Custom Claim Mapper

[agasser4324]

Hello all,

I am trying to enable a custom claim mapper for our self-hosted Temporal server. We already have a JWT that is passed to the Temporal frontend, but now I need to map our claims to existing Temporal roles in order to control access.

I wonder how this is done. A couple of minutes ago I saw this post here, which mentions, that I probably need to rebuild the server image in order to make a custom claim mapper work.

Namespaces creation and their lifecycle

You could restrict access to certain client apis via authorization which you could customize. Dock for authorizer and claims mapper. Temporal has default claims mapper based on JWT. Here is relevant config. You can set both values to “default” to configure default authorizer and claims mapper. If you define your own I believe you would need to rebuild server image.

Is this the correct way to go? Does the same also apply if I want to have a custom authorizer?

Documentation is talking about pluggable components and such, that is why I was more looking into ways of adding a small binary to the Temporal server image which is then kind of loaded during runtime, like in a plugin model. But this does not seem to be the case then.

Thanks for any help in this regards.

Best regards,
André