<a id="add-oauth-identity-providers"></a>

# Add an OAuth/OIDC Identity Provider on Confluent Cloud

An OAuth/OIDC identity provider in Confluent Cloud grants workloads and applications
limited access to Confluent Cloud resources and Confluent Cloud APIs. A Confluent Cloud OAuth/OIDC
identity provider uses the industry-standard OAuth 2.0 and OpenID Connect (OIDC)
protocols to establish trust with Confluent Cloud resources, reduce operational
burdens, and grant programmatic access to Confluent Cloud APIs for your workloads and
applications.

For OAuth/OIDC concepts and the authentication flow, see [Use OAuth/OIDC to Authenticate to Confluent Cloud](overview.md#oauth-overview).

#### NOTE
OAuth/OIDC identity providers cannot authenticate Confluent Cloud user
accounts. For your Confluent Cloud users, you can use a
[SAML-based single sign-on (SSO) identity provider](../../../user-identities/user-idps/sso/overview.md#sso-saml).

To use the Confluent Cloud APIs to create, read, update, list, and delete identity
providers, see [Identity Providers (iam/v2)](https://docs.confluent.io/cloud/current/ccloud/identity-providers-iam-v-2/).

To manage identity providers with Terraform, use the [confluent_identity_provider](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_identity_provider)
resource.

<a id="add-identity-provider"></a>

## Add an identity provider using Confluent Cloud Console

**Required role-based access control (RBAC) roles**:
[OrganizationAdmin](../../../../access-control/rbac/predefined-rbac-roles.md#organizationadmin-role)

#### IMPORTANT
Before you add a new identity provider, review
[Best Practices for OAuth/OIDC Identity Providers on Confluent Cloud](best-practices.md#best-practices-oauth-identity-providers).

## Prerequisites

- You must have an account in the identity provider you want to use.
- You must have an account in Confluent Cloud with the
  [OrganizationAdmin](../../../../access-control/rbac/predefined-rbac-roles.md#organizationadmin-role) role.
- You need the following information for your identity provider:
  - OIDC Discovery URL: Get this URL from your identity provider to import
    metadata required to configure your OIDC provider. Using this option
    automatically fills the JSON Web Key Set (JWKS) URI and Issuer URI fields.
  - Without the OIDC Discovery URL, you need the following information:
    - **Microsoft Entra ID/Azure UAMI**: Tenant ID, JWKS URI, and Issuer URI.
    - **Okta**: Authorization server, domain, JWKS URI, and Issuer URI.
    - **AWS IAM**: JWKS URI and Issuer URI for the AWS Security Token Service
      (STS).
    - **Other OIDC identity provider**: JWKS URI, and Issuer URI.
- To use AWS IAM as your identity provider, your Kafka clients must run on
  AWS compute (EC2, EKS, ECS, Fargate, or Lambda) with an IAM role that can
  mint AWS STS web identity tokens. For the client-side setup, see
  [Configure AWS IAM OAuth for Python Client](clients/aws-iam-python-plugin.md#aws-iam-python-plugin), [Configure AWS IAM OAuth for Java Client](clients/aws-iam-java-plugin.md#aws-iam-java-plugin), and
  [Configure AWS IAM OAuth for .NET Client](clients/aws-iam-dotnet-plugin.md#aws-iam-dotnet-plugin).
- To use Azure User-Assigned Managed Identity (UAMI) with Microsoft Entra ID,
  your Kafka clients must run on Azure compute (VM, AKS, or Azure Container
  Instance) with an assigned UAMI, and you must have a Microsoft Entra ID App
  Registration. For the client-side setup, see [Configure Azure User Assigned Managed Identity OAuth for Confluent Cloud](clients/uami.md#oauth-uami-share).
- If your identity provider is behind a firewall, you must add Confluent Cloud public
  IP addresses to your firewall allowlist. Confluent Cloud uses these public IP
  addresses to access your JWKS URI over the internet. To get the available
  Confluent Cloud public IP addresses, see [Verify network access to the JWKS URI](jwks-manual-refresh.md#verify-network-access-jwks-uri).

## Configure an OAuth/OIDC identity provider

Configuring an OAuth/OIDC identity provider establishes trust between Confluent Cloud
and your external identity provider so your workloads can authenticate
programmatically. Follow these steps to configure an identity provider using the
Confluent Cloud Console.

