fix: allow UI-only binding flow without CLI-provided cluster identity

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

On-behalf-of: @SAP karol.szwaj@sap.com

Author: cnvergence

backend/http/handler.go

@@ -360,14 +360,20 @@ func (h *handler) handleBind(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// TODO: Move to validating admission.
-	if bindRequest.Spec.ClusterIdentity.Identity == "" {
-		logger.Error(fmt.Errorf("missing cluster identity"), "invalid bind request")
-		writeErrorResponse(w, http.StatusBadRequest, kubebindv1alpha2.ErrorCodeBadRequest, "Missing cluster identity in bind request", "The cluster identity must be provided in the bind request")
-		return
+	// Use the cluster identity from the request, or derive from the authenticated session
+	// for UI-only flows where no consumer_id is available.
+	identity := bindRequest.Spec.ClusterIdentity.Identity
+	if identity == "" {
+		identity = state.Token.Issuer + "/" + state.Token.Subject
+		logger.Info("Using session-derived identity for UI-only flow", "identity", identity)
+	}
+
+	consumerID := params.ConsumerID
+	if consumerID == "" {
+		consumerID = identity
 	}
 
-	handleResult, err := h.kubeManager.HandleResources(r.Context(), state.Token.Subject, params.ConsumerID, params.ClusterID)
+	handleResult, err := h.kubeManager.HandleResources(r.Context(), state.Token.Subject, consumerID, params.ClusterID)
 	if err != nil {
 		logger.Error(err, "failed to handle resources")
 		statusCode, code, details := mapErrorToCode(err)

web/src/views/Resources.vue

@@ -326,10 +326,8 @@ const handleBind = async (templateName: string, bindingName: string) => {
     const sessionIdFromRoute = route.query.session_id as string || ''
     const clusterIdentity = consumerId.value || sessionIdFromRoute
 
-    if (!clusterIdentity) {
-      showAlertModal('Missing cluster identity. Please ensure you have authenticated properly.', 'Binding Failed', 'error')
-      return
-    }
+    // In UI-only flow, clusterIdentity may be empty - the backend will derive
+    // identity from the authenticated session (OIDC subject/issuer).
 
     const bindingRequest: BindableResourcesRequest = {
       metadata: {