Red Hat OpenShift Container Platform

Sample OpenID Connect CRs

Review the sample OpenID Connect (OIDC) custom resources (CRs) before you configure the oidc identity provider. These examples show required parameters, acceptable values, and optional fields such as custom certificate bundles and extra scopes.

If you must specify a custom certificate bundle, extra scopes, extra authorization request parameters, or a userInfo URL, use the full OIDC CR.

Standard OIDC CR

The following is an example of a standard OIDC CR.

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: oidcidp
    mappingMethod: claim
    type: OpenID
    openID:
      clientID: ...
      clientSecret:
        name: idp-secret
      claims:
        preferredUsername:
        - preferred_username
        name:
        - name
        email:
        - email
        groups:
        - groups
      issuer: https://www.idp-issuer.com

where:

spec.identityProviders.name: Specifies that this provider name is prefixed to the value of the identity claim to form an identity name. It is also used to build the redirect URL.
spec.identityProviders.mappingMethod: Specifies how mappings are established between identities from this provider and User objects.
spec.identityProviders.openID.clientID: Specifies the client ID of a client registered with the OpenID provider. The client must be allowed to redirect to https://oauth-openshift.apps.<cluster_name>.<cluster_domain>/oauth2callback/<idp_provider_name>.
spec.identityProviders.openID.clientSecret: Specifies a reference to an Red Hat OpenShift Container Platform Secret object containing the client secret.
spec.identityProviders.openID.claims: Specifies the list of claims to use as the identity. The first non-empty claim is used.
spec.identityProviders.openID.issuer: Specifies the Issuer Identifier described in the OpenID spec. Must use https without query or fragment component. For more information, see "Issuer Identifier".

Full OpenID CR

The following is an example of a full OpenID Connect CR.

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: oidcidp
    mappingMethod: claim
    type: OpenID
    openID:
      clientID: ...
      clientSecret:
        name: idp-secret
      ca:
        name: ca-config-map
      extraScopes:
      - email
      - profile
      extraAuthorizeParameters:
        include_granted_scopes: "true"
      claims:
        preferredUsername:
        - preferred_username
        - email
        name:
        - nickname
        - given_name
        - name
        email:
        - custom_email_claim
        - email
        groups:
        - groups
      issuer: https://www.idp-issuer.com

where:

spec.identityProviders.openID.ca: Specifies a reference to an Red Hat OpenShift Container Platform config map containing the PEM-encoded certificate authority bundle to use in validating server certificates for the configured URL. This value is optional.
spec.identityProviders.openID.extraScopes: Specifies the list of scopes to request, in addition to the openid scope, during the authorization token request. This value is optional.
spec.identityProviders.openID.extraAuthorizeParameters: Specifies a map of extra parameters to add to the authorization token request. This value is optional.
spec.identityProviders.openID.claims.preferredUsername: Specifies the list of claims to use as the preferred username when provisioning a user for this identity. The first non-empty claim is used.
spec.identityProviders.openID.claims.name: Specifies the list of claims to use as the display name. The first non-empty claim is used.
spec.identityProviders.openID.claims.email: Specifies the list of claims to use as the email address. The first non-empty claim is used.
spec.identityProviders.openID.claims.groups: Specifies the list of claims to use to synchronize groups from the OpenID Connect provider to Red Hat OpenShift Container Platform upon user login. The first non-empty claim is used.