OpenID Connect (OIDC)

wikipedia:OpenID Connect identity provider is an authentication layer on top of OAuth 2.0

• OIDC tokens

EKS, aws eks describe-cluster:

        .../...
        "identity": {
            "oidc": {
                "issuer": "https://oidc.eks.us-east-2.amazonaws.com/id/6457185BA3C72F8Axxxxxxxx"
            }
        },

Activities

• Creating an IAM OIDC provider for your EKS cluster
• Managing the Amazon EBS CSI driver as an Amazon EKS add-on

AWS

• aws iam list-open-id-connect-providers
• aws iam create-open-id-connect-provider
• aws iam get-open-id-connect-provider
• aws_lb_listener_rule: authenticate_oidc
• aws sts assume-role-with-web-identity
• Terraform EKS module
• Dynamic Credentials with the AWS Provider

GitHub

• Terraform module: Github-oidc-provider

Related terms

• Keycloak
• Atlassian: Server vs. Data Center
• vault auth enable oidc
• IdP, SAML
• aws cognito-idp create-identity-provider --provider-type OIDC
• EKS OIDC: eksctl utils associate-iam-oidc-provider
• kubectl oidc-login
• aws eks describe-cluster --name my-cluster --query "cluster.identity.oidc.issuer" --output text
• OIDC Identity Provider: IAM OIDC provider

• Terraform resource: aws_lb_listener_rule: action block: forward, redirect, fixed-response, authenticate-cognito and authenticate-oidc.
• Terraform resource: aws_iam_openid_connect_provider

• Access Management (AM) Magic Quadrant
• kubectl config set-credentials USER_NAME --auth-provider=oidc .../...
• kubectl krew install oidc-login

See also

• aws iam oidc [ list-open-id-connect-providers | create-open-id-connect-provider | get-open-id-connect-provider ]
• OIDC, kubectl oidc-login, AWS IAM OIDC, EKS OIDC, EKS module, aws iam list-open-id-connect-providers | aws iam create-open-id-connect-provider | aws iam get-open-id-connect-provider, OIDC tokens, aws_lb_listener_rule
• OpenID, OpenID Foundation, OIDC, OAuth, OpenID Connect Provider, eksctl utils associate-iam-oidc-provider, aws_iam_openid_connect_provider, Relying Party (RP)

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener_rule#action-blocks