Set OIDC settings
POST /api/admin/auth/oidc/settings
Configure OpenID Connect as a login provider for Unleash.
Request
- application/json
Body
required
oidcSettingsSchema
- MOD1
- MOD2
- enabled boolean required
Possible values: [
true]Whether to enable or disable OpenID Connect for this instance
- discoverUrl uri
- clientId string required
The OIDC client ID of this application.
- secret string required
Shared secret from OpenID server. Used to authenticate login requests
- autoCreate boolean
Auto create users based on email addresses from login tokens
- enableSingleSignOut boolean
Support Single sign out when user clicks logout in Unleash. If
trueuser is signed out of all OpenID Connect sessions against the clientId they may have active - defaultRootRole string
Possible values: [
Viewer,Editor,Admin]Default role granted to users auto-created from email. Only relevant if autoCreate is
true - defaultRootRoleId number
Assign this root role to auto created users. Should be a role ID and takes precedence over
defaultRootRole. - emailDomains string
Comma separated list of email domains that are automatically approved for an account in the server. Only relevant if autoCreate is
true - acrValues string
Authentication Context Class Reference, used to request extra values in the acr claim returned from the server. If multiple values are required, they should be space separated. Consult the OIDC reference for more information
- idTokenSigningAlgorithm string
Possible values: [
RS256,RS384,RS512]The signing algorithm used to sign our token. Refer to the JWT signatures documentation for more information.
- enableGroupSyncing boolean
Should we enable group syncing. Refer to the documentation Group syncing
- groupJsonPath string
Specifies the path in the OIDC token response to read which groups the user belongs to from.
- addGroupsScope boolean
When enabled Unleash will also request the 'groups' scope as part of the login request.
- enabled boolean
Possible values: [
false]Whether to enable or disable OpenID Connect for this instance
- discoverUrl uri
- clientId string
The OIDC client ID of this application.
- secret string
Shared secret from OpenID server. Used to authenticate login requests
- autoCreate boolean
Auto create users based on email addresses from login tokens
- enableSingleSignOut boolean
Support Single sign out when user clicks logout in Unleash. If
trueuser is signed out of all OpenID Connect sessions against the clientId they may have active - defaultRootRole string
Possible values: [
Viewer,Editor,Admin]Default role granted to users auto-created from email. Only relevant if autoCreate is
true - defaultRootRoleId number
Assign this root role to auto created users. Should be a role ID and takes precedence over
defaultRootRole. - emailDomains string
Comma separated list of email domains that are automatically approved for an account in the server. Only relevant if autoCreate is
true - acrValues string
Authentication Context Class Reference, used to request extra values in the acr claim returned from the server. If multiple values are required, they should be space separated. Consult the OIDC reference for more information
- idTokenSigningAlgorithm string
Possible values: [
RS256,RS384,RS512]The signing algorithm used to sign our token. Refer to the JWT signatures documentation for more information.
- enableGroupSyncing boolean
Should we enable group syncing. Refer to the documentation Group syncing
- groupJsonPath string
Specifies the path in the OIDC token response to read which groups the user belongs to from.
- addGroupsScope boolean
When enabled Unleash will also request the 'groups' scope as part of the login request.
- 200
- 400
- 401
- 403
- 415
oidcSettingsSchema
- application/json
- Schema
Schema
- MOD1
- MOD2
- enabled boolean required
Possible values: [
true]Whether to enable or disable OpenID Connect for this instance
- discoverUrl uri
- clientId string required
The OIDC client ID of this application.
- secret string required
Shared secret from OpenID server. Used to authenticate login requests
- autoCreate boolean
Auto create users based on email addresses from login tokens
- enableSingleSignOut boolean
Support Single sign out when user clicks logout in Unleash. If
trueuser is signed out of all OpenID Connect sessions against the clientId they may have active - defaultRootRole string
Possible values: [
Viewer,Editor,Admin]Default role granted to users auto-created from email. Only relevant if autoCreate is
true - defaultRootRoleId number
Assign this root role to auto created users. Should be a role ID and takes precedence over
defaultRootRole. - emailDomains string
Comma separated list of email domains that are automatically approved for an account in the server. Only relevant if autoCreate is
true - acrValues string
Authentication Context Class Reference, used to request extra values in the acr claim returned from the server. If multiple values are required, they should be space separated. Consult the OIDC reference for more information
- idTokenSigningAlgorithm string
Possible values: [
RS256,RS384,RS512]The signing algorithm used to sign our token. Refer to the JWT signatures documentation for more information.
