Identity plugin · listing tai42/identity-oidcInstall
Permissions
Provides
identity-oidc
Identity — Validate-only OIDC identity provider — resolve an issuer-minted JWT to an authenticated identity.
This provider lets machines authenticate with a JWT your identity provider
already issues, rather than with an API key the runtime minted. It verifies
tokens; it never issues them — there is no authorization-code flow, no client id
or secret, and no key-minting surface.
Register and select it
manifest.yml
identity-oidc, which is the value
ACCESS_CONTROL_AUTH_PROVIDERS selects. Listing redis alongside it keeps
minted API keys working next to issuer-signed JWTs.
Configuration
TheTAI_IDENTITY_OIDC_ env group.
The issuer must publish standard discovery metadata and a JWKS endpoint. Startup
fetches both, so a misconfigured issuer fails at boot rather than on the first
call.
Write the policy
A verified token resolves to the user ididp:{issuer}:{claim value}. Nothing is
provisioned automatically: until a policy exists for that exact id, every
protected route denies the call. The owner_user_id claim is stripped from the
claims the runtime keeps, so it cannot be used to escalate.
See also
- Access control — the policy model this feeds.
- User types and permissions — how each identity type is judged.
- Set up access control — the jq policy end to end.