OpenID Connect

Overview Examples Configuration reference Changelog API reference

Configuration

configobjectrequired

Hide Child Parameters

anonymousstring

An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a 4xx HTTP status code. This value must refer to the consumer id or username attribute, and not its custom_id.

audiencearray[string]

The audience passed to the authorization endpoint.

audience_claimarray[string]

The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload.

Default:aud

audience_requiredarray[string]

The audiences (audience_claim claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases.

auth_methodsarray[string]

Types of credentials/grants to enable.

Allowed values:authorization_codebearerclient_credentialsintrospectionkong_oauth2passwordrefresh_tokensessionuserinfo

Default:authorization_code, bearer, client_credentials, introspection, kong_oauth2, password, refresh_token, session, userinfo

authenticated_groups_claimarray[string]

The claim that contains authenticated groups. This setting can be used together with ACL plugin, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload.

authorization_endpointstring

The authorization endpoint. If set it overrides the value in authorization_endpoint returned by the discovery endpoint.

authorization_query_args_clientarray[string]

Extra query arguments passed from the client to the authorization endpoint.

authorization_query_args_namesarray[string]

Extra query argument names passed to the authorization endpoint.

authorization_query_args_valuesarray[string]

Extra query argument values passed to the authorization endpoint.

authorization_rolling_timeoutnumber

Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.

Default:600

bearer_token_param_typearray[string]

Where to look for the bearer token: - header: search the Authorization, access-token, and x-access-token HTTP headers - query: search the URL’s query string - body: search the HTTP request body - cookie: search the HTTP request cookies specified with config.bearer_token_cookie_name.

Allowed values:bodycookieheaderquery

Default:body, header, query

by_username_ignore_caseboolean

If consumer_by is set to username, specify whether username can match consumers case-insensitively.

Default:false

cache_introspectionboolean

Cache the introspection endpoint requests.

Default:true

cache_token_exchangeboolean

Cache the token exchange endpoint requests.

Default:true

cache_tokensboolean

Cache the token endpoint requests.

Default:true

cache_tokens_saltstring

Salt used for generating the cache key that is used for caching the token endpoint requests.

cache_ttlnumber

The default cache ttl in seconds that is used in case the cached object does not specify the expiry.

Default:3600

cache_ttl_maxnumber

The maximum cache ttl in seconds (enforced).

cache_ttl_minnumber

The minimum cache ttl in seconds (enforced).

cache_ttl_negnumber

The negative cache ttl in seconds.

cache_ttl_resurrectnumber

The resurrection ttl in seconds.

cache_user_infoboolean

Cache the user info requests.

Default:true

claims_forbiddenarray[string]

If given, these claims are forbidden in the token payload.

client_algarray[string]

The algorithm to use for client_secret_jwt (only HS***) or private_key_jwt authentication.

Allowed values:ES256ES384ES512EdDSAHS256HS384HS512PS256PS384PS512RS256RS384RS512

client_argstring

The client to use for this request (the selection is made with a request parameter with the same name).

Default:client_id

client_autharray[string]

The default OpenID Connect client authentication method is ‘client_secret_basic’ (using ‘Authorization: Basic’ header), ‘client_secret_post’ (credentials in body), ‘client_secret_jwt’ (signed client assertion in body), ‘private_key_jwt’ (private key-signed assertion), ‘tls_client_auth’ (client certificate), ‘self_signed_tls_client_auth’ (self-signed client certificate), and ‘none’ (no authentication).

Allowed values:client_secret_basicclient_secret_jwtclient_secret_postnoneprivate_key_jwtself_signed_tls_client_authtls_client_auth

client_credentials_param_typearray[string]

Where to look for the client credentials: - header: search the HTTP headers - query: search the URL’s query string - body: search from the HTTP request body.

Allowed values:bodyheaderquery

Default:body, header, query

client_idarray[string]

This field is referenceable.

client_jwkarray[object]

The JWK used for the private_key_jwt authentication.

