Chapter 4. Authenticating with OpenID Connect

Procedure

1. Stop the flightctl services before editing your service-config.yaml file:

   sudo systemctl stop flightctl.target

2. Configure the integration settings by editing the configuration file:

   sudo vi /etc/flightctl/service-config.yaml

3. Update the configuration file to integrate with OIDC:

   global:
     baseDomain: YOUR_EDGE_MANAGER_HOSTNAME
     auth:
       type: oidc
       insecureSkipTlsVerify: false
       oidc:
         oidcAuthority: "https://YOUR_IDP_HOST/realms/YOUR_REALM"
         externalOidcAuthority: "https://YOUR_IDP_PUBLIC_HOST/realms/YOUR_REALM"
         oidcClientId: "YOUR_OIDC_CLIENT_ID"

   baseDomain

   The domain name or IP for the host.

   type

   Set this to oidc to enable OIDC authentication.

   insecureSkipTlsVerify

   Set to false. Only set this to true to skip TLS certificate verification for your identity provider URLs. For production environments, configure a proper CA trust store instead of leaving verification disabled.

   oidcAuthority

   The base URL to your Realm’s OpenID Connect configuration endpoint.

   externalOidcAuthority

   The publicly accessible URL for the same Keycloak realm endpoint.

   oidcClientId

   The Client ID you defined when registering your application in the Keycloak console.

4. Start the services:

   sudo systemctl start flightctl.target