- Save

- Go to Clients
  - Click on `account`
  - Mappers
  - Create
    - `Name` with any text
    - `Mapper Type` is `User Attribute`
    - `User Attribute` is `policy`
    - `Token Claim Name` is `policy`
    - `Claim JSON Type` is `string`
  - Save

client_id     (string)    unique public identifier for apps e.g. "292085223830.apps.googleusercontent.com"
claim_name    (string)    JWT canned policy claim name, defaults to "policy"
claim_prefix  (string)    JWT claim namespace prefix e.g. "customer1/"
scopes        (csv)       Comma separated list of OpenID scopes for server, defaults to advertised scopes from discovery document e.g. "email,admin"

	podWithTwoPVCs := st.MakePod().Name("pod-with-two-pvcs").Namespace(metav1.NamespaceDefault).PVC("claim-with-rwop-1").PVC("claim-with-rwop-2").Node("node-1").Obj()
	podWithOneConflict := st.MakePod().Name("pod-with-one-conflict").Namespace(metav1.NamespaceDefault).PVC("claim-with-rwop-1").Node("node-1").Obj()

		claimed []*v1.Pod
		patches int
	}
	var tests = []test{
		func() test {
			controller := v1.ReplicationController{}
			controller.Namespace = metav1.NamespaceDefault
			return test{
				name: "Claim pods with correct label",
				manager: NewPodControllerRefManager(&FakePodControl{},
					&controller,
					productionLabelSelector,
					controllerKind,
					func(ctx context.Context) error { return nil }),

}

// PrefixedClaimOrExpression provides the configuration for a single prefixed claim or expression.
type PrefixedClaimOrExpression struct {
	Claim  string
	Prefix *string

	Expression string
}

// ClaimOrExpression provides the configuration for a single claim or expression.
type ClaimOrExpression struct {
	Claim      string
	Expression string
}

	oidcCAFileFlag         = "oidc-ca-file"
	oidcUsernameClaimFlag  = "oidc-username-claim"
	oidcUsernamePrefixFlag = "oidc-username-prefix"
	oidcGroupsClaimFlag    = "oidc-groups-claim"
	oidcGroupsPrefixFlag   = "oidc-groups-prefix"
	oidcSigningAlgsFlag    = "oidc-signing-algs"
	oidcRequiredClaimFlag  = "oidc-required-claim"
)

temporary credentials generated in the AssumeRoleWithWebIdentity call.

2. `id_token` claims: When the role policy is not configured, MinIO looks for a specific claim in the `id_token` (JWT) returned by the OpenID provider in the STS request. The default claim is `policy` and can be overridden by the `claim_name` configuration parameter or the `MINIO_IDENTITY_OPENID_CLAIM_NAME` environment variable. The claim value can be a string (comma-separated list) or an array of IAM access policy names defined...

func GetPersistentVolumeClaimClass(claim *core.PersistentVolumeClaim) string {
	// Use beta annotation first
	if class, found := claim.Annotations[core.BetaStorageClassAnnotation]; found {
		return class
	}

	if claim.Spec.StorageClassName != nil {
		return *claim.Spec.StorageClassName
	}

	return ""
}

// PersistentVolumeClaimHasClass returns true if given claim has set StorageClassName field.

			t.Fatalf("%s: failed to parse token: %v", tc.name, err)
		}

		claims := map[string]any{}
		err = json.Unmarshal(token, &claims)
		if err != nil {
			t.Fatalf("%s: failed to parse payload: %v", tc.name, err)
		}

		for k, v := range tc.wantClaims {
			got, ok := claims[k]
			if ok {
				if !reflect.DeepEqual(got, v) {
					t.Errorf("%s: claim %q got value %v but want %v", tc.name, k, got, v)
				}
			} else {

		update                     func(claim *resource.ResourceClaimParameters) *resource.ResourceClaimParameters
		wantFailures               field.ErrorList
	}{
		"valid-no-op-update": {
			oldResourceClaimParameters: validResourceClaimParameters,
			update:                     func(claim *resource.ResourceClaimParameters) *resource.ResourceClaimParameters { return claim },
		},
		"invalid-name-update": {