How to set the client_secret in kratos.yml for an OIDC provider?

[johanforssell]

Hello!

According to the docs I can set SELFSERVICE_METHODS_OIDC_CONFIG_PROVIDERS as an environment variable, but as that represents the whole block, I don't really see how

        providers:
          - id: google
            provider: google
            client_id: ''
            client_secret: ''
            mapper_url: file://path/to/oidc.jsonnet
            auth_url: https://accounts.google.com/o/oauth2/v2/auth
            token_url: https://www.googleapis.com/oauth2/v4/token
            scope:
              - offline_access
            tenant: common
            requested_claims:
              id_token:
                email:
                email_verified:
            issuer_url: https://accounts.google.com

I just want to pick the client_secret from the environment - should I specify SELFSERVICE_METHODS_OIDC_CONFIG_PROVIDERS_google_client_secret or what? (I guess not).

Could I get an example?

[vinckr]

Nested paths get mapped to config values by putting an underscore _ between every level, e.g. selfservice.flows.settings.ui_url becomes SELFSERVICE_FLOWS_SETTINGS_UI_URL=.
from configuring

but I am not sure how to do it in this case, maybe you have to pass the whole array like
SELFSERVICE_METHODS_OIDC_CONFIG_PROVIDERS={id: google, client_secret:...}

Just write it in your kratos.yml configuration, that should be the best option.

This is the library we use to read env, yaml ect.: https://github.com/knadh/koanf.
Maybe you can find some answers there.

Would love to find this out for you, but it will take a bit probably.

[vinckr]

Hey @johanforssell @bryanveloso , just checking in if the problem still persists.
I will mark this as answered for now, but feel free to come back to the discussion any time.
Thanks a ton 🐝

[oscarsilver]

Hello @vinckr. I am still facing the same issue using oryd/kratos:v0.7.1-alpha.1. Passing the whole SELFSERVICE_METHODS_OIDC_CONFIG_PROVIDERS array does not work for me. The config parsing seems to just ignore the environment variable.

[willemruys]

I managed to get the oidc config inject properly by using the following stringified array:

SELFSERVICE_METHODS_OIDC_CONFIG_PROVIDERS='[{"id":"google","provider":"google","mapper_url":"<jsonnet_file>","client_id":"<client_id>","client_secret":"<client_secret>","scope":["openid","email","profile"],"auth_url":"https://accounts.google.com/o/oauth2/v2/auth","token_url":"https://www.googleapis.com/oauth2/v4/token","issuer_url":"https://accounts.google.com"},{"id":"microsoft","provider":"microsoft","mapper_url":"<jsonnet_file>","client_id":"<client_id>","client_secret":"<client_secret>","scope":["openid","email","profile"],"auth_url":"https://accounts.google.com/o/oauth2/v2/auth","token_url":"https://www.googleapis.com/oauth2/v4/token","issuer_url":"https://login.microsoftonline.com"}]'

[vinckr]

Thanks for supplying your solution @willemruys
I will see to add it to the documentation as example 🙌

[willemruys]

@vinckr I've created a PR that adds this example to the oidc docs.