docs(v2): OIDC discovery_url + claims_mapping and Azure AD B2C guide

[montaro]

Overview

Documents the two new per-provider OIDC options and adds a dedicated Azure AD B2C login guide. This pairs with an upcoming change in flipt-io/flipt that adds discovery_url and claims_mapping to the OIDC auth method.

Why

Azure AD B2C is OIDC-compliant but has two behaviors that break the generic oidc method today:

1. Issuer/discovery mismatch — B2C serves its discovery document from a policy-specific URL (tenant domain) while the issuer it reports (and puts in the iss claim) is the tenant GUID. The standard OIDC issuer check then fails.
2. Non-standard email claim — B2C returns the email in an emails array rather than a string email claim, so email_matches has nothing to match against.

Changes

• v2/configuration/authentication.mdx
  • New Discovery URL subsection explaining discovery_url (fetch discovery from one URL, verify tokens against issuer_url).
  • New Claims Mapping subsection explaining claims_mapping (JSON Pointer extraction of email/name/picture/sub).
  • Added Azure AD B2C to the list of tested providers with a link to the new guide.
• v2/configuration/overview.mdx — added discovery_url and claims_mapping rows to the OIDC config reference table.
• v2/guides/operations/authentication/login-with-azure-ad-b2c.mdx — new guide covering app registration, finding the issuer vs discovery URLs, a full config.yml, and a troubleshooting section (404 discovery, issuer mismatch, email_matches needing claim mapping).
• docs.json — registered the new guide in the Authentication nav group.
• .vale/styles/Flipt/spelling-exceptions.txt — added b2c and guid.

Notes

• The config reference "Since" column uses v2.12.0 as a placeholder for the anticipated release; happy to adjust to whatever version the code change lands in.
• Could not run vale/mint dev locally (deps not installed); prettier (2.8.8) was run on the changed files.

Made with Cursor