# Configure OIDC SSO for the Confluent CLI on Confluent Platform OpenID Connect (OIDC) is an authentication layer built on top of the OAuth 2.0 protocol. Authentication with OIDC on Confluent Platform permits you to integrate with an identity provider (IdP) such as Okta to support one or more authentication flows. For example, your integration could have an SSO OIDC flow for authenticating users and another flow for client application or service credential authentication. The example on this page for the Confluent CLI configures an OIDC SSO flow that authenticates users only. The Confluent CLI uses device grant flow. The Metadata Service (MDS) acts as the intermediary that enables the OIDC SSO flow where MDS interacts primarily with the identity provider (IdP). The CLI never directly interacts with the IdP. Thus, to enable OIDC SSO flows for the CLI, you must configure the MDS intermediary. Considerations: - To use SSO with Control Center your installation must use Confluent Platform version 7.5 or later. - SSO for Control Center does not support identity provider (IdP) refresh token rotation. If your IdP has this feature enabled, you must turn it off in your IdP settings to ensure successful token renewal. For more information, see [Refresh token rotation is not supported](troubleshoot.md#troubleshoot-sso-oidc-refresh-token-rotation). ## Configure, test, and verify OIDC SSO Complete the steps in this procedure to configure, test SSO, and verify user access through the Confluent CLI using OpenID Connect (OIDC). ### Step 1: Add OIDC properties 1. Add the following OIDC properties to your MDS configuration in your properties file (`$CONFLUENT_HOME/etc/kafka/broker.properties`). ```properties confluent.metadata.server.sso.mode=oidc confluent.oidc.idp.jwks.endpoint.uri= confluent.oidc.idp.authorize.base.endpoint.uri= confluent.oidc.idp.device.authorization.endpoint.uri= confluent.oidc.idp.client.id= confluent.oidc.idp.client.secret= confluent.oidc.idp.token.base.endpoint.uri= confluent.oidc.idp.issuer= confluent.oidc.idp.refresh.token.enabled=true confluent.oidc.session.token.expiry.ms=120000 confluent.oidc.session.max.timeout.ms=600000 ``` Authentication with OIDC on Confluent Platform is flexible in that you can integrate with two different identity providers. For example, your environment can integrate with one identity provider for authenticating using SSO flows and another, separate provider, for client credential flows. As this MDS configuration is for user authentication in the CLI SSO flow only, it requires the identity provider endpoints and client app details of the IdP hosting your user identities. Replace the placeholder values (``, ``, ``, ``, ``, ``, and ``) with the endpoints and client credentials from your identity provider. 2. Save and close the properties file. 3. Gracefully shut down and restart the server for your changes to take effect. ### Step 2: Install the Confluent CLI The Confluent CLI is packaged and available in every Confluent Platform release. Single sign-on for Confluent CLI is available starting with version 3.64.3. If you need to update your CLI installation, see the [update](https://docs.confluent.io/confluent-cli/current/command-reference/confluent_update.html#confluent-update) command. ### Step 3: Test SSO sign-in After you configure an identity provider, the `confluent login` command redirects users to a browser to sign in using that provider. This flow works in environments with or without a browser. For environments with a browser, use the following command: ```bash confluent login --url https://: \ --certificate-authority-path ``` For an environment without a browser, such as a jump host, add the `--no-browser` flag, like this: ```bash confluent login --url https://: \ --certificate-authority-path \ --no-browser ``` This command asks you for your email and prints a URL, for example: ```bash Enter your Confluent credentials: Email: smith@confluent.io Navigate to the following link in your browser to authenticate: https://login.confluent.io/authorize?response_type=code&code_challenge=NovO_c6FO44G-6cfRbqTrBcEOrDnvm7GNZLCHCmbPM8&code_challenge_method=S256&client_id=hPbGLM8G55HSaUsaaieiiAprnJaEc3rH&redirect_uri=https://confluent.cloud/cli_callback&scope=email%20openid&audience=https://confluent.auth0.com/api/v2/&state=CoOGX1aQhvwdH2dFSvKV-gh09INnYcXFaYbUnWq3Ekw&connection=big-company After authenticating in your browser, paste the code here: ``` Pasting the URL into the browser causes it to display a code. After you copy the code and paste it back into the Confluent CLI, your login is complete. ### Step 4: Display the user environment At this point, you should have successfully logged in using SSO. Display your Confluent Platform user environment with the following command: ```bash confluent iam user describe -o json ``` ### Step 5: Verify user authorization Try some Confluent CLI commands that access resources to ensure that the user has the authorization you expect. For example, you can create a Apache Kafka® topic (ensure the signed-in user has proper role-based access control (RBAC) roles) by running the following Confluent CLI command: ```bash confluent kafka topic create test-topic --url https://:8090/kafka ``` ## Switching back to HTTP Basic Authentication If you configured CLI SSO on an existing cluster with upgrades, and the metadata store has LDAP server configured as the user store along with OIDC, you have the option to switch back to HTTP Basic Authentication if required. To switch back to HTTP Basic Authentication and sign in using your username and password, you can use the `--prompt` flag, like this: ```bash confluent login --url https://: \ --certificate-authority-path \ --prompt ``` ## Session timeout for Confluent CLI SSO sign-in The `confluent.oidc.session.max.timeout.ms` property controls the session timeout for signing in with SSO. If the configuration enables refresh tokens (`confluent.oidc.idp.refresh.token.enabled=true`), the identity provider’s refresh token settings control the timeout.