tsb.tetrate.io/v2

OIDC

↩ Parent

Name	Type	Description	Required
apiVersion	string	tsb.tetrate.io/v2	true
kind	string	OIDC	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object	OIDC represents an OpenID Connect (OIDC) configuration that can be used to authenticate users in Service Bridge.	false
status	object		false

OIDC.spec

↩ Parent

OIDC represents an OpenID Connect (OIDC) configuration that can be used to authenticate users in Service Bridge.

Name	Type	Description	Required
config	object	OIDC settings for the OIDC provider.	true
secret	string	Base64 encoded client secret for the OIDC provider.	true
configGenerationMetadata	object	Default metadata values that will be propagated to the children Istio generated configurations.	false
deletionProtectionEnabled	boolean	When set, prevents the resource from being deleted.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
etag	string	The etag for the resource.	false
fqn	string	Fully-qualified name of the resource.	false

OIDC.spec.config

↩ Parent

OIDC settings for the OIDC provider.

Name	Type	Description	Required
clientId	string	The client ID from the OIDC provider's application configuration settings.	true
providerConfig	object	OIDC provider configuration.	true
redirectUri	string	The public URI where TSB is accessed.	true
authorizationParams	map[string]string	Optional parameters that will be included in the authorization request to the authorization endpoint.	false
jitProvisioning	object	Optional OIDC Just-In-Time (JIT) user provisioning settings.	false
maxExpirationSeconds	integer	Optional max expiration time of issued tokens. Format: int32	false
offlineAccessConfig	object	Optional OIDC settings specific to offline access.	false
scopes	[]string	Scopes passed to the OIDC provider in the Authentication Request.	false

OIDC.spec.config.providerConfig

↩ Parent

OIDC provider configuration.

Name	Type	Description	Required
dynamic	object		false
static	object		false

OIDC.spec.config.providerConfig.dynamic

↩ Parent

Name	Type	Description	Required
configurationUri	string	OIDC provider's well-known OIDC configuration URI.	true

OIDC.spec.config.providerConfig.static

↩ Parent

Name	Type	Description	Required
authorizationEndpoint	string	The Authorization Endpoint for the OIDC provider.	true
tokenEndpoint	string	The Token Endpoint for the OIDC provider.	true
deviceCodeEndpoint	string	The Device Code endpoint for the OIDC provider.	false
introspectionEndpoint	string	The Introspection endpoint for the OIDC provider.	false
jwks	string	JSON string with the OIDC provider's JSON Web Key Sets.	false
jwksUri	string	URI for the OIDC provider's JSON Web Key Sets.	false

OIDC.spec.config.jitProvisioning

↩ Parent

Optional OIDC Just-In-Time (JIT) user provisioning settings.

Name	Type	Description	Required
enabled	boolean	Enabled turns on JIT user creation: an OIDC-authenticated subject with no existing TSB principal is auto-created from the token claims.	false
groupSync	object	GroupSync controls reconciliation of OIDC group claims into TSB team membership.	false
groupsClaim	string	GroupsClaim selects which OIDC token claim carries the user's group memberships, matched against each team's oidc_groups during reconciliation.	false
providerName	string	ProviderName is recorded on the created user's provider_name field, identifying which configured identity provider the user originated from (for example "google", "azure-oidc", or "pingam").	false
subjectClaim	string	SubjectClaim selects which OIDC claim becomes the TSB principal name.	false
verifyBearerSignature	boolean	VerifyBearerSignature makes the management-plane apiserver cryptographically verify the IAM-minted session bearer's signature before it provisions a JIT user, rather than trusting the IAM ext-authz edge alone (defense in depth).	false

OIDC.spec.config.jitProvisioning.groupSync

↩ Parent

GroupSync controls reconciliation of OIDC group claims into TSB team membership.

Name	Type	Description	Required
googleAdminSdk	object	Google Admin SDK Directory API, used for Google Workspace.	false
maxDriftWindow	string	MaxDriftWindow bounds how long IdP-to-TSB membership may diverge and also clamps the OIDC bearer lifetime.	false
mode	enum	Mode selects the group-reconciliation behavior. Enum: OFF, DRY_RUN, MEMBERSHIP_ONLY	false
requireMappedTeam	boolean	RequireMappedTeam, when true, denies login or refresh for users whose group claims resolve to no existing teams (break-glass teams are exempt).	false

OIDC.spec.config.jitProvisioning.groupSync.googleAdminSdk

↩ Parent

Google Admin SDK Directory API, used for Google Workspace.

