Creating Amazon Verified Permissions OIDC identity sources

To create an OpenID Connect (OIDC) identity source

1. Open the Verified Permissions console. Choose your policy store.

2. In the navigation pane on the left, choose Identity sources.

3. Choose Create identity source.

4. Choose External OIDC provider.

5. In Issuer URL, enter the URL of your OIDC issuer. This is the service endpoint that provides the authorization server, signing keys, and other information about your provider, for example https://auth.example.com. Your issuer URL must host an OIDC discovery document at /.well-known/openid-configuration.

6. In Token type, choose the type of OIDC JWT that you want your application to submit for authorization. For more information, see Mapping OIDC tokens to schema.

7. In Map token claims to schema entities, choose a User entity and User claim for the identity source. The User entity is an entity in your policy store that you want to refer to users from your OIDC provider. The User claim is a claim, typically sub, from your ID or access token that holds the unique identifier for the entity to be evaluated. Identities from the connected OIDC IdP will be mapped to the selected principal type.

8. (Optional) In Map token claims to schema entities, choose a Group entity and Group claim for the identity source. The Group entity is a parent of the User entity. Group claims get mapped to this entity. The Group claim is a claim, typically groups, from your ID or access token that contains a string, JSON, or space-delimited string of user-group names for the entity to be evaluated. Identities from the connected OIDC IdP will be mapped to the selected principal type.

9. In validation - optional, enter the client IDs or audience URLs that you want your policy store to accept in authorization requests, if any.

10. Choose Create identity source.

11. (Optional) If your policy store has a schema, before you can reference attributes that you extract from identity or access tokens in your Cedar policies, you must update your schema to make Cedar aware of the type of principal that your identity source creates. That addition to the schema must include the attributes that you want to reference in your Cedar policies. For more information about mapping OIDC token attributes to Cedar principal attributes, see Mapping OIDC tokens to schema.

12. Create policies that use information from the tokens to make authorization decisions. For more information, see Creating Amazon Verified Permissions static policies.

1. Create a config.txt file that contains the following details of an OIDC IdP for use by the --configuration parameter of the create-identity-source command.

   {
       "openIdConnectConfiguration": {
           "issuer": "https://auth.example.com",
           "tokenSelection": {
                   "identityTokenOnly": {
                           "clientIds":["1example23456789"],
                           "principalIdClaim": "sub"
                   },
           },
           "entityIdPrefix": "MyOIDCProvider",
           "groupConfiguration": {
                 "groupClaim": "groups",
                 "groupEntityType": "MyCorp::UserGroup"
           }
       }
   }

2. Run the following command to create an OIDC identity source.

   $ aws verifiedpermissions create-identity-source \
       --configuration file://config.txt \
       --principal-entity-type "User" \
       --policy-store-id 123456789012
   {
       "createdDate": "2023-05-19T20:30:28.214829+00:00",
       "identitySourceId": "ISEXAMPLEabcdefg111111",
       "lastUpdatedDate": "2023-05-19T20:30:28.214829+00:00",
       "policyStoreId": "PSEXAMPLEabcdefg111111"
   }

3. (Optional) If your policy store has a schema, before you can reference attributes that you extract from identity or access tokens in your Cedar policies, you must update your schema to make Cedar aware of the type of principal that your identity source creates. That addition to the schema must include the attributes that you want to reference in your Cedar policies. For more information about mapping OIDC token attributes to Cedar principal attributes, see Mapping OIDC tokens to schema.

4. Create policies that use information from the tokens to make authorization decisions. For more information, see Creating Amazon Verified Permissions static policies.