Generic OIDC Auth

Getting Started

The Generic Auth Service allows you to integrate with any OpenID Connect (OIDC) compliant identity provider (IDP). It discovers the JWKS (JSON Web Key Set) URL either through the provider’s /.well-known/openid-configuration endpoint or directly via the provided authUrl.

To configure this auth service, you need to provide the audience (typically your client ID or the intended audience for the token), the authUrl of your identity provider, and optionally a list of scopesRequired that must be present in the token’s claims.

Behavior

Token Validation

When a request is received, the service will:

1. Extract the Bearer token from the Authorization header.
2. Fetch the JWKS from the configured authUrl (caching it in the background) to verify the token’s signature.
3. Validate that the token is not expired and its signature is valid.
4. Verify that the aud (audience) claim matches the configured audience.
5. (Optional) If scopesRequired is provided, verify that the token’s scope claim contains all required scopes.
6. Return the validated claims to be used for Authenticated Parameters or Authorized Invocations.

Example

kind: authServices
name: my-generic-auth
type: generic
audience: ${YOUR_OIDC_AUDIENCE}
authUrl: https://your-idp.example.com
scopesRequired:
  - read
  - write

Reference