Enable OpenID Connect in the Kong Dev Portal with Gluu

By default you can self signup with Kong developer portal and once admin approves your account, you can login to developer portal with your email and password. However, it is not always the case because you may already have an account in the external identity provider and you want to login to Kong dev portal by using your existing credentials in the external identity provider.

Now let’s see how you can configure openID connect login for dev portal with external identity provider. In this example I will be using Gluu as the external identity provider. However, you can use any identity provider to adhere to openID connect protocols.

Step 01: As an admin you can login to Kong Manager and configure Dev Portal Settings

As per the below image you can select Open ID Connect as the authentication method. From the Auth Config (JSON) you have to select Custom.

Sample custom configuration is provided below and from the description of each field you can refer [1].

{
"scopes": [
"openid",
"profile",
"email",
"offline_access"
],
"client_id": [
"b2fdf86b-afaf-47de-80bb-b8c7f0febdae"
],
"consumer_claim": [
"email"
],
"issuer": "https://idp.icurity.cloud/.well-known/openid-configuration",
"forbidden_redirect_uri": [
"https://api-developer.icurity.cloud/unauthorized"
],
"redirect_uri": [
"https://api-portal.icurity.cloud/Icurity/auth"
],
"login_redirect_uri": [
"https://api-developer.icurity.cloud/Icurity"
],
"logout_methods": [
"GET"
],
"leeway": 1000,
"client_secret": [
"xuy42VVwYnttB4ob2gcJSUR9fP3MnADcDM5xwXXX"
],
"session_cookie_domain": ".icurity.cloud",
"logout_query_arg": "logout",
"ssl_verify": false,
"logout_redirect_uri": [
"https://api-developer.icurity.cloud/Icurity"
],
"login_redirect_mode": "query",
"login_action": "redirect",
"downstream_id_token_header": "id-token",
"consumer_by": [
"username",
"custom_id",
"id"
],
"downstream_access_token_header": "access-token"
}

Step 02: Configure Oauth client in Gluu Identity Provider

Make sure you check Include Claims in Id Token.

In order to check Include claims in id Token, you have to make legacyIdTokenClaims true

Step 03: Test the flow

Now when you click the login button, you will be redirected to Identity Provider login page as below.

Please note here we have customised login page which is different to default login page provided by Identity Provider

Once you enter the credentials to the Identity Provider login page, you will be prompted to create an account page in Kong. Please note you will be getting this page in the first time login only. Once a user is boarded into Kong, you won’t get this page during subsequent login attempts.

Once you enter required details you have to wait till the admin approves your account.

Admin can approve your account as per the below screen.

Now you can login to Kong developer portal with openID connect with your existing account in the identity provider.

Please note: email claim should be presented in the Id Token provided by external IDP. In order to check the content of Id Token you have use the kong support article provided in [2].

[1] https://docs.konghq.com/gateway/latest/kong-enterprise/dev-portal/authentication/oidc/

[2] https://support.konghq.com/support/s/article/how-to-get-id-token-and-access-token-used-for-Kong-Manager-or-Dev-Portal-login