Allow additional claims to map into an ID token issued by the supervisor

- Specify mappings on OIDCIdentityProvider.spec.claims.additionalClaimMappings
- Advertise additionalClaims in the OIDC discovery endpoint under claims_supported

Co-authored-by: Ryan Richard <richardry@vmware.com>
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>

generated/1.17/README.adoc

@@ -1391,6 +1391,7 @@ OIDCClaims provides a mapping from upstream claims into identities.
 | Field | Description
 | *`groups`* __string__ | Groups provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain the groups to which an identity belongs. By default, the identities will not include any group memberships when this setting is not configured.
 | *`username`* __string__ | Username provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain an identity's username. When not set, the username will be an automatically constructed unique string which will include the issuer URL of your OIDC provider along with the value of the "sub" (subject) claim from the ID token.
+| *`additionalClaimMappings`* __object (keys:string, values:string)__ | AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of new claim names as the keys, and upstream claim names as the values. These new claim names will be nested under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients. This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
 |===
 
 

generated/1.17/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go

@@ -138,6 +138,17 @@ type OIDCClaims struct {
 	// the ID token.
 	// +optional
 	Username string `json:"username"`
+
+	// AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the
+	// "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of
+	// new claim names as the keys, and upstream claim names as the values. These new claim names will be nested
+	// under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this
+	// OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients.
+	// This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be
+	// used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims
+	// are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
+	// +optional
+	AdditionalClaimMappings map[string]string `json:"additionalClaimMappings,omitempty"`
 }
 
 // OIDCClient contains information about an OIDC client (e.g., client ID and client

generated/1.17/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go

@@ -438,6 +438,13 @@ func (in *OIDCAuthorizationConfig) DeepCopy() *OIDCAuthorizationConfig {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OIDCClaims) DeepCopyInto(out *OIDCClaims) {
 	*out = *in
+	if in.AdditionalClaimMappings != nil {
+		in, out := &in.AdditionalClaimMappings, &out.AdditionalClaimMappings
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	return
 }
 
@@ -537,7 +544,7 @@ func (in *OIDCIdentityProviderSpec) DeepCopyInto(out *OIDCIdentityProviderSpec)
 		**out = **in
 	}
 	in.AuthorizationConfig.DeepCopyInto(&out.AuthorizationConfig)
-	out.Claims = in.Claims
+	in.Claims.DeepCopyInto(&out.Claims)
 	out.Client = in.Client
 	return
 }

generated/1.17/apis/supervisor/oidc/types_supervisor_oidc.go

@@ -40,6 +40,10 @@ const (
 	// group names which were mapped from the upstream identity provider.
 	IDTokenClaimGroups = "groups"
 
+	// IDTokenClaimAdditionalClaims is the top level claim used to hold additional claims in the downstream ID
+	// token, if any claims are present.
+	IDTokenClaimAdditionalClaims = "additionalClaims"
+
 	// GrantTypeAuthorizationCode is the name of the grant type for authorization code flows defined by the OIDC spec.
 	GrantTypeAuthorizationCode = "authorization_code"
 

generated/1.17/crds/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -185,6 +185,24 @@ spec:
                 description: Claims provides the names of token claims that will be
                   used when inspecting an identity from this OIDC identity provider.
                 properties:
+                  additionalClaimMappings:
+                    additionalProperties:
+                      type: string
+                    description: AdditionalClaimMappings allows for additional arbitrary
+                      upstream claim values to be mapped into the "additionalClaims"
+                      claim of the ID tokens generated by the Supervisor. This should
+                      be specified as a map of new claim names as the keys, and upstream
+                      claim names as the values. These new claim names will be nested
+                      under the top-level "additionalClaims" claim in ID tokens generated
+                      by the Supervisor when this OIDCIdentityProvider was used for
+                      user authentication. These claims will be made available to
+                      all clients. This feature is not required to use the Supervisor
+                      to provide authentication for Kubernetes clusters, but can be
+                      used when using the Supervisor for other authentication purposes.
+                      When this map is empty or the upstream claims are not available,
+                      the "additionalClaims" claim will be excluded from the ID tokens
+                      generated by the Supervisor.
+                    type: object
                   groups:
                     description: Groups provides the name of the ID token claim or
                       userinfo endpoint response claim that will be used to ascertain

generated/1.18/README.adoc

@@ -1391,6 +1391,7 @@ OIDCClaims provides a mapping from upstream claims into identities.
 | Field | Description
 | *`groups`* __string__ | Groups provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain the groups to which an identity belongs. By default, the identities will not include any group memberships when this setting is not configured.
 | *`username`* __string__ | Username provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain an identity's username. When not set, the username will be an automatically constructed unique string which will include the issuer URL of your OIDC provider along with the value of the "sub" (subject) claim from the ID token.
+| *`additionalClaimMappings`* __object (keys:string, values:string)__ | AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of new claim names as the keys, and upstream claim names as the values. These new claim names will be nested under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients. This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
 |===
 
