The operator role is found in the identity provider's token only at hard-coded claim locations #112

New Issue

2026-09-21T07:18:33Z

cgalo5758 commented

2026-09-21 07:18:33 +00:00

The question

The console decides who is an operator by looking for a role name in four fixed places of the provider's token and taking the union: a role of the right name in any of them grants it. The role name is the contract and the claim locations are hard-coded. Providers other than Keycloak put roles in different claims, under different names, and a deployment has no way to say "my operator role is called this and lives here". Which shape should that configuration take?

What depends on the answer

Whether a deployment on Authentik, Authelia, Zitadel or another provider can grant the operator role without renaming roles inside the provider to match the console's expectation, and whether the union rule, which today means a same-named role anywhere in the token grants, stays.

Options known so far

Keep the union over fixed locations and add configuration overrides: a role-name alias and extra claim paths.
A declarative mapping: the deployment names the claim path and the value that means operator, and nothing is hard-coded.

Decided when

A design records which of the two the console adopts, where the operator role's name is declared, and what the identity-provider setup doc tells each provider's users to do.

Migrated from status/issues.md at b7a0e15

## The question The console decides who is an operator by looking for a role name in four fixed places of the provider's token and taking the union: a role of the right name in any of them grants it. The role name is the contract and the claim locations are hard-coded. Providers other than Keycloak put roles in different claims, under different names, and a deployment has no way to say "my operator role is called this and lives here". Which shape should that configuration take? ## What depends on the answer Whether a deployment on Authentik, Authelia, Zitadel or another provider can grant the operator role without renaming roles inside the provider to match the console's expectation, and whether the union rule, which today means a same-named role anywhere in the token grants, stays. ## Options known so far - Keep the union over fixed locations and add configuration overrides: a role-name alias and extra claim paths. - A declarative mapping: the deployment names the claim path and the value that means operator, and nothing is hard-coded. ## Decided when A design records which of the two the console adopts, where the operator role's name is declared, and what the identity-provider setup doc tells each provider's users to do. Migrated from status/issues.md at b7a0e15

cgalo5758 added the

kind

design

area/identity labels 2026-09-21 07:18:33 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wiki-cafe/member-console#112