Why does the OIDC provisioner get ssh principals from the email and not from the sub claim?

[ThiefMaster]

Unless I'm mistaken, the sub claim in OIDC is pretty much the unique user identifier (often a username).

However, I could not find any config option that would use the sub instead of email... Is this not possible? :o

[tashian]

What you'll want to do is create an SSH certificate template for step-ca that maps the certificate principals to sub. For example:

{
    "type": {{ toJson .Type }},
    "keyId": {{ toJson .KeyID }},
    "principals": {{ toJson (list .Token.sub) }},
    "extensions": {{ toJson .Extensions }},
    "criticalOptions": {{ toJson .CriticalOptions }}
}

See Configuring step-ca to Use Templates for instructions on how to install the template.

[ThiefMaster]

Thanks, I had found https://smallstep.com/docs/step-ca/templates/#ssh-templates but was missing the part about how to get stuff from the token in there!