 

generated/1.18/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go

@@ -138,6 +138,17 @@ type OIDCClaims struct {
 	// the ID token.
 	// +optional
 	Username string `json:"username"`
+
+	// AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the
+	// "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of
+	// new claim names as the keys, and upstream claim names as the values. These new claim names will be nested
+	// under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this
+	// OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients.
+	// This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be
+	// used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims
+	// are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
+	// +optional
+	AdditionalClaimMappings map[string]string `json:"additionalClaimMappings,omitempty"`
 }
 
 // OIDCClient contains information about an OIDC client (e.g., client ID and client

generated/1.18/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go

@@ -438,6 +438,13 @@ func (in *OIDCAuthorizationConfig) DeepCopy() *OIDCAuthorizationConfig {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OIDCClaims) DeepCopyInto(out *OIDCClaims) {
 	*out = *in
+	if in.AdditionalClaimMappings != nil {
+		in, out := &in.AdditionalClaimMappings, &out.AdditionalClaimMappings
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	return
 }
 
@@ -537,7 +544,7 @@ func (in *OIDCIdentityProviderSpec) DeepCopyInto(out *OIDCIdentityProviderSpec)
 		**out = **in
 	}
 	in.AuthorizationConfig.DeepCopyInto(&out.AuthorizationConfig)
-	out.Claims = in.Claims
+	in.Claims.DeepCopyInto(&out.Claims)
 	out.Client = in.Client
 	return
 }

generated/1.18/apis/supervisor/oidc/types_supervisor_oidc.go

@@ -40,6 +40,10 @@ const (
 	// group names which were mapped from the upstream identity provider.
 	IDTokenClaimGroups = "groups"
 
+	// IDTokenClaimAdditionalClaims is the top level claim used to hold additional claims in the downstream ID
+	// token, if any claims are present.
+	IDTokenClaimAdditionalClaims = "additionalClaims"
+
 	// GrantTypeAuthorizationCode is the name of the grant type for authorization code flows defined by the OIDC spec.
 	GrantTypeAuthorizationCode = "authorization_code"
 

generated/1.18/crds/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -185,6 +185,24 @@ spec:
                 description: Claims provides the names of token claims that will be
                   used when inspecting an identity from this OIDC identity provider.
                 properties:
+                  additionalClaimMappings:
+                    additionalProperties:
+                      type: string
+                    description: AdditionalClaimMappings allows for additional arbitrary
+                      upstream claim values to be mapped into the "additionalClaims"
+                      claim of the ID tokens generated by the Supervisor. This should
+                      be specified as a map of new claim names as the keys, and upstream
+                      claim names as the values. These new claim names will be nested
+                      under the top-level "additionalClaims" claim in ID tokens generated
+                      by the Supervisor when this OIDCIdentityProvider was used for
+                      user authentication. These claims will be made available to
+                      all clients. This feature is not required to use the Supervisor
+                      to provide authentication for Kubernetes clusters, but can be
+                      used when using the Supervisor for other authentication purposes.
+                      When this map is empty or the upstream claims are not available,
+                      the "additionalClaims" claim will be excluded from the ID tokens
+                      generated by the Supervisor.
+                    type: object
                   groups:
                     description: Groups provides the name of the ID token claim or
                       userinfo endpoint response claim that will be used to ascertain

generated/1.19/README.adoc

@@ -1391,6 +1391,7 @@ OIDCClaims provides a mapping from upstream claims into identities.
 | Field | Description
 | *`groups`* __string__ | Groups provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain the groups to which an identity belongs. By default, the identities will not include any group memberships when this setting is not configured.
 | *`username`* __string__ | Username provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain an identity's username. When not set, the username will be an automatically constructed unique string which will include the issuer URL of your OIDC provider along with the value of the "sub" (subject) claim from the ID token.
+| *`additionalClaimMappings`* __object (keys:string, values:string)__ | AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of new claim names as the keys, and upstream claim names as the values. These new claim names will be nested under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients. This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
 |===
 
 

generated/1.19/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go

@@ -138,6 +138,17 @@ type OIDCClaims struct {
 	// the ID token.
 	// +optional
 	Username string `json:"username"`
+
+	// AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the
+	// "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of
+	// new claim names as the keys, and upstream claim names as the values. These new claim names will be nested
+	// under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this
+	// OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients.
+	// This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be
+	// used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims
+	// are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
+	// +optional
+	AdditionalClaimMappings map[string]string `json:"additionalClaimMappings,omitempty"`
 }
 
