Include full space ancestry in OIDC token claims

The client is requesting an additional claim —spaceAncestry— that represents the full hierarchy of the space structure.

Example:
For a hierarchy structured as:

root > parent > child 

A stack in the child space currently receives an OIDC token containing:

spaceId = child 

The proposed enhancement would include an additional claim such as:

spaceAncestry = root;parent;child

This would enable orgs to make more dynamic and hierarchical authorization decisions, particularly in integrations with identity systems like Google Cloud Workload Identity Federation (WIF). For example, when provisioning GCP service accounts and corresponding Spacelift contexts automatically, policies could be written to recognize all descendant spaces within a hierarchy — ensuring permission inheritance without manual updates whenever new child spaces are added.

Workaround
-
Problem
-

Please authenticate to join the conversation.

Upvoters
Status

⚙️ In Progress

Board

💡 Feature Requests

Tags

OIDC

Date

3 months ago

Subscribe to post

Get notified by email when there are changes.