Skip to content

OIDC#

You configure OIDC (OpenID Connect) for MKE 4 through the authentication.oidc section of the mke4.yaml configuration file.

OIDC example configuration:

authentication:
  oidc:
    enabled: true
    issuer: https://auth.example.com
    clientID: 0oedtj...zlD5d4
    clientSecret: DF...yomD
    usernameClaim: custom_username
    rootCAs:
      - |
        -----BEGIN CERTIFICATE-----
        ...
        -----END CERTIFICATE-----
    # insecureSkipVerify: true

Configure OIDC service for MKE#

In the mke4.yaml configuration file authentication.oidc section, enable your OIDC service by setting enabled to true. Use the remaining fields, which are defined in the following table, to configure your chosen OIDC provider.

Info

For information on how to obtain the field values, refer to Setting up Okta as an OIDC provider.

Field                                Description Required
issuer OIDC provider root URL. yes
clientID ID from the IdP application configuration. Refer to Supply Athentication Credentials for information on how to provide the ID. yes
clientSecret Secret from the IdP application configuration. Refer to Supply Athentication Credentials for information on how to provide the Secret. no (recommended)
usernameClaim Sets the unique JWT ID token claim that contains the user names from your identity provider. Default: "name" no
rootCAs List of PEM-encoded root CA certificates that serve to verify the TLS connection to the OIDC provider, for use when the IdP is served with a private or self-signed certificate. no
insecureSkipVerify Disables TLS certificate verification of the OIDC provider. For testing only. Do not use in production. no

Important

Before OIDC service users can use the MKE 4 Dashboard, it is first necessary to deploy additional ClusterRoleBindings. Refer to Grant sevice/proxy and Prometheus access for full details.

Notes

  • Following an upgrade to MKE 4 from an MKE 3 cluster that has OIDC enabled, ensure that the redirectURI is updated to the MKE-4 control-plane Dex callback endpoint and that the authentication.oidc.redirectURI field in mke4.yaml configuration file is updated accordingly.
  • The OIDC provider trust certificates in rootCAs are public configuration, not a credential. Do not place them in the credentials Secret.
  • If MKE 4 cannot reach the identity provider directly, refer to Authentication proxy.