Request groups scope for whynot OIDC role

2026-06-28 13:23:14 +02:00
parent adf865611c
commit 3527bc1cae
7 changed files with 74 additions and 5 deletions
--- a/schemas/credential-change-request.schema.yaml
+++ b/schemas/credential-change-request.schema.yaml
@@ -86,6 +86,7 @@ workload_kv_read:
      required:
        - allowed_redirect_uris
      allowed_redirect_uris: non-empty list of OpenBao callback URIs accepted by the role
+      groups_claim: requires openbao.auth.oidc_scopes to include groups

 access_frontdoor_readiness:
  allowed: