OAuth helper

As we agree that the configuration of an external OAuth/OIDC provider can be a pain, this page is dedicated to help you configure the most common providers.

Supported OAuth flows#

We support three types of authentication flows. See authentication.md for more information.

Authorization Code Flow RFC 6749#

When the user login with their own personal credentials in the external provider’s website through the Perses UI.

Device Code Flow RFC 8628#

When the user login with their own personal credentials in the external provider’s website but this time from the Perses command line (percli). User will be invited to go to the provider’s website to enter a device code, and then login.

Client Credentials Flow RFC 6749#

Here we log in as an application, not a user. This is useful for scripted tasks not necessarily requiring a user to be logged in.

List of providers#

For each of the providers, the main pre-requisite is always to create an app in the provider’s console and to get the client ID and client secret, but we realised that each of them had their own little oddities that we’ll try to list up there.

Disclaimer: We try to keep this page up-to-date, but the provider’s documentation is always the most reliable source of information.

Azure AD#

authentication:
  providers:
    oidc:
      - slug_id: azure
        name: "Azure AD"
        client_id: "<your client ID>"
        client_secret: "<your client Secret>"
        issuer: "https://login.microsoftonline.com/<your tenant ID>/v2.0"
        scopes: ["openid", "profile", "email", "User.read"] # For Auth code / Device code
        client_credentials:
          scopes: ["https://graph.microsoft.com/.default"] # For Client Credentials

[!tip] The scope used to generate a token from client credentials is different from the one used in other flows.

Ref: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow

<Place Your Provider here …>#

… (don’t hesitate to propose new providers to add!)