Expose configuration attribute Auth.Providers.Options to Docker and Helm based deployments to allow adding extra URL query params when redirecting to auth provider.

Is your feature request related to a problem? Please describe.

We have a self-hosted Helm based deployment of Temporal using Entra ID (Azure) as the IDP for the UI component. We would like to add additional params (specifically domain_hint) to the OIDC redirect requests. This will improve the experience for our users who work across multiple auth domains.

The ability to set these options does already exist in Temporal UI but it is not exposed to Helm or any other Docker based deployment.

Describe the solution you'd like

Since the configuration option (Auth.Providers.Options) already exists within Temporal:
https://github.com/temporalio/ui/blob/d126ea8a9cd92bd83376a2c8b70c98a46900800a/server/server/config/config.go#L133-L134

The straight forward solution is to add the option to the docker config and expose with ENV vars.
https://github.com/temporalio/ui/blob/d126ea8a9cd92bd83376a2c8b70c98a46900800a/server/config/docker.yaml#L62-L63

Add options support to ui/server/config/docker.yaml#L62

callbackUrl: {{ env "TEMPORAL_AUTH_CALLBACK_URL" }}
{{- $options := fromJson (env "TEMPORAL_AUTH_OPTIONS") }}
{{- if and (env "TEMPORAL_AUTH_OPTIONS") (not (empty $options)) }}
options:
{{- range $key, $value := $options }}
  {{ $key }}: {{ $value }}
{{- end }}
{{- end }}
useIdTokenAsBearer: {{ env "TEMPORAL_AUTH_USE_ID_TOKEN_AS_BEARER" | default "false" }}

Providing this Helm configuration

web:
  additionalEnv:
    - name: TEMPORAL_AUTH_OPTIONS
      value: '{"domain_hint":"my.auth.domain", "param2":"something"}'

Renders as

options:
  domain_hint: my.auth.domain
  param2: somthing

Describe alternatives you've considered

We thought about mounting volumes over the existing config but it felt really messy and likely to backfire. And this solution really does seem like the right approach, unless its been deliberately hidden for some reason, which seems unlikely.

Additional context

• Accepting a JSON object will allow multiple attributes to be configured via single generic ENV var.
• go template and sprig helpers are already in use by project so fromJson should be available.
• This with other OIDC provider configurations that require non-standard params in requests.

What are you really trying to do?

Set the domain_hint to improve the login experience for our users, please.

Start with server/config/docker.yaml and compare its Auth.Providers configuration with server/server/config/config.go, then inspect how Helm passes additional environment variables to the UI container. Render the configuration with TEMPORAL_AUTH_OPTIONS set to a JSON object and confirm the resulting options are available for OIDC redirects without affecting existing settings.