- enableGroupSyncing boolean
Should we enable group syncing. Refer to the documentation Group syncing
- groupJsonPath string
Specifies the path in the OIDC token response to read which groups the user belongs to from.
- addGroupsScope boolean
When enabled Unleash will also request the 'groups' scope as part of the login request.
- enabled boolean
Possible values: [
false]Whether to enable or disable OpenID Connect for this instance
- discoverUrl uri
- clientId string
The OIDC client ID of this application.
- secret string
Shared secret from OpenID server. Used to authenticate login requests
- autoCreate boolean
Auto create users based on email addresses from login tokens
- enableSingleSignOut boolean
Support Single sign out when user clicks logout in Unleash. If
trueuser is signed out of all OpenID Connect sessions against the clientId they may have active - defaultRootRole string
Possible values: [
Viewer,Editor,Admin]Default role granted to users auto-created from email. Only relevant if autoCreate is
true - defaultRootRoleId number
Assign this root role to auto created users. Should be a role ID and takes precedence over
defaultRootRole. - emailDomains string
Comma separated list of email domains that are automatically approved for an account in the server. Only relevant if autoCreate is
true - acrValues string
Authentication Context Class Reference, used to request extra values in the acr claim returned from the server. If multiple values are required, they should be space separated. Consult the OIDC reference for more information
- idTokenSigningAlgorithm string
Possible values: [
RS256,RS384,RS512]The signing algorithm used to sign our token. Refer to the JWT signatures documentation for more information.
- enableGroupSyncing boolean
Should we enable group syncing. Refer to the documentation Group syncing
- groupJsonPath string
Specifies the path in the OIDC token response to read which groups the user belongs to from.
- addGroupsScope boolean
When enabled Unleash will also request the 'groups' scope as part of the login request.
The request data does not match what we expect.
- application/json
- Schema
- Example (from schema)
Schema
- id string
The ID of the error instance
- name string
The name of the error kind
- message string
A description of what went wrong.
{
"id": "9c40958a-daac-400e-98fb-3bb438567008",
"name": "ValidationError",
"message": "The request payload you provided doesn't conform to the schema. The .parameters property should be object. You sent []."
}
Authorization information is missing or invalid. Provide a valid API token as the authorization header, e.g. authorization:*.*.my-admin-token.
- application/json
- Schema
- Example (from schema)
Schema
- id string
The ID of the error instance
- name string
The name of the error kind
- message string
A description of what went wrong.
{
"id": "9c40958a-daac-400e-98fb-3bb438567008",
"name": "AuthenticationRequired",
"message": "You must log in to use Unleash. Your request had no authorization header, so we could not authorize you. Try logging in at /auth/simple/login."
}
The provided user credentials are valid, but the user does not have the necessary permissions to perform this operation
- application/json
- Schema
- Example (from schema)
Schema
- id string
The ID of the error instance
- name string
The name of the error kind
- message string
A description of what went wrong.
{
"id": "9c40958a-daac-400e-98fb-3bb438567008",
"name": "NoAccessError",
"message": "You need the \"UPDATE_ADDON\" permission to perform this action in the \"development\" environment."
}
The operation does not support request payloads of the provided type. Please ensure that you're using one of the listed payload types and that you have specified the right content type in the "content-type" header.
- application/json
- Schema
- Example (from schema)
Schema
- id string
The ID of the error instance
- name string
The name of the error kind
- message string
A description of what went wrong.
{
"id": "9c40958a-daac-400e-98fb-3bb438567008",
"name": "ContentTypeerror",
"message": "We do not accept the content-type you provided (application/xml). Try using one of the content-types we do accept instead (application/json) and make sure the body is in the corresponding format."
}