 // OIDCClient contains information about an OIDC client (e.g., client ID and client

generated/1.19/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go

@@ -438,6 +438,13 @@ func (in *OIDCAuthorizationConfig) DeepCopy() *OIDCAuthorizationConfig {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OIDCClaims) DeepCopyInto(out *OIDCClaims) {
 	*out = *in
+	if in.AdditionalClaimMappings != nil {
+		in, out := &in.AdditionalClaimMappings, &out.AdditionalClaimMappings
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	return
 }
 
@@ -537,7 +544,7 @@ func (in *OIDCIdentityProviderSpec) DeepCopyInto(out *OIDCIdentityProviderSpec)
 		**out = **in
 	}
 	in.AuthorizationConfig.DeepCopyInto(&out.AuthorizationConfig)
-	out.Claims = in.Claims
+	in.Claims.DeepCopyInto(&out.Claims)
 	out.Client = in.Client
 	return
 }

generated/1.19/apis/supervisor/oidc/types_supervisor_oidc.go

@@ -40,6 +40,10 @@ const (
 	// group names which were mapped from the upstream identity provider.
 	IDTokenClaimGroups = "groups"
 
+	// IDTokenClaimAdditionalClaims is the top level claim used to hold additional claims in the downstream ID
+	// token, if any claims are present.
+	IDTokenClaimAdditionalClaims = "additionalClaims"
+
 	// GrantTypeAuthorizationCode is the name of the grant type for authorization code flows defined by the OIDC spec.
 	GrantTypeAuthorizationCode = "authorization_code"
 

generated/1.19/crds/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -185,6 +185,24 @@ spec:
                 description: Claims provides the names of token claims that will be
                   used when inspecting an identity from this OIDC identity provider.
                 properties:
+                  additionalClaimMappings:
+                    additionalProperties:
+                      type: string
+                    description: AdditionalClaimMappings allows for additional arbitrary
+                      upstream claim values to be mapped into the "additionalClaims"
+                      claim of the ID tokens generated by the Supervisor. This should
+                      be specified as a map of new claim names as the keys, and upstream
+                      claim names as the values. These new claim names will be nested
+                      under the top-level "additionalClaims" claim in ID tokens generated
+                      by the Supervisor when this OIDCIdentityProvider was used for
+                      user authentication. These claims will be made available to
+                      all clients. This feature is not required to use the Supervisor
+                      to provide authentication for Kubernetes clusters, but can be
+                      used when using the Supervisor for other authentication purposes.
+                      When this map is empty or the upstream claims are not available,
+                      the "additionalClaims" claim will be excluded from the ID tokens
+                      generated by the Supervisor.
+                    type: object
                   groups:
                     description: Groups provides the name of the ID token claim or
                       userinfo endpoint response claim that will be used to ascertain

generated/1.20/README.adoc

@@ -1391,6 +1391,7 @@ OIDCClaims provides a mapping from upstream claims into identities.
 | Field | Description
 | *`groups`* __string__ | Groups provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain the groups to which an identity belongs. By default, the identities will not include any group memberships when this setting is not configured.
 | *`username`* __string__ | Username provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain an identity's username. When not set, the username will be an automatically constructed unique string which will include the issuer URL of your OIDC provider along with the value of the "sub" (subject) claim from the ID token.
+| *`additionalClaimMappings`* __object (keys:string, values:string)__ | AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of new claim names as the keys, and upstream claim names as the values. These new claim names will be nested under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients. This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
 |===
 
 

generated/1.20/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go

@@ -138,6 +138,17 @@ type OIDCClaims struct {
 	// the ID token.
 	// +optional
 	Username string `json:"username"`
+
+	// AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the
+	// "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of
+	// new claim names as the keys, and upstream claim names as the values. These new claim names will be nested
+	// under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this
+	// OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients.
+	// This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be
+	// used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims
+	// are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
+	// +optional
+	AdditionalClaimMappings map[string]string `json:"additionalClaimMappings,omitempty"`
 }
 
 // OIDCClient contains information about an OIDC client (e.g., client ID and client

generated/1.20/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go

@@ -438,6 +438,13 @@ func (in *OIDCAuthorizationConfig) DeepCopy() *OIDCAuthorizationConfig {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OIDCClaims) DeepCopyInto(out *OIDCClaims) {
 	*out = *in
+	if in.AdditionalClaimMappings != nil {
+		in, out := &in.AdditionalClaimMappings, &out.AdditionalClaimMappings
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	return
 }
 
@@ -537,7 +544,7 @@ func (in *OIDCIdentityProviderSpec) DeepCopyInto(out *OIDCIdentityProviderSpec)
 		**out = **in
 	}
 	in.AuthorizationConfig.DeepCopyInto(&out.AuthorizationConfig)
-	out.Claims = in.Claims
+	in.Claims.DeepCopyInto(&out.Claims)
 	out.Client = in.Client
 	return
 }

generated/1.20/apis/supervisor/oidc/types_supervisor_oidc.go

@@ -40,6 +40,10 @@ const (
 	// group names which were mapped from the upstream identity provider.
 	IDTokenClaimGroups = "groups"
 
