// Module included in the following assemblies:
//
// * osd_install_access_delete_cluster/config-identity-providers.adoc
// * rosa_install_access_delete_clusters/rosa-sts-config-identity-providers.adoc

:_mod-docs-content-type: PROCEDURE
[id="config-openid-idp_{context}"]
= Configure an OpenID identity provider

[role="_abstract"]
Configure an OpenID identity provider to integrate with an OpenID Connect identity provider by using an Authorization Code Flow so that users can authenticate by using their existing OpenID Connect credentials.

[IMPORTANT]
====
The Authentication Operator in {product-title} requires that the configured OpenID Connect identity provider implements the link:https://openid.net/specs/openid-connect-discovery-1_0.html[OpenID Connect Discovery] specification.
====

Claims are read from the JWT `id_token` returned from the OpenID identity provider and, if specified, from the JSON returned by the Issuer URL.

At least one claim must be configured to use as the user's identity.

You can also indicate which claims to use as the user's preferred user name, display name, and email address. If multiple claims are specified, the first one with a non-empty value is used. The standard claims are:

[cols="1,2",options="header"]
|===

|Claim
|Description

|`preferred_username`
|The preferred user name when provisioning a user. A shorthand name that the user wants to be referred to as, such as `janedoe`. Typically a value that corresponds to the user's login or username in the authentication system, such as username or email.

|`email`
|Email address.

|`name`
|Display name.

|===

See the
link:http://openid.net/specs/openid-connect-core-1_0.html#StandardClaims[OpenID claims documentation]
for more information.

.Prerequisites
* Before you configure OpenID Connect, check the installation prerequisites for any Red{nbsp}Hat product or service you want to use with your {product-title} cluster.

.Procedure

. From {cluster-manager-url}, navigate to the *Cluster List* page and select the cluster that you need to configure identity providers for.

. Click the *Access control* tab.

. Click *Add identity provider*.
+
[NOTE]
====
You can also click the *Add OAuth configuration* link in the warning message displayed after cluster creation to configure your identity providers.
====

. Select *OpenID* from the drop-down menu.

. Enter a unique name for the identity provider. This name cannot be changed later.
** An *OAuth callback URL* is automatically generated in the provided field.
+
ifndef::openshift-rosa-hcp[]
----
https://oauth-openshift.apps.<cluster_name>.<cluster_domain>/oauth2callback/<idp_provider_name>
----
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa-hcp[]
----
https://oauth.<cluster_name>.<cluster_domain>/oauth2callback/<idp_provider_name>
----
endif::openshift-rosa-hcp[]
+
For example:
+
----
https://oauth-openshift.apps.openshift-cluster.example.com/oauth2callback/openid
----

. Register a new OpenID Connect client in the OpenID identity provider by following the steps to link:https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest[create an authorization request].

. Return to {product-title} and select a mapping method from the drop-down menu. *Claim* is recommended in most cases.

. Enter a *Client ID* and *Client secret* provided from OpenID.

. Enter an *Issuer URL*. This is the URL that the OpenID provider asserts as the Issuer Identifier. It must use the https scheme with no URL query parameters or fragments.

. Enter an *Email* attribute whose value should be used as the email address. Click *Add more* to add multiple email attributes.

. Enter a *Name* attribute whose value should be used as the display name. Click *Add more* to add multiple display names.

. Enter a *Preferred username* attribute whose value should be used as the preferred username. Click *Add more* to add multiple preferred usernames.

. Optional: Click *Show advanced options* to add a certificate authority (CA) file to your OpenID identity provider.

. Optional: Under the advanced options, you can add *Additional scopes*. By default, the `OpenID` scope is requested.

. Click *Confirm*.

.Verification

* The configured identity provider is now visible on the *Access control* tab of the *Cluster List* page.
