Create the OIDC configuration in the ONTAP cluster

07/17/2026

PDFs

POST /security/authentication/cluster/oidc

Introduced In: 9.19

Creates the OIDC configuration in the cluster.

Optional properties

skip_uri_validation
jwks_refresh_interval
outgoing_proxy
access_token_issuer

security oidc create

Parameters

Name	Type	In	Required	Description
return_timeout	integer	query	False	The number of seconds to allow the call to execute before returning. When doing a POST, PATCH, or DELETE operation on a single record, the default is 0 seconds. This means that if an asynchronous operation is started, the server immediately returns HTTP code 202 (Accepted) along with a link to the job. If a non-zero value is specified for POST, PATCH, or DELETE operations, ONTAP waits that length of time to see if the job completes so it can return something other than 202. Default value: 0 Max value: 120 Min value: 0

Name

Type

Required

Description

return_timeout

integer

query

False

The number of seconds to allow the call to execute before returning. When doing a POST, PATCH, or DELETE operation on a single record, the default is 0 seconds. This means that if an asynchronous operation is started, the server immediately returns HTTP code 202 (Accepted) along with a link to the job. If a non-zero value is specified for POST, PATCH, or DELETE operations, ONTAP waits that length of time to see if the job completes so it can return something other than 202.

Default value: 0
Max value: 120
Min value: 0

Request Body

Name	Type	Description
access_token_issuer	string	The issuer value for the access token when it is different from the OpenID Connect issuer.
authorization_endpoint	string	The URI of the authorization endpoint for the OpenID Connect provider.
client_id	string	The client ID for the application.
client_secret	string	The client secret for the application.
client_secret_hash	string	The hash of the client secret for the application.
end_session_endpoint	string	The URI of the end session endpoint for the OpenID Connect provider.
issuer	string	The URI of the OpenID Connect provider.
jwks_refresh_interval	string	The refresh interval for the JSON Web Key Set (JWKS), in ISO-8601 format. This can be set to a value from 300 seconds to 2147483647 seconds.
outgoing_proxy	string	Outgoing proxy to access external identity providers (IdPs). If not specified, no proxy is configured.
provider	string	The OpenID Connect provider type.
provider_jwks_uri	string	The URI of the JSON Web Key Set (JWKS) for the OpenID Connect provider.
redirect_ipaddress	string	The IP address to redirect to after authentication.
remote_user_claim	string	The claim used to identify the remote user.
skip_uri_validation	boolean	Indicates whether to skip URI validation.
token_endpoint	string	The URI of the token endpoint for the OpenID Connect provider.

Name

Type

Description

access_token_issuer

string

The issuer value for the access token when it is different from the OpenID Connect issuer.

authorization_endpoint

string

The URI of the authorization endpoint for the OpenID Connect provider.

client_id

string

The client ID for the application.

client_secret

string

The client secret for the application.

client_secret_hash

string

The hash of the client secret for the application.

end_session_endpoint

string

The URI of the end session endpoint for the OpenID Connect provider.

issuer

string

The URI of the OpenID Connect provider.

jwks_refresh_interval

string

The refresh interval for the JSON Web Key Set (JWKS), in ISO-8601 format. This can be set to a value from 300 seconds to 2147483647 seconds.

outgoing_proxy

string

Outgoing proxy to access external identity providers (IdPs). If not specified, no proxy is configured.

provider

string

The OpenID Connect provider type.

provider_jwks_uri

string

The URI of the JSON Web Key Set (JWKS) for the OpenID Connect provider.

redirect_ipaddress

string

The IP address to redirect to after authentication.

remote_user_claim

string

The claim used to identify the remote user.

skip_uri_validation

boolean

Indicates whether to skip URI validation.

token_endpoint

string

The URI of the token endpoint for the OpenID Connect provider.

Example request

{
  "access_token_issuer": "https://example.netapp.com/adfs/services/trust",
  "authorization_endpoint": "https://example.netapp.com/adfs/oauth2/authorize",
  "client_id": "1234567890abcdef",
  "client_secret": "1234567890abcdef1234567890abcdef",
  "client_secret_hash": "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
  "enabled": 1,
  "end_session_endpoint": "https://example.netapp.com/adfs/oauth2/logout",
  "issuer": "https://example.netapp.com/adfs",
  "jwks_refresh_interval": "PT2H",
  "outgoing_proxy": "https://johndoe:secretpass@proxy.example.com:8080",
  "provider": "adfs",
  "provider_jwks_uri": "https://example.netapp.com/adfs/discovery/v2.0/keys",
  "redirect_ipaddress": "10.10.10.10",
  "remote_user_claim": "unique_name",
  "skip_uri_validation": "",
  "token_endpoint": "https://example.netapp.com/adfs/oauth2/token"
}

