Red Hat OpenShift Container Platform

About OpenID Connect authentication

Review OpenID Connect (OIDC) discovery, scopes, and claim mapping before you configure the oidc identity provider. OIDC support and correctly mapped claims are required for the Authentication Operator to authenticate users in Red Hat OpenShift Container Platform.

The Authentication Operator in Red Hat OpenShift Container Platform requires that the configured OIDC identity provider implements the OIDC discovery specification. For more information, see "OpenID Connect Discovery".

ID Token and UserInfo decryptions are not supported.

By default, the openid scope is requested. If required, extra scopes can be specified in the extraScopes field.

Claims are read from the JWT id_token returned from the OpenID identity provider and, if specified, from the JSON returned by the UserInfo URL.

At least one claim must be configured to use as the identity of the user. The standard identity claim is sub.

You can also indicate which claims to use as the preferred username, display name, and email address of the user. If multiple claims are specified, the first one with a non-empty value is used. The following table lists the standard claims:

Claim Description

Claim	Description
`sub`	Short for "subject identifier." The remote identity for the user at the issuer.
`preferred_username`	The preferred username when provisioning a user. A shorthand name that the user wants to be referred to, such as `janedoe`. Typically a value that corresponds to the login or username of the user in the authentication system, such as username or email.
`email`	Email address.
`name`	Display name.

sub

Short for "subject identifier." The remote identity for the user at the issuer.

preferred_username

The preferred username when provisioning a user. A shorthand name that the user wants to be referred to, such as janedoe. Typically a value that corresponds to the login or username of the user in the authentication system, such as username or email.

email

Email address.

name

Display name.

For more information, see "OpenID claims documentation".

Unless your OpenID Connect identity provider supports the resource owner password credentials (ROPC) grant flow, users must get a token from <namespace_route>/oauth/token/request to use with command-line tools.