Identity federation: add user and service account examples, correct stale claims (DOCS-2516)

platform/hosting/env-vars.mdx

@@ -37,7 +37,8 @@ The following table describes each environment variable, the behavior it control
 | `WANDB_ARTIFACT_DIR`               | Where to store all downloaded artifacts. If unset, defaults to the `artifacts` directory relative to your training script. Make sure this directory exists and the running user has permission to write to it. This does not control the location of generated metadata files, which you can set using the `WANDB_DIR` environment variable. |
 | `WANDB_DATA_DIR`                   | Where to upload staging artifacts. The default location depends on your platform, because it uses the value of `user_data_dir` from the `platformdirs` Python package. Make sure this directory exists and the running user has permission to write to it. |
 | `WANDB_DIR`                        | Where to store all generated files. If unset, defaults to the `wandb` directory relative to your training script. Make sure this directory exists and the running user has permission to write to it. This does not control the location of downloaded artifacts, which you can set using the `WANDB_ARTIFACT_DIR` environment variable. |
-| `WANDB_IDENTITY_TOKEN_FILE`        | For [identity federation](/platform/hosting/iam/identity_federation/), the absolute path to the local directory where Java Web Tokens (JWTs) are stored. |
+| `WANDB_IDENTITY_TOKEN_FILE`        | For [identity federation](/platform/hosting/iam/identity_federation/), the absolute path to the local file that holds the JSON Web Token (JWT). |
+| `WANDB_CREDENTIALS_FILE`           | For [identity federation](/platform/hosting/iam/identity_federation/), the absolute path to the file where the SDK caches the W&B access token it receives in exchange for a JWT. Defaults to `~/.config/wandb/credentials.json`. |
 
 <Note>
 - Use the `GORILLA_DATA_RETENTION_PERIOD` environment variable cautiously. It applies to **deleted run data** (including run-associated files such as media after deletion flows). It does **not** delete artifacts; use artifact deletion and `GORILLA_ARTIFACT_GC_ENABLED` as described in [Delete an artifact](/models/artifacts/delete-artifacts). For how deleting runs and files relates to storage and this setting, see [When deleted run data is removed from storage](/models/runs/delete-runs#when-deleted-run-data-is-removed-from-storage) in **Delete runs**. Data is removed according to the retention window once the variable is set. Back up both the database and the storage bucket before you enable or change this value.

platform/hosting/iam/advanced_env_vars.mdx

@@ -19,8 +19,11 @@ Choose any of the following environment variables for your instance depending on
 | `GORILLA_USE_IDENTIFIER_CLAIMS` | If you use OIDC-based SSO, set this variable to `true` to enforce the username and full name of your users using specific OIDC claims from your identity provider. If set, ensure that you configure the enforced username and full name in the `preferred_username` and `name` OIDC claims respectively. Usernames can only contain alphanumeric characters along with underscores and hyphens as special characters. |
 | `GORILLA_DISABLE_PERSONAL_ENTITY` | When set to `true`, turns off [personal entities](/support/models/articles/what-is-the-difference-between-team-and-). Prevents creation of new personal projects in their personal entities and prevents writing to existing personal projects. |
 | `GORILLA_DISABLE_ADMIN_TEAM_ACCESS` | Set this to `true` to restrict Organization or Instance Admins from self-joining or adding themselves to a W&B team, ensuring that only Data and AI personas have access to the projects within the teams. |
+| `FEDERATED_AUTH_AUDIENCES` | For [identity federation](/platform/hosting/iam/identity_federation#audience-requirements), a comma-separated list of the `aud` claim values that W&B accepts in a JWT. When unset, W&B accepts the single value `wandb`. Dedicated Cloud and Self-Managed only. |
+| `SKIP_AUDIENCE_VALIDATION` | Set this to `true` to turn off `aud` claim validation for [identity federation](/platform/hosting/iam/identity_federation#audience-requirements). RFC 7523 requires this check, so prefer listing your audience in `FEDERATED_AUTH_AUDIENCES` instead. Dedicated Cloud and Self-Managed only. |
 | `GORILLA_DISABLE_TEAM_SERVICE_ACCOUNT_CREATION` | Set this to `true` to prevent the creation of new [team-scoped service accounts](/platform/hosting/iam/service-accounts#team-scoped-service-accounts). Available in Dedicated Cloud and Self-Managed v0.83.0+. To prevent members from creating new API keys, see [Disable API key creation](/platform/hosting/iam/api-keys#disable-api-key-creation), which is an organization setting rather than an environment variable. |
-| `WANDB_IDENTITY_TOKEN_FILE`        | For [identity federation](/platform/hosting/iam/identity_federation/), the absolute path to the local directory where JSON Web Tokens (JWTs) are stored. |
+| `WANDB_IDENTITY_TOKEN_FILE`        | For [identity federation](/platform/hosting/iam/identity_federation), the absolute path to the local file that holds the JSON Web Token (JWT). |
+| `WANDB_CREDENTIALS_FILE`           | For [identity federation](/platform/hosting/iam/identity_federation), the absolute path to the file where the SDK caches the W&B access token it receives in exchange for a JWT. Defaults to `~/.config/wandb/credentials.json`. |
 
 <Warning>
 W&B advises caution and understanding all implications before you enable some of these settings, such as `GORILLA_DISABLE_ADMIN_TEAM_ACCESS`. Contact your W&B team with any questions.