+	// IDTokenClaimAdditionalClaims is the top level claim used to hold additional claims in the downstream ID
+	// token, if any claims are present.
+	IDTokenClaimAdditionalClaims = "additionalClaims"
+
 	// GrantTypeAuthorizationCode is the name of the grant type for authorization code flows defined by the OIDC spec.
 	GrantTypeAuthorizationCode = "authorization_code"
 

generated/1.20/crds/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -185,6 +185,24 @@ spec:
                 description: Claims provides the names of token claims that will be
                   used when inspecting an identity from this OIDC identity provider.
                 properties:
+                  additionalClaimMappings:
+                    additionalProperties:
+                      type: string
+                    description: AdditionalClaimMappings allows for additional arbitrary
+                      upstream claim values to be mapped into the "additionalClaims"
+                      claim of the ID tokens generated by the Supervisor. This should
+                      be specified as a map of new claim names as the keys, and upstream
+                      claim names as the values. These new claim names will be nested
+                      under the top-level "additionalClaims" claim in ID tokens generated
+                      by the Supervisor when this OIDCIdentityProvider was used for
+                      user authentication. These claims will be made available to
+                      all clients. This feature is not required to use the Supervisor
+                      to provide authentication for Kubernetes clusters, but can be
+                      used when using the Supervisor for other authentication purposes.
+                      When this map is empty or the upstream claims are not available,
+                      the "additionalClaims" claim will be excluded from the ID tokens
+                      generated by the Supervisor.
+                    type: object
                   groups:
                     description: Groups provides the name of the ID token claim or
                       userinfo endpoint response claim that will be used to ascertain

generated/1.21/README.adoc

@@ -1391,6 +1391,7 @@ OIDCClaims provides a mapping from upstream claims into identities.
 | Field | Description
 | *`groups`* __string__ | Groups provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain the groups to which an identity belongs. By default, the identities will not include any group memberships when this setting is not configured.
 | *`username`* __string__ | Username provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain an identity's username. When not set, the username will be an automatically constructed unique string which will include the issuer URL of your OIDC provider along with the value of the "sub" (subject) claim from the ID token.
+| *`additionalClaimMappings`* __object (keys:string, values:string)__ | AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of new claim names as the keys, and upstream claim names as the values. These new claim names will be nested under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients. This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
 |===
 
 

generated/1.21/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go

@@ -138,6 +138,17 @@ type OIDCClaims struct {
 	// the ID token.
 	// +optional
 	Username string `json:"username"`
+
+	// AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the
+	// "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of
+	// new claim names as the keys, and upstream claim names as the values. These new claim names will be nested
+	// under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this
+	// OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients.
+	// This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be
+	// used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims
+	// are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
+	// +optional
+	AdditionalClaimMappings map[string]string `json:"additionalClaimMappings,omitempty"`
 }
 
 // OIDCClient contains information about an OIDC client (e.g., client ID and client

generated/1.21/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go

@@ -438,6 +438,13 @@ func (in *OIDCAuthorizationConfig) DeepCopy() *OIDCAuthorizationConfig {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OIDCClaims) DeepCopyInto(out *OIDCClaims) {
 	*out = *in
+	if in.AdditionalClaimMappings != nil {
+		in, out := &in.AdditionalClaimMappings, &out.AdditionalClaimMappings
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	return
 }
 
@@ -537,7 +544,7 @@ func (in *OIDCIdentityProviderSpec) DeepCopyInto(out *OIDCIdentityProviderSpec)
 		**out = **in
 	}
 	in.AuthorizationConfig.DeepCopyInto(&out.AuthorizationConfig)
-	out.Claims = in.Claims
+	in.Claims.DeepCopyInto(&out.Claims)
 	out.Client = in.Client
 	return
 }

generated/1.21/apis/supervisor/oidc/types_supervisor_oidc.go

@@ -40,6 +40,10 @@ const (
 	// group names which were mapped from the upstream identity provider.
 	IDTokenClaimGroups = "groups"
 
