Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Feature Request: Extend Custom OIDC Claims Support to Self-Hosted GitLab Instances

-1

Hi AWS Team and Community,

I'm excited about the recent announcement (February 2026) that AWS STS now supports validation of select identity provider-specific claims for OIDC federation, including GitLab.com! This is a fantastic enhancement that significantly improves fine-grained access control for federated identities.

However, I'd like to propose extending this great development further.

Current State

The new custom claims support currently works with:

GitLab.com multi-tenant SaaS instance ✅
GitLab Dedicated ❌
GitLab Self-Managed instances ❌

Feature Request

I'd love to see AWS add the ability to configure custom claim mappings directly in the OIDC Identity Provider setup, which would:

  • Enable self-hosted GitLab support: Allow organizations using GitLab Dedicated or Self-Managed to leverage the same custom claims functionality
  • Provide configuration flexibility: Let users define which custom claims from their OIDC provider should be recognized and usable in IAM trust policies
  • Maintain security: Keep the same validation and security controls while expanding compatibility

Use Case

Many enterprises use self-hosted GitLab instances for security, compliance, or operational reasons. These organizations would benefit greatly from the same fine-grained access control capabilities that GitLab.com users now enjoy.

Proposed Implementation

Add a "Custom Claims" section in the IAM OIDC Identity Provider configuration where users can:

  • Specify which custom claims their provider supports
  • Map those claims to condition keys usable in trust policies
  • Validate claim formats and requirements

This would be a natural continuation of the excellent work already done for the major SaaS providers and would make AWS federation even more powerful for enterprise customers.

Has anyone else encountered this limitation? Would this enhancement be valuable for your use cases as well?

Thanks for considering this feedback!

Topics
Security, Identity, & Compliance
Tags
AWS IAM Identity CenterIAM Roles Anywhere
Language
English

asked a month ago65 views

1 Answer
0

Thank you for your detailed feedback regarding OIDC federation with self-hosted GitLab instances. I appreciate your enthusiasm about the recent enhancements to AWS STS.

To clarify the current capabilities: AWS STS does support OIDC federation with self-hosted identity providers, including self-hosted GitLab instances. When you create an OIDC identity provider in IAM, you can specify the provider URL for your self-hosted instance, which allows federated access through the AssumeRoleWithWebIdentity API.

The recent announcement about validating select identity provider-specific claims applies to certain pre-configured claims from specific providers. However, AWS already provides flexibility for working with custom claims from OIDC providers:

For Custom Claims: You can add your own custom claims to tokens by passing them as request tags when working with AWS STS. Custom claims are nested under the https://sts.amazonaws.com/ namespace and can be referenced in IAM role trust policies and resource control policies as condition keys.

For Self-Hosted GitLab: When integrating with self-hosted GitLab instances, you would configure the OIDC identity provider in IAM with your GitLab instance URL. The standard OIDC claims (such as sub, aud, iss) are available for use in trust policy conditions, and you can work with additional claims that your GitLab instance includes in its tokens.

The key is ensuring that your IAM role trust policies are configured to properly validate the claims coming from your self-hosted provider, using condition keys that match the claims structure your provider sends.

If you're looking for specific pre-validated custom claims similar to those announced for the SaaS providers, I'd recommend submitting this as formal feedback through the AWS Support Center or your AWS account team, as they can route feature requests to the appropriate service teams for consideration.
Sources
AWS STS now supports validation of select identity provider specific claims from Google, GitHub, CircleCI and OCI - AWS
Understanding token claims - AWS Identity and Access Management

answered a month ago

EXPERT

reviewed a month ago

  • Matthias Glastra
    a month ago

    Thank you for the response. I am aware of the custom claims that STS will add. And that is great but it was not what I was going for.

    I have a self hosted GitLab instance and each job gets a OIDC JWT from GitLab that can be used to authenticate against AWS by using the IAM Identity Provider and setting up GitLab OIDC. The documentation of GitLab shows how you can use their custom claims (https://docs.gitlab.com/ci/secrets/id_token_authentication/) by specifying the conditions in the trust relationship. https://docs.gitlab.com/ci/cloud_services/aws/.

    But these custom claims are only supported by AWS IAM if they are coming from gitlab.com and not when they are from a custom OIDC endpoint like my self hosted instance. That is where adding pre-vetted custom claims to the IAM Identity Provider OIDC configuration could be enormously valuable. I understand they might not want to ingest all claims but maybe this is a step in the right direction to support that.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content