Configure an External IDP for Use with TKG Service Clusters

You can configure Supervisor with any OIDC-compliant identity provider (IDP), such as Okta. To complete the integration, you configure the IDP with the callback URL for Supervisor.

Supported External OIDC Providers

You can configure Supervisor with any OIDC-compliant identity provider. The table lists common ones and includes links for configuration instructions.

External IDP	Configuration
Okta	Example OIDC Configuration Using Okta See also Configure Okta as an OIDC provider for Pinniped
Workspace ONE	Configure Workspace ONE Access as an OIDC provider for Pinniped
Dex	Configure Dex as an OIDC provider for Pinniped
GitLab	Configure GitLab as an OIDC provider for Pinniped
Google OAuth	Using Google OAuth 2

Configuring the IDP with the Callback URL for Supervisor

Supervisor acts as an OAuth 2.0 client to the external identity provider. The Supervisor Callback URL is the redirect URL used to configure the external IDP. The Callback URL takes the form https://SUPERVISOR-VIP/wcp/pinniped/callback.

Note: When performing the IDP registration, the callback URL might be called the "redirect URL" in the OIDC provider you are configuring.

When configuring the external identity provider for use with TKG on Supervisor, you supply the external identity provider with the Callback URL that is available in vCenter Server at Workload Management > Supervisors > Configure > Identity Providers screen.

Example OIDC Configuration Using Okta

Okta lets users sign-in to applications using the OpenID Connect protocol. When you configure Okta as an external identity provider for Tanzu Kubernetes Grid on Supervisor, the Pinniped pods on Supervisor and on Tanzu Kubernetes Grid clusters control user access to both vSphere Namespaces and workload clusters.

1. Copy the Identity Provider Callback URL which you need to create an OIDC connection between Okta and vCenter Server.

   Using the vSphere Client, get the Identity Provider Callback URL at Workload Management > Supervisors > Configure > Identity Providers. Copy this URL to a temporary location.

   Figure 1. IDP Callback URL

   

2. Log in to the Okta account for your organization, or create a trial account at https://www.okta.com/. Click the Admin button to open the Okta admin console.

   Figure 2. Okta Admin Console

   

3. From the Getting Started page in the admin console, navigate to Applications > Applications.

   Figure 3. Okta Getting Started

   

4. Select the option to Create App Integration.

   Figure 4. Okta Create App Integration

   

5. Create the new app integration.
   • Set the Sign-in method to OIDC - OpenID Connect
   • Set the Application type to Web Application

   Figure 5. Okta Sign-On Method and Application Type

   

6. Configure the Okta web application integration details.
   • Provide an App integration name, which is a user-defined string.
   • Specify the Grant type: Select Authorization Code and also select Refresh Token.
   • Sign-in redirect URIs: Enter the Identity Provider Callback URL that you copied from Supervisor (see Step 1), such as https://10.27.62.33/wcp/pinnipend/callback.
   • Sign-out redirect URIs: Enter the Identity Provider Callback URL that you copied from Supervisor (see Step 1), such as https://10.27.62.33/wcp/pinnipend/callback.

   Figure 6. Okta Web Application Integration Details

   

7. Configure user access control.

   In the Assignments > Controlled access section, you can optionally control which of the Okta users that exist in your organization can access Tanzu Kubernetes Grid clusters. In the example, allow everyone defined in the organization has access.

   Figure 7. Okta Access Control

   

8. Click Save and copy the Client ID and Client Secret that are returned.

   When you save the OKTA configuration, the admin console provides you with a Client ID and Client Secret. Copy both pieces of data because you need them to configure Supervisor with an external identity provider.

   Figure 8. OIDC Client ID and Secret

   

9. Configure the OpenID Connect ID Token.

   Click the Sign On tab. In the OpenID Connect ID Token section, click the Edit link, fill in the Groups claim type filter, and Save the settings.

   For example, if you want the claim name "groups" to match all groups, select groups > Matches regex > *.

   Figure 9. OpenID Connect ID Token

   

10. Copy the Issuer URL.

    To configure Supervisor, you need Issuer URL, in addition to the Client ID and Client Secret.

    Copy the Issuer URL from the Okta admin console.

    Figure 10. Okta Issuer URL