DOC-377: Add OIDC identity source support for Verified Permissions

[HarshCasper]

Summary

This PR updates the LocalStack documentation to reflect the new OIDC identity source support in AWS Verified Permissions, as implemented in localstack/localstack-pro#8072.

Changes

1. Updated Verified Permissions Service Documentation (src/content/docs/aws/services/verifiedpermissions.mdx)

• Introduction: Updated to mention support for custom OIDC identity providers alongside Cognito
• New "Identity Sources" section: Added comprehensive documentation explaining OIDC support, including:
  • How LocalStack validates OIDC tokens (discovery document, JWKS, JWT signatures, expiration)
  • Principal and group membership extraction from token claims
  • Reference to the new VERIFIEDPERMISSIONS_DISABLE_JWT_VERIFICATION configuration option for local development
• Updated "Current limitations" section: Removed the outdated statement that "only Cognito is supported" and removed JWT validation limitations that have been addressed

2. Added Configuration Variable (src/content/docs/aws/customization/configuration-options.md)

Added a new "Verified Permissions" section under "Local AWS Services" with the VERIFIEDPERMISSIONS_DISABLE_JWT_VERIFICATION environment variable:

• Default value: 0 (verification enabled)
• Purpose: Allows disabling JWT signature verification for OIDC identity sources in local development scenarios where the OIDC issuer may be unreachable or uses self-signed certificates

Audit Trail

Research Protocol Followed

Coverage Analysis:

• Reviewed src/data/coverage/verifiedpermissions.json
• Confirmed all identity source APIs (CreateIdentitySource, UpdateIdentitySource, GetIdentitySource, DeleteIdentitySource, ListIdentitySources) are marked as implemented with aws_validated: true
• Confirmed token-based authorization APIs (IsAuthorizedWithToken, BatchIsAuthorizedWithToken) are fully supported

Existing Documentation:

• Read complete existing service doc at src/content/docs/aws/services/verifiedpermissions.mdx
• Identified outdated limitations section that contradicted the new feature implementation

AWS Documentation Referenced:

• AWS Verified Permissions - OIDC Identity Sources
• OpenIdConnectConfiguration API Reference
• IsAuthorizedWithToken API Reference
• BatchIsAuthorizedWithToken API Reference

Linear Ticket Context:

• Ticket DOC-377: https://linear.app/localstack/issue/DOC-377
• Implementation PR: localstack/localstack-pro#8072
• Explicitly requested documentation changes:
  1. ✅ Add VERIFIEDPERMISSIONS_DISABLE_JWT_VERIFICATION to configuration reference
  2. ✅ Update Verified Permissions coverage page for OIDC support

Verification

• ✅ Ran npm run build successfully with no errors
• ✅ All internal links validated
• ✅ Frontmatter follows schema defined in src/content.config.ts
• ✅ Writing style follows agents.md conventions (direct, instructional, second person, present tense)
• ✅ Configuration variable added in correct alphabetical order (after Step Functions)
• ✅ Internal links use root-relative paths

Confidence Assessment

High Confidence - All information is directly sourced from:

1. The Linear ticket description and documentation requirements
2. The implementation PR details describing the exact behavior
3. The coverage JSON file confirming API support
4. Official AWS documentation for OIDC identity sources

No Gaps or Conflicts - The feature implementation aligns with AWS behavior as documented, and all previously listed limitations regarding OIDC have been addressed by the implementation.

---

Closes DOC-377

Important

An AI agent generated this pull request. Review all changes before you merge.

• Linear ticket: DOC-377
• Workflow run: https://github.com/localstack/localstack-docs/actions/runs/31017706204

[cloudflare-workers-and-pages]

Deploying localstack-docs with    Cloudflare Pages

Latest commit:	d246d9d
Status:	✅  Deploy successful!
Preview URL:	https://47a65971.localstack-docs.pages.dev
Branch Preview URL:	https://docs-agent-doc-377.localstack-docs.pages.dev

View logs

[quetzalliwrites]

FYI, it's marking Harsh as the creator of the PR but that is incorrect, it's the agent workflow bot. We need to fix this.

[bentsku]

LGTM, one comment about the last bullet point in the Identity Sources part. I think it is more like "in order to use IsAuthorizedWithToken, you need to create an identity source", this is not well said, but I'd like to communicate this intent a bit better?

[bentsku]

note: I think from the sentence above, this is a consequence of "when you create an identity source", but I don't think this is true. By creating an identity source, you can then call IsAuthorizedWithToken, so it's the result, it shouldn't be a bullet point. Does it make sense?

[bentsku]

FYI, it's marking Harsh as the creator of the PR but that is incorrect, it's the agent workflow bot. We need to fix this.

Ah, I didn't realize. I approved, but this is then a comment, I would react differently reviewing an Agent PR vs a Human one, as my comment / intent being it is not very clear.

@quetzalliwrites it is also pointing to main, so this might lead to issues? I don't know how the agent work and if it can rebase?

didn't read the whole description and missed it was agent generated. Have a few comments before merge