# OIDC ## Create Identity Provider (OIDC) Create an OIDC-based Identity Provider using the `rctl` CLI. ### Create OIDC Identity Provider Using CLI ``` ./rctl create idp --authType oidc ``` **_Example_** ``` ./rctl create idp demoidp okta dummydomain.co user@dummydomain.co demogroup dummyclientid dummyclientsecret https://integrator-3525358-admin.okta.com/ "OIDC IdP created via RCTL" --authType oidc ``` **_Output_** ``` Creating OIDC IdP with name: demoidp, type: okta, domain: dummydomain.co, admin: user@dummydomain.co, group: demogroup, clientID: dummyclientid, clientSecret: dummyclientsecret, opDomainURL: https://integrator-3525358-admin.okta.com/, description: OIDC IdP created via RCTL Success patching IdP with name: demoidp ********* IMPORTANT ********* PLEASE USE BELOW REDIRECT URL TO CONFIGURE IdP Redirect URL: https://qc-console.stage.rafay.dev/auth/v1/oidc/callback/81dbe2f0-0150-4536-81fb-007b7b841b18/ Group Attribute Name: demogroup EMAIL FOR DOMAIN VERIFICATION FOR IDP HAS BEEN SENT TO user@dummydomain.co. PLEASE VERIFY DOMAIN. ``` Note The inline command is supported only for **Okta** and **PingOne** OIDC integrations. For any other Identity Provider such as **Keycloak**, use the configuration file method described below. ### Create OIDC Identity Provider Using YAML File ``` ./rctl create idp -f ./oidc_idp.yaml --authType oidc ``` **_Example Yaml File_** ``` name: oidcidp description: create oidc idp using yaml file via rctl idp_name: okta idp_admin: admin@dummydomain.co domain: dummydomain.co client_id: 0oaylauz7g9Axb7pH697 group_attribute_name: groups webhook_payload: custom: k2: v2 k3: v3 k1: v1 optional: - first_name - last_name - trigger_type client_secret: dummysecret op_domain_url: http://integrator-3525358.okta.com ``` **_Output_** ``` Success patching IdP with name: oidcidp ********* IMPORTANT ********* PLEASE USE BELOW REDIRECT URL TO CONFIGURE IdP Redirect URL: https://qc-console.stage.rafay.dev/auth/v1/oidc/callback/8dd77a71-b323-49e1-90e3-2029263fe071/ Group Attribute Name: groups EMAIL FOR DOMAIN VERIFICATION FOR IDP HAS BEEN SENT TO admin@dummydomain.co. PLEASE VERIFY DOMAIN. ``` ### Creating Keycloak Identity Provider **_Example_** ``` idp_name: keycloak idp_admin: user@dummydomainkeycloak.co domain: dummydomainkeycloak.co webhook_url: https://webhook.site/c9efe01a-e322-491d-9ffa-bf0b3e8d2a34 webhook_trigger_type: SSO_USER_LOGIN webhook_secret: demowebhooksecret client_id: democlientidfile group_attribute_name: demogroupsfile webhook_payload: custom: k2: v2 k3: v3 input: fileupdate optional: - first_name - trigger_type client_secret: democlientsecretfile op_domain_url: https://keycloak.qasimplified.com:8443/ discovery_endpoint: https://keycloak.qasimplified.com:8443/realms/master/.well-known/openid-configuration ``` ``` ./rctl create idp -f oidc_idp.yaml --authType oidc ``` **_Output_** ``` Success patching IdP with name: demoidpfilekeycloak ********* IMPORTANT ********* PLEASE USE BELOW REDIRECT URL TO CONFIGURE IdP Redirect URL: https://qc-console.stage.rafay.dev/auth/v1/oidc/callback/9753439c-4948-4abd-bf95-ed72dead07bf/ Group Attribute Name: demogroupsfile EMAIL FOR DOMAIN VERIFICATION FOR IDP HAS BEEN SENT TO user@dummydomainkeycloak.co. PLEASE VERIFY DOMAIN. ``` **Error Outputs** - Same Domain Error ``` Error: server error [return code: 500]: {"error":"rpc error: code = Unknown desc = failed to create OIDC config: ERROR #23505 duplicate key value violates unique constraint \"authsrv_idp_oidc_partner_id_domain_orgid_uniq\""} ``` - Domain and Admin Email Mismatch ``` Error: server error [return code: 500]: {"error":"rpc error: code = Unknown desc = failed to create OIDC config: IdP admin's email domain admin@dummydomain2.co does not match the provided domain dummydomain1.co"} ``` - Duplicate IdP Name ``` Error: