Temporal UI OIDC example configuration

 # OIDC ENABLED
web:
  additionalEnvSecretName: temporal-web-sso-kc
 
  # Configuration for self signed certificates in your identity provider:
  #  
  # kubectl get secret YOUR_KEYCLOAK_TLS_SECRET_NAME -n YOUR_NAMESPACE -o jsonpath='{.data.ca\.crt}' | base64 -d >  /tmp/your_keycloak_cert.crt
  # openssl x509 -in /tmp/your_keycloak_cert.crt -noout -subject -issuer
  # cat /etc/ssl/certs/ca-certificates.crt /tmp/your_keycloak_cert > ca-bundle.crt
  #
  # kubectl create configmap temporal-ca-bundle --from-file=ca-bundle.crt -n YOUR_NAMESPACE

  additionalEnv:
    - name: SSL_CERT_FILE
      value: /custom-ca/ca-bundle.crt
  additionalVolumes:
    - name: temporal-ca
      configMap:
        name: temporal-ca-bundle
  additionalVolumeMounts:
    - name: temporal-ca
      mountPath: /custom-ca
      readOnly: true
  
# OIDC configuration 
extraObjects:
  - apiVersion: v1
    kind: Secret
    metadata:
      name: temporal-web-sso-kc
    stringData:
      TEMPORAL_AUTH_ENABLED: "true"
      TEMPORAL_AUTH_CLIENT_ID: "temporal"
      TEMPORAL_AUTH_CLIENT_SECRET: "XXXXXXX"        # kcadm.sh get clients -r YourRealm --fields clientId,secret
      TEMPORAL_AUTH_SCOPES: "openid,profile,email"
      TEMPORAL_AUTH_ISSUER_URL: "https://kc.example.org/realms/YOUR_REAL"
      TEMPORAL_AUTH_PROVIDER_URL: "https://kc.example.org/realms/YOUR_REAL"
      TEMPORAL_AUTH_CALLBACK_URL: "https://temporal.example.orgo/auth/sso/callback"

Activities

• Improve configuration using SOPS for secret management

Related

• Error: secret
• web.additionalEnv
• kcadm.sh get clients

See also

• Temporal UI, oAuth, web., temporal-web, web.additionalEnv, web.additionalEnvSecretName, temporalio/ui, Env variables, ExtraObjects
• Temporal OIDC, Temporal Auth, TEMPORAL_AUTH_ENABLED, TEMPORAL_AUTH_CLIENT_ID, TEMPORAL_AUTH_CLIENT_SECRET, TEMPORAL_AUTH_SCOPES, Web UI, Web UI vars, web.additionalEnvSecretName, Temporal OIDC example configuration