Hide Child Parameters

algstring

crvstring

dstring

This field is encrypted.
This field is referenceable.

dpstring

This field is encrypted.
This field is referenceable.

dqstring

This field is encrypted.
This field is referenceable.

estring

issuerstring

kstring

This field is encrypted.
This field is referenceable.

key_opsarray[string]

kidstring

ktystring

nstring

othstring

This field is encrypted.
This field is referenceable.

pstring

This field is encrypted.
This field is referenceable.

qstring

This field is encrypted.
This field is referenceable.

qistring

This field is encrypted.
This field is referenceable.

rstring

This field is encrypted.
This field is referenceable.

tstring

This field is encrypted.
This field is referenceable.

usestring

xstring

x5carray[string]

x5tstring

x5t#S256string

x5ustring

ystring

client_secretarray[string]

This field is referenceable.

cluster_cache_redisobject

Hide Child Parameters

cluster_max_redirectionsinteger

Maximum retry attempts for redirection.

Default:5

cluster_nodesarray[object]

Cluster addresses to use for Redis connections when the redis strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.

>= 1 characters

Hide Child Parameters

ipstring

A string representing a host name, such as example.com.

Default:127.0.0.1

portinteger

An integer representing a port number between 0 and 65535, inclusive.

Default:6379

>= 0<= 65535

connect_timeoutinteger

An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.

Default:2000

>= 0<= 2147483646

connection_is_proxiedboolean

If the connection to Redis is proxied (e.g. Envoy), set it true. Set the host and port to point to the proxy address.

Default:false

databaseinteger

Database to use for the Redis connection when using the redis strategy

Default:0

hoststring

A string representing a host name, such as example.com.

Default:127.0.0.1

keepalive_backloginteger

Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less than keepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger than keepalive_pool_size.

>= 0<= 2147483646

keepalive_pool_sizeinteger

The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither keepalive_pool_size nor keepalive_backlog is specified, no pool is created. If keepalive_pool_size isn’t specified but keepalive_backlog is specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low.

Default:256

>= 1<= 2147483646

passwordstring

Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
This field is referenceable.
This field is encrypted.

portinteger

An integer representing a port number between 0 and 65535, inclusive.

Default:6379

>= 0<= 65535

read_timeoutinteger

An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.

Default:2000

>= 0<= 2147483646

send_timeoutinteger

An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.

Default:2000

>= 0<= 2147483646

sentinel_masterstring

Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.

sentinel_nodesarray[object]

Sentinel node addresses to use for Redis connections when the redis strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.

>= 1 characters

Hide Child Parameters

hoststring

A string representing a host name, such as example.com.

Default:127.0.0.1

portinteger

An integer representing a port number between 0 and 65535, inclusive.

Default:6379

>= 0<= 65535

sentinel_passwordstring

Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
This field is referenceable.
This field is encrypted.

sentinel_rolestring

Sentinel role to use for Redis connections when the redis strategy is defined. Defining this value implies using Redis Sentinel.

Allowed values:anymasterslave

sentinel_usernamestring

Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won’t be performed. This requires Redis v6.2.0+.
This field is referenceable.

server_namestring

A string representing an SNI (server name indication) value for TLS.

sslboolean

If set to true, uses SSL to connect to Redis.

Default:false

ssl_verifyboolean

If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure lua_ssl_trusted_certificate in kong.conf to specify the CA (or server) certificate used by your Redis server. You may also need to configure lua_ssl_verify_depth accordingly.

Default:false

usernamestring

Username to use for Redis connections. If undefined, ACL authentication won’t be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to default.
This field is referenceable.

cluster_cache_strategystring

The strategy to use for the cluster cache. If set, the plugin will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared.

Allowed values:offredis

Default:off

consumer_byarray[string]

Consumer fields used for mapping: - id: try to find the matching Consumer by id - username: try to find the matching Consumer by username - custom_id: try to find the matching Consumer by custom_id.

Allowed values:custom_ididusername

Default:custom_id, username

consumer_claimarray[string]

The claim used for consumer mapping. If multiple values are set, it means the claim is inside a nested object of the token payload.

consumer_optionalboolean

Do not terminate the request if consumer mapping fails.

Default:false

credential_claimarray[string]

The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting plugin), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload.

Default:sub

disable_sessionarray[string]

Disable issuing the session cookie with the specified grants.

