// Module included in the following assemblies:
//
// * authentication/external-auth.adoc

:_mod-docs-content-type: REFERENCE
[id="external-auth-cli_{context}"]
= Example OIDC provider configuration for CLI clients only

[role="_abstract"]
In {product-title} clusters where the web console is disabled, you can configure direct authentication with an external OIDC provider for a CLI client only. In these cases, users must authenticate with the cluster directly through the {oc-first} instead of through the web console.

The following example OIDC provider configuration shows how to configure a CLI client without defining a web console client:

.OIDC provider configuration with only a CLI client
[source,yaml]
----
apiVersion: config.openshift.io/v1
kind: Authentication
metadata:
# ...
spec:
  type: OIDC
  webhookTokenAuthenticator: null
  oidcProviders:
  - claimMappings:
      groups:
        claim: groups
        prefix: 'oidc-groups-test:'
      username:
        claim: email
        prefixPolicy: Prefix
        prefix:
          prefixString: 'oidc-user-test:'
    issuer:
      audiences:
      - my-cli-client-id
      issuerURL: my-issuer-url
    name: my-oidc-provider-name
----
