: ExtraClaims contains additional configuration for extra claims. + properties: + insecureSkipEmailVerified: + default: false + description: InsecureSkipEmailVerified allows to skip the verification of the "email_verified" claim in ID tokens. + enum: + - true + - false + type: boolean + userIDClaim: + default: login_name + description: UserIDClaim is the claim to be used as user ID. + type: string + type: object issuer: description: Issuer is the URL of the identity service. type: string @@ -691,10 +699,6 @@ components: RedirectURI is the redirect URI to be used for the OIDC flow against the upstream IdP. If none is specified, the Greenhouse ID proxy will be used. type: string - userIDClaim: - default: login_name - description: UserIDClaim is the claim to be used as user ID. - type: string required: - clientIDReference - clientSecretReference From 2290e271d4d5ef443cfff7139e294fd130b1a33d Mon Sep 17 00:00:00 2001 From: "cloud-operator-bot[bot]" <224791424+cloud-operator-bot[bot]@users.noreply.github.com> Date: Thu, 29 Jan 2026 13:30:48 +0000 Subject: [PATCH 07/12] Automatic generation of CRD API Docs --- api/v1alpha1/zz_generated.deepcopy.go | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index 8f9ccea31..0e5eb1d97 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -858,6 +858,21 @@ func (in *OIDCConfig) DeepCopy() *OIDCConfig { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OIDCExtraConfig) DeepCopyInto(out *OIDCExtraConfig) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCExtraConfig. +func (in *OIDCExtraConfig) DeepCopy() *OIDCExtraConfig { + if in == nil { + return nil + } + out := new(OIDCExtraConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *OptionsOverride) DeepCopyInto(out *OptionsOverride) { *out = *in From 52ce0dfddd9947912f2ee80e6135331ed0baf38b Mon Sep 17 00:00:00 2001 From: David Gogl <1381862+kengou@users.noreply.github.com> Date: Thu, 26 Feb 2026 11:33:47 +0100 Subject: [PATCH 08/12] Update config/samples/organization/demo.yaml Co-authored-by: Abhijith Ravindra <137736216+abhijith-darshan@users.noreply.github.com> --- config/samples/organization/demo.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/config/samples/organization/demo.yaml b/config/samples/organization/demo.yaml index cac535baf..8bcf7650b 100644 --- a/config/samples/organization/demo.yaml +++ b/config/samples/organization/demo.yaml @@ -53,5 +53,6 @@ spec: name: demo-oidc issuer: https://global.accounts.dev redirectURI: https://bogus.accounts.foo - insecureSkipEmailVerified: true - userIDClaim: email + extraConfig: + insecureSkipEmailVerified: true + userIDClaim: email From 9480ff50606db467db15baa404bd19ab1ff8fda8 Mon Sep 17 00:00:00 2001 From: David Gogl <1381862+kengou@users.noreply.github.com> Date: Fri, 27 Mar 2026 23:23:28 +0100 Subject: [PATCH 09/12] fix issues, add test and run generate Signed-off-by: David Gogl <1381862+kengou@users.noreply.github.com> --- api/v1alpha1/organization_types.go | 9 +-- .../crds/greenhouse.sap_organizations.yaml | 18 +++--- config/samples/organization/demo.yaml | 1 - docs/reference/api/index.html | 8 ++- docs/reference/api/openapi.yaml | 13 +++-- internal/controller/organization/dex.go | 6 +- .../organization_controller_test.go | 57 +++++++++++++++++++ internal/test/resources.go | 17 ++++++ types/typescript/schema.d.ts | 43 +++++++------- 9 files changed, 124 insertions(+), 48 deletions(-) diff --git a/api/v1alpha1/organization_types.go b/api/v1alpha1/organization_types.go index 7120582f0..e55d4abdf 100755 --- a/api/v1alpha1/organization_types.go +++ b/api/v1alpha1/organization_types.go @@ -85,16 +85,17 @@ type OIDCConfig struct { // OAuth2ClientRedirectURIs are a registered set of redirect URIs. When redirecting from the idproxy to // the client application, the URI requested to redirect to must be contained in this list. OAuth2ClientRedirectURIs []string `json:"oauth2ClientRedirectURIs,omitempty"` - // ExtraClaims contains additional configuration for extra claims. + // ExtraConfig contains additional OIDC configuration for claim mapping and token validation behavior. ExtraConfig *OIDCExtraConfig `json:"extraConfig,omitempty"` } type OIDCExtraConfig struct { - // InsecureSkipEmailVerified allows to skip the verification