🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The newOIDCIdentityProvider() mutation creates a new OpenID Connect (OIDC) identity provider in LogScale. This is a root operation, so it requires root-level access. Use this mutation when you set up an OIDC provider for the first time. To modify an existing provider, use updateOIDCIdentityProvider() instead.

Syntax

graphql
newOIDCIdentityProvider(
      input: OidcConfigurationInput!
   ): OidcIdentityProvider!

The mutation accepts a single required argument, input, of type OidcConfigurationInput!. The input specifies all configuration details for the OIDC provider, including the client ID, client secret, issuer URL, authorization endpoint, token endpoint authentication method, and email domains. The mutation returns a non-null OidcIdentityProvider! object representing the newly created provider. The Input Parameters section lists all available fields.

Example

Raw
graphql
mutation {
  newOIDCIdentityProvider(input: { 
     name: "myOIDC",
     clientID: "123abc",
     clientSecret: "MD39xf83M301",
     issuer: "https://my.oidc-idp.com",
     tokenEndpointAuthMethod: "client_secret_basic",
     authorizationEndpoint: "https://my.oidc-idp.com/authorize",
     domains: ["humio"],
     scopes: ["profile", "email", "openid"],
     enableDebug: false    
       } ) 
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  newOIDCIdentityProvider(input: { 
     name: \"myOIDC\",
     clientID: \"123abc\",
     clientSecret: \"MD39xf83M301\",
     issuer: \"https://my.oidc-idp.com\",
     tokenEndpointAuthMethod: \"client_secret_basic\",
     authorizationEndpoint: \"https://my.oidc-idp.com/authorize\",
     domains: [\"humio\"],
     scopes: [\"profile\", \"email\", \"openid\"],
     enableDebug: false    
       } ) 
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  newOIDCIdentityProvider(input: { 
     name: \"myOIDC\",
     clientID: \"123abc\",
     clientSecret: \"MD39xf83M301\",
     issuer: \"https://my.oidc-idp.com\",
     tokenEndpointAuthMethod: \"client_secret_basic\",
     authorizationEndpoint: \"https://my.oidc-idp.com/authorize\",
     domains: [\"humio\"],
     scopes: [\"profile\", \"email\", \"openid\"],
     enableDebug: false    
       } ) 
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  newOIDCIdentityProvider(input: {  ^
     name: \"myOIDC\", ^
     clientID: \"123abc\", ^
     clientSecret: \"MD39xf83M301\", ^
     issuer: \"https://my.oidc-idp.com\", ^
     tokenEndpointAuthMethod: \"client_secret_basic\", ^
     authorizationEndpoint: \"https://my.oidc-idp.com/authorize\", ^
     domains: [\"humio\"], ^
     scopes: [\"profile\", \"email\", \"openid\"], ^
     enableDebug: false     ^
       } )  ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  newOIDCIdentityProvider(input: { 
     name: \"myOIDC\",
     clientID: \"123abc\",
     clientSecret: \"MD39xf83M301\",
     issuer: \"https://my.oidc-idp.com\",
     tokenEndpointAuthMethod: \"client_secret_basic\",
     authorizationEndpoint: \"https://my.oidc-idp.com/authorize\",
     domains: [\"humio\"],
     scopes: [\"profile\", \"email\", \"openid\"],
     enableDebug: false    
       } ) 
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  newOIDCIdentityProvider(input: { 
     name: \"myOIDC\",
     clientID: \"123abc\",
     clientSecret: \"MD39xf83M301\",
     issuer: \"https://my.oidc-idp.com\",
     tokenEndpointAuthMethod: \"client_secret_basic\",
     authorizationEndpoint: \"https://my.oidc-idp.com/authorize\",
     domains: [\"humio\"],
     scopes: [\"profile\", \"email\", \"openid\"],
     enableDebug: false    
       } ) 
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  newOIDCIdentityProvider(input: { 
     name: \"myOIDC\",
     clientID: \"123abc\",
     clientSecret: \"MD39xf83M301\",
     issuer: \"https://my.oidc-idp.com\",
     tokenEndpointAuthMethod: \"client_secret_basic\",
     authorizationEndpoint: \"https://my.oidc-idp.com/authorize\",
     domains: [\"humio\"],
     scopes: [\"profile\", \"email\", \"openid\"],
     enableDebug: false    
       } ) 
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  newOIDCIdentityProvider(input: { 
     name: \"myOIDC\",
     clientID: \"123abc\",
     clientSecret: \"MD39xf83M301\",
     issuer: \"https://my.oidc-idp.com\",
     tokenEndpointAuthMethod: \"client_secret_basic\",
     authorizationEndpoint: \"https://my.oidc-idp.com/authorize\",
     domains: [\"humio\"],
     scopes: [\"profile\", \"email\", \"openid\"],
     enableDebug: false    
       } ) 
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "newOIDCIdentityProvider": {
      "id": "abc123"
    }
  }
}

