Merged
Conversation
|
|
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (29)
📒 Files selected for processing (36)
📝 WalkthroughSummary by CodeRabbit
WalkthroughDocumentation across the Bifrost project has been significantly updated, including restructured changelog content, new identity provider setup guides (Zitadel, Google Workspace, Keycloak), a consolidated User Provisioning (SCIM) page, reorganized governance configuration examples, updated OpenAPI schemas for streaming and LiteLLM compatibility, and UI development setup changes from Next.js to Vite. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~35 minutes Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Author
Merge activity
|
Contributor
🧪 Test Suite AvailableThis PR can be tested by a repository admin. |
Contributor
Confidence Score: 3/5Not safe to merge — two P1 issues (missing Keycloak nav entry + missing screenshots) will cause broken docs on the live site. Three P1 findings: Keycloak guide absent from sidebar navigation, all 6 Keycloak screenshots missing from the repo, and copy-pasted Okta text in the Entra guide. These will ship broken pages to users. docs/docs.json (add Keycloak nav entry), docs/enterprise/setting-up-keycloak.mdx (add screenshots), docs/enterprise/setting-up-entra.mdx (fix provider name copy-paste) Important Files Changed
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| 1. In the Keycloak Admin Console, select your realm and go to **Clients → Create client**. | ||
|
|
||
| <Frame> | ||
| <img src="/media/user-provisioning/keycloak-create-client.png" alt="Creating a client in Keycloak" /> |
Contributor
There was a problem hiding this comment.
The guide references six images that do not exist anywhere in the repository:
keycloak-create-client.png(line 27)keycloak-capability-config.png(line 44)keycloak-client-credentials.png(line 65)keycloak-group-mapper.png(line 80)keycloak-service-account-roles.png(line 122)keycloak-bifrost-config.png(line 159)
Every <Frame> wrapping one of these will render a broken image. Please add the missing screenshots to docs/media/user-provisioning/ before merging.
Comment on lines
+279
to
+291
| ### Attribute Mappings | ||
|
|
||
| Attribute mappings let you translate Okta claim values into Bifrost roles, teams, or business units without restructuring your Okta claims. Bifrost supports three mapping types: | ||
|
|
||
| Bifrost automatically maps Entra app roles to its internal role hierarchy: | ||
| - **`attributeRoleMappings`**: map a claim value to a Bifrost role (Admin, Developer, Viewer, or a custom role) | ||
| - **`attributeTeamMappings`**: map a claim value to a Bifrost team | ||
| - **`attributeBusinessUnitMappings`**: map a claim value to a Bifrost business unit | ||
|
|
||
| | Entra Role Value | Bifrost Role | Privilege Level | | ||
| |------------------|--------------|-----------------| | ||
| | `admin` | Admin | Highest | | ||
| | `developer` | Developer | Medium | | ||
| | `viewer` | Viewer | Lowest | | ||
| These mappings work with any Okta claim — the `groups` claim from Step 5, the custom `role` claim from Step 4, or any other claim your authorization server includes in the token (e.g., `department`, `organization`). | ||
|
|
||
| **Multiple Roles:** If a user has multiple roles assigned, Bifrost automatically selects the highest privilege role. For example, a user with both `viewer` and `developer` roles will be assigned the Developer role in Bifrost. | ||
| To configure attribute mappings: | ||
|
|
||
| **Default Role:** Users without any assigned role will default to the Viewer role. | ||
| 1. In the User Provisioning configuration, scroll down to **Attribute Mappings** |
Contributor
There was a problem hiding this comment.
This section was copied from setting-up-okta.mdx and still names Okta in three places:
- line 281:
"translate Okta claim values … without restructuring your Okta claims" - line 287:
"These mappings work with any Okta claim — the groups claim from Step 5, the custom role claim from Step 4, or any other claim your authorization server includes"
All three occurrences should reference Microsoft Entra / Entra ID, and the step references (Step 4, Step 5) should match the Entra guide's step numbering. Additionally, the <Frame> on line 242 has alt="Create token dialog in Okta" — that should say Entra.
Comment on lines
+252
to
+258
| | **Client ID** | Your Okta application Client ID | | ||
| | **Issuer URL** | Issuer URL | | ||
| | **Audience** | Your API audience (e.g., `api://default` or custom) | | ||
| | **Client Secret** | Your Okta application Client Secret (optional, for token revocation) | | ||
|
|
||
| 4. Toggle **Enabled** to activate the provider | ||
| 5. Click **Save Configuration** | ||
| 4. **Verify** configuration and see if you get any errors. Make sure you get no errors/warnings. | ||
| 5. Toggle **Enabled** to activate the provider |
Contributor
There was a problem hiding this comment.
clientSecret marked Required but described as optional
The UI config description above (line 244) reads "Your Okta application Client Secret (optional, for token revocation)", but the Configuration Reference table now marks clientSecret as Yes (required). These are contradictory — please align them. If the secret is now mandatory, update the description; if it remains optional, change the table back to No.
Comment on lines
+122
to
+124
| 3. Fill in the provider-specific fields. Required fields are marked and validated on **Verify**. | ||
|
|
||
| <Frame> |
Contributor
There was a problem hiding this comment.
scim-attribute-mapping.png has alt="Preview of users matching an import filter", which is the same alt text used for the import-preview image further down (line 154). The attribute-mapping screenshot should have a distinct, accurate description such as "Attribute mapping configuration in the Bifrost dashboard".
Suggested change
| 3. Fill in the provider-specific fields. Required fields are marked and validated on **Verify**. | |
| <Frame> | |
| <img src="/media/user-provisioning/scim-attribute-mapping.png" alt="Attribute mapping configuration in the Bifrost dashboard" /> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR updates the v1.5.0-prerelease3 changelog to focus on the most significant user-facing changes while removing detailed technical implementation notes. It also includes documentation updates for contributing guidelines, user provisioning setup guides, and various feature enhancements.
Changes
Type of change
Affected areas
How to test
Validate documentation changes by reviewing the updated guides:
Screenshots/Recordings
N/A - Documentation-only changes
Breaking changes
Related issues
Updates documentation to reflect current product capabilities and streamlines changelog for better user experience.
Security considerations
The user provisioning guides include proper security practices for OAuth client setup, service account permissions, and domain-wide delegation configuration across multiple identity providers.
Checklist
docs/contributing/README.mdand followed the guidelines