Allowed values:authorization_codebearerclient_credentialsintrospectionkong_oauth2passwordrefresh_tokensessionuserinfo

discovery_headers_namesarray[string]

Extra header names passed to the discovery endpoint.

discovery_headers_valuesarray[string]

Extra header values passed to the discovery endpoint.

display_errorsboolean

Display errors on failure responses.

Default:false

domainsarray[string]

The allowed values for the hd claim.

downstream_access_token_headerstring

The downstream access token header.

downstream_access_token_jwk_headerstring

The downstream access token JWK header.

downstream_headers_claimsarray[string]

The downstream header claims. If multiple values are set, it means the claim is inside a nested object of the token payload.

downstream_headers_namesarray[string]

The downstream header names for the claim values.

downstream_id_token_headerstring

The downstream id token header.

downstream_id_token_jwk_headerstring

The downstream id token JWK header.

downstream_introspection_headerstring

The downstream introspection header.

downstream_introspection_jwt_headerstring

The downstream introspection JWT header.

downstream_refresh_token_headerstring

The downstream refresh token header.

downstream_session_id_headerstring

The downstream session id header.

downstream_user_info_headerstring

The downstream user info header.

downstream_user_info_jwt_headerstring

The downstream user info JWT header (in case the user info returns a JWT response).

dpop_proof_lifetimenumber

Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise.

Default:300

dpop_use_nonceboolean

Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime.

Default:false

enable_hs_signaturesboolean

Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted).

Default:false

end_session_endpointstring

The end session endpoint. If set it overrides the value in end_session_endpoint returned by the discovery endpoint.

expose_error_codeboolean

Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to false to disable.

Default:true

extra_jwks_urisarray[string]

A string representing a URL, such as https://example.com/path/to/resource?q=search.

forbidden_destroy_sessionboolean

Destroy any active session for the forbidden requests.

Default:true

forbidden_error_messagestring

The error message for the forbidden requests (when not using the redirection).

Default:Forbidden

forbidden_redirect_uriarray[string]

A string representing a URL, such as https://example.com/path/to/resource?q=search.

groups_claimarray[string]

The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload.

Default:groups

groups_requiredarray[string]

The groups (groups_claim claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases.

hide_credentialsboolean

Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the plugin will remove those that were used for successful authentication.

Default:false

http_proxystring

The HTTP proxy.

http_proxy_authorizationstring

The HTTP proxy authorization.
This field is referenceable.

http_versionnumber

The HTTP version used for the requests by this plugin: - 1.1: HTTP 1.1 (the default) - 1.0: HTTP 1.0.

Default:1.1

https_proxystring

The HTTPS proxy.

https_proxy_authorizationstring

The HTTPS proxy authorization.
This field is referenceable.

id_token_param_namestring

The name of the parameter used to pass the id token.

id_token_param_typearray[string]

Where to look for the id token: - header: search the HTTP headers - query: search the URL’s query string - body: search the HTTP request body.

Allowed values:bodyheaderquery

Default:body, header, query

ignore_signaturearray[string]

Skip the token signature verification on certain grants: - password: OAuth password grant - client_credentials: OAuth client credentials grant - authorization_code: authorization code flow - refresh_token: OAuth refresh token grant - session: session cookie authentication - introspection: OAuth introspection - userinfo: OpenID Connect user info endpoint authentication.

Allowed values:authorization_codeclient_credentialsintrospectionpasswordrefresh_tokensessionuserinfo

Default:[]

introspect_jwt_tokensboolean

Specifies whether to introspect the JWT access tokens (can be used to check for revocations).

Default:false

introspection_acceptstring

The value of Accept header for introspection requests: - application/json: introspection response as JSON - application/token-introspection+jwt: introspection response as JWT (from the current IETF draft document) - application/jwt: introspection response as JWT (from the obsolete IETF draft document).

Allowed values:application/jsonapplication/jwtapplication/token-introspection+jwt

Default:application/json

introspection_check_activeboolean

Check that the introspection response has an active claim with a value of true.

