OpenID Connect (OIDC)

wikipedia:OpenID Connect (OIDC) identity provider is an authentication layer on top of OAuth 2.0

• OIDC tokens
• client_id

Providers (IdP)

• oidc-provider-cli

OIDC CLIs:

• go install github.com/jentz/oidc-cli@latest
• cargo install oidc-cli

• Servers: Authentik, Keycloak, Google Cloud Identity

• https://xxxx/realms/YourRealm/broker/oidc/endpoint

EKS, aws eks describe-cluster:

        .../...
        "identity": {
            "oidc": {
                "issuer": "https://oidc.eks.us-east-2.amazonaws.com/id/6457185BA3C72F8Axxxxxxxx"
            }
        },

Configuration examples

• Temporal UI: additionalEnvSecretName
• MinIO OpenID
• pgAdmin OAUTH

Activities

• Test OIDC client connection
• Test connection using: /oauth2/v1/introspect
• Decode token
• Creating an IAM OIDC provider for your EKS cluster
• Managing the Amazon EBS CSI driver as an Amazon EKS add-on
• Read About security hardening with OpenID Connect
• Configuring headscale to use OIDC authentication
• GitHub: Configuring OpenID Connect in Amazon Web Services
• Configuring OpenID Connect in cloud providers
• Keycloak and Okta Integration: Complete Developer Guide

AWS

• aws iam list-open-id-connect-providers
• aws iam create-open-id-connect-provider
• aws iam get-open-id-connect-provider
• aws_lb_listener_rule: authenticate_oidc
• aws sts assume-role-with-web-identity
• Terraform EKS module
• Dynamic Credentials with the AWS Provider

GitHub

• Terraform module: Github-oidc-provider

Related terms

• Keycloak OpenID Connect
• PingFederate
• Shibboleth
• Atlassian: Server vs. Data Center
• vault auth enable oidc
• IdP, SAML
• aws cognito-idp create-identity-provider --provider-type OIDC
• EKS OIDC: eksctl utils associate-iam-oidc-provider
• kubectl oidc-login
• aws eks describe-cluster --name my-cluster --query "cluster.identity.oidc.issuer" --output text
• OIDC Identity Provider: IAM OIDC provider
• SWA
• Terraform resource: aws_lb_listener_rule: action block: forward, redirect, fixed-response, authenticate-cognito and authenticate-oidc.
• Terraform resource: aws_iam_openid_connect_provider

• Access Management (AM) Magic Quadrant
• kubectl config set-credentials USER_NAME --auth-provider=oidc .../...
• kubectl krew install oidc-login
• Google Cloud Identity
• Role
• OpenID Connect v1.0
• /.well-known/openid-configuration
• aws iam list-open-id-connect-providers
• aws iam oidc
• okta_app_oauth
• Endpoint
• JWT, not in the ODIC standard but standard de facto
• audience (aud)
• Okta groups

See also

• OpenID Connect (OIDC), kubectl oidc-login, AWS IAM OIDC, EKS OIDC, EKS module, aws iam list-open-id-connect-providers | aws iam create-open-id-connect-provider | aws iam get-open-id-connect-provider, OIDC tokens, aws_lb_listener_rule, Google Cloud Identity, Claims, keycloak_oidc_identity_provider, settings, OIDC client, client_id, client_secret, Authorization Code Flow, OIDC Web App, Back-Channel

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener_rule#action-blocks