Skip to main content

Use a different OIDC Provider

Tags:
🎯context

You want to use a different Identity provider than the default one.

Description​

This How-To will show you how to configure a different Identity provider for your deployed services by setting up the necessary configurations in the k5-Project configuration and applying it on your services.

Preconditions​

  • OIDC Support: Your Identity Provider supports OIDC and has implicit flow enabled
  • Information Access: You have access to the required OIDC provider information (Client ID, Secret, URIs)

To know more about OpenID Connect (OIDC), please check the official documentation.

Step-by-Step Guide​

❗️info

The following steps apply for Domain Service projects only. For Basic service projects, this needs to be implemented explicitly.

General Steps​

  1. Gather OIDC Provider Information:
  • Client ID
  • Client Secret
  • Issuer
  • JWK URI
  • User authorization URI
  • Token URI
💡tip

You may need to contact your admin to get the needed information

  1. Navigate to Authentication Settings:
Environment Screenshot 1

Go to the Environment page. Open your deployment target that you want to apply the change on

Environment Screenshot 2

Navigate to k5-project-configurations tab

Authentication Screenshot 3

Unfold the Authentication section

  1. Create New Identity Provider:
Authentication Screenshot 4

Select field "Identity provider service binding" and add a new name (Example: "azure-auth")

Authentication Screenshot 5

Using the gathered information from step 1, fill in the required fields and click on create

Authentication Screenshot 6

New Identity provider service binding

🔥danger

Make sure not to click on save button, as the new Identity Provider is automatically selected and applied on all deployments in the selected environment.

Use Case Options​

Change Identity Provider for All Deployments

Change Identity Provider for All Deployments​

  1. Select and Apply New Binding:
  • Select the newly created binding and click on save
  1. Trigger Redeploy:
  • Trigger deploy pipelines for all your single deployments
  • Delete application deployments using OpenShift console to force redeployment
Change Identity Provider for One Service (Single Deployment)

Change Identity Provider for One Service (Single Deployment)​

  1. Maintain Default Binding:
  • Make sure that the default binding is selected
  1. Navigate to Service Deployment:
  • Navigate to service deployments tab
  • Open your specific service deployment
  1. Change Authentication Settings:
  • Unfold the Authentication section
  • Select the newly created secret and click on save
  1. Redeploy Service:
  • Trigger deploy pipeline for your service to apply the changes
Change Identity Provider for Services within an Application

Change Identity Provider for Services within an Application​

  1. Access Solution Designer:
  • Go to Solution Designer
  • Open the application you want to apply the change on
  1. Configure Components:
  • Navigate to the deployment target
  • Open the component configuration
  1. Specify Custom Configuration:
  • Add the following YAML to the "Custom configuration" field and click save:
oidc:
secretName: k5-azure-auth-iam-service-binding
  1. Configure All Components:
  • Adjust all other components where you want to use a different OIDC provider
💡tip

For easy integration of services within an application, it is recommended that all components use the same OIDC provider

  1. Commit Changes:
  • Click Commit to apply the changes

Conclusion​

🌟result

Congratulations! You have successfully changed the Identity Provider of one or all your deployments/services. Your services are now authenticating using your custom OIDC provider.

Further Reading​