Default:true

introspection_endpointstring

The introspection endpoint. If set it overrides the value in introspection_endpoint returned by the discovery endpoint.

introspection_endpoint_auth_methodstring

The introspection endpoint authentication method: : client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, tls_client_auth, self_signed_tls_client_auth, or none: do not authenticate

Allowed values:client_secret_basicclient_secret_jwtclient_secret_postnoneprivate_key_jwtself_signed_tls_client_authtls_client_auth

introspection_headers_clientarray[string]

Extra headers passed from the client to the introspection endpoint.

introspection_headers_namesarray[string]

Extra header names passed to the introspection endpoint.

introspection_headers_valuesarray[string]

This field is referenceable.

introspection_hintstring

Introspection hint parameter value passed to the introspection endpoint.

Default:access_token

introspection_post_args_clientarray[string]

Extra post arguments passed from the client to the introspection endpoint.

introspection_post_args_client_headersarray[string]

Extra post arguments passed from the client headers to the introspection endpoint.

introspection_post_args_namesarray[string]

Extra post argument names passed to the introspection endpoint.

introspection_post_args_valuesarray[string]

Extra post argument values passed to the introspection endpoint.

introspection_token_param_namestring

Designate token’s parameter name for introspection.

Default:token

issuerstringrequired

The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure config.using_pseudo_issuer=true.

issuers_allowedarray[string]

The issuers allowed to be present in the tokens (iss claim).

jwt_session_claimstring

The claim to match against the JWT session cookie.

Default:sid

keepaliveboolean

Use keepalive with the HTTP client.

Default:true

leewaynumber

Defines leeway time (in seconds) for auth_time, exp, iat, and nbf claims

Default:0

login_tokensarray[string]

What tokens to include in response body or redirect query string or fragment: - id_token: include id token - access_token: include access token - refresh_token: include refresh token - tokens: include the full token endpoint response - introspection: include introspection response.

Allowed values:access_tokenid_tokenintrospectionrefresh_tokentokens

Default:id_token

logout_methodsarray[string]

The request methods that can activate the logout: - POST: HTTP POST method - GET: HTTP GET method - DELETE: HTTP DELETE method.

Allowed values:DELETEGETPOST

Default:DELETE, POST

logout_post_argstring

The request body argument that activates the logout.

logout_query_argstring

The request query argument that activates the logout.

logout_redirect_uriarray[string]

A string representing a URL, such as https://example.com/path/to/resource?q=search.
This field is referenceable.

logout_revokeboolean

Revoke tokens as part of the logout.

For more granular token revocation, you can also adjust the logout_revoke_access_token and logout_revoke_refresh_token parameters.

Default:false

logout_revoke_access_tokenboolean

Revoke the access token as part of the logout. Requires logout_revoke to be set to true.

Default:true

logout_revoke_refresh_tokenboolean

Revoke the refresh token as part of the logout. Requires logout_revoke to be set to true.

Default:true

logout_uri_suffixstring

The request URI suffix that activates the logout.

max_agenumber

The maximum age (in seconds) compared to the auth_time claim.

mtls_introspection_endpointstring

Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in mtls_endpoint_aliases returned by the discovery endpoint.

mtls_revocation_endpointstring

Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in mtls_endpoint_aliases returned by the discovery endpoint.

mtls_token_endpointstring

Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in mtls_endpoint_aliases returned by the discovery endpoint.

no_proxystring

Do not use proxy with these hosts.

password_param_typearray[string]

Where to look for the username and password: - header: search the HTTP headers - query: search the URL’s query string - body: search the HTTP request body.

Allowed values:bodyheaderquery

Default:body, header, query

preserve_query_argsboolean

With this parameter, you can preserve request query arguments even when doing authorization code flow.

Default:false

proof_of_possession_auth_methods_validationboolean

If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP.

Default:true

proof_of_possession_dpopstring

Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP’s key are verified with the proof.

Allowed values:offoptionalstrict

Default:off

proof_of_possession_mtlsstring

Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401.

Allowed values:offoptionalstrict

Default:off

pushed_authorization_request_endpointstring

The pushed authorization endpoint. If set it overrides the value in pushed_authorization_request_endpoint returned by the discovery endpoint.

pushed_authorization_request_endpoint_auth_methodstring

The pushed authorization request endpoint authentication method: client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, tls_client_auth, self_signed_tls_client_auth, or none: do not authenticate

Allowed values:client_secret_basicclient_secret_jwtclient_secret_postnoneprivate_key_jwtself_signed_tls_client_authtls_client_auth

redirect_uriarray[string]

A string representing a URL, such as https://example.com/path/to/resource?q=search.

redisobject

Hide Child Parameters

cluster_max_redirectionsinteger

Maximum retry attempts for redirection.

