Supported credentials, grants, and tested IdPs

Looking for the plugin's configuration parameters? You can find them in the OpenID Connect configuration reference doc.

The plugin supports several types of credentials and grants:

• Signed JWT access tokens (JWS)
• Opaque access tokens
• Refresh tokens
• Authorization code with client secret or PKCE
• Username and password
• Client credentials
• Session cookies

The plugin has been tested with several OpenID Connect providers:

• Auth0 (Kong Integration Guide)
• Amazon AWS Cognito (Kong Integration Guide)
• Connect2id
• Curity (Kong Integration Guide)
• Dex
• Gluu
• Google (Kong Integration Guide)
• IdentityServer
• Keycloak
• Microsoft Azure Active Directory (Kong Integration Guide)
• Microsoft Active Directory Federation Services
• Microsoft Live Connect
• Okta (Kong Integration Guide)
• OneLogin
• OpenAM
• PayPal
• PingFederate
• Salesforce
• WSO2
• Yahoo!

As long as your provider supports OpenID Connect standards, the plugin should work, even if it is not specifically tested against it. Let Kong know if you want your provider to be tested and added to the list.

Once applied, any user with a valid credential can access the service.