10.3.4. OAuth configuration fields
The following fields define the behavior of Red Hat Quay when handling authentication through external identity providers using OAuth. You can configure global OAuth options such as token assignment and whitelisted client IDs, as well as provider-specific settings for GitHub and Google.
| Field | Type | Description |
|---|---|---|
| DIRECT_OAUTH_CLIENTID_WHITELIST | Array of String | A list of client IDs for Quay-managed applications that are allowed to perform direct OAuth approval without user approval. |
| FEATURE_ASSIGN_OAUTH_TOKEN | Boolean | Allows organization administrators to assign OAuth tokens to other users. |
Global OAuth example YAML
# ...
DIRECT_OAUTH_CLIENTID_WHITELIST:
- <quay_robot_client>
- <quay_app_token_issuer>
FEATURE_ASSIGN_OAUTH_TOKEN: true
# ...
Additional resources
| Field | Type | Description |
|---|---|---|
| FEATURE_GITHUB_LOGIN | Boolean |
Whether GitHub login is supported |
| GITHUB_LOGIN_CONFIG | Object | Configuration for using GitHub (Enterprise) as an external login provider. |
| .ALLOWED_ORGANIZATIONS | Array of String | The names of the GitHub (Enterprise) organizations whitelisted to work with the ORG_RESTRICT option. |
| .API_ENDPOINT | String |
The endpoint of the GitHub (Enterprise) API to use. Must be overridden for github.com |
|
.CLIENT_ID | String |
The registered client ID for this Red Hat Quay instance; cannot be shared with |
|
.CLIENT_SECRET | String |
The registered client secret for this Red Hat Quay instance. |
|
.GITHUB_ENDPOINT | String |
The endpoint for GitHub (Enterprise). |
| .ORG_RESTRICT | Boolean | If true, only users within the organization whitelist can login using this provider. |
Github OAth example YAML
# ...
FEATURE_GITHUB_LOGIN: true
GITHUB_LOGIN_CONFIG:
ALLOWED_ORGANIZATIONS:
- <myorg>
- <dev-team>
API_ENDPOINT: <https://api.github.com/>
CLIENT_ID: <client_id>
CLIENT_SECRET: <client_secret>
GITHUB_ENDPOINT: <https://github.com/>
ORG_RESTRICT: true
# ...
| Field | Type | Description |
|---|---|---|
| FEATURE_GOOGLE_LOGIN | Boolean |
Whether Google login is supported. |
| GOOGLE_LOGIN_CONFIG | Object | Configuration for using Google for external authentication. |
|
.CLIENT_ID | String |
The registered client ID for this Red Hat Quay instance. |
|
.CLIENT_SECRET | String |
The registered client secret for this Red Hat Quay instance. |
Google OAuth example YAML
# ...
FEATURE_GOOGLE_LOGIN: true
GOOGLE_LOGIN_CONFIG:
CLIENT_ID: <client_id>
CLIENT_SECRET: <client_secret>
# ...