Dynamic Roles

[russjones]

Description

At the moment using OIDC with individual system logins means you have to either create a role for every user or keep updating a shared role with logins whenever someone new joins the team.

To improve the user experience of OIDC and Teleport, we should have an option to allow creation of roles dynamically based off the claims received from an identity provider.

Implementation Details

claims_to_roles:
  - name: group
    value: teleport_user
    role_template:
      kind: role
      version: v1
      metadata:
        name: {{.user}}
        namespace: default
        spec:
          logins: [{{.claims.nickname}}]
          max_session_ttl: 90h0m0s
          node_labels:
            '*': '*'