Default:5

cluster_nodesarray[object]

Cluster addresses to use for Redis connections when the redis strategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element.

>= 1 characters

Hide Child Parameters

ipstring

A string representing a host name, such as example.com.

Default:127.0.0.1

portinteger

An integer representing a port number between 0 and 65535, inclusive.

Default:6379

>= 0<= 65535

connect_timeoutinteger

An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.

Default:2000

>= 0<= 2147483646

connection_is_proxiedboolean

If the connection to Redis is proxied (e.g. Envoy), set it true. Set the host and port to point to the proxy address.

Default:false

databaseinteger

Database to use for the Redis connection when using the redis strategy

Default:0

hoststring

A string representing a host name, such as example.com.

Default:127.0.0.1

keepalive_backloginteger

>= 0<= 2147483646

keepalive_pool_sizeinteger

Default:256

>= 1<= 2147483646

passwordstring

Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
This field is encrypted.
This field is referenceable.

portinteger

An integer representing a port number between 0 and 65535, inclusive.

Default:6379

>= 0<= 65535

prefixstring

The Redis session key prefix.

read_timeoutinteger

An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.

Default:2000

>= 0<= 2147483646

send_timeoutinteger

An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.

Default:2000

>= 0<= 2147483646

sentinel_masterstring

Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.

sentinel_nodesarray[object]

Sentinel node addresses to use for Redis connections when the redis strategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element.

>= 1 characters

Hide Child Parameters

hoststring

A string representing a host name, such as example.com.

Default:127.0.0.1

portinteger

An integer representing a port number between 0 and 65535, inclusive.

Default:6379

>= 0<= 65535

sentinel_passwordstring

Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
This field is encrypted.
This field is referenceable.

sentinel_rolestring

Sentinel role to use for Redis connections when the redis strategy is defined. Defining this value implies using Redis Sentinel.

Allowed values:anymasterslave

sentinel_usernamestring

Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won’t be performed. This requires Redis v6.2.0+.
This field is referenceable.

server_namestring

A string representing an SNI (server name indication) value for TLS.

socketstring

The Redis unix socket path.

sslboolean

If set to true, uses SSL to connect to Redis.

Default:false

ssl_verifyboolean

Default:false

usernamestring

rediscovery_lifetimenumber

Specifies how long (in seconds) the plugin waits between discovery attempts. Discovery is still triggered on an as-needed basis.

Default:30

refresh_token_param_namestring

The name of the parameter used to pass the refresh token.

refresh_token_param_typearray[string]

Where to look for the refresh token: - header: search the HTTP headers - query: search the URL’s query string - body: search the HTTP request body.

Allowed values:bodyheaderquery

Default:body, header, query

refresh_tokensboolean

Specifies whether the plugin should try to refresh (soon to be) expired access tokens if the plugin has a refresh_token available.

Default:true

require_proof_key_for_code_exchangeboolean

Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of code_challenge_methods_supported, and enabled automatically (in case the code_challenge_methods_supported is missing, the PKCE will not be enabled).

require_pushed_authorization_requestsboolean

Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of require_pushed_authorization_requests (which defaults to false).

require_signed_request_objectboolean

Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of require_signed_request_object, and enabled automatically (in case the require_signed_request_object is missing, the feature will not be enabled).

resolve_distributed_claimsboolean

Distributed claims are represented by the _claim_names and _claim_sources members of the JSON object containing the claims. If this parameter is set to true, the plugin explicitly resolves these distributed claims.

Default:false

response_modestring

Response mode passed to the authorization endpoint: - query: for parameters in query string - form_post: for parameters in request body - fragment: for parameters in uri fragment (rarely useful as the plugin itself cannot read it) - query.jwt, form_post.jwt, fragment.jwt: similar to query, form_post and fragment but the parameters are encoded in a JWT - jwt: shortcut that indicates the default encoding for the requested response type.