+	// IDTokenClaimAdditionalClaims is the top level claim used to hold additional claims in the downstream ID
+	// token, if any claims are present.
+	IDTokenClaimAdditionalClaims = "additionalClaims"
+
 	// GrantTypeAuthorizationCode is the name of the grant type for authorization code flows defined by the OIDC spec.
 	GrantTypeAuthorizationCode = "authorization_code"
 

generated/1.21/crds/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -185,6 +185,24 @@ spec:
                 description: Claims provides the names of token claims that will be
                   used when inspecting an identity from this OIDC identity provider.
                 properties:
+                  additionalClaimMappings:
+                    additionalProperties:
+                      type: string
+                    description: AdditionalClaimMappings allows for additional arbitrary
+                      upstream claim values to be mapped into the "additionalClaims"
+                      claim of the ID tokens generated by the Supervisor. This should
+                      be specified as a map of new claim names as the keys, and upstream
+                      claim names as the values. These new claim names will be nested
+                      under the top-level "additionalClaims" claim in ID tokens generated
+                      by the Supervisor when this OIDCIdentityProvider was used for
+                      user authentication. These claims will be made available to
+                      all clients. This feature is not required to use the Supervisor
+                      to provide authentication for Kubernetes clusters, but can be
+                      used when using the Supervisor for other authentication purposes.
+                      When this map is empty or the upstream claims are not available,
+                      the "additionalClaims" claim will be excluded from the ID tokens
+                      generated by the Supervisor.
+                    type: object
                   groups:
                     description: Groups provides the name of the ID token claim or
                       userinfo endpoint response claim that will be used to ascertain

generated/1.22/README.adoc

@@ -1391,6 +1391,7 @@ OIDCClaims provides a mapping from upstream claims into identities.
 | Field | Description
 | *`groups`* __string__ | Groups provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain the groups to which an identity belongs. By default, the identities will not include any group memberships when this setting is not configured.
 | *`username`* __string__ | Username provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain an identity's username. When not set, the username will be an automatically constructed unique string which will include the issuer URL of your OIDC provider along with the value of the "sub" (subject) claim from the ID token.
+| *`additionalClaimMappings`* __object (keys:string, values:string)__ | AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of new claim names as the keys, and upstream claim names as the values. These new claim names will be nested under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients. This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
 |===
 
 

generated/1.22/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go

@@ -138,6 +138,17 @@ type OIDCClaims struct {
 	// the ID token.
 	// +optional
 	Username string `json:"username"`
+
+	// AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the
+	// "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of
+	// new claim names as the keys, and upstream claim names as the values. These new claim names will be nested
+	// under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this
+	// OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients.
+	// This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be
+	// used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims
+	// are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
+	// +optional
+	AdditionalClaimMappings map[string]string `json:"additionalClaimMappings,omitempty"`
 }
 
 // OIDCClient contains information about an OIDC client (e.g., client ID and client

generated/1.22/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go

@@ -438,6 +438,13 @@ func (in *OIDCAuthorizationConfig) DeepCopy() *OIDCAuthorizationConfig {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OIDCClaims) DeepCopyInto(out *OIDCClaims) {
 	*out = *in
+	if in.AdditionalClaimMappings != nil {
+		in, out := &in.AdditionalClaimMappings, &out.AdditionalClaimMappings
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	return
 }
 
@@ -537,7 +544,7 @@ func (in *OIDCIdentityProviderSpec) DeepCopyInto(out *OIDCIdentityProviderSpec)
 		**out = **in
 	}
 	in.AuthorizationConfig.DeepCopyInto(&out.AuthorizationConfig)
-	out.Claims = in.Claims
+	in.Claims.DeepCopyInto(&out.Claims)
 	out.Client = in.Client
 	return
 }

generated/1.22/apis/supervisor/oidc/types_supervisor_oidc.go

@@ -40,6 +40,10 @@ const (
 	// group names which were mapped from the upstream identity provider.
 	IDTokenClaimGroups = "groups"
 
+	// IDTokenClaimAdditionalClaims is the top level claim used to hold additional claims in the downstream ID
+	// token, if any claims are present.
+	IDTokenClaimAdditionalClaims = "additionalClaims"
+
 	// GrantTypeAuthorizationCode is the name of the grant type for authorization code flows defined by the OIDC spec.
 	GrantTypeAuthorizationCode = "authorization_code"
 

generated/1.22/crds/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -185,6 +185,24 @@ spec:
                 description: Claims provides the names of token claims that will be
                   used when inspecting an identity from this OIDC identity provider.
                 properties:
+                  additionalClaimMappings:
+                    additionalProperties:
+                      type: string
+                    description: AdditionalClaimMappings allows for additional arbitrary
+                      upstream claim values to be mapped into the "additionalClaims"
+                      claim of the ID tokens generated by the Supervisor. This should
+                      be specified as a map of new claim names as the keys, and upstream
+                      claim names as the values. These new claim names will be nested
+                      under the top-level "additionalClaims" claim in ID tokens generated
+                      by the Supervisor when this OIDCIdentityProvider was used for
+                      user authentication. These claims will be made available to
+                      all clients. This feature is not required to use the Supervisor
+                      to provide authentication for Kubernetes clusters, but can be
+                      used when using the Supervisor for other authentication purposes.
+                      When this map is empty or the upstream claims are not available,
+                      the "additionalClaims" claim will be excluded from the ID tokens
+                      generated by the Supervisor.
+                    type: object
                   groups:
                     description: Groups provides the name of the ID token claim or
                       userinfo endpoint response claim that will be used to ascertain

