:_mod-docs-content-type: ASSEMBLY
[id="zero-trust-manager-oidc-federation"]
= Zero Trust Workload Identity Manager OIDC federation

include::_attributes/common-attributes.adoc[]

:context: zero-trust-manager-oidc-federation

toc::[]

[role="_abstract"]
Ensure that your workloads can receive verifiable JSON Web Tokens (JWT-SVIDs) and allow external systems, such as cloud providers, to retrieve public keys from the discovery endpoint. Configure {zero-trust-full} to act as an OpenID Connect (OIDC) provider through the SPIRE server. 

The following providers are verified to work with SPIRE OIDC federation:

* Azure Entra ID

* Vault

// About the Entra ID OIDC
include::modules/zero-trust-manager-entraid-oidc-about.adoc[leveloffset=+1]

// configure OIDC route
include::modules/zero-trust-manager-create-route-oidc.adoc[leveloffset=+2]

// disable a route
include::modules/zero-trust-manager-disabling-route.adoc[leveloffset=+2]

// configure Azure
include::modules/zero-trust-manager-configure-azure.adoc[leveloffset=+2]

// configure azure blog
include::modules/zero-trust-manager-config-azure-blob.adoc[leveloffset=+2]

// configure azure managed identity
include::modules/zero-trust-manager-config-azure-identity.adoc[leveloffset=+2]

// create demo application
include::modules/zero-trust-manager-create-demo-app.adoc[leveloffset=+2]

// deploy demo application
include::modules/zero-trust-manager-deploy-app.adoc[leveloffset=+2]

// deploy demo application
include::modules/zero-trust-manager-spiffe-identity-federation.adoc[leveloffset=+2]

// verify access to Azure Blob
include::modules/zero-trust-manager-verify-blob-access.adoc[leveloffset=+2]


// About the Vault OIDC
include::modules/zero-trust-manager-vault-oidc-about.adoc[leveloffset=+1]

// Install the Vault OIDC
include::modules/zero-trust-manager-install-vault-oidc.adoc[leveloffset=+2]

// Initialize the Vault OIDC
include::modules/zero-trust-manager-initialize-vault-oidc.adoc[leveloffset=+2]

// Enable kv secret
include::modules/zero-trust-manager-vault-enable-kv.adoc[leveloffset=+2]

// Authenticate the JWT
include::modules/zero-trust-manager-vault-authenticate-jwt.adoc[leveloffset=+2]

// deploy a demonstration application
include::modules/zero-trust-manager-vault-deploy-demo.adoc[leveloffset=+2]

// authenticate and retrieve secret
include::modules/zero-trust-manager-vault-authenticate-secret.adoc[leveloffset=+2]



