Skip to main content
Command reference

security oidc create

Suggest changes
PDFs

Create OIDC Client Configuration

Availability: This command is available to cluster administrators at the admin privilege level.

Description

The security oidc create command creates a new OpenID Connect (OIDC) client configuration. This command automatically generates the OAuth2.0 Provider configuration using the OIDC configurations. This command does not enable the OIDC feature, it only configures it. Configuring and enabling the OIDC feature is a two-step process:

  • Create an OIDC configuration using the security oidc create command.

  • Enable the OIDC feature using the security oidc modify-enabled true command.

Note Enabling or Disabling the OIDC feature restarts the web server. Any HTTP/S connections that are active will be disrupted.

Parameters

-provider {adfs|entra} - OIDC Provider

The name of the Identity Provider to use for the OIDC client.

-issuer {scheme://(hostname|IPv4 Address|'['IPv6 Address']')…​} - Issuer URI

This is the OIDC issuer URL. This is provided by the Identity Provider metadata.

-client-id <text> - Client ID

The client identifier for the OIDC client. This is provided by the Identity Provider.

-provider-jwks-uri {scheme://(hostname|IPv4 Address|'['IPv6 Address']')…​} - Provider JWKS URI

The JSON Web Key Set (JWKS) URI for the OIDC provider. This is provided by the Identity Provider. This is used to verify the signature of the ID token.

-remote-user-claim <text> - Remote User Claim

The claim in the ID token that contains the remote user name. This value of the claim will be set as authenticated user name.

-authorization-endpoint {scheme://(hostname|IPv4 Address|'['IPv6 Address']')…​} - Authorization Endpoint

The authorization endpoint URL for the OIDC provider. This is provided by the Identity Provider metadata.

-token-endpoint {scheme://(hostname|IPv4 Address|'['IPv6 Address']')…​} - Token Endpoint

The token endpoint URL for the OIDC provider. This is provided by the Identity Provider metadata.

[-skip-uri-validation {true|false}] - Skip URI Validations

When this parameter is set to true , validation of provider-jwks-uri is skipped. The default value of this parameter is false .

-redirect-ipaddress <Remote InetAddress> - OIDC Redirect IP Address

The IP address to use for the redirect URI. This is used when the OIDC client is enabled. Also this is the IP address or FQDN on which Apache will be hosted.

-end-session-endpoint {scheme://(hostname|IPv4 Address|'['IPv6 Address']')…​} - End Session URI

The end session endpoint URL for the OIDC provider. This is provided by the Identity Provider metadata. This is used to log out the user from the Identity Provider.

[-jwks-refresh-interval {P[<integer>D]T[<integer>H][<integer>M][<integer>S] | P<integer>W}] - JWKS Refresh Interval in ISO-8601 format

The interval in seconds to refresh the JSON Web Key Set (JWKS) from the OIDC provider. The default value is 3600 seconds (1 hour).

[-outgoing-proxy <text>] - Outgoing Proxy

The outgoing proxy to use for the OIDC client. This is used to connect to the OIDC provider. The format is \http://[username:password@]host:port .

[-access-token-issuer {scheme://(hostname|IPv4 Address|'['IPv6 Address']')…​}] - Issuer URI for access token

The issuer of the access token if it is different from the OIDC issuer. This is used to configure the OAuth2.0 Provider. If not provided, the issuer from the OIDC provider will be used.

Examples

The following example creates an OIDC client configuration for ADFS

cluster1::> security oidc create -provider adfs -issuer https://adfs.example.com/ -client-id myclient_id -client-secret myclientsecret -provider-jwks-uri https://adfs.example.com/adfs/discovery/keys -remote-user-claim unique_name -authorization-endpoint https://adfs.example.com/adfs/oauth2/authorize -token-endpoint https://adfs.example.com/adfs/oauth2/token -end-session-endpoint https://adfs.example.com/adfs/oauth2/logout -redirect-ipaddress  cluster_mgmt_address -access-token-issuer https://adfs.example.com/adfs/services/trust