Workforce Identity Provider
WorkforceIdentityProvider
Defines the high-level intent for integrating external workforce identity systems.
Establishes a federated trust boundary connecting external Identity Providers (e.g. Google Workspace, Microsoft Entra ID) to the platform via SAML or OIDC to enable workforce Single Sign-On with attribute-based access controls. NOTE: the engine does not yet provision this resource — the executor is currently a no-op, so the spec fields below are declared in the schema but not acted upon.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as a WorkforceIdentityProvider so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant WorkforceIdentityProvider. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Reserved keys are read by the engine to resolve this manifest's identity and to locate its parent PublicIngress in the dependency graph. |
| spec | Spec | Desired workforce identity provider configuration. The authoritative, user-authored specification for this workforce identity provider. See Spec. |
Spec
User-authored workforce identity provider configuration.
Protocol-specific settings (SAML or OIDC), attribute mapping, and a conditional access expression for federating an external workforce IdP. NOT YET IMPLEMENTED: the executor does not currently read these fields, so no workforce pool provider is provisioned.
| Property | Type | Description |
|---|---|---|
| description | string | Human-readable description of this workforce provider. Optional free text describing the role of this provider. Used as context by AI assistants when reasoning about the manifest; not propagated onto any provisioned resource. |
| disabled | bool | Disable this workforce identity provider. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: when true, disable the provisioned workforce pool provider. |
| attributeMapping | list of AttributeMappingEntry | IdP-to-Google attribute mapping. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: map attributes from the external identity provider to Google Cloud attributes (e.g. google.subject). |
| attributeCondition | string | Attribute-based access condition. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: a CEL expression that must evaluate to true for an identity to be authenticated. |
| expireTime | string | Provider expiration time. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: the RFC3339 timestamp at which the workforce pool provider expires. |
| saml | Saml | SAML provider configuration. See Saml. NOT YET IMPLEMENTED: not currently read by the engine. |
| oidc | Oidc | OIDC provider configuration. See Oidc. NOT YET IMPLEMENTED: not currently read by the engine. |
AttributeMappingEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |
Oidc
OIDC provider settings.
Configuration for an OIDC-based workforce identity provider.
| Property | Type | Description |
|---|---|---|
| issuerUri | string | OIDC issuer URI. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: the OIDC issuer (discovery) URI identifying the external provider. |
| clientId | string | OIDC client ID. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: the OAuth 2.0 client ID registered with the external provider. |
| webSsoConfig | WebSsoConfig | Web SSO configuration. See WebSsoConfig. NOT YET IMPLEMENTED: not currently read by the engine. |
| jwksJson | string | OIDC JWKS document. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: the JSON Web Key Set (JWKS) used to verify tokens issued by the OIDC provider. |
WebSsoConfig
OIDC web SSO behavior.
Controls the browser-based OIDC sign-in flow: response type, how assertion claims are resolved, and any extra scopes requested.
| Property | Type | Description |
|---|---|---|
| responseType | string | OIDC response type. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: select the OAuth 2.0 response type for the web SSO flow; one of CODE or ID_TOKEN. |
| assertionClaimsBehavior | string | Assertion claims resolution behavior. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: choose how claims are resolved; one of MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS or ONLY_ID_TOKEN_CLAIMS. |
| additionalScopes | list of string | Additional OIDC scopes. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: request these extra OAuth scopes during the web SSO flow beyond the defaults. |
Saml
SAML provider settings.
Configuration for a SAML-based workforce identity provider.
| Property | Type | Description |
|---|---|---|
| idpMetadataXml | string | SAML IdP metadata XML. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: supply the external IdP's SAML metadata XML document used to establish the SAML trust. |