Skip to main content

Identity providers

An identity provider record here describes an upstream service that a connector authenticates against. It is not how your people sign in to the platform.

Both concepts exist and it is easy to conflate them:

  • Your corporate identity provider signs users in to the platform. It is set once at install time. See Configure identity.
  • Connector identity providers, on this page, are the services a connector brokers OAuth against so a developer's tool call can reach a backend on their behalf.

Where to find them​

In the console, go to Identity providers. Over REST the collection is /v1/connector-identity-providers.

The corporate provider appears here, read-only​

Your corporate identity provider is listed first, marked as coming from platform configuration rather than from an administrator. It appears for a practical reason: connectors can authenticate against it, so an administrator needs to be able to confirm it is configured at all.

It cannot be edited or deleted from this screen. Attempting to do so is refused with a message naming the chart value that governs it, rather than failing quietly. To change it, change your platform values and upgrade.

Its client secret is sealed into managed-secret storage at startup, so connectors resolve it through the same mechanism as every other provider's credential. Because that happens at startup, rotating the underlying secret takes effect on the next restart rather than immediately.

If the corporate provider's secret cannot be sealed, that one record is absent and the condition is logged. It does not stop the directory from starting, on the grounds that one unusable provider record should not take down identity resolution for everything else.

Register a provider​

Adding a provider needs its issuer, its client identifier, and a reference to a managed secret holding the client secret. Create the managed secret first; the provider record points at it rather than holding the credential itself.

Once registered, a provider becomes selectable when you configure a connector's authentication.

Next steps​