Set Up External Portal Application Authentication with Azure AD and OIDC
These instructions help you set up Azure AD as your third-party identity provider
for use with the Kong OIDC and Portal Application Registration plugins.
Create an Application in Azure
Within Azure, go to the App registrations service and register a new application.
In Certificates & secrets, create a Client secret and save it in a
secure location. You can only view the secret once.
Under Manifest, update
accessTokenAcceptedVersion=2 (default is null).
The JSON for your application should look similar to this example:
Create a Service in Kong
Create a Route in Kong
Map the OIDC and Application Registration Plugins to the Service
Map the OpenID Connect and Application Registration plugins to the Service.
The plugins must be applied to a Service to work properly.
Step 1: Configure the OIDC plugin for the Service
For more information, see OIDC plugin.
Step 2: Configure the Application Registration plugin for the Service
Step 3: Get an access token from Azure
Get an access token using the Client Credential workflow and convert the token
into a JSON Web Token (JWT). Replace the placeholder values with your values for
Get an access token from Azure:
Step 4: Convert an access token into a JWT token
Paste the access token obtained from the previous step into
Click Share JWT to copy the value for the
aud (audience) claim to
your clipboard. You will use the
aud value as your Reference ID in the
Create an Application in Kong
- Log in to your Developer Portal and create a new application:
- Select the My Apps menu -> New Application.
- Enter the Name of your Azure application.
- Paste the
aud value generated in JWT in the Reference ID field.
- (Optional) Enter a Description.
The Create Application form should look similar to this example:
After you create your application, make sure you activate the Service. In the
Services section of the Application Dashboard, click Activate on the Service
you want to use.
The view application details page should look similar to this example:
Because you enabled
on the associated Application Registration Plugin, an admin won’t need to
approve the request.
Test your Authentication Flows with your Azure Application
Follow these instructions to test your client credentials or authorization code
flows with your Azure AD implementation.
Test Client Credentials Flow
Step 1: Get a token
<token_from_above> with the bearer token you generated in the previous step.
Test Authorization Code Flow
In your browser, go to
You should be guided through a log in process within Azure and then the results
delivered in your browser.
If you encounter any issues, review your data plane logs. Because you
display_errors=true on the OpenID Connect Plugin, you will receive
more verbose error messages that can help pinpoint any issues.