Auth

Get OIDC auth settings

Changed on

Enterprise feature

Returns the current settings for OIDC Authentication

get/api/admin/auth/oidc/settings

Request

  • Base URL
    https://app.unleash-instance.example.com
  • URL
    https://app.unleash-instance.example.com/api/admin/auth/oidc/settings
  • Auth
    • API key in header Authorization
    • or HTTP bearer

Response

oidcSettingsResponseSchema

enabledtrue

Whether to enable or disable OpenID Connect for this instance

discoverUrlstring uri

The .well-known OpenID discover URL

clientIdstring

The OIDC client ID of this application.

secretstring

Shared secret from OpenID server. Used to authenticate login requests

autoCreateboolean

Auto create users based on email addresses from login tokens

enableSingleSignOutboolean

Support Single sign out when user clicks logout in Unleash. If true user is signed out of all OpenID Connect sessions against the clientId they may have active

defaultRootRole'Viewer' | 'Editor' | 'Admin'

Default role granted to users auto-created from email. Only relevant if autoCreate is true

defaultRootRoleIdnumber

Assign this root role to auto created users. Should be a role ID and takes precedence over defaultRootRole.

emailDomainsstring

Comma separated list of email domains that are automatically approved for an account in the server. Only relevant if autoCreate is true

acrValuesstring

Authentication Context Class Reference, used to request extra values in the acr claim returned from the server. If multiple values are required, they should be space separated. Consult the OIDC reference for more information

idTokenSigningAlgorithm'RS256' | 'RS384' | 'RS512'

The signing algorithm used to sign our token. Refer to the JWT signatures documentation for more information.

enableGroupSyncingboolean

Should we enable group syncing. Refer to the documentation Group syncing

groupJsonPathstring

Specifies the path in the OIDC token response to read which groups the user belongs to from.

addGroupsScopeboolean

When enabled Unleash will also request the 'groups' scope as part of the login request.

enablePkceboolean

Enable PKCE (Proof Key for Code Exchange) for enhanced security. Recommended for public clients and provides additional protection against authorization code interception attacks.

extraScopesstring

Space-separated list of additional scopes to request during login, beyond the default openid email profile and groups if group syncing is enabled.

Example response

{
  "enabled": true,
  "discoverUrl": "https://myoidchost.azure.com/.well-known/openid-configuration",
  "clientId": "FB87266D-CDDB-4BCF-BB1F-8392FD0EDC1B",
  "secret": "qjcVfeFjEfoYAF3AEsX2IMUWYuUzAbXO",
  "defaultRootRoleId": 2,
  "emailDomains": "getunleash.io,getunleash.ai",
  "acrValues": "urn:okta:loa:2fa:any phr",
  "idTokenSigningAlgorithm": "RS256",
  "groupJsonPath": "groups",
  "extraScopes": "custom_scope1 custom_scope2"
}

Changes