From 57afbeed2f5622a6328c48a1368639cc6287e20a Mon Sep 17 00:00:00 2001 From: Pritha Srivastava Date: Wed, 5 Aug 2020 11:27:59 +0530 Subject: [PATCH] rgw/sts: adding documentation for a shadow user created for a user that authenticates with oidc provider. Signed-off-by: Pritha Srivastava --- doc/radosgw/STS.rst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/doc/radosgw/STS.rst b/doc/radosgw/STS.rst index 6e2dfe119aef..d843ea5d37c1 100644 --- a/doc/radosgw/STS.rst +++ b/doc/radosgw/STS.rst @@ -71,6 +71,10 @@ is of the form:: The app_id in the condition above must match the 'aud' field of the incoming token. +A shadow user is created corresponding to every federated user. The user id is derived from the 'sub' field of the incoming web token. +The user is created in a separate namespace - 'oidc' such that the user id doesn't clash with any other user ids in rgw. The format of the user id +is - $$ where user-namespace is 'oidc' for users that authenticate with oidc providers. + STS Configuration ================= -- 2.47.3