identity schema

values.yml

docs

"oidc.gitlab.jsonnet": |
      {
        local claims = {
          email_verified: false
        } + std.extVar('claims');

        {
          identity: {
            traits: {
              // Allowing unverified email addresses enables account
              // enumeration attacks, especially if the value is used for
              // e.g. verification or as a password login identifier.
              //
              // Therefore we only return the email if it (a) exists and (b) is marked verified
              // by GitLab.
              [if "email" in claims && claims.email_verified then "email" else null]: claims.email,
            },
          },
        }
      }