Temporal OIDC

Temporal Server (OSS) has No native OIDC. The open-source Temporal server has no built-in OIDC/auth support.

• Temporal UI OIDC example configuration

It relies on:

• mTLS for transport security (client ↔ server). Custom ClaimMapper and Authorizer plugins for authz logic. If you want OIDC for the OSS server, you'd need to implement a custom ClaimMapper that validates JWTs from your IdP (e.g., Keycloak) on incoming gRPC metadata headers.

Layer:

• Web UI: Native OIDC config (actual OIDC flow built in). auth.providers (TEMPORAL_AUTH_ENABLED), example configuration
• Server/gRPC API (OSS)No native OIDC — JWT validation via custom ClaimMapper only
• Worker SDKs: You handle token acquisition; just inject as Bearer header

auth:
  enabled: true
  providers:
    label: sso
    type: oidc
    providerUrl: https://xxxxx-kc.test.example.org/realms/YOURREALM
    issuerUrl: https://xxxxxx-kc.test.example.org/realms/YOURREALM
    clientId: temporal-ui
    clientSecret: <secret>
    callbackUrl: https://temporal.test.example.org/auth/sso/callback
    scopes:
      - openid
      - profile
      - email

Errors

• Unable to exchange token

Related

• TEMPORAL_AUTH_ENABLED
• JWKS
• TEMPORAL_AUTH_CLIENT_ID
• web.additionalEnv
• TEMPORAL_TLS

See also

• Temporal OIDC, Temporal Auth, TEMPORAL_AUTH_ENABLED, TEMPORAL_AUTH_CLIENT_ID, TEMPORAL_AUTH_CLIENT_SECRET, TEMPORAL_AUTH_SCOPES, Web UI, Web UI vars, web.additionalEnvSecretName, Temporal OIDC example configuration
• Temporal UI, oAuth, web., temporal-web, web.additionalEnv, web.additionalEnvSecretName, temporalio/ui, Env variables, ExtraObjects