generated/1.23/README.adoc

@@ -1391,6 +1391,7 @@ OIDCClaims provides a mapping from upstream claims into identities.
 | Field | Description
 | *`groups`* __string__ | Groups provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain the groups to which an identity belongs. By default, the identities will not include any group memberships when this setting is not configured.
 | *`username`* __string__ | Username provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain an identity's username. When not set, the username will be an automatically constructed unique string which will include the issuer URL of your OIDC provider along with the value of the "sub" (subject) claim from the ID token.
+| *`additionalClaimMappings`* __object (keys:string, values:string)__ | AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of new claim names as the keys, and upstream claim names as the values. These new claim names will be nested under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients. This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
 |===
 
 

generated/1.23/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go

@@ -138,6 +138,17 @@ type OIDCClaims struct {
 	// the ID token.
 	// +optional
 	Username string `json:"username"`
+
+	// AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the
+	// "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of
+	// new claim names as the keys, and upstream claim names as the values. These new claim names will be nested
+	// under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this
+	// OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients.
+	// This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be
+	// used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims
+	// are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
+	// +optional
+	AdditionalClaimMappings map[string]string `json:"additionalClaimMappings,omitempty"`
 }
 
 // OIDCClient contains information about an OIDC client (e.g., client ID and client

generated/1.23/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go

@@ -438,6 +438,13 @@ func (in *OIDCAuthorizationConfig) DeepCopy() *OIDCAuthorizationConfig {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OIDCClaims) DeepCopyInto(out *OIDCClaims) {
 	*out = *in
+	if in.AdditionalClaimMappings != nil {
+		in, out := &in.AdditionalClaimMappings, &out.AdditionalClaimMappings
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	return
 }
 
@@ -537,7 +544,7 @@ func (in *OIDCIdentityProviderSpec) DeepCopyInto(out *OIDCIdentityProviderSpec)
 		**out = **in
 	}
 	in.AuthorizationConfig.DeepCopyInto(&out.AuthorizationConfig)
-	out.Claims = in.Claims
+	in.Claims.DeepCopyInto(&out.Claims)
 	out.Client = in.Client
 	return
 }

generated/1.23/apis/supervisor/oidc/types_supervisor_oidc.go

@@ -40,6 +40,10 @@ const (
 	// group names which were mapped from the upstream identity provider.
 	IDTokenClaimGroups = "groups"
 
+	// IDTokenClaimAdditionalClaims is the top level claim used to hold additional claims in the downstream ID
+	// token, if any claims are present.
+	IDTokenClaimAdditionalClaims = "additionalClaims"
+
 	// GrantTypeAuthorizationCode is the name of the grant type for authorization code flows defined by the OIDC spec.
 	GrantTypeAuthorizationCode = "authorization_code"
 

generated/1.23/crds/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -185,6 +185,24 @@ spec:
                 description: Claims provides the names of token claims that will be
                   used when inspecting an identity from this OIDC identity provider.
                 properties:
+                  additionalClaimMappings:
+                    additionalProperties:
+                      type: string
+                    description: AdditionalClaimMappings allows for additional arbitrary
+                      upstream claim values to be mapped into the "additionalClaims"
+                      claim of the ID tokens generated by the Supervisor. This should
+                      be specified as a map of new claim names as the keys, and upstream
+                      claim names as the values. These new claim names will be nested
+                      under the top-level "additionalClaims" claim in ID tokens generated
+                      by the Supervisor when this OIDCIdentityProvider was used for
+                      user authentication. These claims will be made available to
+                      all clients. This feature is not required to use the Supervisor
+                      to provide authentication for Kubernetes clusters, but can be
+                      used when using the Supervisor for other authentication purposes.
+                      When this map is empty or the upstream claims are not available,
+                      the "additionalClaims" claim will be excluded from the ID tokens
+                      generated by the Supervisor.
+                    type: object
                   groups:
                     description: Groups provides the name of the ID token claim or
                       userinfo endpoint response claim that will be used to ascertain

generated/1.24/README.adoc

@@ -1391,6 +1391,7 @@ OIDCClaims provides a mapping from upstream claims into identities.
 | Field | Description
 | *`groups`* __string__ | Groups provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain the groups to which an identity belongs. By default, the identities will not include any group memberships when this setting is not configured.
 | *`username`* __string__ | Username provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain an identity's username. When not set, the username will be an automatically constructed unique string which will include the issuer URL of your OIDC provider along with the value of the "sub" (subject) claim from the ID token.
+| *`additionalClaimMappings`* __object (keys:string, values:string)__ | AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of new claim names as the keys, and upstream claim names as the values. These new claim names will be nested under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients. This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
 |===
 
