Add an OAuth/OIDC Identity Provider on Confluent Cloud

An OAuth/OIDC identity provider in Confluent Cloud grants workloads and applications limited access to Confluent Cloud resources and Confluent Cloud APIs. A Confluent Cloud OAuth/OIDC identity provider uses the industry-standard OAuth 2.0 and OpenID Connect (OIDC) protocols to establish trust with Confluent Cloud resources, reduce operational burdens, and grant programmatic access to Confluent Cloud APIs for your workloads and applications.

For OAuth/OIDC concepts and the authentication flow, see Use OAuth/OIDC to Authenticate to Confluent Cloud.

Note

OAuth/OIDC identity providers cannot authenticate Confluent Cloud user accounts. For your Confluent Cloud users, you can use a SAML-based single sign-on (SSO) identity provider.

To use the Confluent Cloud APIs to create, read, update, list, and delete identity providers, see Identity Providers (iam/v2).

Add an identity provider using Confluent Cloud Console

Required role-based access control (RBAC) roles: OrganizationAdmin

Important

Before you add a new identity provider, review Best Practices for OAuth/OIDC Identity Providers on Confluent Cloud.

Prerequisites

• You must have an account in the identity provider you want to use.

• You must have an account in Confluent Cloud with the OrganizationAdmin role.

• You need the following information for your identity provider:

  • OIDC Discovery URL: Get this URL from your identity provider to import metadata required to configure your OIDC provider. Using this option automatically fills the JSON Web Key Set (JWKS) URI and Issuer URI fields.

  • Without the OIDC Discovery URL, you need the following information:

    • Microsoft Entra ID/Azure UAMI: Tenant ID, JWKS URI, and Issuer URI.

    • Okta: Authorization server, domain, JWKS URI, and Issuer URI.

    • AWS IAM: JWKS URI and Issuer URI for the AWS Security Token Service (STS).

    • Other OIDC identity provider: JWKS URI, and Issuer URI.

• To use AWS IAM as your identity provider, your Kafka clients must run on AWS compute (EC2, EKS, ECS, Fargate, or Lambda) with an IAM role that can mint AWS STS web identity tokens. For the client-side setup, see Configure AWS IAM OAuth for Python Client, Configure AWS IAM OAuth for Java Client, and Configure AWS IAM OAuth for .NET Client.

• To use Azure User-Assigned Managed Identity (UAMI) with Microsoft Entra ID, your Kafka clients must run on Azure compute (VM, AKS, or Azure Container Instance) with an assigned UAMI, and you must have a Microsoft Entra ID App Registration. For the client-side setup, see Configure Azure User Assigned Managed Identity OAuth for Confluent Cloud.

• If your identity provider is behind a firewall, you must add Confluent Cloud public IP addresses to your firewall allowlist. Confluent Cloud uses these public IP addresses to access your JWKS URI over the internet. To get the available Confluent Cloud public IP addresses, see Verify network access to the JWKS URI.

Configure an OAuth/OIDC identity provider

Configuring an OAuth/OIDC identity provider establishes trust between Confluent Cloud and your external identity provider so your workloads can authenticate programmatically. Follow these steps to configure an identity provider using the Confluent Cloud Console.

1. In Confluent Cloud Console, go to the Workload identities tab under Accounts & access at https://confluent.cloud/settings/org/workload_identities.

2. Click Add identity providers.

3. Select OAuth/OIDC as the identity provider type and click Next.

4. Click Microsoft Entra ID/Azure UAMI, Okta, AWS IAM, or Other OIDC identity provider and click Next. Complete the fields.

   Microsoft Entra ID/Azure UAMI

   Use this option for Microsoft Entra ID, including Azure User-Assigned Managed Identity (UAMI), which uses Microsoft Entra ID to issue tokens.

   To use UAMI, after you add the identity provider, configure your Kafka clients to retrieve UAMI tokens from Azure Instance Metadata Service (IMDS). For the client-side setup, see Configure Azure User Assigned Managed Identity OAuth for Confluent Cloud.

   Name

   Enter a meaningful name for your Microsoft Entra ID identity provider.

   Description

   Enter meaningful information for using and managing this provider.

   Tenant ID

   Enter the tenant identifier. For UAMI, use the Directory (tenant) ID from your Microsoft Entra ID App Registration.

   Import from Tenant ID

   Click to import metadata required to configure your OIDC provider. This option adds the OIDC Discovery URL and automatically fills the Issuer URI and JWKS URI fields.

   Issuer URI

   Enter the issuer URI for your Microsoft Entra ID authorization server. This value must match the iss claim in the tokens issued by Microsoft Entra ID.

   Example: https://login.microsoftonline.com/<tenant_id>/v2.0

   JWKS URI

   Enter the URI for JSON Web Key Set (JWKS).

   JSON Web Key Sets (JWKS) provide a set of keys containing the public keys used to verify any JSON Web Token (JWT) issued by your Microsoft Entra ID identity provider. The HTTP response from the JWKS URI must include one of Content-Type: application/json, Content-Type: application/jwk+json, or Content-Type: application/jwk-set+json in the header.

