OIDC via Gateway

Authentication via Gateway

By default, OIDC authentication is handled by the Akeyless SaaS authentication service: the
browser and the Identity Provider (IdP) complete the authorization code flow against
https://auth.akeyless.io, and the Akeyless Gateway is not part of the login flow.

Authentication via Gateway moves that flow to your own
Akeyless Gateway. When it is enabled on an OIDC
Authentication Method, the IdP and the client communicate with the Gateway instead of the SaaS
authentication service, and the Gateway completes the callback and issues the Akeyless token.

Use this option when the login flow must stay inside your network — for example when the IdP is
not reachable from the internet, when corporate policy forbids redirecting users to a SaaS
callback endpoint, or in air-gapped and offline-oriented deployments where the SaaS authentication
service is not reachable from the client.

Prerequisites

• An Akeyless Gateway reachable from the client over HTTPS at its
  Configuration Manager address (default port 8000), referred to below as https://<Your-Akeyless-GW-URL>:8000.
  See TLS Settings for enabling HTTPS on the
  Gateway.
• Admin permission on the target Gateway. Enabling or changing the Gateway binding on an
  Authentication Method modifies the Gateway configuration, so it requires the Admin capability in
  the Gateway's access permissions. See
  Gateway Access Permissions Reference
  and Authentication and Access.
• Administrative access to the IdP application, so its redirect URI can be repointed to the
  Gateway.

Enable Authentication via Gateway

1. Open the Gateway Configuration Manager UI at https://<Your-Akeyless-GW-URL>:8000.
2. Navigate to the OIDC Authentication Method (or create a new one).
3. Enable the Enable Gateway Authentication option.
4. Select the Gateway cluster that should own the authentication flow.
5. Save.

Configure the IdP

Point the IdP application at the Gateway instead of the Akeyless SaaS callback. Replace
https://<Your-Akeyless-GW-URL>:8000 with your Gateway Configuration Manager URL.

Configure Allowed Redirect URIs

Allowed Redirect URIs (--allowed-redirect-uri in the CLI) controls where the client is sent
after a successful IdP login. This is separate from the IdP callback URL configured above, and
the Gateway addresses used by your clients must appear in this list.

Sign in with the CLI

The CLI must be told explicitly to authenticate through the Gateway. Pass --gateway-url with the
Gateway Configuration Manager URL:

akeyless auth \
  --access-type oidc \
  --access-id <OIDC Access ID> \
  --gateway-url https://<Your-Akeyless-GW-URL>:8000

Troubleshooting