When we add an OIDC provider to the config for a database via the Admin API it doesn’t seem to work. However, when we add the same configuration to the sync_gateway.json and restart the sync gateway it seems to actually use the config.
Example config:
"oidc": {
"providers": {
"auth0": {
"issuer": "https://<issuer url goes here>/",
"client_id": "<client id goes here>,
"validation_key": "<validation key goes here>",
"register": true,
"username_claim": "email",
"IsDefault": true,
"InsecureSkipVerify": true
}
}
},
When we use the PUT on the _config endpoint on the API gateway and attempt to authenticate with OIDC and then attempt to create a session hitting the _session endpoint (on the public API), we get the following output in the logs:
2021-01-27T17:31:11.036Z [INF] HTTP: #16232: POST /cbc-dev-data/_session (as GUEST)
2021-01-27T17:31:11.037Z [INF] HTTP: #16232: --> 401 Invalid login (1.4 ms)
However, when we restart the sync gateway with that same config in the actual json file (i.e. not submitted through the admin API) and then hit the session creation endpoint on the public API, we get the following output:
2021-01-27T17:48:14.055Z [DBG] Auth+: AuthenticateUntrustedJWT called with token:
This seems to indicate that the OIDC configuration is only used when it is directly in the config file and cannot be defined via the Admin API on the sync gateway. Is that correct?