<titledata-rh="true">OpenID Connect | OAuth2 Proxy</title><metadata-rh="true"name="viewport"content="width=device-width,initial-scale=1"><metadata-rh="true"name="twitter:card"content="summary_large_image"><metadata-rh="true"property="og:url"content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/openid_connect"><metadata-rh="true"name="docusaurus_locale"content="en"><metadata-rh="true"name="docsearch:language"content="en"><metadata-rh="true"name="docusaurus_version"content="current"><metadata-rh="true"name="docusaurus_tag"content="docs-default-current"><metadata-rh="true"name="docsearch:version"content="current"><metadata-rh="true"name="docsearch:docusaurus_tag"content="docs-default-current"><metadata-rh="true"property="og:title"content="OpenID Connect | OAuth2 Proxy"><metadata-rh="true"name="description"content="OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."><metadata-rh="true"property="og:description"content="OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."><linkdata-rh="true"rel="icon"href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><linkdata-rh="true"rel="canonical"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/openid_connect"><linkdata-rh="true"rel="alternate"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/openid_connect"hreflang="en"><linkdata-rh="true"rel="alternate"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/openid_connect"hreflang="x-default"><linkrel="stylesheet"href="/oauth2-proxy/assets/css/styles.4014daec.css">
<divrole="region"aria-label="Skip to main content"><aclass="skipToContent_fXgn"href="#__docusaurus_skipToContent_fallback">Skip to main content</a></div><navaria-label="Main"class="navbar navbar--fixed-top"><divclass="navbar__inner"><divclass="navbar__items"><buttonaria-label="Toggle navigation bar"aria-expanded="false"class="navbar__toggle clean-btn"type="button"><svgwidth="30"height="30"viewBox="0 0 30 30"aria-hidden="true"><pathstroke="currentColor"stroke-linecap="round"stroke-miterlimit="10"stroke-width="2"d="M4 7h22M4 15h22M4 23h22"></path></svg></button><aclass="navbar__brand"href="/oauth2-proxy/"><divclass="navbar__logo"><imgsrc="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"alt="OAuth2 Proxy"class="themedImage_ToTc themedImage--light_HNdA"><imgsrc="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"alt="OAuth2 Proxy"class="themedImage_ToTc themedImage--dark_i4oU"></div><bclass="navbar__title text--truncate">OAuth2 Proxy</b></a><aaria-current="page"class="navbar__item navbar__link navbar__link--active"href="/oauth2-proxy/docs/">Docs</a></div><divclass="navbar__items navbar__items--right"><divclass="navbar__item dropdown dropdown--hoverable dropdown--right"><aclass="navbar__link"aria-haspopup="true"aria-expanded="false"role="button"href="/oauth2-proxy/docs/next/">Next</a><ulclass="dropdown__menu"><li><aaria-current="page"class="dropdown__link dropdown__link--active"href="/oauth2-proxy/docs/next/configuration/providers/openid_connect">Next</a></li><li><aclass="dropdown__link"href="/oauth2-proxy/docs/">7.5.x</a></li><li><aclass="dropdown__link"href="/oauth2-proxy/docs/7.4.x/">7.4.x</a></li><li><aclass="dropdown__link"href="/oauth2-proxy/docs/7.3.x/">7.3.x</a></li><li><aclass="dropdown__link"href="/oauth2-proxy/docs/7.2.x/">7.2.x</a></li><li><aclass="dropdown__link"href="/oauth2-proxy/docs/7.1.x/">7.1.x</a></li><li><aclass="dropdown__link"href="/oauth2-proxy/docs/7.0.x/">7.0.x</a></li><li><aclass="dropdown__link"href="/oauth2-proxy/docs/6.1.x/">6.1.x</a></li></ul></div><ahref="https://github.com/oauth2-proxy/oauth2-proxy"target="_blank"rel="noopener noreferrer"class="navbar__item navbar__link">GitHub<svgwidth="13.5"height="13.5"aria-hidden="true"viewBox="0 0 24 24"class="iconExternalLink_nPIU"><pathfill="currentColor"d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><divclass="toggle_vylO colorModeToggle_DEke"><buttonclass="clean-btn toggleButton_gllP toggleButtonDisabled_aARS"type="button"disabled=""title="Switch between dark and light mode (currently light mode)"aria-label="Switch between dark and light mode (currently light mode)"aria-live="polite"><svgviewBox="0 0 24 24"width="24"height="24"class="lightToggleIcon_pyhR"><pathfill="currentColor"d="M12,9c1.65,0,3,1.35,3,3s-1.35,3-3,3s-3-1.35-3-3S10.35,9,12,9 M12,7c-2.76,0-5,2.24-5,5s2.24,5,5,5s5-2.24,5-5 