Skip to main content

Add OpenID Connect identity providers to an Aiven Runtime application

You can give users access to an Aiven Runtime application through identity providers (IdPs) that support OpenID Connect (OIDC).

Required roles or permissions:role:project:admin, role:project:manager, or project:services:write
Note

Aiven handles authentication and blocks unauthenticated traffic at the platform level. If your backend needs to identify the logged-in user, read the identity passed in the X-Forwarded-User HTTP header.

Your identity provider must support the openid, profile, and email scopes. The setup order depends on when your provider requires the redirect URI. For provider-specific instructions, see Okta, Google Cloud, Microsoft Entra ID, or Auth0.

Step 1: Register an app in your identity provider​

Use this procedure if your provider allows registration without a redirect URI. If registration requires a redirect URI, follow the provider-specific instructions instead.

  1. Open the console for your identity provider in another tab.
  2. In your identity provider, register a new app.
  3. Copy the OIDC issuer URL, client ID, and client secret.

Step 2: Add your IdP to a Runtime application​

Add the identity provider in the Aiven Console:

  1. In the Aiven Console, go to your Aiven Runtime application and click Authentication.

  2. Click Add authentication method.

  3. Select OpenID Connect (OIDC) and click Next.

  4. Enter a name for the identity provider.

  5. Enter the Issuer/Provider URL, Client ID, and Client secret.

  6. Copy the Redirect URL.

  7. Click Add.

Step 3: Add the redirect URL to your application​

In your identity provider, add the Redirect URL from the Aiven Console.