Custom OIDC | SqlOS Docs

Discovery-based setup#

For providers that publish a .well-known/openid-configuration endpoint (Okta, Auth0, Keycloak, etc.):

BASH

curl -X POST http://localhost:5062/sqlos/admin/auth/api/oidc-connections \
  -b "$SQLOS_DASHBOARD_COOKIE_JAR" \
  -H "Content-Type: application/json" \
  -d '{
    "providerType": "custom",
    "displayName": "Okta",
    "clientId": "YOUR_CLIENT_ID",
    "clientSecret": "YOUR_CLIENT_SECRET",
    "useDiscovery": true,
    "discoveryUrl": "https://your-org.okta.com/.well-known/openid-configuration",
    "allowedCallbackUris": [
      "http://localhost:5062/sqlos/auth/oidc/callback"
    ]
  }'

SqlOS fetches the authorization, token, and userinfo endpoints automatically from the discovery document.

Manual configuration#

For providers without a discovery endpoint:

BASH

curl -X POST http://localhost:5062/sqlos/admin/auth/api/oidc-connections \
  -b "$SQLOS_DASHBOARD_COOKIE_JAR" \
  -H "Content-Type: application/json" \
  -d '{
    "providerType": "custom",
    "displayName": "Custom Provider",
    "clientId": "YOUR_CLIENT_ID",
    "clientSecret": "YOUR_CLIENT_SECRET",
    "useDiscovery": false,
    "issuer": "https://provider.com",
    "authorizationEndpoint": "https://provider.com/authorize",
    "tokenEndpoint": "https://provider.com/token",
    "userinfoEndpoint": "https://provider.com/userinfo",
    "jwksUri": "https://provider.com/.well-known/jwks.json",
    "allowedCallbackUris": [
      "http://localhost:5062/sqlos/auth/oidc/callback"
    ]
  }'

Both create operations enable the connection. The callback URI must exactly match a redirect URI registered with the provider. For manual mode, issuer, authorizationEndpoint, tokenEndpoint, and jwksUri are required; include userinfoEndpoint when the provider exposes one. See Authenticate operator API calls and OIDC Social Login.