Allowed values:form_postform_post.jwtfragmentfragment.jwtjwtqueryquery.jwt

Default:query

response_typearray[string]

The response type passed to the authorization endpoint.

Default:code

reverifyboolean

Specifies whether to always verify tokens stored in the session.

Default:false

revocation_endpointstring

The revocation endpoint. If set it overrides the value in revocation_endpoint returned by the discovery endpoint.

revocation_endpoint_auth_methodstring

The revocation endpoint authentication method: : client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, tls_client_auth, self_signed_tls_client_auth, or none: do not authenticate

Allowed values:client_secret_basicclient_secret_jwtclient_secret_postnoneprivate_key_jwtself_signed_tls_client_authtls_client_auth

revocation_token_param_namestring

Designate token’s parameter name for revocation.

Default:token

roles_claimarray[string]

The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload.

Default:roles

roles_requiredarray[string]

The roles (roles_claim claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases.

run_on_preflightboolean

Specifies whether to run this plugin on pre-flight (OPTIONS) requests.

Default:true

scopesarray[string]

This field is referenceable.

Default:openid

scopes_claimarray[string]

The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload.

Default:scope

scopes_requiredarray[string]

The scopes (scopes_claim claim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases.

search_user_infoboolean

Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers.

Default:false

session_absolute_timeoutnumber

Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks.

Default:86400

session_audiencestring

The session audience, which is the intended target application. For example "my-application".

Default:default

session_enforce_same_subjectboolean

When set to true, audiences are forced to share the same subject.

Default:false

session_hash_storage_keyboolean

When set to true, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie.

Default:false

session_hash_subjectboolean

When set to true, the value of subject is hashed before being stored. Only applies when session_store_metadata is enabled.

Default:false

session_idling_timeoutnumber

Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching.

Default:900

session_memcached_hoststring

The memcached host.

Default:127.0.0.1

session_memcached_portinteger

The memcached port.

Default:11211

>= 0<= 65535

session_memcached_prefixstring

The memcached session key prefix.

session_memcached_socketstring

The memcached unix socket path.

session_rememberboolean

Enables or disables persistent sessions.

Default:false

session_remember_absolute_timeoutnumber

Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks.

Default:2592000

session_remember_rolling_timeoutnumber

Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling.

Default:604800

session_request_headersarray[string]

Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. [ "id", "timeout" ] will set Session-Id and Session-Timeout request headers.

Allowed values:absolute-timeoutaudienceididling-timeoutrolling-timeoutsubjecttimeout

session_response_headersarray[string]

Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g. [ "id", "timeout" ] will set Session-Id and Session-Timeout response headers.

Allowed values:absolute-timeoutaudienceididling-timeoutrolling-timeoutsubjecttimeout

session_rolling_timeoutnumber

Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling.

Default:3600

session_secretstring

The session secret.
This field is encrypted.
This field is referenceable.

session_storagestring

The session storage for session data: - cookie: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn’t require a database) - memcache: stores session data in memcached - redis: stores session data in Redis.

Allowed values:cookiememcachememcachedredis

Default:cookie

session_store_metadataboolean

Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject.

Default:false

ssl_verifyboolean

Verify identity provider server certificate. If set to true, the plugin uses the CA certificate set in the kong.conf config parameter lua_ssl_trusted_certificate.

Default:false

timeoutnumber

Network IO timeout in milliseconds.

Default:10000

tls_client_auth_cert_idstring

ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server.

tls_client_auth_ssl_verifyboolean

Verify identity provider server certificate during mTLS client authentication.

Default:true

token_cache_key_include_scopeboolean

Include the scope in the token cache key, so token with different scopes are considered diffrent tokens.

Default:false

token_endpointstring

The token endpoint. If set it overrides the value in token_endpoint returned by the discovery endpoint.

token_endpoint_auth_methodstring

The token endpoint authentication method: client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, tls_client_auth, self_signed_tls_client_auth, or none: do not authenticate

Allowed values:client_secret_basicclient_secret_jwtclient_secret_postnoneprivate_key_jwtself_signed_tls_client_authtls_client_auth

token_exchange_endpointstring

The token exchange endpoint.

token_headers_clientarray[string]

Extra headers passed from the client to the token endpoint.

token_headers_grantsarray[string]

Enable the sending of the token endpoint response headers only with certain grants: - password: with OAuth password grant - client_credentials: with OAuth client credentials grant - authorization_code: with authorization code flow - refresh_token with refresh token grant.

