[Feature]: Support for OpenID Connect (OIDC) for Azure SSO

Open

Is your feature request related to a problem?

We currently use Azure as the identity provider (IdP) for SSO. The integration requires the following configuration:

config:
  IDP_ISSUER: "https://login.microsoftonline.com/my_tenant/v2.0"
  IDP_CLIENT_ID: my_client_id
  IDP_CLIENT_SECRET: my_client_secret
  IDP_CUSTOM_SCOPES: my_client_id/.default

Azure client secrets have an expiration date and must be renewed periodically. Under security policies that require secret rotation every three months, this creates a recurring operational task for the team.

Describe the solution you'd like

Azure already offers a better way to use SPN without the need of any secret. It uses the OIDC protocol to do so (OpenID Connect).

Describe alternatives you've considered

No response

Priority

High - Critical for my use case

Use Case

Mockups or Examples

No response

Additional Context

No response

Contribution

I would be willing to submit a PR to implement this feature

Code of Conduct

I agree to follow this project's Code of Conduct

Activity

github-actions[bot]23d ago

🔗 Synced to Linear: SUP-276

rogefm10d ago

Hey @gabrielrih-abinbev, thanks for opening this.

We've got it solved in #2008. The gateway can now sign in to Entra ID without a client secret, using workload identity federation: Kubernetes mounts a service account token in the pod, Entra trusts it through a federated credential on your app registration, and the gateway sends that token instead of the secret. Kubernetes keeps renewing the token, so there's nothing left to rotate every three months.

With the helm chart it comes down to:

idpFederatedToken:
  enabled: true
serviceAccount:
  create: true
config:
  IDP_ISSUER: "https://login.microsoftonline.com/<tenant>/v2.0"
  IDP_CLIENT_ID: <client_id>
  IDP_CUSTOM_SCOPES: <client_id>/.default

plus a federated credential on the app registration with your AKS OIDC issuer, subject system:serviceaccount:<namespace>:hoopgateway and audience api://AzureADTokenExchange. If you manage the IdP from Settings → Authentication instead, there's a "Federated token" option there too. The full steps are in the PR and in the chart README.

We tested it against a real Entra tenant on AKS. It's still in review, so it isn't in a release yet, and we'll update this issue when it ships. If you can take a look at the PR and tell us whether it fits your setup, that would help a lot.

gabrielrih-abinbev9d ago

Hey @rogefm I'll test it in a minute.

rogefm9d ago

Quick update: this is out in 1.260.0.

Once you upgrade the gateway and the chart to 1.260.0, you can turn on idpFederatedToken, drop IDP_CLIENT_SECRET and add the federated credential on the app registration. The steps are in the chart README, under "Entra ID without a client secret" (deploy/helm-chart/README.md). The page on the docs site is coming soon.

If anything behaves differently on your cluster, let us know here and we'll take a look.

gabrielrih-abinbev9d ago

@rogefm

It worked! I just needed to add the serviceAccount as well:

idpFederatedToken:
  enabled: true
  audience: api://AzureADTokenExchange
  expirationSeconds: 3600

serviceAccount:
  create: true
  annotations: {}