feat(identity): Consumer Group linking to principals#5676
Open
cloudjumpercat wants to merge 1 commit into
Open
feat(identity): Consumer Group linking to principals#5676cloudjumpercat wants to merge 1 commit into
cloudjumpercat wants to merge 1 commit into
Conversation
✅ Deploy Preview for kongdeveloper ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds documentation to the Kong Identity “Principals and directories” reference to describe how principals can be associated with Kong Gateway Consumer Groups via principal metadata, including an API example for updating the mapping.
Changes:
- Documented Consumer Groups as an additional principal entity mapping option alongside Consumers and applications.
- Added a new “Link a principal to Consumer Groups” section describing the reserved
consumer_groupsmetadata key and a Konnect APIPATCHexample.
cloudjumpercat
force-pushed
the
release/kong-identity-m0
branch
from
33ce795 to
7b2f80b
Compare
Signed-off-by: Diana <75819066+cloudjumpercat@users.noreply.github.com>
cloudjumpercat
force-pushed
the
feat/principal-consumer-group-mapping
branch
from
15f3ed2 to
3cfb8ff
Compare
juliamrch
approved these changes
Jun 26, 2026
| Each product has its own representation of who is authenticating: {{site.base_gateway}} has Consumers and {{site.dev_portal}} has applications: | ||
|
|
||
| * **Consumers**: Attach a `control_plane_consumer` [identity](#identities) to map a principal to a Consumer in a specific {{site.base_gateway}} control plane. When an authentication plugin authenticates the principal, the mapped Consumer loads into the request context just as if the Consumer had been authenticated directly. This allows existing Consumer-scoped plugins to function while you migrate to principals. | ||
| * **Consumer Groups**: Map a principal to one or more Consumer Groups by setting the reserved `consumer_groups` key in the principal's [metadata](#metadata) to a list of Consumer Group UUIDs. Consumer Groups have a many-to-many relationship with principals: the same group can map to many principals, and one principal can map to many groups. If the principal is also mapped to a Consumer and that Consumer belongs to its own Consumer Groups, the gateway loads the union of both sets into the request context. Consumer Groups must be defined in the same {{site.base_gateway}} control plane and workspace as the plugin. |
Contributor
There was a problem hiding this comment.
Break the paragraph to ease human reading.
Suggested change
| * **Consumer Groups**: Map a principal to one or more Consumer Groups by setting the reserved `consumer_groups` key in the principal's [metadata](#metadata) to a list of Consumer Group UUIDs. Consumer Groups have a many-to-many relationship with principals: the same group can map to many principals, and one principal can map to many groups. If the principal is also mapped to a Consumer and that Consumer belongs to its own Consumer Groups, the gateway loads the union of both sets into the request context. Consumer Groups must be defined in the same {{site.base_gateway}} control plane and workspace as the plugin. | |
| * **Consumer Groups**: Map a principal to one or more Consumer Groups by setting the reserved `consumer_groups` key in the principal's [metadata](#metadata) to a list of Consumer Group UUIDs. Consumer Groups have a many-to-many relationship with principals: | |
| - The same group can map to many principals | |
| - One principal can map to many groups. | |
| If the principal is also mapped to a Consumer and that Consumer belongs to its own Consumer Groups, the gateway loads the union of both sets into the request context. Consumer Groups must be defined in the same {{site.base_gateway}} control plane and workspace as the plugin. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes https://kongstrong.slack.com/archives/C0AMY2Z45GQ/p1782042911938269?thread_ts=1781636326.243639&cid=C0AMY2Z45GQ
Preview Links
Checklist
descriptionentry in frontmatter.