Skip to content

docs(Auth): Description of OIDC_ALL identity type #839

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Twokubikmeter wants to merge 2 commits into
base: main
Choose a base branch
from
Open

docs(Auth): Description of OIDC_ALL identity type #839

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7849871
docs(Auth): Description of OIDC_ALL identity type
Jul 3, 2026
6b997ce
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot] Jul 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion docs/operator/configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ is created, you need to create and attach an identity to this account:
--email jdoe@blahblih.com --account jdoe
```

The list of possible identity types is X509, GSS, USERPASS, SSH, OIDC:
The list of possible identity types is X509, GSS, USERPASS, SSH, OIDC, OIDC_ALL:

@rdimaio rdimaio Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocking comment to note that this should be merged after rucio/rucio#8638 is out


```bash
$ rucio-admin account list-identities jdoe
Expand Down Expand Up @@ -80,6 +80,21 @@ the `SSLOptions` directive looks like this:
SSLOptions +StdEnvVars +LegacyDNStringFormat
```

### OIDC_ALL identity format

OIDC_ALL identities are used to enable access to data without managing individual
user. For example two experiments having a memorandum of understanding and sharing

@rdimaio rdimaio Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
user. For example two experiments having a memorandum of understanding and sharing
users. For example two experiments having a memorandum of understanding and sharing

data while not keep track of each others users.

@rdimaio rdimaio Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
data while not keep track of each others users.
data without keeping track of each other's users.


It is configured using only the OIDC provider as the identity and all users having
valid OIDC tokens will be mapped to one account.

Example
```bash
$ rucio account identity add --id 'ISS=https://iam-test.ch/' --type OIDC_ALL --email someone@iam-test.ch externaluser
Added new identity to account: ISS=https://iam-test.ch/-externaluser
```

## Creating scope

One needs then to create some scopes associated with the accounts:
Expand Down