S14.76,7,12,7L12,7z M2,13l2,0c0.55,0,1-0.45,1-1s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S1.45,13,2,13z M20,13l2,0c0.55,0,1-0.45,1-1 s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S19.45,13,20,13z M11,2v2c0,0.55,0.45,1,1,1s1-0.45,1-1V2c0-0.55-0.45-1-1-1S11,1.45,11,2z M11,20v2c0,0.55,0.45,1,1,1s1-0.45,1-1v-2c0-0.55-0.45-1-1-1C11.45,19,11,19.45,11,20z M5.99,4.58c-0.39-0.39-1.03-0.39-1.41,0 c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0s0.39-1.03,0-1.41L5.99,4.58z M18.36,16.95 c-0.39-0.39-1.03-0.39-1.41,0c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0c0.39-0.39,0.39-1.03,0-1.41 L18.36,16.95z M19.42,5.99c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06c-0.39,0.39-0.39,1.03,0,1.41 s1.03,0.39,1.41,0L19.42,5.99z M7.05,18.36c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06 c-0.39,0.39-0.39,1.03,0,1.41s1.03,0.39,1.41,0L7.05,18.36z"></path></svg><svgviewBox="0 0 24 24"width="24"height="24"class="darkToggleIcon_wfgR"><pathfill="currentColor"d="M9.37,5.51C9.19,6.15,9.1,6.82,9.1,7.5c0,4.08,3.32,7.4,7.4,7.4c0.68,0,1.35-0.09,1.99-0.27C17.45,17.19,14.93,19,12,19c-3
The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below.</p><h4class="anchor anchorWithStickyNavbar_LWe7"id="dex">Dex<ahref="#dex"class="hash-link"aria-label="Direct link to Dex"title="Direct link to Dex"></a></h4><p>To configure the OIDC provider for Dex, perform the following steps:</p><ol><li><p>Download Dex:</p><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">go get github.com/dexidp/dex</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>See the <ahref="https://dexidp.io/docs/getting-started/"target="_blank"rel="noopener noreferrer">getting started guide</a> for more details.</p></li><li><p>Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to
the <code>staticClients</code> section of <code>examples/config-dev.yaml</code>:</p><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">- id: oauth2-proxy</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">redirectURIs:</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">- 'http://127.0.0.1:4180/oauth2/callback'</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">name: 'oauth2-proxy'</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">secret: proxy</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li><li><p>Launch Dex: from <code>$GOPATH/github.com/dexidp/dex</code>, run:</p><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">bin/dex serve examples/config-dev.yaml</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li><li><p>In a second terminal, run the oauth2-proxy with the following args:</p><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-provider oidc</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-provider-display-name "My OIDC Provider"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-client-id oauth2-proxy</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-client-secret proxy</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-redirect-url http://127.0.0.1:4180/oauth2/callback</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-oidc-issuer-url http://127.0.0.1:5556/dex</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-cookie-secure=false</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-cookie-secret=secret</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-email-domain kilgore.trout</span><br></span></code></pre><divclass="buttonGroup__atx"><buttonty
you may wish to configure an authorization server for each application. Otherwise, the provided <code>default</code> will work.</p><ul><li>Navigate to <strong>Security</strong> then select <strong>API</strong></li><li>Click <strong>Add Authorization Server</strong>, if this option is not available you may require an additional license for a custom
authorization server.</li><li>Fill out the <strong>Name</strong> with something to describe the application you are protecting. e.g. 'Example App'.</li><li>For <strong>Audience</strong>, pick the URL of the application you wish to protect: <ahref="https://example.corp.com"target="_blank"rel="noopener noreferrer">https://example.corp.com</a></li><li>Fill out a <strong>Description</strong></li><li>Add any <strong>Access Policies</strong> you wish to configure to limit application access.</li><li>The default settings will work for other options.
