OpenID-Connect (OIDC) support
Landscape offers support for OpenID-Connect (OIDC) authentication. Common OIDC providers include Okta, Keycloak, Amazon Cognito, Google Identity Platform and Microsoft Entra ID (formerly Azure Active Directory).
To enable OIDC support, add
/etc/landscape/service.conf in the
[landscape] section. For example:
[landscape] […] oidc-issuer = <https://accounts.google.com/> oidc-client-id = 000000000000-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.apps.googleusercontent.com oidc-client-secret = a4sDFAsdfA4F52as-asDfAsd
oidc-issuer is the URL of the issuer. That URL should also be a discovery configuration file available by appending
.well-known/openid-configuration, such as https://accounts.google.com/.well-known/openid-configuration.
oidc-client-secret should be provided by your OIDC provider when you create the client credentials. The provider may require setting an authorization redirect URI. This should look like
https://your_landscape/login/handle-openid. If your provider also requires a logout redirect URL, this should be the address of your Landscape server such as
To restart all Landscape services, run:
sudo lsctl restart
A logout URL can be configured with
oidc-logout-url if the provider doesn’t expose one. For example:
[landscape] … oidc-logout-url = <https://accounts.google.com/logout>
There is no provision yet to upgrade current users to OIDC authentication. Most providers return pairwise subject identifiers (sub) which are not easily available. For this reason, we do not provide a user migration method and recommend recreating users.