Add a generic OIDC identity provider

Configure any OIDC-compliant identity provider (Okta, Keycloak, Microsoft Entra ID, or others) to enable enterprise authentication. You must have the admin role to manage identity providers.

Before you begin

  • An OIDC-compliant identity provider with administrator access.
  • A registered OAuth 2.0 client application on the identity provider. Configure the client with a client ID, client secret, and redirect URI: https://orchestrator-host/api/v1/auth/oidc/callback
  • The identity provider's issuer URL (for auto-discovery) or manual endpoint URLs.
  • Network connectivity between automation orchestrator and the identity provider.

Procedure

  1. Log in to automation orchestrator as the built-in administrator.
  2. From the navigation menu, select System Administration > Identity Providers.
  3. Select Add OIDC provider.
  4. From the Provider Template list, select Custom.
  5. Enter a Provider Name (for example, "Okta", "Keycloak").
  6. Optional: Enable the provider immediately by setting the Enable Provider switch.
  7. Enter the Issuer URL of your OIDC provider.
  8. Leave Use OIDC Discovery enabled (recommended). If your provider does not support OIDC discovery, disable it and enter the endpoints manually:
    • Authorization Endpoint
    • Token Endpoint
    • JWKS URI
    • Userinfo Endpoint (optional)
    • End session endpoint (optional)
  9. Enter the Client ID and Client Secret.
  10. If your identity provider is using self-signed certificates or internal certificates, ensure Disable TLS certificate verification is on.
  11. Copy the Redirect URI displayed in the form and configure it in your identity provider's OAuth application settings.
  12. Verify the Scopes (default: openid profile email). Add additional scopes if required by your provider.
  13. Set Allow all authenticated if you want all users from this identity provider to log in, regardless of group mapping results.
  14. Set Single logout if your provider supports RP-initiated logout, and you would like users to be logged out of their identity provider as well.
  15. If custom claim mapping is required, select Next. Otherwise, select Add Provider to create the identity provider.

Test the identity provider connection

Before saving a new identity provider configuration, test the connection to verify that automation orchestrator can reach the identity provider and retrieve its OIDC discovery document.

Procedure

  1. Navigate to the identity provider form.
  2. Select Test connection.

    The test verifies connectivity and returns the discovery status without creating a record.

Claim mappings

The claim mapping configuration controls how identity provider token claims map to automation orchestrator user attributes. Configure these in Step 2 of the provider form.

Field Default Description
Subject claim sub Unique user identifier from the identity provider
Email claim email User's email address
Username claim preferred_username Username for the local user record
First name claim given_name User's first name
Last name claim family_name User's last name
Group extraction expression groups[*] JMESPath expression to retrieve groups from an OIDC claim

When you select a provider template, claim mappings are pre-configured and read-only. Select Custom to configure claim mappings manually.

If OIDC discovery is enabled and the test connection succeeds, the claim fields display a list of claims supported by the identity provider. Select a supported claim or select Custom... to enter a claim name manually.

Configure group mappings

Configure group mappings to control how identity provider groups map to automation orchestrator groups.

Before you begin

  • An identity provider configured in automation orchestrator.
  • You must have the admin role.

About this task

Option 1: Allow all authenticated

Enable Allow all authenticated in the provider configuration. All users from this identity provider can log in regardless of group mapping results, receiving the implicit users group membership.

Option 2: Explicit group mappings

Important:

If Allow all authenticated is disabled, users whose identity provider groups do not match any configured group mapping cannot log in.

Procedure

  1. Navigate to the identity provider detail page.
  2. Select the Group Mapping tab.
  3. Select Add Manually if none are yet configured or select Add mapping. Alternatively, use Discover groups to discover available groups.
  4. For each mapping, enter the IdP Group Value and select the target Automation Orchestrator Group.
  5. Select Save mapping.

Results

Group extraction expression

The group extraction expression is a JMESPath expression that extracts group values from the ID token claims. Provider templates pre-configure this expression. For custom providers, configure the expression in the Advanced section of the Group Mapping tab.

The default expression is groups[*], which extracts values from a top-level groups array in the token. Adjust the expression based on your identity provider's claim structure.

Verify the identity provider configuration

After adding an identity provider, verify that users can authenticate through it.

Procedure

  1. Log out from the built-in administrator account.
  2. On the login page, select Log in with {provider name}.
  3. Authenticate with your identity provider credentials.
  4. Verify that you can access automation orchestrator.
  5. Navigate to My Profile to verify your user record was created.
  6. Verify your group memberships match your configured mappings.