:_mod-docs-content-type: ASSEMBLY
[id="rosa-hcp-sts-creating-a-cluster-ext-auth"]
= Creating a {product-title} cluster that uses external authentication
include::_attributes/attributes-openshift-dedicated.adoc[]
:context: rosa-hcp-sts-creating-a-cluster-ext-auth

toc::[]

[role="_abstract"]
You can create {product-title} clusters that use an external OpenID Connect (OIDC) identity provider to issue tokens for authentication, replacing the built-in OpenShift OAuth server.

While the built-in OpenShift OAuth server supports integration with a variety of identity providers, including external OIDC identity providers, it is limited to the capabilities of the OAuth server itself. You can directly integrate external OIDC identity providers with {product-title} clusters to enable machine-to-machine workflows and capabilities beyond the built-in OpenShift OAuth server.

[IMPORTANT]
====
You cannot upgrade or convert existing {rosa-classic-title} clusters to {hcp} architecture. You must create a new {product-title} cluster. You also cannot convert a cluster that was created to use external authentication providers to use the internal OAuth2 server. You must also create a new cluster.
====

[NOTE]
====
{product-title} clusters only support {sts-first} authentication.
====

include::modules/rosa-hcp-prerequisites.adoc[leveloffset=+1]

include::modules/rosa-hcp-sts-creating-a-cluster-external-auth-cluster-cli.adoc[leveloffset=+1]

include::modules/rosa-hcp-sts-creating-a-cluster-external-auth-provider-cli.adoc[leveloffset=+1]

include::modules/rosa-hcp-sts-example-microsoft-entra-id-configuration.adoc[leveloffset=+2]

include::modules/rosa-hcp-sts-example-keycloak-configuration.adoc[leveloffset=+2]

include::modules/rosa-hcp-sts-creating-a-break-glass-cred-cli.adoc[leveloffset=+1]

include::modules/rosa-hcp-sts-accessing-a-break-glass-cred-cli.adoc[leveloffset=+1]

include::modules/rosa-hcp-sts-revoking-a-break-glass-cred-cli.adoc[leveloffset=+1]

include::modules/rosa-hcp-sts-creating-a-cluster-external-auth-provider-delete-cli.adoc[leveloffset=+1]

[role="_additional-resources"]
[id="additional-resources_rosa-sts-creating-a-cluster-ext-auth"]
== Additional resources

* xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-ext-auth.adoc#rosa-hcp-sts-creating-a-cluster-external-auth-cluster-cli_rosa-hcp-sts-creating-a-cluster-ext-auth[Creating a {product-title} cluster that uses direct authentication with an external OIDC identity provider]
* xref:../authentication/using-rbac.adoc#authorization-overview_using-rbac[Using RBAC to define and apply permissions]
* xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-creating-vpc_rosa-hcp-sts-creating-a-cluster-quickly[Configured virtual private cloud (VPC)]
* xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-sts-creating-account-wide-sts-roles-and-policies_rosa-hcp-sts-creating-a-cluster-quickly[Account-wide roles]
* xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-sts-byo-oidc_rosa-hcp-sts-creating-a-cluster-quickly[OIDC configuration]
* xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-operator-config_rosa-hcp-sts-creating-a-cluster-quickly[Operator roles]
* xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-about-operator-role-prefixes_rosa-sts-about-iam-resources[About custom Operator IAM role prefixes]
* xref:../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-hcp-aws-prereqs[AWS prerequisites for ROSA with STS]
* link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html[Creating OpenID Connect (OIDC) identity providers (AWS documentation)]
* xref:../support/troubleshooting/rosa-troubleshooting-installations-hcp.adoc#rosa-troubleshooting-installations-hcp[Troubleshooting {product-title} cluster installations]
* xref:../support/getting-support.adoc#getting-support[Getting support for {product-title}]
