OIDC Auth Plugin

TLS

TLS fields are grouped under Security > TLS. Connection endpoints, saved field names, defaults, sensitive handling and validation retain their behavior.

Enter a private CA in tls_ca_cert (PEM) to verify issuer endpoints outside the system trust store. tls_server_name selects the certificate name; tls_client_cert and tls_client_key supply mutual TLS credentials together. These settings apply to discovery, JWKS, token, and user-info requests. tls_insecure_skip_verify retains encryption but bypasses server verification and defaults to false.

The OIDC auth plugin connects Konduo Enterprise to an external OpenID Connect provider.

Common Uses

1. Sign in through an internal or cloud identity provider
2. Synchronize user profiles from OIDC claims
3. Provide the basis for operator group and role mapping
4. Separate local account operations from externally managed accounts

Highlights

• Performs OIDC discovery, OAuth2 token exchange, ID token verification, and optional UserInfo lookup.
• Checks JWKS readiness and reports issuer, endpoint, claim mapping, login gate, and key-count metadata without exposing secrets.
• Uses authorization_code by default and supports the password grant only for trusted providers that explicitly enable it.
• Keeps resource plugins such as Keycloak separate from login providers so Admin API credentials and login client credentials do not mix.

Before Registration

• Prepare the OIDC issuer URL, client ID, and client secret.
• Register the redirect URI in the identity provider.
• Confirm the user identifier claim and group claim policy.

Operations Tips

• Validate login and role mapping with a limited test group first.
• Review Konduo settings when the provider certificate or issuer configuration changes.
• Keep at least one local administrator account for recovery.
• Claim mapping changes can affect login identifiers and existing external identity namespaces; validate them with a test provider before rollout.

Operational Scenarios

• Connect Keycloak, Entra ID, Okta, Auth0, Google Workspace, or another OIDC issuer as the Konduo Enterprise login source.
• Use group claims or email domains as login gates while keeping effective permissions in Konduo role mapping.
• When the same Keycloak realm is also monitored as a resource, keep the Keycloak resource plugin and this OIDC auth plugin as separate instances.

Boundaries

• This plugin only authenticates users. IdP health, realm diagnostics, and Admin API workflows belong to resource plugins.
• Use the browser-based authorization code flow by default. Reserve the password grant for trusted legacy providers that explicitly allow it.