OIDC

Concourse supports OpenID Connect (OIDC) for single sign-on with Google, Okta, Azure AD, Auth0, and any OIDC-compliant identity provider.

Configuration

auth:
  oidc:
    enabled: true
    issuer: https://accounts.google.com
    client_id: ${OIDC_CLIENT_ID}
    client_secret: ${OIDC_CLIENT_SECRET}
    redirect_uri: https://your-concourse.example.com/api/v1/auth/oidc/callback

Field	Description
enabled	Set to true to enable OIDC.
issuer	The OIDC issuer URL. Must serve a /.well-known/openid-configuration document.
client_id	Client ID from your identity provider.
client_secret	Client secret from your identity provider.
redirect_uri	The callback URL. Must match what is registered with the IdP.

Authentication flow

1. The inboard app directs the user to GET /api/v1/auth/oidc/authorize.
2. Concourse redirects the user to the identity provider’s authorization endpoint.
3. The user authenticates with the IdP.
4. The IdP redirects back to /api/v1/auth/oidc/callback with an authorization code.
5. Concourse exchanges the code for an ID token, extracts user claims, and issues a JWT.

Provider setup

Google

1. Go to the Google Cloud Console and create an OAuth 2.0 credential.
2. Set the authorized redirect URI to https://your-concourse.example.com/api/v1/auth/oidc/callback.
3. Use the issuer https://accounts.google.com.

auth:
  oidc:
    enabled: true
    issuer: https://accounts.google.com
    client_id: ${OIDC_CLIENT_ID}
    client_secret: ${OIDC_CLIENT_SECRET}
    redirect_uri: https://your-concourse.example.com/api/v1/auth/oidc/callback

Okta

1. In the Okta Admin Console, create a new OIDC Web Application integration.
2. Set the sign-in redirect URI to https://your-concourse.example.com/api/v1/auth/oidc/callback.
3. The issuer is your Okta org URL.

auth:
  oidc:
    enabled: true
    issuer: https://your-org.okta.com
    client_id: ${OIDC_CLIENT_ID}
    client_secret: ${OIDC_CLIENT_SECRET}
    redirect_uri: https://your-concourse.example.com/api/v1/auth/oidc/callback

Azure AD (Entra ID)

1. In the Azure portal, register a new application under Entra ID.
2. Add a redirect URI of type “Web”: https://your-concourse.example.com/api/v1/auth/oidc/callback.
3. Create a client secret under “Certificates & secrets”.
4. The issuer includes your tenant ID.

auth:
  oidc:
    enabled: true
    issuer: https://login.microsoftonline.com/{tenant-id}/v2.0
    client_id: ${OIDC_CLIENT_ID}
    client_secret: ${OIDC_CLIENT_SECRET}
    redirect_uri: https://your-concourse.example.com/api/v1/auth/oidc/callback

Auth0

1. In the Auth0 dashboard, create a Regular Web Application.
2. Set the allowed callback URL to https://your-concourse.example.com/api/v1/auth/oidc/callback.
3. The issuer is your Auth0 tenant domain.

auth:
  oidc:
    enabled: true
    issuer: https://your-tenant.auth0.com
    client_id: ${OIDC_CLIENT_ID}
    client_secret: ${OIDC_CLIENT_SECRET}
    redirect_uri: https://your-concourse.example.com/api/v1/auth/oidc/callback

Checking OIDC status

To verify OIDC is configured:

curl http://localhost:8080/api/v1/auth/oidc/status

Returns {"enabled": true} or {"enabled": false}.

Auto-provisioning

When a user signs in via OIDC for the first time and no matching account exists, Concourse automatically creates a user with the member role. The email and name are extracted from the ID token claims. See Attribute Mapping for details.