FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

DOC-377: Add OIDC identity source support for Verified Permissions by HarshCasper · Pull Request #848 · localstack/localstack-docs · GitHub

/ localstack-docs Public

DOC-377: Add OIDC identity source support for Verified Permissions - #848

Open
HarshCasper wants to merge 1 commit into
mainfrom
docs-agent/doc-377
ConversationCommits (1)ChecksFiles changed
Open

DOC-377: Add OIDC identity source support for Verified Permissions#848
HarshCasper wants to merge 1 commit into
mainfrom
docs-agent/doc-377

Conversation

HarshCasper commented Aug 5, 2026

Copy link
Copy Markdown
Member

Summary

This PR updates the LocalStack documentation to reflect the new OIDC identity source support in AWS Verified Permissions, as implemented in localstack/localstack-pro#8072.

Changes

1. Updated Verified Permissions Service Documentation (src/content/docs/aws/services/verifiedpermissions.mdx)

  • Introduction: Updated to mention support for custom OIDC identity providers alongside Cognito
  • New "Identity Sources" section: Added comprehensive documentation explaining OIDC support, including:
    • How LocalStack validates OIDC tokens (discovery document, JWKS, JWT signatures, expiration)
    • Principal and group membership extraction from token claims
    • Reference to the new VERIFIEDPERMISSIONS_DISABLE_JWT_VERIFICATION configuration option for local development
  • Updated "Current limitations" section: Removed the outdated statement that "only Cognito is supported" and removed JWT validation limitations that have been addressed

2. Added Configuration Variable (src/content/docs/aws/customization/configuration-options.md)

Added a new "Verified Permissions" section under "Local AWS Services" with the VERIFIEDPERMISSIONS_DISABLE_JWT_VERIFICATION environment variable:

  • Default value: 0 (verification enabled)
  • Purpose: Allows disabling JWT signature verification for OIDC identity sources in local development scenarios where the OIDC issuer may be unreachable or uses self-signed certificates

Audit Trail

Research Protocol Followed

Coverage Analysis:

  • Reviewed src/data/coverage/verifiedpermissions.json
  • Confirmed all identity source APIs (CreateIdentitySource, UpdateIdentitySource, GetIdentitySource, DeleteIdentitySource, ListIdentitySources) are marked as implemented with aws_validated: true
  • Confirmed token-based authorization APIs (IsAuthorizedWithToken, BatchIsAuthorizedWithToken) are fully supported

Existing Documentation:

  • Read complete existing service doc at src/content/docs/aws/services/verifiedpermissions.mdx
  • Identified outdated limitations section that contradicted the new feature implementation

AWS Documentation Referenced:

Linear Ticket Context:

Verification

  • ✅ Ran npm run build successfully with no errors
  • ✅ All internal links validated
  • ✅ Frontmatter follows schema defined in src/content.config.ts
  • ✅ Writing style follows agents.md conventions (direct, instructional, second person, present tense)
  • ✅ Configuration variable added in correct alphabetical order (after Step Functions)
  • ✅ Internal links use root-relative paths

Confidence Assessment

High Confidence - All information is directly sourced from:

  1. The Linear ticket description and documentation requirements
  2. The implementation PR details describing the exact behavior
  3. The coverage JSON file confirming API support
  4. Official AWS documentation for OIDC identity sources

No Gaps or Conflicts - The feature implementation aligns with AWS behavior as documented, and all previously listed limitations regarding OIDC have been addressed by the implementation.

Closes DOC-377

Important

An AI agent generated this pull request. Review all changes before you merge.

cloudflare-workers-and-pages Bot commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying localstack-docs with    Cloudflare Pages

Latest commit: d246d9d
Status: ✅  Deploy successful!
Preview URL: https://47a65971.localstack-docs.pages.dev
Branch Preview URL: https://docs-agent-doc-377.localstack-docs.pages.dev

View logs

quetzalliwrites commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

FYI, it's marking Harsh as the creator of the PR but that is incorrect, it's the agent workflow bot. We need to fix this.

bentsku previously approved these changes Aug 5, 2026
View reviewed changes

bentsku left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

LGTM, one comment about the last bullet point in the Identity Sources part. I think it is more like "in order to use IsAuthorizedWithToken, you need to create an identity source", this is not well said, but I'd like to communicate this intent a bit better?

Comment thread src/content/docs/aws/services/verifiedpermissions.mdx
- Validates JWT signatures against the issuer's public keys
- Enforces token expiration (`exp` claim)
- Extracts principal information and group memberships from token claims
- Evaluates authorization requests using [`IsAuthorizedWithToken`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html) and [`BatchIsAuthorizedWithToken`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorizedWithToken.html)

bentsku Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

note: I think from the sentence above, this is a consequence of "when you create an identity source", but I don't think this is true. By creating an identity source, you can then call IsAuthorizedWithToken, so it's the result, it shouldn't be a bullet point. Does it make sense?

bentsku commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

FYI, it's marking Harsh as the creator of the PR but that is incorrect, it's the agent workflow bot. We need to fix this.

Ah, I didn't realize. I approved, but this is then a comment, I would react differently reviewing an Agent PR vs a Human one, as my comment / intent being it is not very clear.

@quetzalliwrites it is also pointing to main, so this might lead to issues? I don't know how the agent work and if it can rebase?

bentsku dismissed their stale review August 5, 2026 15:27

didn't read the whole description and missed it was agent generated. Have a few comments before merge

quetzalliwrites commented Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

hey @bentsku thank you for the prompt reviews!

good questions, here's how to think about it:

  1. yes, it is pointing to main right (for now, testing new workflow). When it comes to being added to review a docs PR, as an ENG, the good news is you don't need you to worry about branching/merging/release processes for the docs PRs (I handle that per usual, for each PR, nothing has changed). Just focus on the technical review as an ENG. 🫰
  2. you can leave technical feedback just as you did here for a "human", the agent understands your comments. For now, the way you left comments is good in that it strikes the balance of being understood by humans. I need to understand your feedback points too.
  3. Everyone has access to read the agent.md I built which is in this same repo, I've been sharing it also extensively in our slack channels internally ;)

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

bentsku bentsku left review comments
quetzalliwrites Awaiting requested review from quetzalliwrites quetzalliwrites is a code owner
remotesynth Awaiting requested review from remotesynth remotesynth is a code owner

At least 0 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

Back | FazBrowse Home | New Git URL