   Example URI: https://login.microsoftonline.com/<tenant_id>/discovery/v2.0/keys

   Important

   Confluent Cloud requires v2 tokens. To use your Microsoft Entra ID identity provider created here, you must also edit your Microsoft Entra ID application manifest to set the requestedAccessTokenVersion attribute to 2 to use the v2 token instead of the default legacy v1 token. For example, add the following line to your manifest:

   "requestedAccessTokenVersion": 2
   

   For details, follow the steps in Configure the application manifest.

   By default, applications registered in a Microsoft Entra tenant are available to all users of the tenant who authenticate successfully. As a best practice, to restrict which identities can get tokens for your application, require user assignment in your Microsoft Entra tenant.

   Alternatively, you can apply the restriction on the Confluent Cloud side: when you create the identity pool for this provider, add a filter that validates the token audience. In v2 tokens, the audience is the App Registration Application (client) ID:

   claims.aud == "<application_client_id>"
   

   Okta

   Name

   Enter a meaningful name for your Okta identity provider.

   Description

   Enter meaningful information for using and managing this provider.

   Domain

   Enter the domain. Default value is {yourDomain}.okta.com. Replace {yourDomain} with your domain name for Okta.

   Authorization server

   Enter the authorization server identifier for your Okta identity provider. The default value is default, but you can modify it.

   Import from configuration

   Click to import metadata required to configure your OIDC provider using the Domain and Authorization server fields. This option adds the OIDC Discovery URL and automatically fills the Issuer URI and JWKS URI fields.

   Issuer URI

   Enter the issuer URI for your Okta identity provider.

   The unique issuer URI represents a string that represents the entity for issuing tokens.

   Example: https://mycompany.okta.com/oauth2/default

   JWKS URI

   Enter the URI for JSON Web Key Set (JWKS).

   JSON Web Key Sets (JWKS) provide a set of keys containing the public keys used to verify any JSON Web Token (JWT) issued by your Okta identity provider. The HTTP response from the JWKS URI must include one of Content-Type: application/json, Content-Type: application/jwk+json, or Content-Type: application/jwk-set+json in the header.

   Example URI: https://mycompany.okta.com/oauth2/default/v1/keys

   AWS IAM

   Name

   Enter a meaningful name for your AWS IAM identity provider.

   Description

   Enter meaningful information for using and managing this provider.

   Issuer URI

   Enter the issuer URI for the AWS STS OIDC endpoint. This value must match the iss claim in the tokens minted by AWS STS.

   Example: https://<uuid>.tokens.sts.global.api.aws

   JWKS URI

   Enter the URI for the JSON Web Key Set (JWKS) published by AWS STS.

   JSON Web Key Sets (JWKS) provide a set of public keys used to verify any JWT issued by AWS STS.

   Example URI: https://<uuid>.tokens.sts.global.api.aws/.well-known/jwks.json

   Note

   The <uuid> in the issuer and JWKS URIs is a unique identifier that AWS generates for your account. It is not your AWS account ID.

   After you add the identity provider, configure your Kafka clients to mint AWS STS tokens. For client-side setup, see Configure AWS IAM OAuth for Python Client, Configure AWS IAM OAuth for Java Client, and Configure AWS IAM OAuth for .NET Client.

   For end-to-end examples of AWS IAM authentication with Confluent Cloud, see confluentinc/AWS-IAM-Examples.

   Other OIDC identity provider

   Use this option for any OAuth/OIDC-compliant provider that does not have a dedicated tab, such as Auth0 or Google Identity Platform.

   Name

   Enter a meaningful name for your Other OIDC identity provider.

   Description

   Enter meaningful information for using and managing this provider.

   OIDC Discovery URL

   Enter your OIDC Discovery URL.

   Import from OIDC Discovery URL

   Click to import metadata required to configure your OIDC provider. This option adds the OIDC Discovery URL and automatically fills the Issuer URI and JWKS URI fields.

   Issuer URI

   Enter the issuer URI for your OAuth identity provider.

   The unique issuer URI represents a string that represents the entity for issuing tokens.

   JWKS URI

   Enter the URI for JSON Web Key Set (JWKS).

   JSON Web Key Sets (JWKS) provide a set of keys containing the public keys used to verify any JSON Web Token (JWT) issued by your OIDC identity provider. The HTTP response from the JWKS URI must include one of Content-Type: application/json, Content-Type: application/jwk+json, or Content-Type: application/jwk-set+json in the header.

5. Click Validate and save. The Accounts & access page appears, displaying the Workload identities tab.

   Note

   After validation, you can modify the default Identity claim, which is set to claims.sub by default. Confluent Cloud uses this claim to identify the external identity in audit logs when no identity pool ID is specified, or multiple identity pool IDs are matched. For more information about auto pool mapping, see Use auto pool mapping with OAuth identity pools.

6. Click your new identity provider. A details page appears, showing a summary of your identity provider name, description, issuer URI, and JWKS URI.

To use your new identity provider, set up an identity pool next.

Next steps

• Use OAuth Identity Pools with Your OAuth/OIDC Identity Provider on Confluent Cloud

• Configure Kafka Clients for OAuth 2.0 Authentication in Confluent Cloud