OAuth2 Profile Auth Plugin

TLS

TLS fields are grouped under Security > TLS. Connection endpoints, saved field names, defaults, sensitive handling and validation retain their behavior.

Enter a private CA in tls_ca_cert (PEM) to verify token and profile endpoints. Use tls_server_name when the certificate DNS name differs from the address, and provide tls_client_cert with tls_client_key for mutual TLS. tls_insecure_skip_verify keeps encryption but bypasses server verification and defaults to false.

The OAuth2 Profile auth plugin connects systems that provide OAuth2 Authorization Code flow and a profile API, even when they are not OIDC issuers. It fits GitLab, GitHub, GitHub Enterprise, and internal OAuth2 profile APIs.

Highlights

• Provides generic, gitlab, and github presets for endpoint and profile field mapping.
• Derives authorization, token, and profile URLs from the provider URL for GitLab and GitHub presets.
• Maps profile API subject, username, email, display name, and verified email fields into external identities.
• Health metadata reports endpoint resolution and whether client credentials are configured without leaking secret values.

Before Registration

• Prepare OAuth application client ID, client secret, and redirect URI.
• The generic preset also requires authorization URL, token URL, profile URL, subject field, and username field.
• When verified email is required, define verified_email_field and require_verified_email together.

Operations Tips

• Do not use this plugin for GitLab operational monitoring. It is login-only.
• Multiple GitLab or GitHub Enterprise instances can be registered, so keep provider names and namespaces explicit.
• If profile API fields change, inspect health check mapping metadata before troubleshooting RBAC.

Operational Scenarios

• Use it to connect GitLab, GitHub Enterprise, or an internal OAuth2 profile API as a login source without requiring OIDC discovery.
• A provider is suitable when authorization, token, profile endpoints, and profile field mappings are explicit and stable.
• When verified email or organization membership gates login, define recovery and exception-account policy before rollout.

Boundaries

• This plugin does not collect repositories, CI/CD, issues, or organization inventory. Those belong to separate resource plugins.
• OAuth2 profile values map the external identity and login gate only; Konduo permissions remain owned by RBAC policy.