Skip to content

Commit 4f48823

Browse files
marythoughtclaude
andcommitted
chore(docs): clean up subject mapping guide nits
- Remove vale suppression comments (re-enable linting) - Simplify title from "Comprehensive Guide" to "Guide" - Remove emoji from section headers for cleaner anchor IDs - Replace manual base64 JWT decode with otdfctl dev selectors generate - Update cross-reference link text in subject_mappings.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 2e65f87 commit 4f48823

2 files changed

Lines changed: 8 additions & 11 deletions

File tree

docs/components/policy/subject_mappings.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Subject Mappings
22

33
:::tip New to Subject Mappings?
4-
For a comprehensive tutorial with IdP integration examples, troubleshooting, and step-by-step guides, see the [Subject Mapping Comprehensive Guide](/guides/subject-mapping-guide).
4+
For a comprehensive tutorial with IdP integration examples, troubleshooting, and step-by-step guides, see the [Subject Mapping Guide](/guides/subject-mapping-guide).
55
:::
66

77
:::note What Subject Mappings evaluate against

docs/guides/subject-mapping-guide.md

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,9 @@
11
---
2-
title: Subject Mapping Comprehensive Guide
2+
title: Subject Mapping Guide
33
sidebar_position: 1
44
---
55

6-
<!-- vale Vale.Terms = NO -->
7-
<!-- vale Vale.Spelling = NO -->
8-
9-
# Subject Mapping: Comprehensive Guide
6+
# Subject Mapping Guide
107

118
:::info What You'll Learn
129
This guide explains how OpenTDF connects user identities from your Identity Provider (IdP) to attribute-based access control. You'll understand:
@@ -18,7 +15,7 @@ This guide explains how OpenTDF connects user identities from your Identity Prov
1815

1916
## The Core Problem: Why Subject Mappings Exist
2017

21-
### How It Actually Works
18+
### How It Actually Works
2219

2320
OpenTDF uses a three-layer architecture:
2421

@@ -374,7 +371,7 @@ Instead of thinking "grant Alice access", think "grant anyone in the finance tea
374371

375372
All attribute values in OpenTDF must be explicitly created before they can be used — there is no "freeform" or "dynamic" attribute value type. Each `attribute_value_id` in a Subject Mapping must reference an existing, named value. The flexibility comes from how Subject Condition Sets match entity claims.
376373

377-
### Anti-Pattern: One Mapping Per User
374+
### Anti-Pattern: One Mapping Per User
378375

379376
```json
380377
{
@@ -397,7 +394,7 @@ All attribute values in OpenTDF must be explicitly created before they can be us
397394

398395
**Why this fails at scale:** Requires creating a new Subject Mapping (and a corresponding attribute value) for every user. Performance degrades significantly as the number of mappings grows.
399396

400-
### Recommended: Pattern-Based Access
397+
### Recommended: Pattern-Based Access
401398

402399
Use `IN_CONTAINS` (operator `3`) to match token claim substrings, covering many users with one Subject Mapping:
403400

@@ -723,8 +720,8 @@ See the [actions reference](https://github.com/opentdf/otdfctl/blob/main/docs/ma
723720

724721
**1. Verify token claims:**
725722
```bash
726-
# Decode your JWT token
727-
echo "<your-jwt>" | base64 -d
723+
# Inspect all valid selectors for your JWT
724+
otdfctl dev selectors generate --subject "<your-jwt>"
728725
```
729726

730727
**2. Check selector with `otdfctl dev selectors`:**

0 commit comments

Comments
 (0)