OIDC configuration

Edit online

Request

Edit online

Security

Edit online
Table 1. Roles capable of executing the OIDC Configuration API method
Any     Storage Account Administrator  
Super User ✔   Vault Provisioner  
System Administrator ✔   Elastic Device Provisioner  
Security Officer     Service Account  
Operator        

HTTP method

Edit online
POST /manager/api/{apiResponseType}/1.0/systemOidcConfiguration.adm HTTP/1.1 Host:{manager.dsnet} enabled={true|false}&issuer={issuer-url}&authorizationEndpoint={authorization-endpoint}&tokenEndpoint={token-endpoint}&jwksUri={jwks-uri}&userInfoEndpoint={userinfo-endpoint}&clientAuthenticationScheme={clientSecretBasic|clientSecretPost|clientSecretJwt|privateKeyJwt}&clientId={client-id}&clientSecret={client-secret}&groupClaim={group-claim}&audience={audience}&proxyEnabled={true|false}

Curl method

Edit online
curl -u {username}:{password} "https://{manager-ip}/manager/api/{apiResponseType}/1.0/systemOidcConfiguration.adm" 
-d "enabled={true|false}
   &issuer={issuer-url}
   &authorizationEndpoint={authorization-endpoint}
   &tokenEndpoint={token-endpoint}
   &jwksUri={jwks-uri}
   &userInfoEndpoint={userinfo-endpoint}
   &clientAuthenticationScheme={clientSecretBasic|clientSecretPost|clientSecretJwt|privateKeyJwt}
   &clientId={client-id}
   &clientSecret={client-secret}
   &groupClaim={group-claim}
   &audience={audience}&proxyEnabled={true|false}"

Parameters

Edit online
Table 2. Request parameters for OIDC Configuration (systemOidcConfiguration.adm) API method
Parameter Type Usage Default Description
enabled Boolean Required   Flag representing whether an OIDC provider is enabled or not.
issuer String Required if enabled=true   The issuer identifier (e.g: https://myTenant.verify.ibm.com/oidc/endpoint/default).
authorizationEndpoint String Required if enabled=true   The authorization endpoint (e.g: https://myTenant.verify.ibm.com/oidc/endpoint/authorize).
tokenEndpoint String Required if enabled=true   The token endpoint (e.g: https://myTenant.verify.ibm.com/oidc/endpoint/token).
jwksUri String Required if enabled=true   The JWKS URI (e.g: https://myTenant.verify.ibm.com/oidc/endpoint/jwks).
userInfoEndpoint String Required if enabled=true   The user info endpoint (e.g: https://myTenant.verify.ibm.com/oidc/endpoint/userinfo)
clientAuthenticationScheme String Required if enabled=true   The client authentication scheme the manager will use. Possible values:
  • clientSecretBasic
  • clientSecretPost
  • clientSecretJwt
  • privateKeyJwt
Note: Only JWS algorithms HS256 and RS256 are supported for clientSecretJwt and privateKeyJwt, respectively.
clientId String Required if enabled=true   The Manager's client ID.
clientSecret String Required if enabled=true   TheManager's client secret.
Note: The Manager is an OAuth 2.0 confidential client and requires a client secret
jwtKid String Required if clientAuthenticationScheme = privateKeyJwt   The value of the "kid" header in the generated JWT.
Note: The Manager does not support publishing keys via a JWKS URI. Use this field to manually set a key id so the OIDC provider can be configured if it requires a kid when using private_key_jwt.
jwtPrivateKeyPem String Optional   The RSA private key used with the privateKeyJwt scheme.
caCertificatePem String Optional   The CA certificate(s) used to establish provider trust in PEM format. Each certificate must be a root CA certificate.
Note: If not configured, the system's default trust store will be used and should be sufficient for cloud-based providers.
groupClaim String Required if enabled=true   The claim used to identify groups.
audience String Required if enabled=true   The manager's audience that is configured in the provider.
Note: All tokens must contain this audience or the manager will reject the token.
acr String Optional   The OIDC Authentication Context Class Reference claim.
proxyEnabled Boolean Required if enabled=true   Flag representing whether all communication with the provider will use a proxy or not.
proxyUrl String Required if proxyEnabled=true   The URL of the proxy.
proxyAuthenticated Boolean Required if proxyEnabled=true   Flag representing whether the HTTP proxy server requires authentication.
proxyUsername String Required if proxyAuthenticated=true   The username used to authenticate with the HTTP proxy server.
proxyPassword String Required if proxyAuthenticated=true   The password used to authenticate with the HTTP proxy server.