Input Parameters

The input argument requires fields that identify the provider, authenticate with the issuer, and configure endpoint and domain settings. The following table describes each field:

Table: OidcConfigurationInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
JWKSEndpointString  Long-Term A URL to the JWKS endpoint for retrieving keys for validating tokens. Required.
authorizationEndpointStringyes Long-Term A URL to the endpoint a user should be redirected to when authorizing. Required for clients.
clientIDStringyes Long-Term The unique identifier of the client.
clientSecretStringyes Long-Term The client's password or passphrase or the like for the identity provider.
defaultIdpBoolean  Long-Term The default identity provider.
domainsStringyes Long-Term The domains for the OIDC authentication.
enableDebugBooleanyes Long-Term Whether to enable debugging mode.
federatedIdpString  Long-Term The Federated IdP.
groupsClaimString  Long-Term The name of the claim to interpret as the groups in LogScale. The value in the claim must be an array of strings. Optional. Defaults to humio-groups.
humioOwnedBoolean  Long-Term Whether this is a LogScale owned OIDC.
issuerStringyes Long-Term The OIDC issuer.
lazyCreateUsersBoolean  Long-Term Whether to create users at the last moment, and only when needed.
nameStringyes Long-Term The name of the OpenID Connect (OIDC) identity provider.
registrationEndpointString  Long-Term LogScale will use the OIDC endpoint (%OIDC_PROVIDER%/.well-known/openid-configuration) to configure missing parameters.
scopeClaimString  Long-Term The scope claim.
scopesStringyes Long-Term Comma-separated list of scopes to add in addition to the default requested scopes (openid, email, and profile). Optional.
tokenEndpointString  Long-Term A URL to the token endpoint used to exchange a authentication code to an access token. Required for clients.
tokenEndpointAuthMethodStringyes Long-Term The authentication method used to authenticate LogScale against the token endpoint. Can either be client_secret_basic or client_secret_post for placing the client id and secret in either basic auth or post data, respectively. Defaults to client_secret_basic, or client_secret_post if client_secret_basic is not supported as per the discovery endpoint.
userClaimString  Long-Term The name of the claim to interpret as username in LogScale. Defaults to humio-user. Can be set to email if using emails as usernames.
userInfoEndpointString  Long-Term A URL to the user info endpoint used to retrieve user information from an access token. Required.

Returned Values

The mutation returns a non-null OidcIdentityProvider! object representing the newly created provider. The returned fields include the provider identifier, authentication method, endpoint URLs, and domain list. Retrieve the identifier to reference this provider in subsequent mutations. The following table describes all available fields:

Table: OidcIdentityProvider Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
authenticationMethodAuthenticationMethodAuthyes Long-Term The authentication method used. See AuthenticationMethodAuth.
authorizationEndpointstring  Long-Term A URL to the endpoint a user should be redirected to when authorizing.
clientIdstringyes Long-Term The unique identifier for the client.
clientSecretstringyes Long-Term The password for the client.
debugbooleanyes Long-Term Whether debugging is enabled.
defaultIdpbooleanyes Long-Term Whether the identity provider is the default.
domains[string]yes Long-Term The domains authorized by the OIDC identity providers.
federatedIdpstring  Long-Term The Federated IdP.
groupsClaimstring  Long-Term The name of the claim to interpret as the groups in LogScale. The value in the claim must be an array of strings. Optional. Defaults to humio-groups.
humioManagedbooleanyes Long-Term Whether authentication is managed by LogScale.
idstringyes Long-Term The unique identifier for the OIDC identity provider.
issuerstringyes Long-Term The issuer of the OIDC authentication.
jwksEndpointstring  Long-Term A URL to the JWKS endpoint for retrieving keys for validating tokens. Required.
lazyCreateUsersbooleanyes Long-Term Whether to wait to create users until necessary.
namestringyes Long-Term The name of the OIDC identity provider.
registrationEndpointstring  Long-Term To use OIDC as a client, PUBLIC_URL must be set, LogScale must be registered as a client with your OpenID provider, and the provider must allow %PUBLIC_URL%/auth/oidc as a valid redirect endpoint for the client.
scopeClaimstring  Long-Term The scope claim.
scopes[string]yes Long-Term Comma-separated list of scopes to add in addition to the default requested scopes (openid, email, and profile).
tokenEndpointstring  Long-Term A URL to the token endpoint used to exchange a authentication code to an access token. Required for clients.
tokenEndpointAuthMethodstringyes Long-Term A URL to the token endpoint used to exchange a authentication code to an access token. Required for clients.
userClaimstringyes Long-Term The name of the claim to interpret as username in LogScale. The value in the claim must be a string. Defaults to humio-user. Can be set to email if using emails as usernames.
userInfoEndpointstring  Long-Term A URL to the user info endpoint used to retrieve user information from an access token.