Skip to main content

Identity providers

An identity provider record describes an upstream service that a connector authenticates against. This is separate from platform sign-in:

  • Your corporate identity provider signs users in to the platform. It is set once at install time. See Configure identity.
  • Connector identity providers let the Connector Gateway broker OAuth to upstream services.

Where to find them​

In the admin console, go to Identity providers.

The corporate provider appears here, read-only​

The console lists the corporate identity provider as a read-only record sourced from platform configuration. To change it, update the platform values and upgrade the release.

At startup, the directory copies its client secret into managed-secret storage. Restart the directory after rotating the source Secret.

If the directory cannot store the secret, it logs the error and omits the provider record while continuing to serve other directory operations.

Register a provider​

Create a managed secret for the client secret. Then add the provider issuer, client identifier, and managed-secret reference.

The console displays the callback derived from the Connector Gateway issuer: {issuer}/oauth/callback. Register this URI in the upstream provider's OAuth application. A mismatch causes the upstream provider to reject authorization.

Once registered, a provider becomes selectable when you configure a connector's authentication.

Next steps​