Configure GiiS with OpenID Connect (OIDC) authentication. Available with common identity providers such as Okta and Microsoft Entra ID (Azure AD).

This guide will walk you through the setup process for Okta. Other identity providers will have a similar process. Please contact us if you need help with a different identity provider.

Guide

Create Okta Application

Navigate to the Okta Admin Console → Applications → Create App Integration.

Configure Okta Application

Select OIDC and Web Application.

Name your application `GiiS`.

::: tip
  If you are white-labeling GiiS, you can freely name your application.

:::

Add a **Sign-in redirect URI**

  ```
  https://YOUR_GIIS_DOMAIN.com/auth/oidc/callback
  ```

Determine whether all users or select groups may access GiiS or skip this step and assign users later.

Save OIDC Credentials

Create the new Application and save the Client ID and Client Secret.

Also note your **Okta Base URL** in the format of `https://.okta.com`.


::: info
  After saving your application,
  you can upload the GiiS logo or your white-labeled logo by clicking the gear icon next to the app title **GiiS**

Configure GiiS for OIDC

Configure GiiS with the following environment variables in your .env or values.yaml file (Docker and Kubernetes, respectively).

  ```bash .env
  AUTH_TYPE=oidc
  OAUTH_CLIENT_ID=
  OAUTH_CLIENT_SECRET=
  OPENID_CONFIG_URL=https:///.well-known/openid-configuration
  ```

::: info

If you're using Docker but don't have a .env file, copy giis/deployment/docker_compose/env.prod.template to a new .env file in the same directory. :::

  ```bash values.yaml
  auth:
     secrets:
        OAUTH_CLIENT_ID: 
        OAUTH_CLIENT_SECRET:
  configMap:
     AUTH_TYPE: oidc
     OPENID_CONFIG_URL: https:///.well-known/openid-configuration
  ```

Customizing requested scopes

By default, GiiS uses the standard OIDC base scopes when redirecting users to the identity provider. You can override this list with OIDC_SCOPE_OVERRIDE, a comma-separated list of scopes to request instead. This is primarily useful when the access token issued at login should be passed through to tool calls that need additional scopes from the identity provider.

OIDC_SCOPE_OVERRIDE=openid,email,profile,groups

GiiS will always also request offline_access so refresh tokens are issued, even if it is not in the override list.

WARNING

The override replaces the default scopes — make sure openid, email, and profile are still included if you want standard login to keep working.

Any scopes you add here must also be enabled on the application in your identity provider. GiiS only changes what is sent in the authorize request; the IdP still rejects scopes that are not configured for the client.

:::

Enabling PKCE

PKCE is disabled by default to preserve backwards compatibility with existing OIDC deployments. To enable it, set:

OIDC_PKCE_ENABLED=true