add prop reference

Author: paulohtb6

modules/reference/partials/properties/cluster-properties.adoc

@@ -13277,6 +13277,59 @@ endif::[]
 |===
 
 
+=== nested_group_behavior
+
+Behavior for handling nested groups when extracting groups from authentication tokens. With `none`, the group is left alone (for example, `/group/child/grandchild`). With `suffix`, Redpanda extracts the final component from the nested group (for example, `/group/child/grandchild` becomes `grandchild`).
+
+[cols="1s,2a"]
+|===
+| Property | Value
+
+| Type
+| `string` (enum)
+
+| Accepted values
+|
+ifndef::env-cloud[]
+`none`, `suffix`
+endif::[]
+ifdef::env-cloud[]
+`none`, `suffix`
+endif::[]
+
+
+| Default
+|
+ifdef::env-cloud[]
+Available in the Redpanda Cloud Console
+endif::[]
+ifndef::env-cloud[]
+`none`
+endif::[]
+
+| Nullable
+| No
+
+| Requires restart
+| No
+
+ifndef::env-cloud[]
+| Restored on xref:manage:whole-cluster-restore.adoc[Whole Cluster Restore]
+| Yes
+endif::[]
+
+ifndef::env-cloud[]
+| Visibility
+| User
+endif::[]
+
+| Related topics
+|
+* xref:manage:security/authorization/gbac.adoc[Group-Based Access Control (GBAC)]
+
+|===
+
+
 === node_isolation_heartbeat_timeout
 
 How long after the last heartbeat request a node will wait before considering itself to be isolated.
@@ -13546,6 +13599,51 @@ endif::[]
 
 // end::redpanda-cloud[]
 
+=== oidc_group_claim_path
+
+A https://goessner.net/articles/JsonPath/[JSON path^] expression that tells Redpanda where to find group information in the OIDC token payload. The path must point to a claim containing group names as either a JSON array or a comma-separated string.
+
+[cols="1s,2a"]
+|===
+| Property | Value
+
+| Type
+| `string`
+
+
+
+| Default
+|
+ifdef::env-cloud[]
+Available in the Redpanda Cloud Console
+endif::[]
+ifndef::env-cloud[]
+`$.groups`
+endif::[]
+
+| Nullable
+| No
+
+| Requires restart
+| No
+
+ifndef::env-cloud[]
+| Restored on xref:manage:whole-cluster-restore.adoc[Whole Cluster Restore]
+| Yes
+endif::[]
+
+ifndef::env-cloud[]
+| Visibility
+| User
+endif::[]
+
+| Related topics
+|
+* xref:manage:security/authorization/gbac.adoc[Group-Based Access Control (GBAC)]
+
+|===
+
+
 === oidc_keys_refresh_interval
 
 The frequency of refreshing the JSON Web Keys (JWKS) used to validate access tokens.