OpenID Connect (OIDC) is a federated authentication protocol that lets LogScale delegate user authentication to an external identity provider (IdP). When an OIDC provider is configured, LogScale redirects users to the IdP for login, then maps claims in the returned token to LogScale usernames, groups, and roles. Domain mappings on the provider determine which email domains route users to this IdP automatically.

The updateOIDCIdentityProvider() mutation modifies an existing OIDC provider configuration. You must supply the provider id, the name, the clientID and clientSecret registered with the IdP, the issuer URL, the authorizationEndpoint, the tokenEndpointAuthMethod, the domains list, the scopes list, the userClaim, and enableDebug. Optional fields such as groupsClaim, lazyCreateUsers, and defaultIdp adjust group mapping, user provisioning behavior, and instance-level defaults respectively; omit them to leave those properties unchanged. To create a new OIDC provider, use newOIDCIdentityProvider() instead.

To create a new OIDC provider, use newOIDCIdentityProvider(). To retrieve the current configuration of an existing provider, including its id required by this mutation, use the oidcIdentityProvider() query. To pre-populate endpoint fields from a discovery document, use fetchOIDCMetadataFromDiscoveryEndpoint() before calling this mutation.

For more information on OpenID Connect, see Authenticate with OpenID Connect. For related authentication information, see Requirements for identity provider configuration.

updateOIDCIdentityProvider(
      input: UpdateOidcConfigurationInput!
   ): OidcIdentityProvider!

The mutation accepts a single required input argument of type UpdateOidcConfigurationInput!. The required fields are id, name, clientID, clientSecret, issuer, authorizationEndpoint, tokenEndpointAuthMethod, domains, scopes, userClaim, and enableDebug. Optional fields such as tokenEndpoint, JWKSEndpoint, userInfoEndpoint, groupsClaim, lazyCreateUsers, and defaultIdp let you configure endpoint overrides, group mapping, user provisioning, and the instance-level default provider.

The required fields are id (the unique identifier of the OIDC configuration to update), name (the display name for the provider), clientID and clientSecret (the credentials registered for LogScale with the IdP), issuer (the base URL of the IdP, used to verify token signatures and construct endpoint URLs if discovery is available), authorizationEndpoint (the URL to which LogScale redirects users for authentication), tokenEndpointAuthMethod (how LogScale authenticates against the token endpoint; either client_secret_basic to send credentials in the HTTP Authorization header or client_secret_post to send them as POST body parameters; defaults to client_secret_basic unless the discovery endpoint indicates it is unsupported), domains (the list of email domains that route users to this provider automatically), scopes (additional OAuth scopes to request beyond the default openid, email, and profile), userClaim (the token claim LogScale maps to the LogScale username; defaults to humio-user and can be set to email when email addresses are used as usernames), and enableDebug (set to true to write detailed OIDC authentication events to the LogScale audit log).

Optional fields override derived values or adjust provider behavior. Set tokenEndpoint to provide an explicit token exchange URL when the IdP does not publish a discovery document. Set JWKSEndpoint to specify an explicit key set URL for token signature validation. Set userInfoEndpoint to provide an explicit user info URL for resolving user attributes from an access token. Set groupsClaim to name the token claim LogScale maps to groups; the claim value must be a string array and defaults to humio-groups. Set lazyCreateUsers to true to defer LogScale account creation until the user first logs in through this provider, rather than provisioning accounts immediately. Set defaultIdp to true to make this provider the instance-level default; only one provider can hold this designation at a time. Omit optional fields to leave those properties unchanged.

The mutation returns a non-null OidcIdentityProvider! object reflecting the updated configuration. The id field contains the unique provider identifier; store this value to update the provider again in the future. The name field returns the display name. The clientId and clientSecret fields return the registered client credentials. The issuer field returns the IdP base URL. The authorizationEndpoint, tokenEndpoint, userInfoEndpoint, and jwksEndpoint fields return the configured endpoint URLs; null values indicate the endpoint is not explicitly set and will be derived from the issuer or discovery document at runtime. The tokenEndpointAuthMethod field returns the active authentication method for the token endpoint. The domains field returns the email domains that route users to this provider. The scopes field returns the configured scope list. The userClaim field returns the claim mapped to LogScale usernames. The groupsClaim field returns the claim mapped to LogScale groups; a null value means no group claim is configured and group membership is not synchronized from this provider. The defaultIdp field indicates whether this provider is the instance-level default. The lazyCreateUsers field indicates whether account creation is deferred until first login. The humioManaged field indicates whether LogScale manages the authentication configuration for this provider. The debug field reflects whether detailed OIDC authentication events are written to the audit log. The authenticationMethod field returns the active authentication method as an AuthenticationMethodAuth interface value.