About direct authentication with an external OIDC identity provider
You can enable direct integration with an external OpenID Connect (OIDC) identity provider to issue tokens for authentication. This bypasses the built-in OAuth server and uses the external identity provider directly.
By integrating directly with an external OIDC provider, you can leverage the advanced capabilities of your preferred OIDC provider instead of being limited by the capabilities of the built-in OAuth server. Your organization can manage users and groups from a single interface, while also streamlining authentication across multiple clusters and in hybrid environments. You can also integrate with existing tools and solutions.
|
|
Currently, you may configure only one OIDC provider for direct authentication. |
After switching to direct authentication, existing authentication configuration is not guaranteed to be preserved. Before enabling direct authentication, back up any existing user, group, oauthclient, or identity provider configuration in case you need to revert back to using the built-in OAuth server for authentication.
Before replacing the built-in OAuth server with an external provider, ensure that you have access to a long-lived method of logging in with cluster administrator permissions, such as one of the following:
-
a certificate-based user
kubeconfigfile, such as the one generated by the installation program -
a long-lived service account token
kubeconfigfile -
a certificate-based service account
kubeconfigfile
If there are any issues with the external identity provider, you need one of these methods to gain access to the Red Hat OpenShift Container Platform cluster in an emergency situation.