Skip to main content

Directory groups and OIDC claim groups

Stacklok Enterprise uses directory groups for connector access and budgets. It uses OpenID Connect (OIDC) claim groups for cluster authorization policy. Choose the group model that matches the control you are configuring.

ControlGroup model
Connector accessDirectory group
AI Gateway budgetDirectory group
PlatformRoleBinding or ClusterPlatformRoleBindingOIDC claim group
ToolhiveAuthorizationPolicyOIDC claim group

Directory groups​

A directory group is a record in the directory service with an identifier, name, and membership list. Administrators can manage directory groups in the console or provision them from an identity provider through System for Cross-domain Identity Management (SCIM).

The Connector Gateway resolves each caller to a directory user and uses their group memberships to determine connector access. AI Gateway group budgets also reference the directory group's identifier.

OIDC claim groups​

An OIDC claim group is a string in the caller's token. The PlatformRoleBinding, ClusterPlatformRoleBinding, and ToolhiveAuthorizationPolicy resources match these strings when evaluating cluster authorization policy.

These resources read group values directly from the token. Configure the identity provider to include the expected values.

Keeping them aligned​

To use the same organizational groups for both control planes, provision directory groups through SCIM from the identity provider that issues the OIDC group claims. Keep the directory group names and claim values aligned. Stacklok Enterprise evaluates the two group models independently.