 

generated/1.24/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go

@@ -138,6 +138,17 @@ type OIDCClaims struct {
 	// the ID token.
 	// +optional
 	Username string `json:"username"`
+
+	// AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the
+	// "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of
+	// new claim names as the keys, and upstream claim names as the values. These new claim names will be nested
+	// under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this
+	// OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients.
+	// This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be
+	// used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims
+	// are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
+	// +optional
+	AdditionalClaimMappings map[string]string `json:"additionalClaimMappings,omitempty"`
 }
 
 // OIDCClient contains information about an OIDC client (e.g., client ID and client

generated/1.24/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go

@@ -438,6 +438,13 @@ func (in *OIDCAuthorizationConfig) DeepCopy() *OIDCAuthorizationConfig {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OIDCClaims) DeepCopyInto(out *OIDCClaims) {
 	*out = *in
+	if in.AdditionalClaimMappings != nil {
+		in, out := &in.AdditionalClaimMappings, &out.AdditionalClaimMappings
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	return
 }
 
@@ -537,7 +544,7 @@ func (in *OIDCIdentityProviderSpec) DeepCopyInto(out *OIDCIdentityProviderSpec)
 		**out = **in
 	}
 	in.AuthorizationConfig.DeepCopyInto(&out.AuthorizationConfig)
-	out.Claims = in.Claims
+	in.Claims.DeepCopyInto(&out.Claims)
 	out.Client = in.Client
 	return
 }

generated/1.24/apis/supervisor/oidc/types_supervisor_oidc.go

@@ -40,6 +40,10 @@ const (
 	// group names which were mapped from the upstream identity provider.
 	IDTokenClaimGroups = "groups"
 
+	// IDTokenClaimAdditionalClaims is the top level claim used to hold additional claims in the downstream ID
+	// token, if any claims are present.
+	IDTokenClaimAdditionalClaims = "additionalClaims"
+
 	// GrantTypeAuthorizationCode is the name of the grant type for authorization code flows defined by the OIDC spec.
 	GrantTypeAuthorizationCode = "authorization_code"
 

generated/1.24/crds/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -185,6 +185,24 @@ spec:
                 description: Claims provides the names of token claims that will be
                   used when inspecting an identity from this OIDC identity provider.
                 properties:
+                  additionalClaimMappings:
+                    additionalProperties:
+                      type: string
+                    description: AdditionalClaimMappings allows for additional arbitrary
+                      upstream claim values to be mapped into the "additionalClaims"
+                      claim of the ID tokens generated by the Supervisor. This should
+                      be specified as a map of new claim names as the keys, and upstream
+                      claim names as the values. These new claim names will be nested
+                      under the top-level "additionalClaims" claim in ID tokens generated
+                      by the Supervisor when this OIDCIdentityProvider was used for
+                      user authentication. These claims will be made available to
+                      all clients. This feature is not required to use the Supervisor
+                      to provide authentication for Kubernetes clusters, but can be
+                      used when using the Supervisor for other authentication purposes.
+                      When this map is empty or the upstream claims are not available,
+                      the "additionalClaims" claim will be excluded from the ID tokens
+                      generated by the Supervisor.
+                    type: object
                   groups:
                     description: Groups provides the name of the ID token claim or
                       userinfo endpoint response claim that will be used to ascertain

generated/1.25/README.adoc

@@ -1387,6 +1387,7 @@ OIDCClaims provides a mapping from upstream claims into identities.
 | Field | Description
 | *`groups`* __string__ | Groups provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain the groups to which an identity belongs. By default, the identities will not include any group memberships when this setting is not configured.
 | *`username`* __string__ | Username provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain an identity's username. When not set, the username will be an automatically constructed unique string which will include the issuer URL of your OIDC provider along with the value of the "sub" (subject) claim from the ID token.
+| *`additionalClaimMappings`* __object (keys:string, values:string)__ | AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of new claim names as the keys, and upstream claim names as the values. These new claim names will be nested under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients. This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
 |===
 
 

generated/1.25/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go

@@ -138,6 +138,17 @@ type OIDCClaims struct {
 	// the ID token.
 	// +optional
 	Username string `json:"username"`
+
+	// AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the
+	// "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of
+	// new claim names as the keys, and upstream claim names as the values. These new claim names will be nested
+	// under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this
+	// OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients.
+	// This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be
+	// used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims
+	// are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
+	// +optional
+	AdditionalClaimMappings map[string]string `json:"additionalClaimMappings,omitempty"`
 }
 