server error [return code: 500]: {"error":"rpc error: code = Unknown desc = OIDC config with name demoidp already exists"} ``` ## Update Identity Provider (OIDC) Update an existing OIDC Identity Provider using CLI flags or a YAML file. ### Update OIDC Identity Provider Using CLI Flags ``` ./rctl update idp oidcidp \ --clientID oidcclientid \ --clientSecret oidcclientsecret \ --opDomainURL http://integrator-3525358.okta.com \ --groupAttributeName groups \ --webhookSecret secret \ --webhookURL https://webhookurl.com \ --webhookPayload '{ "custom": { "k1": "v1", "k2": "v2" }, "optional": [\ "first_name",\ "last_name",\ "trigger_type"\ ] }' \ --authType oidc ``` **_Output_** ``` Updating OIDC IdP with name: oidcidp Success patching IdP with name: oidcidp ********** IMPORTANT ********** PLEASE USE BELOW REDIRECT URL TO CONFIGURE IdP ------------------------------ Redirect URL: https://qc-console.stage.rafay.dev/auth/v1/oidc/callback/86d77a71-b323-49e1-90e3-2029263fa071/ Group Attribute Name: groups ``` ### Update OIDC Identity Provider Using YAML File ``` ./rctl update idp -f ./oidc_idp.yaml --authType oidc ``` **_Example Yaml_** ``` idp_name: okta idp_admin: admin@dummydemo.co domain: dummydemo.co client_id: 0oaylauz7g9Axb7pH697 group_attribute_name: groupsnew webhook_payload: custom: k2: v2 k3: v3 k1: v1 op: rctl update optional: - first_name - last_name - trigger_type webhook_url: https://dummywebhookurl webhook_secret: dummysecret webhook_trigger_type: SSO_USER_LOGIN client_secret: dummysecret op_domain_url: http://integrator-3525358.okta.com ``` **_Output_** ``` Success patching IdP with name: oidcidp Group Attribute Name: groupsnew ``` ## Get Identity Provider (OIDC) ### Get Identity Provider (Table View) ``` ./rctl get idp oidcidp ``` ``` +---------+----------+-------------+----------------------+----------------+-------------------+-----------+ | NAME | IDP NAME | DOMAIN | GROUP ATTRIBUTE NAME | DOMAIN VERIFIED| ENCRYPTION STATUS | AUTH TYPE | +---------+----------+-------------+----------------------+----------------+-------------------+-----------+ | oidcidp | okta | dummydemo.co | groups | unverified | disabled | oidc | +---------+----------+-------------+----------------------+----------------+-------------------+-----------+ ``` ### Get Identity Provider (YAML Output) ``` ./rctl get idp oidcidp --authType oidc -o yaml ``` ``` rafaytypemeta: apiversion: "" kind: "" metadata: count: 1 offset: 0 limit: 1 items: - id: 72d9gkg name: oidcidp idpname: okta idpadmin: admin@dummydemo.co domain: dummydemo.co groupattributename: groups domainverified: unverified encryption: disabled authtype: oidc organizationid: 7w2lnkp partnerid: rx28oml createdat: 2026-01-12T10:38:08.69641Z modifiedat: 2026-01-12T10:38:08.696411Z ``` ### Get Identity Provider (Detailed Output) ``` ./rctl get idp oidcidp -o yaml --detailed --authType oidc ``` ``` rafaytypemeta: apiversion: "" kind: "" metadata: count: 1 offset: 0 limit: 10 items: - id: x3mxvkr name: demoidpfile description: create oidc idp using yaml file via rctl createdat: 2025-12-19T17:29:05.044997Z modifiedat: 2025-12-19T17:29:05.044997Z trashed: false idpname: okta idpadmin: user@dummydomain.co domain: dummydomain.co domainverified: false clientid: democlientid opdomainurl: https://integrator-3525358-admin.okta.com authorizationendpoint: https://integrator-3525358.okta.com/oauth2/default/v1/authorize tokenendpoint: https://integrator-3525358.okta.com/oauth2/default/v1/token userinfoendpoint: https://integrator-3525358.okta.com/oauth2/default/v1/userinfo redirecturl: https://console-nikhil-testoidc.dev.rafay-edge.net/auth/v1/oidc/callback/70f14a7a-5b7d-4235-a04c-b6536f7a0e6d jwksendpoint: https://integrator-3525358.okta.com/oauth2/default/v1/keys discoveryendpoint: