Documentation: Add Descope as User Identity Provider

[antonsmolyanyy]

Summary

Adds a new identity provider guide for Descope at
content/docs/integrations/user-identity/descope.mdx.

The page covers:

• Create a Descope OIDC Application — walking through the Descope
  console (Federated Apps → Generic OIDC Application), noting where to
  find the Issuer URL (IdP Configuration) and the Client ID /
  Client Secret (SP Configuration, Confidential client). Includes
  three supporting screenshots under img/descope/.
• Configure Pomerium — Core config using idp_provider: oidc with
  the Descope issuer as idp_provider_url, shown in both config.yaml
  and environment-variable tabs.
• Role-Based Access Control and Custom Claims — how to authorize on
  Descope roles/permissions by requesting the descope.claims scope,
  with example claim/roles and claim/permissions policies, plus
  descope.custom_claims for custom claims (e.g. claim/department).
  No existing pages or shared components are changed; this is additive
  (one new .mdx file and three images).

AI disclosure

none, only the PR summary was written by AI ^

Checklist

• [y ] reference any related issues
• [ y] disclosed AI usage (or wrote "none") per AI_POLICY.md

[netlify]

👷 Deploy request for pomerium-docs pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	9872843

[CLAassistant]

All committers have signed the CLA.

[greptile-apps]

Greptile Summary

This PR adds a new identity provider guide for Descope at content/docs/integrations/user-identity/descope.mdx, covering OIDC application setup, Pomerium configuration, and role-based access control via Descope scopes. It also registers "descope" in the project spell-check dictionary. The new guide follows the same structure used by other IdP pages and is purely additive (one MDX file plus three screenshots).

• OIDC Application setup: Walks through creating a Generic OIDC Application in the Descope console, capturing the Issuer URL, Client ID/Secret, and configuring Approved Domains so Pomerium's callback redirect is accepted.
• Pomerium config: Shows idp_provider: oidc with the Descope issuer as idp_provider_url, presented in both config-file and env-var tabs.
• RBAC and custom claims: Documents descope.claims and descope.custom_claims scopes with example claim/roles and claim/permissions policies.

Confidence Score: 5/5

Safe to merge — purely additive documentation with no changes to existing pages or shared components.

The change is a new standalone MDX guide and three screenshots. The Approved Domains step correctly handles the redirect-URI requirement for Descope, the scope format matches the reference docs, and the cspell addition is trivially correct. The one clarity issue in the RBAC section (the "append" wording) does not block users from completing the integration.

content/docs/integrations/user-identity/descope.mdx — the RBAC section wording could be clearer, and previously raised threads (newline at EOF, duplicate word) are still open.

Important Files Changed

Filename	Overview
content/docs/integrations/user-identity/descope.mdx	New IdP guide for Descope; covers OIDC app creation, Approved Domains configuration, and RBAC via scopes. Minor documentation clarity issue: the Configure Pomerium section already includes descope.claims in the default idp_scopes, but the RBAC section instructs users to "append" it as if it weren't already there.
cspell.json	Adds "descope" to the spell-check dictionary; alphabetically ordered correctly between "dearmor" and "disablerepo".
content/docs/integrations/user-identity/img/descope/create-oidc-app.png	Screenshot of the Descope console OIDC app creation step; referenced correctly from descope.mdx.
content/docs/integrations/user-identity/img/descope/idp-configuration.png	Screenshot of the Descope IdP Configuration tab showing the Issuer URL; referenced correctly from descope.mdx.
content/docs/integrations/user-identity/img/descope/sp-configuration.png	Screenshot of the Descope SP Configuration tab showing Client ID/Secret; referenced correctly from descope.mdx.

Sequence Diagram

sequenceDiagram
    participant User
    participant Pomerium
    participant Descope

    User->>Pomerium: Access protected route
    Pomerium->>User: Redirect to Descope OIDC authorize endpoint
    Note over Pomerium,Descope: idp_provider_url = https://api.descope.com/<ProjectID>
    Note over Pomerium,Descope: scopes: openid, profile, email, offline_access,<br/>descope.claims, descope.custom_claims
    User->>Descope: Authenticate via Descope Flow
    Descope-->>Pomerium: Authorization code (redirect to /oauth2/callback)
    Note over Descope,Pomerium: Redirect URI domain validated against Approved Domains
    Pomerium->>Descope: Exchange code for tokens (client_id + client_secret)
    Descope-->>Pomerium: ID token + access token (with roles/permissions claims)
    Note over Pomerium: Evaluates claim/roles, claim/permissions,<br/>claim/department against policy
    Pomerium-->>User: Allow or deny access

Loading

_{Reviews (3): Last reviewed commit: "added descope to cspell json file" | Re-trigger Greptile}