expose oidc scope (#249)

acryldata · Jan 24, 2023 · a8e2042 · a8e2042
1 parent d5dfe26
commit a8e2042
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 6 deletions.
diff --git a/charts/datahub/Chart.yaml b/charts/datahub/Chart.yaml
@@ -14,7 +14,7 @@ dependencies:
     repository: file://./subcharts/datahub-gms
     condition: datahub-gms.enabled
   - name: datahub-frontend
-    version: 0.2.131
+    version: 0.2.132
     repository: file://./subcharts/datahub-frontend
     condition: datahub-frontend.enabled
   - name: datahub-mae-consumer

diff --git a/charts/datahub/subcharts/datahub-frontend/Chart.yaml b/charts/datahub/subcharts/datahub-frontend/Chart.yaml
@@ -12,7 +12,7 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: 0.2.131
+version: 0.2.132
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
 appVersion: v0.9.6.1
diff --git a/charts/datahub/subcharts/datahub-frontend/templates/deployment.yaml b/charts/datahub/subcharts/datahub-frontend/templates/deployment.yaml
@@ -179,7 +179,7 @@ spec:
             - name: AUTH_OIDC_DISCOVERY_URI
               value: https://accounts.google.com/.well-known/openid-configuration
             - name: AUTH_OIDC_SCOPE
-              value: "openid profile email"
+              value: {{ .scope | default "openid profile email" }}
             - name: AUTH_OIDC_USER_NAME_CLAIM
               value: email
             - name: AUTH_OIDC_USER_NAME_CLAIM_REGEX
@@ -188,12 +188,12 @@ spec:
             - name: AUTH_OIDC_DISCOVERY_URI
               value: https://{{ .oktaDomain }}/.well-known/openid-configuration
             - name: AUTH_OIDC_SCOPE
-              value: "openid profile email groups"
+              value: {{ .scope | default "openid profile email groups" }}
             {{- else if eq .provider "azure" }}
             - name: AUTH_OIDC_DISCOVERY_URI
               value: https://login.microsoftonline.com/{{ .azureTenantId }}/v2.0/.well-known/openid-configuration
             - name: AUTH_OIDC_SCOPE
-              value: "openid profile email"
+              value: {{ .scope | default "openid profile email" }}
             {{- else }}
             {{- fail (printf "unsupported .oidcAuthentication.provider value '%s'" .provider) }}
             {{- end }}

diff --git a/charts/datahub/subcharts/datahub-frontend/values.yaml b/charts/datahub/subcharts/datahub-frontend/values.yaml
@@ -72,6 +72,7 @@ ingress:
 oidcAuthentication:
   enabled: false
   # provider: google/okta/azure  <- choose only one
+
   # clientId: your-client-id
   # clientSecret: your-client-secret
   # only needed if you would like to store the client secret in secret
@@ -81,8 +82,10 @@ oidcAuthentication:
   # only needed if provider is `okta`
   # oktaDomain: your-okta-domain.com
 
-  # only neede if provider is `azure`
+  # only needed if provider is `azure`
   # azureTenantId: your-azure-tenant-id
+  # if needed, it should set meaningful defaults from provider
+  # scope: "openid profile email"
 
 # Extra environment variables
 # This will be appended to the current 'env:' key. You can use any of the kubernetes env