Receiver.spec.oidcProviders
OIDCProviders specifies the OIDC providers used to authenticate incoming requests when Type is 'generic-oidc'. The provider whose IssuerURL matches the token's 'iss' claim is used to verify the token signature, expiration and audience, and to evaluate the configured CEL validations against the token claims.
| Field / Type | Description |
|---|---|
audience | Audience is the expected audience ('aud' claim) for tokens issued by this provider. Defaults to 'notification-controller'. |
issuerURL | IssuerURL is the OIDC issuer URL used for provider discovery. It must match the 'iss' claim of tokens issued by this provider.
|
Validations is the list of CEL boolean expressions evaluated against the token claims and the variables. The request is accepted only if all of them evaluate to true; the message of each failing expression is returned to the caller. At least one validation is required. A valid signature alone does not authorize a request: public issuers issue tokens to any caller on the platform, so the validations must constrain the caller's identity claims (e.g. 'repository_owner' for GitHub Actions).
| |
Variables is an optional list of named CEL expressions, evaluated in order and exposed as 'vars.<name>'. Each expression can read the token claims via 'claims' and any variable defined before it. Use it to share sub-expressions across validations. |