Name	Type	Description	Required
impersonateSubject	string	ImpersonateSubject is the Google Workspace administrator that the service account impersonates via domain-wide delegation.	false
scopes	[]string	Scopes are the OAuth scopes requested.	false
serviceAccountSecretRef	string	ServiceAccountSecretRef references the mounted service-account JSON credential.	false

OIDC.spec.config.offlineAccessConfig

↩ Parent

Optional OIDC settings specific to offline access.

Name	Type	Description	Required
deviceCodeAuth	object	OIDC settings for Device Code Authorization grant used with offline access.	false
tokenExchange	object	OIDC settings for Token Exchange grant used with offline access.	false

OIDC.spec.config.offlineAccessConfig.deviceCodeAuth

↩ Parent

OIDC settings for Device Code Authorization grant used with offline access.

Name	Type	Description	Required
clientId	string	The client ID from the OIDC provider's application configuration settings.	false
providerConfig	object	OIDC provider configuration.	false
scopes	[]string	Scopes passed to the OIDC provider in the Device Code request Required scope 'openid' is included by default, any additional scopes will be appended in the Device Code Authorization request.	false
skipClientIdCheck	boolean	Instructs JWT validation to ignore the 'aud' claim.	false

OIDC.spec.config.offlineAccessConfig.deviceCodeAuth.providerConfig

↩ Parent

OIDC provider configuration.

Name	Type	Description	Required
dynamic	object		false
static	object		false

OIDC.spec.config.offlineAccessConfig.deviceCodeAuth.providerConfig.dynamic

↩ Parent

Name	Type	Description	Required
configurationUri	string	OIDC provider's well-known OIDC configuration URI.	true

OIDC.spec.config.offlineAccessConfig.deviceCodeAuth.providerConfig.static

↩ Parent

Name	Type	Description	Required
authorizationEndpoint	string	The Authorization Endpoint for the OIDC provider.	true
tokenEndpoint	string	The Token Endpoint for the OIDC provider.	true
deviceCodeEndpoint	string	The Device Code endpoint for the OIDC provider.	false
introspectionEndpoint	string	The Introspection endpoint for the OIDC provider.	false
jwks	string	JSON string with the OIDC provider's JSON Web Key Sets.	false
jwksUri	string	URI for the OIDC provider's JSON Web Key Sets.	false

OIDC.spec.config.offlineAccessConfig.tokenExchange

↩ Parent

OIDC settings for Token Exchange grant used with offline access.

Name	Type	Description	Required
clientId	string	The client ID from the OIDC provider's application configuration settings.	false
providerConfig	object	OIDC provider configuration.	false
scopes	[]string	Scopes passed to the OIDC provider in the Device Code request Required scope 'openid' is included by default, any additional scopes will be appended in the Device Code Authorization request.	false
skipClientIdCheck	boolean	Instructs JWT validation to ignore the 'aud' claim.	false

OIDC.spec.config.offlineAccessConfig.tokenExchange.providerConfig

↩ Parent

OIDC provider configuration.

Name	Type	Description	Required
dynamic	object		false
static	object		false

OIDC.spec.config.offlineAccessConfig.tokenExchange.providerConfig.dynamic

↩ Parent

Name	Type	Description	Required
configurationUri	string	OIDC provider's well-known OIDC configuration URI.	true

OIDC.spec.config.offlineAccessConfig.tokenExchange.providerConfig.static

↩ Parent

Name	Type	Description	Required
authorizationEndpoint	string	The Authorization Endpoint for the OIDC provider.	true
tokenEndpoint	string	The Token Endpoint for the OIDC provider.	true
deviceCodeEndpoint	string	The Device Code endpoint for the OIDC provider.	false
introspectionEndpoint	string	The Introspection endpoint for the OIDC provider.	false
jwks	string	JSON string with the OIDC provider's JSON Web Key Sets.	false
jwksUri	string	URI for the OIDC provider's JSON Web Key Sets.	false

OIDC.spec.configGenerationMetadata

↩ Parent

Default metadata values that will be propagated to the children Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the metadata.annotations field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the metadata.labels field of the Istio generated configurations.	false