https://integrator-3525358-admin.okta.com/oauth2/default/.well-known/openid-configuration scopes: - openid - profile - email groupattributename: demogroups organizationid: 7w2lnkp partnerid: rx28oml authtype: oidc webhookpayload: custom: k1: v1 k2: v2 k3: v3 optional: - first_name - last_name - trigger_type webhooktriggertype: SSO_USER_LOGIN webhookurl: https://webhook.site/c9efe01a-e322-491d-9ffa-bf0b3e8d2a34 webhooksecret: 47fWfD3NyJz0eSh7vg0n6Zkx6nP4DNQAGNEI3J54DpTOcVkHKP8LfjZvD4 ``` ### Invalid Identity Provider Name ``` ./rctl get idp randomidp ``` ``` Error: server error [return code: 500]: {"error":"rpc error: code = Unknown desc = IdP config not found"} ``` ## List Identity Providers (OIDC) List all configured Identity Providers and view their summary or detailed configuration. ### List OIDC Identity Providers (Table View) ``` ./rctl get idp --authType oidc ``` ``` | NAME | IDP NAME | DOMAIN | GROUP ATTRIBUTE NAME | DOMAIN VERIFIED | ENCRYPTION STATUS | AUTH TYPE | |------------------------|----------|----------------------------|----------------------|-----------------|-------------------|-----------| | oidcidp | okta | dummydemo.co | groups | unverified | disabled | oidc | | demoidp | okta | dummydomain.co | demogroup | unverified | disabled | oidc | | demoidpfilekeycloak | keycloak | dummydomainkeycloak.co | demogroupsfile | unverified | disabled | oidc | | demo-keycloakoidc | keycloak | mycompany.com | group | unverified | disabled | oidc | | OKTA-test1 | okta | denipl.com | groups | verified | disabled | oidc | ``` ### List All IdPs (SAML + OIDC) ``` ./rctl get idp --authType all -o yaml ``` ``` metadata: count: 61 offset: 0 limit: 10 items: - name: oidcidp idpname: okta idpadmin: admin@dummydemo.co domain: dummydemo.co groupattributename: groups domainverified: unverified encryption: disabled authtype: oidc - name: demoidp idpname: okta idpadmin: user@dummydomain.co domain: dummydomain.co groupattributename: demogroup domainverified: unverified encryption: disabled authtype: oidc - name: samlidp idpname: okta idpadmin: admin@dummydemo.co domain: dummydemo.co groupattributename: group domainverified: unverified encryption: enabled authtype: saml ``` ### List OIDC Identity Providers (Detailed Output) ``` ./rctl get idp -o yaml --detailed --authType oidc ``` ``` metadata: count: 5 offset: 0 limit: 10 items: - name: demoidpfile description: create oidc idp using yaml file via rctl idpname: okta idpadmin: user@dummydomain1.co domain: dummydomain1.co domainverified: false clientid: democlientid opdomainurl: https://integrator-3525358-admin.okta.com authorizationendpoint: https://integrator-3525358.okta.com/oauth2/default/v1/authorize tokenendpoint: https://integrator-3525358.okta.com/oauth2/default/v1/token userinfoendpoint: https://integrator-3525358.okta.com/oauth2/default/v1/userinfo redirecturl: https://qc-console.stage.rafay.dev/auth/v1/oidc/callback/70f14a7a-5b7d-4235-a04c-b6536f7a0e6d/ jwksendpoint: https://integrator-3525358.okta.com/oauth2/default/v1/keys discoveryendpoint: https://integrator-3525358-admin.okta.com/oauth2/default/.well-known/openid-configuration scopes: - openid - profile - email groupattributename: demogroups organizationid: 7w2lnkp partnerid: rx28oml authtype: oidc webhookpayload: custom: k1: v1 k2: v2 k3: v3 optional: - first_name - last_name - trigger_type webhooktriggertype: SSO_USER_LOGIN ``` ## Delete Identity Provider (OIDC) Delete an existing Identity Provider using the `rctl` CLI. ### Delete Identity Provider ``` ./rctl delete idp ``` **Example** ``` ./rctl delete idp demoidpfile ``` ``` Success deleting idp config: demoidpfile ``` **Error Output** ``` ./rctl delete idp randomidp ``` ``` Error: error fetching idp randomidp: server error [return code: 500]: {"error":"rpc error: code = Unknown desc = IdP config not found"} ```