1. In Confluent Cloud Console, go to the **Workload identities** tab under **Accounts &
   access** at [https://confluent.cloud/settings/org/workload_identities](https://confluent.cloud/settings/org/workload_identities).
2. Click **Add identity providers**.
3. Select **OAuth/OIDC** as the identity provider type and click **Next**.
4. Click **Microsoft Entra ID/Azure UAMI**, **Okta**, **AWS IAM**, or **Other
   OIDC identity provider** and click **Next**. Complete the fields.

   ### Microsoft Entra ID/Azure UAMI

   Use this option for Microsoft Entra ID, including Azure
   User-Assigned Managed Identity (UAMI), which uses Microsoft Entra ID
   to issue tokens.

   To use UAMI, after you add the identity provider, configure your Kafka
   clients to retrieve UAMI tokens from Azure Instance Metadata Service
   (IMDS). For the client-side setup, see [Configure Azure User Assigned Managed Identity OAuth for Confluent Cloud](clients/uami.md#oauth-uami-share).

   Name
   : Enter a meaningful name for your Microsoft Entra ID identity provider.

   Description
   : Enter meaningful information for using and managing this provider.

   Tenant ID
   : Enter the tenant identifier. For UAMI, use the **Directory (tenant)
     ID** from your Microsoft Entra ID App Registration.

   Import from Tenant ID
   : Click to import metadata required to configure your OIDC provider.
     This option adds the OIDC Discovery URL and automatically fills
     the **Issuer URI** and **JWKS URI** fields.

   Issuer URI
   : Enter the issuer URI for your Microsoft Entra ID authorization
     server. This value must match the `iss` claim in the tokens
     issued by Microsoft Entra ID.
     <br/>
     Example: `https://login.microsoftonline.com/<tenant_id>/v2.0`

   JWKS URI
   : Enter the URI for JSON Web Key Set (JWKS).
     <br/>
     JSON Web Key Sets (JWKS) provide a set of keys containing the public
     keys used to verify any JSON Web Token (JWT) issued by your Microsoft
     Entra ID identity provider. The HTTP response from the JWKS URI must
     include one of
     `Content-Type: application/json`, `Content-Type: application/jwk+json`,
     or `Content-Type: application/jwk-set+json` in the header.
     <br/>
     Example URI: `https://login.microsoftonline.com/<tenant_id>/discovery/v2.0/keys`

   #### IMPORTANT
   Confluent Cloud requires v2 tokens. To use your Microsoft Entra ID
   identity provider created here, you must also
   edit your Microsoft Entra ID application manifest to set the [requestedAccessTokenVersion](https://learn.microsoft.com/en-us/entra/identity-platform/reference-app-manifest#configure-the-app-manifest)
   attribute to `2` to use the v2 token instead of the default legacy
   v1 token. For example, add the following line to your manifest:
   ```json
   "requestedAccessTokenVersion": 2
   ```

   For details, follow the steps in [Configure the application manifest](https://learn.microsoft.com/en-us/entra/identity-platform/reference-app-manifest#configure-the-app-manifest).

   By default, applications registered in a Microsoft Entra tenant are
   available to all users of the tenant who authenticate successfully.
   As a best practice, to restrict which identities can get tokens for
   your application,
   [require user assignment](https://learn.microsoft.com/en-us/entra/identity-platform/howto-restrict-your-app-to-a-set-of-users#update-the-app-to-require-user-assignment)
   in your Microsoft Entra tenant.

   Alternatively, you can apply the restriction on the Confluent Cloud side:
   when you create the identity pool for this provider, add a filter
   that validates the token audience. In v2 tokens, the audience is
   the App Registration Application (client) ID:
   ```text
   claims.aud == "<application_client_id>"
   ```

   ### Okta

   Name
   : Enter a meaningful name for your Okta identity provider.

   Description
   : Enter meaningful information for using and managing this provider.

   Domain
   : Enter the domain. Default value is `{yourDomain}.okta.com`. Replace
     `{yourDomain}` with your domain name for Okta.

   Authorization server
   : Enter the authorization server identifier for your Okta identity provider.
     The default value is `default`, but you can modify it.

   Import from configuration
   : Click to import metadata required to configure your OIDC provider
     using the **Domain** and **Authorization server** fields. This
     option adds the OIDC Discovery URL and automatically fills the
     **Issuer URI** and **JWKS URI** fields.

