Generic OIDC Auth

Getting Started

The Generic Auth Service allows you to integrate with any OpenID Connect (OIDC) compliant identity provider (IDP). It discovers the JWKS (JSON Web Key Set) URL either through the provider’s /.well-known/openid-configuration endpoint or directly via the provided authorizationServer.

To configure this auth service, you need to provide the audience (typically your client ID or the intended audience for the token), the authorizationServer of your identity provider, and optionally a list of scopesRequired that must be present in the token’s claims.

Behavior

Token Validation

When a request is received, the service will:

1. Extract the token from the <name>_token header (e.g., my-generic-auth_token).
2. Fetch the JWKS from the configured authorizationServer (caching it in the background) to verify the token’s signature.
3. Validate that the token is not expired and its signature is valid.
4. Verify that the aud (audience) claim matches the configured audience. claim contains all required scopes.
5. Return the validated claims to be used for Authenticated Parameters or Authorized Invocations.

Example

kind: authServices
name: my-generic-auth
type: generic
audience: ${YOUR_OIDC_AUDIENCE}
authorizationServer: https://your-idp.example.com
mcpEnabled: false
scopesRequired:
  - read
  - write

Reference