You are browsing documentation for an outdated version. See the latest documentation here.
Set Up External Portal Application Authentication with Azure AD and OIDC
These instructions help you set up Azure AD as your third-party identity provider for use with the Kong OIDC and Portal Application Registration plugins.
portal_app_authconfiguration option is configured for your OAuth provider and strategy (
external-oauth2). See Configure the Authorization Provider Strategy for the Portal Application Registration plugin.
Create an Application in Azure
Within Azure, go to the App registrations service and register a new application.
In Certificates & secrets, create a Client secret and save it in a secure location. You can only view the secret once.
Under Manifest, update
accessTokenAcceptedVersion=2(default is null). The JSON for your application should look similar to this example:
Create a Service in Kong
Create a Route in Kong
Map the OIDC and Application Registration Plugins to the Service
Map the OpenID Connect and Application Registration plugins to the Service. The plugins must be applied to a Service to work properly.
Step 1: Configure the OIDC plugin for the Service
For more information, see OIDC plugin.
Step 2: Configure the Application Registration plugin for the Service
Step 3: Get an access token from Azure
Get an access token using the Client Credential workflow and convert the token
into a JSON Web Token (JWT). Replace the placeholder values with your values for
Get an access token from Azure:
Step 4: Convert an access token into a JWT token
Paste the access token obtained from the previous step into JWT.
Click Share JWT to copy the value for the aud (audience) claim to your clipboard. You will use the
audvalue as your Reference ID in the next procedure.
Create an Application in Kong
- Log in to your Dev Portal and create a new application:
- Select the My Apps menu -> New Application.
- Enter the Name of your Azure application.
- Paste the
audvalue generated in JWT in the Reference ID field.
- (Optional) Enter a Description.
After you create your application, make sure you activate the Service. In the Services section of the Application Dashboard, click Activate on the Service you want to use.
Because you enabled Auto-approve on the associated Application Registration Plugin, an admin won’t need to approve the request.
Test your Authentication Flows with your Azure Application
Follow these instructions to test your client credentials or authorization code flows with your Azure AD implementation.
Test Client Credentials Flow
Step 1: Get a token
Step 2: Use the token in an authorization header to retrieve the data
<token_from_above> with the bearer token you generated in the previous step.
Test Authorization Code Flow
In your browser, go to
You should be guided through a log in process within Azure and then the results delivered in your browser.
If you encounter any issues, review your data plane logs. Because you
display_errors=true on the OpenID Connect Plugin, you will receive
more verbose error messages that can help pinpoint any issues.