From f5805e210eae6ee75012e9e9ecc248126c2362c4 Mon Sep 17 00:00:00 2001 From: Mahesh Vagicherla Date: Tue, 13 Oct 2026 12:11:25 +0530 Subject: [PATCH 1/2] chore: support verified domains for backend --- charts/portkey-app/docs/sso-setup.md | 22 ++++++++++++++++++++++ charts/portkey-app/templates/_helpers.tpl | 4 ++++ charts/portkey-app/values.yaml | 5 +++++ 3 files changed, 31 insertions(+) diff --git a/charts/portkey-app/docs/sso-setup.md b/charts/portkey-app/docs/sso-setup.md index 39b5edd..2cf6039 100644 --- a/charts/portkey-app/docs/sso-setup.md +++ b/charts/portkey-app/docs/sso-setup.md @@ -114,6 +114,28 @@ config: --- +## Verified Email Domains + +Domain verification from Organisation Settings relies on sending a verification email, which isn't possible in air-gapped deployments. Instead, declare your verified domains in `values.yaml`: + +```yaml +config: + oauth: + enabled: true + # ...SAML/OIDC settings above... + verifiedEmailDomains: + - "acme.com" # exact domain: user@acme.com + - "*.acme.io" # domain and its subdomains: user@acme.io, user@eu.acme.io +``` + +These domains: + +* Are passed to the backend as the comma-separated `VERIFIED_EMAIL_DOMAINS` environment variable. +* Apply to **every** organisation in the deployment, in addition to any domains verified from Organisation Settings. +* Are accepted wherever a verified domain is required: SSO sign-in domain checks, SCIM user creation, and invited users when auto-provisioning is disabled. + +--- + **Note:** * Use only one `oauthType` (`saml` or `oidc`) in the config at a time. diff --git a/charts/portkey-app/templates/_helpers.tpl b/charts/portkey-app/templates/_helpers.tpl index 4687921..c0c6c30 100644 --- a/charts/portkey-app/templates/_helpers.tpl +++ b/charts/portkey-app/templates/_helpers.tpl @@ -372,6 +372,10 @@ Template containing common environment variables that are used by several servic name: {{ include "portkey.secretsName" . }} key: oauthMetadataXml optional: true +{{- with .Values.config.oauth.verifiedEmailDomains }} +- name: VERIFIED_EMAIL_DOMAINS + value: {{ (kindIs "slice" .) | ternary (join "," .) (toString .) | quote }} +{{- end }} {{- end }} {{- if .Values.config.noAuth.enabled }} - name: AUTH_MODE diff --git a/charts/portkey-app/values.yaml b/charts/portkey-app/values.yaml index 90b390b..a1bd9ae 100644 --- a/charts/portkey-app/values.yaml +++ b/charts/portkey-app/values.yaml @@ -102,6 +102,11 @@ config: oauthClientSecret: "" oauthRedirectURI: "" oauthMetadataXml: "" + # Email domains treated as verified for every organisation (in addition to + # domains verified from the UI, which needs outbound mail). Used for SSO/SCIM + # domain checks and invited-user provisioning. "*." also allows subdomains. + # e.g. ["acme.com", "*.acme.io"] + verifiedEmailDomains: [] smtp: enabled: false From c2f6f1dbeabd63916ec74d0c157ffc88b09a28b2 Mon Sep 17 00:00:00 2001 From: Mahesh Vagicherla Date: Tue, 13 Oct 2026 14:16:45 +0530 Subject: [PATCH 2/2] chore: add secret reference for verfied domains --- charts/portkey-app/docs/secret-manager-integration.md | 2 ++ charts/portkey-app/docs/sso-setup.md | 5 ++++- charts/portkey-app/templates/_helpers.tpl | 9 ++++++++- 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/charts/portkey-app/docs/secret-manager-integration.md b/charts/portkey-app/docs/secret-manager-integration.md index dfc3aad..70f12b0 100644 --- a/charts/portkey-app/docs/secret-manager-integration.md +++ b/charts/portkey-app/docs/secret-manager-integration.md @@ -147,6 +147,8 @@ spec: objectAlias: oauthRedirectURI - path: oauthMetadataXml objectAlias: oauthMetadataXml + - path: oauthVerifiedEmailDomains + objectAlias: oauthVerifiedEmailDomains - path: smtpHost objectAlias: smtpHost - path: smtpPort diff --git a/charts/portkey-app/docs/sso-setup.md b/charts/portkey-app/docs/sso-setup.md index 2cf6039..06ac130 100644 --- a/charts/portkey-app/docs/sso-setup.md +++ b/charts/portkey-app/docs/sso-setup.md @@ -128,9 +128,12 @@ config: - "*.acme.io" # domain and its subdomains: user@acme.io, user@eu.acme.io ``` +`*.` only works on a root domain: `*.eng.acme.com` will **not** match `user@x.eng.acme.com`. List such subdomains explicitly (e.g. `x.eng.acme.com`) instead. + These domains: -* Are passed to the backend as the comma-separated `VERIFIED_EMAIL_DOMAINS` environment variable. +* Are passed to the backend as the comma-separated `VERIFIED_EMAIL_DOMAINS` environment variable. This works with or without `config.existingSecretName`. +* Can alternatively come from a secret: leave `verifiedEmailDomains` empty and add an `oauthVerifiedEmailDomains` key (e.g. `acme.com,*.acme.io`) to the chart Secret / `existingSecretName` / your secret manager. If both are set, the `values.yaml` list wins. * Apply to **every** organisation in the deployment, in addition to any domains verified from Organisation Settings. * Are accepted wherever a verified domain is required: SSO sign-in domain checks, SCIM user creation, and invited users when auto-provisioning is disabled. diff --git a/charts/portkey-app/templates/_helpers.tpl b/charts/portkey-app/templates/_helpers.tpl index c0c6c30..9abbbe2 100644 --- a/charts/portkey-app/templates/_helpers.tpl +++ b/charts/portkey-app/templates/_helpers.tpl @@ -372,9 +372,16 @@ Template containing common environment variables that are used by several servic name: {{ include "portkey.secretsName" . }} key: oauthMetadataXml optional: true -{{- with .Values.config.oauth.verifiedEmailDomains }} +{{- /* Plain value from values.yaml wins (works with or without existingSecretName); otherwise read the optional secret key. */}} - name: VERIFIED_EMAIL_DOMAINS +{{- with .Values.config.oauth.verifiedEmailDomains }} value: {{ (kindIs "slice" .) | ternary (join "," .) (toString .) | quote }} +{{- else }} + valueFrom: + secretKeyRef: + name: {{ include "portkey.secretsName" . }} + key: oauthVerifiedEmailDomains + optional: true {{- end }} {{- end }} {{- if .Values.config.noAuth.enabled }}