Allowed values:authorization_codeclient_credentialspasswordrefresh_token

token_headers_namesarray[string]

Extra header names passed to the token endpoint.

token_headers_prefixstring

Add a prefix to the token endpoint response headers before forwarding them to the downstream client.

token_headers_replayarray[string]

The names of token endpoint response headers to forward to the downstream client.

token_headers_valuesarray[string]

Extra header values passed to the token endpoint.

token_post_args_clientarray[string]

Pass extra arguments from the client to the OpenID-Connect plugin. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header This parameter can be used with scope values, like this: config.token_post_args_client=scope In this case, the token would take the scope value from the query parameter or from the request body or from the header and send it to the token endpoint.

token_post_args_namesarray[string]

Extra post argument names passed to the token endpoint.

token_post_args_valuesarray[string]

Extra post argument values passed to the token endpoint.

unauthorized_destroy_sessionboolean

Destroy any active session for the unauthorized requests.

Default:true

unauthorized_error_messagestring

The error message for the unauthorized requests (when not using the redirection).

Default:Unauthorized

unauthorized_redirect_uriarray[string]

A string representing a URL, such as https://example.com/path/to/resource?q=search.

unexpected_redirect_uriarray[string]

A string representing a URL, such as https://example.com/path/to/resource?q=search.

upstream_access_token_headerstring

The upstream access token header.

Default:authorization:bearer

upstream_access_token_jwk_headerstring

The upstream access token JWK header.

upstream_headers_claimsarray[string]

The upstream header claims. Only top level claims are supported.

upstream_headers_namesarray[string]

The upstream header names for the claim values.

upstream_id_token_headerstring

The upstream id token header.

upstream_id_token_jwk_headerstring

The upstream id token JWK header.

upstream_introspection_headerstring

The upstream introspection header.

upstream_introspection_jwt_headerstring

The upstream introspection JWT header.

upstream_refresh_token_headerstring

The upstream refresh token header.

upstream_session_id_headerstring

The upstream session id header.

upstream_user_info_headerstring

The upstream user info header.

upstream_user_info_jwt_headerstring

The upstream user info JWT header (in case the user info returns a JWT response).

userinfo_acceptstring

The value of Accept header for user info requests: - application/json: user info response as JSON - application/jwt: user info response as JWT (from the obsolete IETF draft document).

Allowed values:application/jsonapplication/jwt

Default:application/json

userinfo_endpointstring

The user info endpoint. If set it overrides the value in userinfo_endpoint returned by the discovery endpoint.

userinfo_headers_clientarray[string]

Extra headers passed from the client to the user info endpoint.

userinfo_headers_namesarray[string]

Extra header names passed to the user info endpoint.

userinfo_headers_valuesarray[string]

Extra header values passed to the user info endpoint.

userinfo_query_args_clientarray[string]

Extra query arguments passed from the client to the user info endpoint.

userinfo_query_args_namesarray[string]

Extra query argument names passed to the user info endpoint.

userinfo_query_args_valuesarray[string]

Extra query argument values passed to the user info endpoint.

using_pseudo_issuerboolean

If the plugin uses a pseudo issuer. When set to true, the plugin will not discover the configuration from the issuer URL specified with config.issuer.

Default:false

verify_claimsboolean

Verify tokens for standard claims.

Default:true

verify_nonceboolean

Verify nonce on authorization code flow.

Default:true

verify_parametersboolean

Verify plugin configuration against discovery.

Default:false

verify_signatureboolean

Verify signature of tokens.

Default:true

protocolsarray[string]

A set of strings representing HTTP protocols.

Allowed values:grpcgrpcshttphttps

Default:grpc, grpcs, http, https

routeobject

If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.

* Additional properties are NOT allowed.

Hide Child Parameters

idstring

serviceobject

If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.

* Additional properties are NOT allowed.

Hide Child Parameters

idstring

OpenID Connect

Configuration

Did this doc help?

Help us make these docs great!

Still need help