<ahref="https://developer.okta.com/docs/guides/customize-authz-server/overview/"target="_blank"rel="noopener noreferrer">See Okta documentation for more information on Authorization Servers</a></li></ul></li><li><p>Navigate to <strong>Applications</strong> then select <strong>Add Application</strong>.</p><ul><li>Select <strong>Web</strong> for the <strong>Platform</strong> setting.</li><li>Select <strong>OpenID Connect</strong> and click <strong>Create</strong></li><li>Pick an <strong>Application Name</strong> such as <code>Example App</code>.</li><li>Set the <strong>Login redirect URI</strong> to <code>https://example.corp.com</code>.</li><li>Under <strong>General</strong> set the <strong>Allowed grant types</strong> to <code>Authorization Code</code> and <code>Refresh Token</code>.</li><li>Leave the rest as default, taking note of the <code>Client ID</code> and <code>Client Secret</code>.</li><li>Under <strong>Assignments</strong> select the users or groups you wish to access your application.</li></ul></li><li><p>Create a configuration file like the following:</p><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">provider = "oidc"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">redirect_url = "https://example.corp.com/oauth2/callback"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">upstreams = [</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">"https://example.corp.com"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">]</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">email_domains = [</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">"corp.com"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">]</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">client_id = "XXXXX"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">client_secret = "YYYYY"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">pass_access_token = true</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">cookie_secret = "ZZZZZ"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">skip_provider_button = true</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li></ol><p>The <code>oidc_issuer_url</code> is based on URL from your <strong>Authorization Server</strong>'s <strong>Issuer</strong> field in step 2, or simply
<ahref="https://corp.okta.com."target="_blank"rel="noopener noreferrer">https://corp.okta.com.</a> The <code>client_id</code> and <code>client_secret</code> are configured in the application settings.
Generate a unique <code>cookie_secret</code> to encrypt the cookie.</p><p>Then you can start the oauth2-proxy with <code>./oauth2-proxy --config /etc/example.cfg</code></p><h4class="anchor anchorWithStickyNavbar_LWe7"id="okta---localhost">Okta - localhost<ahref="#okta---localhost"class="hash-link"aria-label="Direct link to Okta - localhost"title="Direct link to Okta - localhost"></a></h4><ol><li>Signup for developer account: <ahref="https://developer.okta.com/signup/"target="_blank"rel="noopener noreferrer">https://developer.okta.com/signup/</a></li><li>Create New <code>Web</code> Application: https://${your-okta-domain}/dev/console/apps/new</li><li>Example Application Settings for localhost:<ul><li><strong>Name:</strong> My Web App</li><li><strong>Base URIs:</strong> http://localhost:4180/</li><li><strong>Login redirect URIs:</strong> http://localhost:4180/oauth2/callback</li><li><strong>Logout redirect URIs:</strong> http://localhost:4180/</li><li><strong>Group assignments:</strong><code>Everyone</code></li><li><strong>Grant type allowed:</strong><code>Authorization Code</code> and <code>Refresh Token</code></li></ul></li><li>Make note of the <code>Client ID</code> and <code>Client secret</code>, they are needed in a future step</li><li>Make note of the <strong>default</strong> Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as</li><li>Example config file <code>/etc/localhost.cfg</code><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">provider = "oidc"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">redirect_url = "http://localhost:4180/oauth2/callback"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">upstreams = [</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">"http://0.0.0.0:8080"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">]</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">email_domains = [</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">"*"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">]</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">client_id = "XXX"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">client_secret = "YYY"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">pass_access_token = true</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">cookie_secret = "ZZZ"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">cookie_secure = false</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">skip_provider_button = true</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"># Note: use the following for testing within a container</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"># http_address = "0.0.0.0:4180"</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,200,06,7V21A2,200,08,23
