--- layout: docs page_title: OIDC Identity Provider description: >- Setup and configuration for Vault as an OpenID Connect (OIDC) identity provider. --- # OIDC Identity Provider Vault is an OpenID Connect ([OIDC](https://openid.net/specs/openid-connect-core-1_0.html)) identity provider. This enables client applications that speak the OIDC protocol to leverage Vault's source of [identity](/docs/concepts/identity) and wide range of [authentication methods](/docs/auth) when authenticating end-users. Client applications can configure their authentication logic to talk to Vault. Once enabled, Vault will act as the bridge to other identity providers via its existing authentication methods. Client applications can also obtain identity information for their end-users by leveraging custom templating of Vault identity information. \-> **Note**: For more detailed information on the configuration resources and OIDC endpoints, please visit the [OIDC provider](/docs/concepts/oidc-provider) concepts page. ## Setup The Vault OIDC provider system is built on top of the identity secrets engine. This secrets engine is mounted by default and cannot be disabled or moved. Each Vault namespace has a default OIDC [provider](/docs/concepts/oidc-provider#providers) and [key](/docs/concepts/oidc-provider#key). This built-in configuration enables client applications to begin using Vault as a source of identity with minimal configuration. For details on the built-in configuration and advanced options, see the [OIDC provider](/docs/concepts/oidc-provider) concepts page. The following steps show a minimal configuration that allows a client application to use Vault as an OIDC provider. 1. Enable a Vault auth method: ```text $ vault auth enable userpass Success! Enabled userpass auth method at: userpass/ ``` Any Vault auth method may be used within the OIDC flow. For simplicity, enable the `userpass` auth method. 2. Create a user: ```text $ vault write auth/userpass/users/end-user password="securepassword" Success! Data written to: auth/userpass/users/end-user ``` This user will authenticate to Vault through a client application, otherwise known as an OIDC [relying party](https://openid.net/specs/openid-connect-core-1_0.html#Terminology). 2. Create a client application: ```text $ vault write identity/oidc/client/my-webapp \ redirect_uris="https://localhost:9702/auth/oidc-callback" \ assignments="allow_all" Success! Data written to: identity/oidc/client/my-webapp ``` This operation creates a client application which can be used to configure an OIDC relying party. See the [client applications](/docs/concepts/oidc-provider#client-applications) section for details on different client types, including `confidential` and `public` clients. The `assignments` parameter limits the Vault entities and groups that are allowed to authenticate through the client application. By default, no Vault entities are allowed. To allow all Vault entities to authenticate, the built-in [allow_all](/docs/concepts/oidc-provider#assignments) assignment is provided. 2. Read client credentials: ```text $ vault read identity/oidc/client/my-webapp Key Value --- ----- access_token_ttl 24h assignments [allow_all] client_id GSDTnn3KaOrLpNlVGlYLS9TVsZgOTweO client_secret hvo_secret_gBKHcTP58C4aq7FqPWsuqKgpiiegd7ahpifGae9WGkHRCwFEJTZA9KGdNVpzE0r8 client_type confidential id_token_ttl 24h key default redirect_uris [https://localhost:9702/auth/oidc-callback] ``` The `client_id` and `client_secret` are the client application's credentials. These values are typically required when configuring an OIDC relying party. 2. Read OIDC discovery configuration: ```text $ curl -s http://127.0.0.1:8200/v1/identity/oidc/provider/default/.well-known/openid-configuration { "issuer": "http://127.0.0.1:8200/v1/identity/oidc/provider/default", "jwks_uri": "http://127.0.0.1:8200/v1/identity/oidc/provider/default/.well-known/keys", "authorization_endpoint": "http://127.0.0.1:8200/ui/vault/identity/oidc/provider/default/authorize", "token_endpoint": "http://127.0.0.1:8200/v1/identity/oidc/provider/default/token", "userinfo_endpoint": "http://127.0.0.1:8200/v1/identity/oidc/provider/default/userinfo", "request_parameter_supported": false, "request_uri_parameter_supported": false, "id_token_signing_alg_values_supported": [ "RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA" ], "response_types_supported": [ "code" ], "scopes_supported": [ "openid" ], "subject_types_supported": [ "public" ], "grant_types_supported": [ "authorization_code" ], "token_endpoint_auth_methods_supported": [ "none", "client_secret_basic", "client_secret_post" ] } ``` Each Vault OIDC provider publishes [discovery metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). The `issuer` value is typically required when configuring an OIDC relying party. ## Usage After configuring a Vault auth method and client application, the following details can be used to configure an OIDC relying party to delegate end-user authentication to Vault. - `client_id` - The ID of the client application - `client_secret` - The secret of the client application - `issuer` - The issuer of the Vault OIDC provider A number of HashiCorp products provide OIDC authentication methods. This means that they can leverage Vault as a source of identity using the OIDC protocol. See the following links for details on configuring OIDC authentication for other HashiCorp products: - [Boundary](https://learn.hashicorp.com/tutorials/boundary/oidc-auth) - [Consul](https://developer.hashicorp.com/consul/docs/security/acl/auth-methods/oidc) - [Waypoint](https://developer.hashicorp.com/waypoint/docs/server/auth/oidc) Otherwise, refer to the documentation of the specific OIDC relying party for usage details. ## Supported Flows The Vault OIDC provider feature currently supports the following authentication flow: - [Authorization Code Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth). ## Tutorial Refer to the [Vault as an OIDC Identity Provider](https://learn.hashicorp.com/tutorials/vault/oidc-identity-provider) tutorial to learn how to configure a HashiCorp [Boundary](https://www.boundaryproject.io/) to leverage Vault as a source of identity using the OIDC protocol. ## API The Vault OIDC provider feature has a full HTTP API. Please see the [OIDC identity provider API](/api-docs/secret/identity/oidc-provider) for more details.