of the "email_verified" claim in ID tokens. + // InsecureSkipEmailVerified if set to true, treats email_verified as true when the claim is absent from the ID token. + // This does not override an explicit email_verified=false. Only enable for providers that omit the claim entirely (e.g. some Okta, EntraID or CloudFoundry configurations). // +kubebuilder:default:=false - // +kubebuilder:validation:Enum:=true;false InsecureSkipEmailVerified bool `json:"insecureSkipEmailVerified,omitempty"` - // UserIDClaim is the claim to be used as user ID. + // UserIDClaim is the claim to be used as both user ID and username. + // When set, it overrides both UserIDKey and UserNameKey in the dex OIDC connector config. // +kubebuilder:default:="login_name" UserIDClaim string `json:"userIDClaim,omitempty"` } diff --git a/charts/manager/crds/greenhouse.sap_organizations.yaml b/charts/manager/crds/greenhouse.sap_organizations.yaml index 210aedff7..556281357 100644 --- a/charts/manager/crds/greenhouse.sap_organizations.yaml +++ b/charts/manager/crds/greenhouse.sap_organizations.yaml @@ -93,22 +93,20 @@ spec: - name type: object extraConfig: - description: ExtraClaims contains additional configuration - for extra claims. + description: ExtraConfig contains additional OIDC configuration + for claim mapping and token validation behavior. properties: insecureSkipEmailVerified: default: false - description: InsecureSkipEmailVerified allows to skip - the verification of the "email_verified" claim in ID - tokens. - enum: - - true - - false + description: |- + InsecureSkipEmailVerified if set to true, treats email_verified as true when the claim is absent from the ID token. + This does not override an explicit email_verified=false. Only enable for providers that omit the claim entirely (e.g. some Okta, EntraID or CloudFoundry configurations). type: boolean userIDClaim: default: login_name - description: UserIDClaim is the claim to be used as user - ID. + description: |- + UserIDClaim is the claim to be used as both user ID and username. + When set, it overrides both UserIDKey and UserNameKey in the dex OIDC connector config. type: string type: object issuer: diff --git a/config/samples/organization/demo.yaml b/config/samples/organization/demo.yaml index 8bcf7650b..d5a55c29c 100644 --- a/config/samples/organization/demo.yaml +++ b/config/samples/organization/demo.yaml @@ -54,5 +54,4 @@ spec: issuer: https://global.accounts.dev redirectURI: https://bogus.accounts.foo extraConfig: - insecureSkipEmailVerified: true userIDClaim: email diff --git a/docs/reference/api/index.html b/docs/reference/api/index.html index 4d31db72c..b4f9915db 100644 --- a/docs/reference/api/index.html +++ b/docs/reference/api/index.html @@ -2001,7 +2001,7 @@ OIDCConfig |
- ExtraClaims contains additional configuration for extra claims. +ExtraConfig contains additional OIDC configuration for claim mapping and token validation behavior. |
- InsecureSkipEmailVerified allows to skip the verification of the “email_verified” claim in ID tokens. +InsecureSkipEmailVerified if set to true, treats email_verified as true when the claim is absent from the ID token. +This does not override an explicit email_verified=false. Only enable for providers that omit the claim entirely (e.g. some Okta, EntraID or CloudFoundry configurations). |
|
- UserIDClaim is the claim to be used as user ID. +UserIDClaim is the claim to be used as both user ID and username. +When set, it overrides both UserIDKey and UserNameKey in the dex OIDC connector config. |
- InsecureSkipEmailVerified if set to true, treats email_verified as true when the claim is absent from the ID token. -This does not override an explicit email_verified=false. Only enable for providers that omit the claim entirely (e.g. some Okta, EntraID or CloudFoundry configurations). +InsecureSkipEmailVerified, if set to true, forces the email_verified claim to true +regardless of the value reported by the upstream IdP, including overriding an explicit +email_verified=false. Enable only for IdPs where the email address is verified by other +means, e.g. Keycloak with SAML or user federation, or providers that omit the claim +entirely such as some Okta, EntraID or CloudFoundry configurations. |