By default, the CSP Vault for Secrets is configured for local authentication. You can change the authentication method as required, but you can use only one type of authentication per vault at a time.

  • If you want to use OpenID Connect (OIDC) without Active Directory (AD), you can only change to that mode from the local authentication mode.
  • If you have configured AD or OIDC with AD, you cannot change to OIDC without AD. You must rescue the vault, which returns the vault to Local Authentication mode. Then remove any additional users and policies, and configure OIDC without AD.

Each vault can be configured with a separate OIDC server or a separate application from same server.

For an example of how to configure an OIDC provider, see Example: Configuring Entrust Identity as a Service. If you are using a cluster, even though you configure OIDC for only one node, you will need to enter the Callback URIs (the Login Redirect URIs and Logout Redirect URIs) for all nodes in the cluster.

At this time, native OIDC group support is not available.

If you require group‑based authorization, you must configure AD for group management and integrate OIDC authentication with AD. This approach allows group membership and access control to be handled by AD while leveraging OIDC for authentication.

For deployments that require only user authentication and do not depend on group membership, OIDC may be configured independently without AD.


Prerequisites

Before you begin, make sure you have completed the following tasks:

  • Create an OIDC application and a user in your identity provider (IdP)
  • Obtain:
    • The client ID
    • The client secret

To configure OIDC 

  1. Log into the CSP Vault for Secrets webGUI using an account with Vault Admin privileges.
  2. In the top menu bar, click Settings. The Settings page appears.
  3. From the menu at the top, click Authentication.
  4. In the Authentication Type drop-down list, select OpenID Connect. The Configure OpenID Connect section appears.
  5. Complete the following fields:
    • Name: Enter the name that you defined for the OpenID Connect provider. Cryptographic Security Platform Vault displays this name on the button on the login dialogs.
    • Client ID: Enter the client ID.

      The client ID is the organizational identity assigned by the OpenID Connect provider when you signed up for the service.

    • Client Secret: Enter the client secret.

      Client secret is a cryptographic component used to secure the organization's access to the OIDC provider.

      This field is write-only. It will never be displayed again after it has been initially created. It can be reentered if necessary.

      Base URL: Enter the URL that Cryptographic Security Platform Vault will use to contact the OpenID Connect provider to present the login page.

  6. Optional. Click Browse to upload the CA Certificate. 

    The certificate needs to be in base64 encoded pem format.

  7. Enter the Admin Name and Admin Email for OIDC user. This user will be created and will act as the Vault Administrator. They will be assigned to the admin policy and receive the email with the registration URL.

  8. Click Apply. The OpenID Connect Configuration window appears showing the current configuration.

  9. Click Verify and Enable. The OpenID Connect Successfully Configured window displays the new login URL.

  10. Copy the URL, and click Log Out and Sign in with IDP. The system logs you out and redirects you to IdP for login. 

  11. On the IdP login page, enter your IDP credentials. Once you complete the IdP login, the vault administrator's registration process completes.

    If you are not the new OIDC vault administrator, copy the registration URL and provide it to the new vault administrator.

    The registration URL is valid for only 24 hours.