From 0063858f751f0e809f705748e17a83e58d591899 Mon Sep 17 00:00:00 2001 From: Tingluo Huang Date: Wed, 20 Nov 2024 09:23:03 -0500 Subject: [PATCH] Doc how to escape ':' in OIDC 'sub' claim. (#53080) Co-authored-by: Steve-Glass <84886334+Steve-Glass@users.noreply.github.com> Co-authored-by: Sophie <29382425+sophietheking@users.noreply.github.com> --- ...-security-hardening-with-openid-connect.md | 23 ++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/content/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect.md b/content/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect.md index fe7842c1a0..13218ea563 100644 --- a/content/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect.md +++ b/content/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect.md @@ -297,7 +297,8 @@ To help improve security, compliance, and standardization, you can customize the Customizing the claims results in a new format for the entire `sub` claim, which replaces the default predefined `sub` format in the token described in "[AUTOTITLE](/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#example-subject-claims)." > [!NOTE] -> The `sub` claim uses the shortened form `repo` (for example, `repo:ORG-NAME/REPO-NAME`) instead of `repository` to reference the repository. +> The `sub` claim uses the shortened form `repo` (for example, `repo:ORG-NAME/REPO-NAME`) instead of `repository` to reference the repository. {% ifversion fpt or ghec or ghes > 3.15 %} +> Any `:` within the context value will be replaced with `%3A`. {% endif %} The following example templates demonstrate various ways to customize the subject claim. To configure these settings on {% data variables.product.prodname_dotcom %}, admins use the REST API to specify a list of claims that must be included in the subject (`sub`) claim. @@ -420,6 +421,26 @@ or: In your cloud provider's OIDC configuration, configure the `sub` condition to require a `repository_owner_id` claim that matches the required value. +{% ifversion fpt or ghec or ghes > 3.15 %} + +#### Example: Context value with `:` + +This example demonstrates how to handle context value with `:`. For example, when the job references an environment named `production:eastus`. + +{% data reusables.actions.use-request-body-api %} + +```json +{ + "include_claim_keys": [ + "environment", + "repository_owner" + ] +} +``` + +In your cloud provider's OIDC configuration, configure the `sub` condition to require that claims must include a specific value for `environment` and `repository_owner`. For example: `"sub": "environment:production%3Aeastus:repository_owner:octo-org"`. +{% endif %} + #### Resetting organization template customizations This example template resets the subject claims to the default format. This template effectively opts out of any organization-level customization policy.