Include full space ancestry in OIDC token claims
The client is requesting an additional claim —spaceAncestry— that represents the full hierarchy of the space structure.
Example:
For a hierarchy structured as:
root > parent > child A stack in the child space currently receives an OIDC token containing:
spaceId = child The proposed enhancement would include an additional claim such as:
spaceAncestry = root;parent;childThis would enable orgs to make more dynamic and hierarchical authorization decisions, particularly in integrations with identity systems like Google Cloud Workload Identity Federation (WIF). For example, when provisioning GCP service accounts and corresponding Spacelift contexts automatically, policies could be written to recognize all descendant spaces within a hierarchy — ensuring permission inheritance without manual updates whenever new child spaces are added.
Log in to comment and vote
Comments24
Sep 25
PinnedDear Upvoters, letting you know that this feature has been released; now the space hierarchy is always present as a custom claim. Just keep in mind that only certain cloud providers are able to access it (AWS is not one of them, but Google Cloud is).
In case you are using AWS (or any other CP, actually), remember that you can customize the content of the OIDC sub by changing the template on which it is constructed, and the SpacePath is one of the elements that can be included there. If you go this way, please make sure to also update anything that needs to evaluate that sub; otherwise, compatibility will break.
You can check the related documentation here for more detailed explanations.
If you have any doubts, please be sure to post them here, and I’ll respond as quickly as possible.
Red Berry
Nov 13, 2025
•Merged request
•13 votes
Allow adding space hierarchy in OIDC subject
Request: Have a option in Spacelift to enable full space hierarchy in the space claim in the OIDC subject.e.g.
Default. behavior:
space:<space_id>:<rest of the claims>Proposed feature enabled:
space:root→space1_id→space1_child_id:<rest of the claims>Black Breeze
May 14, 2025
Hey! I am going to merge this with other tickets that talk about customizing either OIDC `sub` or custom claims. I personally think this work has a great return on investment, I just need to make sure we implement the right thing the right way, and we don’t miss any security aspects.
One of my main questions here is - at which level is the OIDC token customized. The safest bet I can think of is account (perhaps in security settings), but is it granular enough?
Tan Duck
Feb 9
•Merged request
•1 vote
Custom session attributes for AWS intergration
Azure Chipmunk
Feb 9
Responding to
https://github.com/spacelift-io/user-documentation/pull/1065
If adding a label to a stack is the only way to add session tags to OIDC auth (when not using the AWS integration), then this isn’t particularly useful for my use case. I would need this enabled for ALL stacks that auth to AWS. Since we can’t auto-label all stacks, it would require all stacks to explicitly have the label being added.
Is there no way to trigger/control this centrally? Maybe via an org setting?
Tomato Melon
Sep 25
Hey,
Just wanted to tell you that this has been implemented; now the space hierarchy is always present as a custom claim. Just keep in mind that only certain cloud providers are able to access it (AWS is not one of them, but Google Cloud is).
In case you are using AWS (or any other CP, actually), remember that you can customize the content of the OIDC sub by changing the template on which it is constructed, and the SpacePath is one of the elements that can be included there. If you go this way, please make sure to also update anything that needs to evaluate that sub; otherwise, compatibility will break.
You can check the related documentation here for more detailed explanations.
If you have any doubts, please be sure to post them here, and I’ll respond as quickly as possible.
Cheers!