Skip to main content

General guidelines

Use this scenario if you have an existing service provider that supports the OIDC standard and acts as an intermediary between your application and Secrets Vault Identity. This approach is for backend applications secured by an existing OIDC-compliant service provider (e.g., Keycloak, Auth0, Okta). Your application will typically not interact directly with Secrets Vault Identity; instead, your OIDC provider handles the communication.

Prerequisites:​

  • You have an existing OIDC-compliant service provider that acts as the identity broker for your applications.
  • You must register your service provider (not your individual application) with our Secrets Vault Identity service to obtain a client_id and client_secret for this integration. The client type for this registration will be Confidential.

Integration Steps:​

The integration focuses on configuring your existing OIDC provider to delegate authentication to Secrets Vault Identity. Your application code will not need to change, as it continues to trust and communicate only with your existing service provider.

  1. Add Secrets Vault Identity as an Upstream Identity Provider: In your existing service provider's admin console, add our Secrets Vault Identity service as a new external OpenID Connect identity provider. This feature is sometimes called an "Identity Provider" or an "Enterprise Connection."
  2. Configure the Connection:
    • Use our discovery endpoint (https://your-server.com/api/oidc/{tenant_id}/.well-known/openid-configuration) to automatically populate most of the required fields within your OIDC provider's configuration.
    • You will need to manually enter the client_id and client_secret you obtained from Secrets Vault Identity during the registration of your service provider.
    • Example (Keycloak): In your realm, navigate to Identity Providers. Select OpenID Connect v1.0 from the list. On the configuration page, paste our discovery endpoint URL into the "Import from URL" field. Fill in the Client ID and Client Secret we provided.
    • Example (Auth0): Navigate to Authentication > Enterprise. Choose OpenID Connect and click Create Connection. Fill in the connection details, including the Issuer URL (from our discovery document), Client ID, and Client Secret.
  3. Enable for Your Application: Enable the newly configured identity provider connection for your client application(s) within your service provider's dashboard.
  4. Authentication Flow: When users log in to your application, they will see an option (or be automatically redirected, depending on your OIDC provider's setup) to authenticate using the Secrets Vault Identity service. Your OIDC provider (e.g., Keycloak/Auth0) will manage the entire OIDC flow with Secrets Vault Identity. After Secrets Vault Identity successfully authenticates the user and returns tokens to your OIDC provider, your provider will establish a session and issue its own tokens to your application, as it normally would.