<titledata-rh="true">OpenID Connect | OAuth2 Proxy</title><metadata-rh="true"name="viewport"content="width=device-width,initial-scale=1"><metadata-rh="true"name="twitter:card"content="summary_large_image"><metadata-rh="true"property="og:url"content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/openid_connect"><metadata-rh="true"name="docusaurus_locale"content="en"><metadata-rh="true"name="docsearch:language"content="en"><metadata-rh="true"name="docusaurus_version"content="current"><metadata-rh="true"name="docusaurus_tag"content="docs-default-current"><metadata-rh="true"name="docsearch:version"content="current"><metadata-rh="true"name="docsearch:docusaurus_tag"content="docs-default-current"><metadata-rh="true"property="og:title"content="OpenID Connect | OAuth2 Proxy"><metadata-rh="true"name="description"content="OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."><metadata-rh="true"property="og:description"content="OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects."><linkdata-rh="true"rel="icon"href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><linkdata-rh="true"rel="canonical"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/openid_connect"><linkdata-rh="true"rel="alternate"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/openid_connect"hreflang="en"><linkdata-rh="true"rel="alternate"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/openid_connect"hreflang="x-default"><linkrel="stylesheet"href="/oauth2-proxy/assets/css/styles.4014daec.css">
The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta, an example can be found below.</p><h4class="anchor anchorWithStickyNavbar_LWe7"id="dex">Dex<ahref="#dex"class="hash-link"aria-label="Direct link to Dex"title="Direct link to Dex"></a></h4><p>To configure the OIDC provider for Dex, perform the following steps:</p><ol><li><p>Download Dex:</p><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">go get github.com/dexidp/dex</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>See the <ahref="https://dexidp.io/docs/getting-started/"target="_blank"rel="noopener noreferrer">getting started guide</a> for more details.</p></li><li><p>Setup oauth2-proxy with the correct provider and using the default ports and callbacks. Add a configuration block to
the <code>staticClients</code> section of <code>examples/config-dev.yaml</code>:</p><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">- id: oauth2-proxy</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">redirectURIs:</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">- 'http://127.0.0.1:4180/oauth2/callback'</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">name: 'oauth2-proxy'</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">secret: proxy</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li><li><p>Launch Dex: from <code>$GOPATH/github.com/dexidp/dex</code>, run:</p><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">bin/dex serve examples/config-dev.yaml</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li><li><p>In a second terminal, run the oauth2-proxy with the following args:</p><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-provider oidc</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-provider-display-name "My OIDC Provider"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-client-id oauth2-proxy</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-client-secret proxy</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-redirect-url http://127.0.0.1:4180/oauth2/callback</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-oidc-issuer-url http://127.0.0.1:5556/dex</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-cookie-secure=false</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-cookie-secret=secret</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">-email-domain kilgore.trout</span><br></span></code></pre><divclass="buttonGroup__atx"><buttonty
you may wish to configure an authorization server for each application. Otherwise, the provided <code>default</code> will work.</p><ul><li>Navigate to <strong>Security</strong> then select <strong>API</strong></li><li>Click <strong>Add Authorization Server</strong>, if this option is not available you may require an additional license for a custom
authorization server.</li><li>Fill out the <strong>Name</strong> with something to describe the application you are protecting. e.g. 'Example App'.</li><li>For <strong>Audience</strong>, pick the URL of the application you wish to protect: <ahref="https://example.corp.com"target="_blank"rel="noopener noreferrer">https://example.corp.com</a></li><li>Fill out a <strong>Description</strong></li><li>Add any <strong>Access Policies</strong> you wish to configure to limit application access.</li><li>The default settings will work for other options.
<ahref="https://developer.okta.com/docs/guides/customize-authz-server/overview/"target="_blank"rel="noopener noreferrer">See Okta documentation for more information on Authorization Servers</a></li></ul></li><li><p>Navigate to <strong>Applications</strong> then select <strong>Add Application</strong>.</p><ul><li>Select <strong>Web</strong> for the <strong>Platform</strong> setting.</li><li>Select <strong>OpenID Connect</strong> and click <strong>Create</strong></li><li>Pick an <strong>Application Name</strong> such as <code>Example App</code>.</li><li>Set the <strong>Login redirect URI</strong> to <code>https://example.corp.com</code>.</li><li>Under <strong>General</strong> set the <strong>Allowed grant types</strong> to <code>Authorization Code</code> and <code>Refresh Token</code>.</li><li>Leave the rest as default, taking note of the <code>Client ID</code> and <code>Client Secret</code>.</li><li>Under <strong>Assignments</strong> select the users or groups you wish to access your application.</li></ul></li><li><p>Create a configuration file like the following:</p><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">provider = "oidc"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">redirect_url = "https://example.corp.com/oauth2/callback"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">upstreams = [</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">"https://example.corp.com"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">]</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">email_domains = [</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">"corp.com"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">]</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">client_id = "XXXXX"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">client_secret = "YYYYY"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">pass_access_token = true</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">cookie_secret = "ZZZZZ"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">skip_provider_button = true</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li></ol><p>The <code>oidc_issuer_url</code> is based on URL from your <strong>Authorization Server</strong>'s <strong>Issuer</strong> field in step 2, or simply
<ahref="https://corp.okta.com."target="_blank"rel="noopener noreferrer">https://corp.okta.com.</a> The <code>client_id</code> and <code>client_secret</code> are configured in the application settings.
Generate a unique <code>cookie_secret</code> to encrypt the cookie.</p><p>Then you can start the oauth2-proxy with <code>./oauth2-proxy --config /etc/example.cfg</code></p><h4class="anchor anchorWithStickyNavbar_LWe7"id="okta---localhost">Okta - localhost<ahref="#okta---localhost"class="hash-link"aria-label="Direct link to Okta - localhost"title="Direct link to Okta - localhost"></a></h4><ol><li>Signup for developer account: <ahref="https://developer.okta.com/signup/"target="_blank"rel="noopener noreferrer">https://developer.okta.com/signup/</a></li><li>Create New <code>Web</code> Application: https://${your-okta-domain}/dev/console/apps/new</li><li>Example Application Settings for localhost:<ul><li><strong>Name:</strong> My Web App</li><li><strong>Base URIs:</strong> http://localhost:4180/</li><li><strong>Login redirect URIs:</strong> http://localhost:4180/oauth2/callback</li><li><strong>Logout redirect URIs:</strong> http://localhost:4180/</li><li><strong>Group assignments:</strong><code>Everyone</code></li><li><strong>Grant type allowed:</strong><code>Authorization Code</code> and <code>Refresh Token</code></li></ul></li><li>Make note of the <code>Client ID</code> and <code>Client secret</code>, they are needed in a future step</li><li>Make note of the <strong>default</strong> Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as</li><li>Example config file <code>/etc/localhost.cfg</code><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">provider = "oidc"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">redirect_url = "http://localhost:4180/oauth2/callback"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">upstreams = [</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">"http://0.0.0.0:8080"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">]</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">email_domains = [</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">"*"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">]</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">client_id = "XXX"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">client_secret = "YYY"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">pass_access_token = true</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">cookie_secret = "ZZZ"</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">cookie_secure = false</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">skip_provider_button = true</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"># Note: use the following for testing within a container</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"># http_address = "0.0.0.0:4180"</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,200,06,7V21A2,200,08,23
