Expose configuration attribute Auth.Providers.Options to Docker and Helm based deployments to allow adding extra URL query params when redirecting to auth provider.

[nclarkau]

Is your feature request related to a problem? Please describe.

We have a self-hosted Helm based deployment of Temporal using Entra ID (Azure) as the IDP for the UI component. We would like to add additional params (specifically domain_hint) to the OIDC redirect requests. This will improve the experience for our users who work across multiple auth domains.

The ability to set these options does already exist in Temporal UI but it is not exposed to Helm or any other Docker based deployment.

Describe the solution you'd like

Since the configuration option (Auth.Providers.Options) already exists within Temporal:

ui/server/server/config/config.go

Lines 133 to 134 in d126ea8

	// Options added as URL query params when redirecting to auth provider. Can be used to configure custom auth flows such as Auth0 invitation flow.
	Options map[string]interface{} `yaml:"options"`

The straight forward solution is to add the option to the docker config and expose with ENV vars.

ui/server/config/docker.yaml

Lines 62 to 63 in d126ea8

	callbackUrl: {{ env "TEMPORAL_AUTH_CALLBACK_URL" }}
	useIdTokenAsBearer: {{ env "TEMPORAL_AUTH_USE_ID_TOKEN_AS_BEARER" | default "false" }}

Add options support to ui/server/config/docker.yaml#L62

callbackUrl: {{ env "TEMPORAL_AUTH_CALLBACK_URL" }}
{{- $options := fromJson (env "TEMPORAL_AUTH_OPTIONS") }}
{{- if and (env "TEMPORAL_AUTH_OPTIONS") (not (empty $options)) }}
options:
{{- range $key, $value := $options }}
  {{ $key }}: {{ $value }}
{{- end }}
{{- end }}
useIdTokenAsBearer: {{ env "TEMPORAL_AUTH_USE_ID_TOKEN_AS_BEARER" | default "false" }}

Providing this Helm configuration

web:
  additionalEnv:
    - name: TEMPORAL_AUTH_OPTIONS
      value: '{"domain_hint":"my.auth.domain", "param2":"something"}'

Renders as

options:
  domain_hint: my.auth.domain
  param2: somthing

Describe alternatives you've considered

We thought about mounting volumes over the existing config but it felt really messy and likely to backfire. And this solution really does seem like the right approach, unless its been deliberately hidden for some reason, which seems unlikely.

Additional context

• Accepting a JSON object will allow multiple attributes to be configured via single generic ENV var.
• go template and sprig helpers are already in use by project so fromJson should be available.
• This with other OIDC provider configurations that require non-standard params in requests.

What are you really trying to do?

Set the domain_hint to improve the login experience for our users.