Response

Status: 202, Accepted

Name	Type	Description
job	job_link

Name

Type

Description

job

job_link

Example response

{
  "job": {
    "uuid": "string"
  }
}

Headers

Name	Description	Type
Location	Useful for tracking the resource location	string

Name

Description

Type

Location

Useful for tracking the resource location

string

Response

Status: 201, Created

Error

Status: Default

ONTAP Error Response Codes

Error Code	Description
301465601	Provided client secret is invalid.
301465603	The value specified for client secret is too long. The text must be between 1 and 256 characters.
301465606	Failed to hash the client secret.
301465613	OIDC provider JWKS URI validation failed. Unable to reach the JWKS URI.
301465614	OIDC provider JWKS URI validation failed. Received incorrect response from the JWKS URI.
301465617	Invalid IP address specified for the "redirect_ipaddress". The IP address must be associated with a cluster management or node management LIF.
301465619	Cannot delete the OIDC configuration because OIDC authentication is enabled.
301465620	OAuth 2.0 configuration already exists for this OIDC configuration.
301465621	An error occurred while while creating OAuth 2.0 configuration for this OIDC configuration.
301465623	Cannot configure OIDC because SAML default metadata is configured.
301465624	Cannot configure OIDC because SAML is configured.
301465625	Specified value for the JWKS refresh interval is invalid. The value must be between 300 seconds to 2147483647 seconds.

Also see the table of common errors in the Response body overview section of this documentation.

Definitions

See Definitions

href

Name	Type	Description
href	string

Name

Type

Description

href

string

_links

security_oidc

Name	Type	Description
access_token_issuer	string	The issuer value for the access token when it is different from the OpenID Connect issuer.
authorization_endpoint	string	The URI of the authorization endpoint for the OpenID Connect provider.
client_id	string	The client ID for the application.
client_secret	string	The client secret for the application.
client_secret_hash	string	The hash of the client secret for the application.
end_session_endpoint	string	The URI of the end session endpoint for the OpenID Connect provider.
issuer	string	The URI of the OpenID Connect provider.
jwks_refresh_interval	string	The refresh interval for the JSON Web Key Set (JWKS), in ISO-8601 format. This can be set to a value from 300 seconds to 2147483647 seconds.
outgoing_proxy	string	Outgoing proxy to access external identity providers (IdPs). If not specified, no proxy is configured.
provider	string	The OpenID Connect provider type.
provider_jwks_uri	string	The URI of the JSON Web Key Set (JWKS) for the OpenID Connect provider.
redirect_ipaddress	string	The IP address to redirect to after authentication.
remote_user_claim	string	The claim used to identify the remote user.
skip_uri_validation	boolean	Indicates whether to skip URI validation.
token_endpoint	string	The URI of the token endpoint for the OpenID Connect provider.

Name

Type

Description

access_token_issuer

string

The issuer value for the access token when it is different from the OpenID Connect issuer.

authorization_endpoint

string

The URI of the authorization endpoint for the OpenID Connect provider.

client_id

string

The client ID for the application.

client_secret

string

The client secret for the application.

client_secret_hash

string

The hash of the client secret for the application.

end_session_endpoint

string

The URI of the end session endpoint for the OpenID Connect provider.

issuer

string

The URI of the OpenID Connect provider.

jwks_refresh_interval

string

The refresh interval for the JSON Web Key Set (JWKS), in ISO-8601 format. This can be set to a value from 300 seconds to 2147483647 seconds.

outgoing_proxy

string

Outgoing proxy to access external identity providers (IdPs). If not specified, no proxy is configured.

provider

string

The OpenID Connect provider type.

provider_jwks_uri

string

The URI of the JSON Web Key Set (JWKS) for the OpenID Connect provider.

redirect_ipaddress

string

The IP address to redirect to after authentication.

remote_user_claim

string

The claim used to identify the remote user.

skip_uri_validation

boolean

Indicates whether to skip URI validation.

token_endpoint

string

The URI of the token endpoint for the OpenID Connect provider.

job_link

Name	Type	Description
uuid	string	The UUID of the asynchronous job that is triggered by a POST, PATCH, or DELETE operation.

Name

Type

Description

uuid

string

The UUID of the asynchronous job that is triggered by a POST, PATCH, or DELETE operation.

error_arguments

Name	Type	Description
code	string	Argument code
message	string	Message argument

Name

Type

Description

code

string

Argument code

message

string

Message argument

returned_error

Name	Type	Description
arguments	array[error_arguments]	Message arguments
code	string	Error code
message	string	Error message
target	string	The target parameter that caused the error.

Name

Type

Description

arguments

array[error_arguments]

Message arguments

code

string

Error code

message

string

Error message

target

string

The target parameter that caused the error.

Create the OIDC configuration in the ONTAP cluster

Creating your file...

Optional properties

Related ONTAP commands

Parameters

Request Body

Response

Headers

Response

Error

Definitions