Authentication

Controls how users authenticate to Control Plane.

Authentication Configuration

Methods

Password

OIDC

OIDC Provider

Settings for an Open ID Connect (OIDC) Authorization Code flow provider.

Session

Cookie

Rate Limit

OpenID Connect

Redirect URI

When setting up an OpenID Connect provider, use the Authorization Code flow. The Redirect URI should be:

http(s)://<control-plane-url>/auth/self-service/methods/oidc/callback/<provider-id>

Claims Mapping

Control Plane requires mapping 2 claims using Jsonnet in the mapper_schema field for the OIDC provider. The claims that should be mapped are:

• username: Unique user identifier claim, typically a Username, Email Address, or Common Name
• name: Full name claim

For example, if your OIDC provider returns an email and a name claim, the mapper_schema would be:

local claims = std.extVar('claims');
{
  identity: {
    traits: {
      username: claims.email,
      name: name,
    },
  },
}

Mapping OIDC Users to App Roles

When using OIDC you may want to set a default App Role for a specific user. This is useful when bootstrapping OIDC in order to upgrade the first user to an Administrator. Example:

authorization:
  user_app_role_mapping:
    admin@example.com: Admin
    ops@example.com: Admin

Google Example

In this example, the provider ID is google because the provider is specified at authentication.methods.oidc.providers.google. When setting up the Google OAuth application, use http(s)://<control-plane-url>/auth/self-service/methods/oidc/callback/google as the Redirect URI.

authentication:
  methods:
    oidc:
      providers:
        google:
          provider: Google
          label: Google
          client_id: your-client-id
          client_secret: your-client-secret
          scope:
            - openid
            - email
            - profile
          mapper_schema: |
            local claims = std.extVar('claims');
            {
              identity: {
                traits: {
                  [if claims.email_verified then 'username' else null]: claims.email,
                  name: claims.given_name + " " + claims.family_name,
                },
              },
            }

Microsoft AAD Example

In this example, the provider ID is microsoft because the provider is specified at authentication.methods.oidc.providers.microsoft. When setting up the Microsoft Azure Active Directory application, use http(s)://<control-plane-url>/auth/self-service/methods/oidc/callback/microsoft as the Redirect URI.

authentication:
  methods:
    oidc:
      providers:
        microsoft:
          provider: Microsoft
          label: Microsoft
          client_id: your-client-id
          client_secret: your-client-secret
          microsoft_tenant: your-microsoft-aad-tenant
          scope:
            - openid
            - email
            - profile
          mapper_schema: |
            local claims = std.extVar('claims');
            {
              identity: {
                traits: {
                  username: claims.preferred_username,
                  name: claims.name,
                },
              },
            }

OIDC Configuration Methods

In server versions 1.6.0 and upwards, OIDC can be configured using the UI or the Control Plane API.

It is possible to seed a new OIDC provider into the database using the OIDC configuration file method. However, this method is designed for populating initial provider data and not updating existing providers thereafter. Any changes to a provider via the configuration file after the initial seed will be ignored. To update a provider after seeding, the UI or API must be used.

More information about how to get started can be found in the Managing OIDC Providers Guide.