Customize OIDC audience

Spacelift’s OIDC tokens always have their audience set to your Spacelift hostname. However, many OIDC consumers require that they be able to set their own audience. Such consumers work on HCP Terraform because it allows you to set TFC_WORKLOAD_IDENTITY_AUDIENCE [1] to customize the token’s audience, but Spacelift offers no such feature.

[1] https://developer.hashicorp.com/terraform/cloud-docs/dynamic-provider-credentials/manual-generation

Workaround
Don't use OIDC and instead give Spacelift static credentials to auth to third parties. This is sub-optimal from both a security perspective (longer lived tokens) and a convenience standpoint (need to rotate secrets periodically).
Problem
-

Please authenticate to join the conversation.

Upvoters
Status

👀 In Review

Board

💡 Feature Requests

Date

2 days ago

Subscribe to post

Get notified by email when there are changes.