   Issuer URI
   : Enter the issuer URI for your Okta identity provider.
     <br/>
     The unique issuer URI represents a string that represents the
     entity for issuing tokens.
     <br/>
     Example: `https://mycompany.okta.com/oauth2/default`

   JWKS URI
   : Enter the URI for JSON Web Key Set (JWKS).
     <br/>
     JSON Web Key Sets (JWKS) provide a set of keys containing the public
     keys used to verify any JSON Web Token (JWT) issued by your Okta
     identity provider. The HTTP response from the JWKS URI must include
     one of
     `Content-Type: application/json`, `Content-Type: application/jwk+json`,
     or `Content-Type: application/jwk-set+json` in the header.
     <br/>
     Example URI: `https://mycompany.okta.com/oauth2/default/v1/keys`

   ### AWS IAM

   Name
   : Enter a meaningful name for your AWS IAM identity provider.

   Description
   : Enter meaningful information for using and managing this provider.

   Issuer URI
   : Enter the issuer URI for the AWS STS OIDC endpoint. This value
     must match the `iss` claim in the tokens minted by AWS STS.
     <br/>
     Example: `https://<uuid>.tokens.sts.global.api.aws`

   JWKS URI
   : Enter the URI for the JSON Web Key Set (JWKS) published by AWS
     STS.
     <br/>
     JSON Web Key Sets (JWKS) provide a set of public keys used to
     verify any JWT issued by AWS STS.
     <br/>
     Example URI:
     `https://<uuid>.tokens.sts.global.api.aws/.well-known/jwks.json`

   #### NOTE
   The `<uuid>` in the issuer and JWKS URIs is a unique identifier
   that AWS generates for your account. It is not your AWS
   account ID.

   After you add the identity provider, configure your Kafka clients to
   mint AWS STS tokens. For client-side setup, see
   [Configure AWS IAM OAuth for Python Client](clients/aws-iam-python-plugin.md#aws-iam-python-plugin), [Configure AWS IAM OAuth for Java Client](clients/aws-iam-java-plugin.md#aws-iam-java-plugin), and
   [Configure AWS IAM OAuth for .NET Client](clients/aws-iam-dotnet-plugin.md#aws-iam-dotnet-plugin).

   For end-to-end examples of AWS IAM authentication with Confluent Cloud,
   see [confluentinc/AWS-IAM-Examples](https://github.com/confluentinc/AWS-IAM-Examples).

   ### Other OIDC identity provider

   Use this option for any OAuth/OIDC-compliant provider that does not
   have a dedicated tab, such as Auth0 or Google Identity Platform.

   Name
   : Enter a meaningful name for your Other OIDC identity provider.

   Description
   : Enter meaningful information for using and managing this provider.

   OIDC Discovery URL
   : Enter your OIDC Discovery URL.

   Import from OIDC Discovery URL
   : Click to import metadata required to configure your OIDC provider.
     This option adds the OIDC Discovery URL and automatically fills
     the **Issuer URI** and **JWKS URI** fields.

   Issuer URI
   : Enter the issuer URI for your OAuth identity provider.
     <br/>
     The unique issuer URI represents a string that represents the
     entity for issuing tokens.

   JWKS URI
   : Enter the URI for JSON Web Key Set (JWKS).
     <br/>
     JSON Web Key Sets (JWKS) provide a set of keys containing the public
     keys used to verify any JSON Web Token (JWT) issued by your OIDC
     identity provider. The HTTP response from the JWKS URI must include
     one of
     `Content-Type: application/json`, `Content-Type: application/jwk+json`,
     or `Content-Type: application/jwk-set+json` in the header.
5. Click **Validate and save**. The **Accounts & access** page appears,
   displaying the **Workload identities** tab.

   #### NOTE
   After validation, you can modify the default Identity claim, which is set
   to `claims.sub` by default. Confluent Cloud uses this claim to identify the
   external identity in audit logs when no identity pool ID is specified, or
   multiple identity pool IDs are matched. For more information about auto
   pool mapping, see [Use auto pool mapping with OAuth identity pools](identity-pools.md#oauth-auto-pool-mapping).
6. Click your new identity provider. A details page appears, showing a summary
   of your identity provider name, description, issuer URI, and JWKS URI.

To use your new identity provider, set up an identity pool next.

## Next steps

- [Use OAuth Identity Pools with Your OAuth/OIDC Identity Provider on Confluent Cloud](identity-pools.md#add-oauth-identity-pools)
- [Configure Kafka Clients for OAuth 2.0 Authentication in Confluent Cloud](clients/overview.md#oauth-client-configuration-overview)