From 784987122b0ab7a00106dab3660180b174d4a8e1 Mon Sep 17 00:00:00 2001 From: Matti Jansson Date: Fri, 3 Jul 2026 15:36:27 +0200 Subject: [PATCH 1/2] docs(Auth): Description of OIDC_ALL identity type Issue: #8636 --- docs/operator/configuration.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/docs/operator/configuration.md b/docs/operator/configuration.md index 3f3b22951c8..773c5c58346 100644 --- a/docs/operator/configuration.md +++ b/docs/operator/configuration.md @@ -29,7 +29,7 @@ is created, you need to create and attach an identity to this account: --email jdoe@blahblih.com --account jdoe ``` -The list of possible identity types is X509, GSS, USERPASS, SSH, OIDC: +The list of possible identity types is X509, GSS, USERPASS, SSH, OIDC, OIDC_ALL: ```bash $ rucio-admin account list-identities jdoe @@ -80,6 +80,21 @@ the `SSLOptions` directive looks like this: SSLOptions +StdEnvVars +LegacyDNStringFormat ``` +### OIDC_ALL identity format + +OIDC_ALL identities are used to enable access to data without managing individual +user. For example two experiments having a memorandum of understanding and sharing +data while not keep track of each others users. + +It is configured using only the OIDC provider as the identity and all users having +valid OIDC tokens will be mapped to one account. + +Example +```bash + $ rucio account identity add --id 'ISS=https://iam-test.ch/' --type OIDC_ALL --email someone@iam-test.ch externaluser + Added new identity to account: ISS=https://iam-test.ch/-externaluser +``` + ## Creating scope One needs then to create some scopes associated with the accounts: From 6b997ce92f623365751461b5cb0b43878057d8c7 Mon Sep 17 00:00:00 2001 From: "pre-commit-ci[bot]" <66853113+pre-commit-ci[bot]@users.noreply.github.com> Date: Fri, 3 Jul 2026 13:39:09 +0000 Subject: [PATCH 2/2] [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --- docs/operator/configuration.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/operator/configuration.md b/docs/operator/configuration.md index 773c5c58346..789edea959d 100644 --- a/docs/operator/configuration.md +++ b/docs/operator/configuration.md @@ -82,12 +82,12 @@ SSLOptions +StdEnvVars +LegacyDNStringFormat ### OIDC_ALL identity format -OIDC_ALL identities are used to enable access to data without managing individual -user. For example two experiments having a memorandum of understanding and sharing -data while not keep track of each others users. +OIDC_ALL identities are used to enable access to data without managing individual +user. For example two experiments having a memorandum of understanding and sharing +data while not keep track of each others users. It is configured using only the OIDC provider as the identity and all users having -valid OIDC tokens will be mapped to one account. +valid OIDC tokens will be mapped to one account. Example ```bash