 // OIDCClient contains information about an OIDC client (e.g., client ID and client

generated/1.25/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go

@@ -438,6 +438,13 @@ func (in *OIDCAuthorizationConfig) DeepCopy() *OIDCAuthorizationConfig {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OIDCClaims) DeepCopyInto(out *OIDCClaims) {
 	*out = *in
+	if in.AdditionalClaimMappings != nil {
+		in, out := &in.AdditionalClaimMappings, &out.AdditionalClaimMappings
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	return
 }
 
@@ -537,7 +544,7 @@ func (in *OIDCIdentityProviderSpec) DeepCopyInto(out *OIDCIdentityProviderSpec)
 		**out = **in
 	}
 	in.AuthorizationConfig.DeepCopyInto(&out.AuthorizationConfig)
-	out.Claims = in.Claims
+	in.Claims.DeepCopyInto(&out.Claims)
 	out.Client = in.Client
 	return
 }

generated/1.25/apis/supervisor/oidc/types_supervisor_oidc.go

@@ -40,6 +40,10 @@ const (
 	// group names which were mapped from the upstream identity provider.
 	IDTokenClaimGroups = "groups"
 
+	// IDTokenClaimAdditionalClaims is the top level claim used to hold additional claims in the downstream ID
+	// token, if any claims are present.
+	IDTokenClaimAdditionalClaims = "additionalClaims"
+
 	// GrantTypeAuthorizationCode is the name of the grant type for authorization code flows defined by the OIDC spec.
 	GrantTypeAuthorizationCode = "authorization_code"
 

generated/1.25/crds/idp.supervisor.pinniped.dev_oidcidentityproviders.yaml

@@ -185,6 +185,24 @@ spec:
                 description: Claims provides the names of token claims that will be
                   used when inspecting an identity from this OIDC identity provider.
                 properties:
+                  additionalClaimMappings:
+                    additionalProperties:
+                      type: string
+                    description: AdditionalClaimMappings allows for additional arbitrary
+                      upstream claim values to be mapped into the "additionalClaims"
+                      claim of the ID tokens generated by the Supervisor. This should
+                      be specified as a map of new claim names as the keys, and upstream
+                      claim names as the values. These new claim names will be nested
+                      under the top-level "additionalClaims" claim in ID tokens generated
+                      by the Supervisor when this OIDCIdentityProvider was used for
+                      user authentication. These claims will be made available to
+                      all clients. This feature is not required to use the Supervisor
+                      to provide authentication for Kubernetes clusters, but can be
+                      used when using the Supervisor for other authentication purposes.
+                      When this map is empty or the upstream claims are not available,
+                      the "additionalClaims" claim will be excluded from the ID tokens
+                      generated by the Supervisor.
+                    type: object
                   groups:
                     description: Groups provides the name of the ID token claim or
                       userinfo endpoint response claim that will be used to ascertain

generated/latest/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go

@@ -138,6 +138,17 @@ type OIDCClaims struct {
 	// the ID token.
 	// +optional
 	Username string `json:"username"`
+
+	// AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the
+	// "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of
+	// new claim names as the keys, and upstream claim names as the values. These new claim names will be nested
+	// under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this
+	// OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients.
+	// This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be
+	// used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims
+	// are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor.
+	// +optional
+	AdditionalClaimMappings map[string]string `json:"additionalClaimMappings,omitempty"`
 }
 
 // OIDCClient contains information about an OIDC client (e.g., client ID and client

generated/latest/apis/supervisor/idp/v1alpha1/zz_generated.deepcopy.go

@@ -438,6 +438,13 @@ func (in *OIDCAuthorizationConfig) DeepCopy() *OIDCAuthorizationConfig {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OIDCClaims) DeepCopyInto(out *OIDCClaims) {
 	*out = *in
+	if in.AdditionalClaimMappings != nil {
+		in, out := &in.AdditionalClaimMappings, &out.AdditionalClaimMappings
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	return
 }
 
@@ -537,7 +544,7 @@ func (in *OIDCIdentityProviderSpec) DeepCopyInto(out *OIDCIdentityProviderSpec)
 		**out = **in
 	}
 	in.AuthorizationConfig.DeepCopyInto(&out.AuthorizationConfig)
-	out.Claims = in.Claims
+	in.Claims.DeepCopyInto(&out.Claims)
 	out.Client = in.Client
 	return
 }

generated/latest/apis/supervisor/oidc/types_supervisor_oidc.go

@@ -40,6 +40,10 @@ const (
 	// group names which were mapped from the upstream identity provider.
 	IDTokenClaimGroups = "groups"
 
+	// IDTokenClaimAdditionalClaims is the top level claim used to hold additional claims in the downstream ID
+	// token, if any claims are present.
+	IDTokenClaimAdditionalClaims = "additionalClaims"
+
 	// GrantTypeAuthorizationCode is the name of the grant type for authorization code flows defined by the OIDC spec.
 	GrantTypeAuthorizationCode = "authorization_code"