OIDC (OpenID Connect)

OIDC is a standard for authentication and authorization that allows you to authenticate users with an external identity provider.

This feature is available in Odigos v1.0.201 and later.

Getting Started

To get started with OIDC, you need to configure the Odigos UI to use an external identity provider.

1. Create a new OIDC application in your identity provider

   You can use the Okta or Auth0 guides to create a new OIDC application.

   Please note that the OIDC application should be configured to allow the Odigos UI to access the Login redirect URLs.

   • If you are using the default Odigos UI, the redirect URL should be http://localhost:3000/auth/oidc-callback.
   • If you are using a custom/remote UI, the redirect URL should be the URL of the Odigos UI, with the path /auth/oidc-callback.
     For example, if you are using a remote UI at https://my-odigos-ui.com, the redirect URL should be https://my-odigos-ui.com/auth/oidc-callback.
2. Set OIDC variables

   You should set the OIDC values during installation or upgrade. The values can be obtained from the identity provider, after creating the OIDC application.

   CLI

   You can use the odigos install --set command.

   odigos install --set ui.oidcTenantUrl=<value> --set ui.oidcClientId=<value> --set ui.oidcClientSecret=<value>
   

   Helm

   You can set these values in your values.yaml file for Helm installations:

   ui:
     oidcTenantUrl: <value>
     oidcClientId: <value>
     oidcClientSecret: <value>
   

   Alternatively, you can use the --set flag when installing/upgrading the Odigos Helm chart:

   helm repo update
   helm upgrade odigos odigos/odigos --namespace odigos-system --set ui.oidcTenantUrl=<value> --set ui.oidcClientId=<value> --set ui.oidcClientSecret=<value>
   
3. Set UI remote URL (optional)

   If you are hosting the Odigos UI on a custom/remote URL (e.g. https://my-odigos-ui.com), you should set the value during installation or upgrade.

   CLI

   You can use the odigos install --set command.

   odigos install --set ui.uiRemoteUrl=<value>
   

   Helm

   You can set this value in your values.yaml file for Helm installations:

   ui:
     uiRemoteUrl: <value>
   

   Alternatively, you can use the --set flag when installing/upgrading the Odigos Helm chart:

   helm repo update
   helm upgrade odigos odigos/odigos --namespace odigos-system --set ui.uiRemoteUrl=<value>
   

Authentication behavior

When OIDC is configured, both the UI pages and the GraphQL, REST, and event APIs require authentication. Browsers use the id_token cookie set by the login callback. API clients can send an OIDC ID token issued for the configured client as Authorization: Bearer <id_token>; an OAuth access token or the Odigos on-prem license token is not a substitute. Unauthenticated API requests return HTTP 401, while unauthenticated UI page requests redirect to the IdP. Health probes, /auth/csrf-token, and /auth/oidc-callback remain public.

For odigos describe --remote, remote source operations, and remote token updates on OIDC-enabled installations, set ODIGOS_UI_ID_TOKEN to a valid ID token in the CLI’s environment. Remote token updates forward it as a cookie through the Kubernetes service proxy so Kubernetes authentication remains intact.

An oidc configuration block enables authentication. Supply the tenant URL, client ID, and a nonempty odigos-oidc secret. Incomplete settings, missing credentials, and unavailable configuration or IdP discovery return HTTP 503; they do not silently disable authentication. To disable OIDC intentionally, remove all three ui.oidc* values so the oidc block is absent.

Authentication work is canceled when the client disconnects and has a ten-second limit. Each request uses one configuration snapshot for its OAuth settings and token verifier.