Configure portal sign-in with OIDC
Create a PortalIdentityProviderRequest that references your Portal and supplies your OIDC issuer, client ID, and client secret.
Prerequisites
Series Prerequisites
This page is part of the Get started with Kong Operator and Dev Portal CRDs series.
Complete the previous page, Configure portal settings before completing this page.
OIDC provider
This guide requires and OIDC provider. In this example, we’ll use Okta, but the steps are similar in any standard OIDC provider. See Microsoft Entra ID, or run Keycloak locally and expose it with a tunnel.
You need an Okta admin account with a developer organization. If you prefer a different provider,
- In the Okta admin console, go to Applications > Applications and click Create App Integration.
- Select OIDC - OpenID Connect and click Next.
- Select Web Application and click Next.
- In the App integration name field, enter a name such as
Dev Portal. - Under Grant type, make sure Authorization Code is checked.
- Under Sign-in redirect URIs, add your Dev Portal callback URL. Use the hostname you configured for your portal, for example:
https://portal.example.dev/callback. - Click Save.
- From the app’s General tab, copy the Client ID and Client Secret.
- Go to Security > API > Authorization Servers and copy the Issuer URI of the
defaultserver, for example,https://your-org.okta.com/oauth2/default. -
Export the following environment variables:
export OIDC_ISSUER_URL='YOUR_OKTA_ISSUER_URL' export OIDC_CLIENT_ID='YOUR_CLIENT_ID' export OIDC_CLIENT_SECRET='YOUR_CLIENT_SECRET'Copied!
Create the PortalIdentityProviderRequest
The PortalIdentityProviderRequest configures the OIDC sign-in provider for the portal. Once applied, developers who visit the portal can sign in using your identity provider instead of a local account.
Create the PortalIdentityProviderRequest resource:
echo '
apiVersion: konnect.konghq.com/v1alpha1
kind: PortalIdentityProviderRequest
metadata:
name: operator-dev-portal-oidc
namespace: kong
spec:
portalRef:
type: namespacedRef
namespacedRef:
name: operator-dev-portal
apiSpec:
type: oidc
config:
type: oIDC
oIDC:
clientID: '"$OIDC_CLIENT_ID"'
clientSecret: '"$OIDC_CLIENT_SECRET"'
issuerURL: '"$OIDC_ISSUER_URL"'
scopes:
- openid
- profile
- email
' | kubectl apply -f -Validation
Check that the resource is ready:
kubectl wait portalidentityproviderrequest/operator-dev-portal-oidc -n kong \
--for=condition=Programmed=True \
--timeout=10m