Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Image Modified

OIDC Identity Provider 

Excerpt

It is possible to configure  to take on the role of the 'identity provider' (IdP) in the OpenID Connect Authorization Code Flow described in https://openid.net/specs/openid-connect-core-1_0.html.

...

The diagram below shows the flow.

Configuring OIDC Identity Provider 

To enable this functionality, you configure the 'auth' section in the values.yaml file used when installing the Helm chart.

...

Where $(domain) is the system domain value specified in value 'global.domain'.

OIDC Client Configuration

For an OIDC client to use  as an OIDC IdP, it needs some configuration to make it able to find and use the IdP APIs correctly. This can be done either through Endpoint Discovery or through Manually Configured Endpoints.

Endpoint Discovery

If the OIDC client supports Provider Configuration service discovery (https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig), it is enough to configure the issuer URL of the IdP for the client to be able to find the URL of all endpoints. The URL must be reachable from the OIDC client. Refer to the client documentation for details on how to set issuer URL.

Note
titleNote!

The service discovery support in currently does not include Issuer Discovery ('/.well-known/webfinger'), only Provider Configuration Discovery ('/.well-known/openid-configuration').

Manually Configured Endpoints

If automatic endpoint discovery is not supported by the OIDC client or is not used, all endpoints must be manually configured in the OIDC client configuration.

...

Endpoint pathDescriptionMandatory/Optional
/authzPerforms Authentication of the End-User, as described in https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpointMandatory
/token

Provides access and Id tokens in response to valid authentication_code, as described in

https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint

Mandatory
/userinfo

Provides additional user information in response to a valid access token, as described in

https://openid.net/specs/openid-connect-core-1_0.html#UserInfo

Optional
/jwksProvides the public key of the issuer according to the JWK specification https://datatracker.ietf.org/doc/html/rfc7517#section-4Optional

Client Identification Configuration

An OIDC client must be configured with the same identification configuration, that is the Client Id and Client Secret fields, as defined in the OIDC configuration.

Example OIDC Client Configuration - Grafana

The below configuration example configures a Grafana installation as OIDC client to the Identity Provider available at the URL https://mediationzone.exampledomain.com. Note that this example uses manually configured endpoints and does not include the Issuer URL.

...