You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Remove vale suppression comments (re-enable linting)
- Simplify title from "Comprehensive Guide" to "Guide"
- Remove emoji from section headers for cleaner anchor IDs
- Replace manual base64 JWT decode with otdfctl dev selectors generate
- Update cross-reference link text in subject_mappings.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Copy file name to clipboardExpand all lines: docs/components/policy/subject_mappings.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
# Subject Mappings
2
2
3
3
:::tip New to Subject Mappings?
4
-
For a comprehensive tutorial with IdP integration examples, troubleshooting, and step-by-step guides, see the [Subject Mapping Comprehensive Guide](/guides/subject-mapping-guide).
4
+
For a comprehensive tutorial with IdP integration examples, troubleshooting, and step-by-step guides, see the [Subject Mapping Guide](/guides/subject-mapping-guide).
Copy file name to clipboardExpand all lines: docs/guides/subject-mapping-guide.md
+7-10Lines changed: 7 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,12 +1,9 @@
1
1
---
2
-
title: Subject Mapping Comprehensive Guide
2
+
title: Subject Mapping Guide
3
3
sidebar_position: 1
4
4
---
5
5
6
-
<!-- vale Vale.Terms = NO -->
7
-
<!-- vale Vale.Spelling = NO -->
8
-
9
-
# Subject Mapping: Comprehensive Guide
6
+
# Subject Mapping Guide
10
7
11
8
:::info What You'll Learn
12
9
This guide explains how OpenTDF connects user identities from your Identity Provider (IdP) to attribute-based access control. You'll understand:
@@ -18,7 +15,7 @@ This guide explains how OpenTDF connects user identities from your Identity Prov
18
15
19
16
## The Core Problem: Why Subject Mappings Exist
20
17
21
-
### ✅ How It Actually Works
18
+
### How It Actually Works
22
19
23
20
OpenTDF uses a three-layer architecture:
24
21
@@ -374,7 +371,7 @@ Instead of thinking "grant Alice access", think "grant anyone in the finance tea
374
371
375
372
All attribute values in OpenTDF must be explicitly created before they can be used — there is no "freeform" or "dynamic" attribute value type. Each `attribute_value_id` in a Subject Mapping must reference an existing, named value. The flexibility comes from how Subject Condition Sets match entity claims.
376
373
377
-
### ❌ Anti-Pattern: One Mapping Per User
374
+
### Anti-Pattern: One Mapping Per User
378
375
379
376
```json
380
377
{
@@ -397,7 +394,7 @@ All attribute values in OpenTDF must be explicitly created before they can be us
397
394
398
395
**Why this fails at scale:** Requires creating a new Subject Mapping (and a corresponding attribute value) for every user. Performance degrades significantly as the number of mappings grows.
399
396
400
-
### ✅ Recommended: Pattern-Based Access
397
+
### Recommended: Pattern-Based Access
401
398
402
399
Use `IN_CONTAINS` (operator `3`) to match token claim substrings, covering many users with one Subject Mapping:
403
400
@@ -723,8 +720,8 @@ See the [actions reference](https://github.com/opentdf/otdfctl/blob/main/docs/ma
723
720
724
721
**1. Verify token claims:**
725
722
```bash
726
-
#Decode your JWT token
727
-
echo"<your-jwt>"| base64 -d
723
+
#Inspect all valid selectors for your JWT
724
+
otdfctl dev selectors generate --subject "<your-jwt>"
728
725
```
729
726
730
727
**2. Check selector with `otdfctl dev selectors`:**
0 commit comments