debug-oidc-claims

The debug-oidc-claims provider previews the claims of an OpenID Connect (OIDC) token from Pulumi ESC. It signs nothing and returns no credential. Use it to find the iss, sub, and aud values that a relying party must trust before you mint a real token with fn::open::oidc.

Workflow

1. Add a fn::open::debug-oidc-claims block with the inputs you plan to give fn::open::oidc, and save the environment:

   values:
     registry:
       login:
         fn::open::debug-oidc-claims:
           audience: https://registry.example.com
           identityToken:
             version: v2
   

2. Open the environment, in the Pulumi Cloud console or with pulumi env open, and read the claims:

   {
     "registry": {
       "login": {
         "aud": "https://registry.example.com",
         "https://pulumi.com/actor": "<user-login>",
         "https://pulumi.com/actor_id": "<user-id>",
         "https://pulumi.com/current_env": "<project>/<environment>",
         "https://pulumi.com/current_env_id": "<environment-id>",
         "https://pulumi.com/org": "<org-name>",
         "https://pulumi.com/org_id": "<org-id>",
         "https://pulumi.com/root_env": "<project>/<environment>",
         "https://pulumi.com/root_env_id": "<environment-id>",
         "iss": "https://api.pulumi.com/oidc/v2",
         "sub": "pulumi:org:<org-id>:env:<environment-id>"
       }
     }
   }
   

3. Copy iss, sub, and aud into the relying party’s trust configuration. For examples, see Configure a relying party for custom-audience OIDC tokens.

4. Change fn::open::debug-oidc-claims to fn::open::oidc. Keep the other inputs as they are. The environment now returns a signed token with the claims you previewed.

The preview leaves out iat, nbf, exp, and jti. Pulumi sets those claims when it signs a token. For what each claim means, see Token claims.

Schema reference

Inputs

With identityToken.version set to v2, the provider takes the same inputs as fn::open::oidc, with the same rules:

Outputs

An object keyed by claim name, holding the claims a token would carry. Nothing is signed.

Preview the vendor login claims

With identityToken.version set to v1, the provider previews the claims that the vendor login providers, such as aws-login, send from the https://api.pulumi.com/oidc issuer. Default token claim describes those claims. In this form, set audiencePrefix (required) and optionally subjectAttributes. The provider refuses audience and duration here.

values:
  preview:
    fn::open::debug-oidc-claims:
      audiencePrefix: aws
      identityToken:
        version: v1

This preview omits iss, iat, and exp. The signed vendor tokens carry them.

Troubleshooting

With identityToken.version set to v2, the provider refuses the same inputs as fn::open::oidc, with debug-oidc-claims in the message. See its troubleshooting section.

Inputs from the wrong form

Symptom: opening fails with fn::open::debug-oidc-claims accepts audience only with identityToken.version: v2; identityToken.version: v1 takes audiencePrefix, the same message for duration, or audiencePrefix is required with identityToken.version: v1; set identityToken.version: v2 for the fn::open::oidc claims.

Cause: identityToken.version selects the form. With v2, the provider takes the fn::open::oidc inputs. With v1, the provider takes audiencePrefix and subjectAttributes.

Fix: to preview a fn::open::oidc token, set identityToken.version: v2 and remove audiencePrefix. To preview the vendor login claims, set identityToken.version: v1, remove audience and duration, and set audiencePrefix.

Version not set

Symptom: opening fails with fn::open::debug-oidc-claims requires identityToken.version: v1 for the vendor login claims or v2 for the fn::open::oidc claims.

Cause: the block has no identityToken.version. The provider never guesses which claims to preview.

Fix: add identityToken.version: v2 to preview a fn::open::oidc token, or identityToken.version: v1 to preview the vendor login claims.

Environment not saved

Symptom: opening fails with fn::open::debug-oidc-claims cannot run in an unsaved environment document; save the environment and import it.

Cause: the fn::open::oidc subject uses the environment’s ID, and an unsaved environment document has no ID yet.

Fix: save the environment that declares the block, then open it.