OpenID Connect (OIDC) is an identity verification protocol that allows users to securely sign in to applications using trusted identity providers (IdPs) such as Google, Microsoft, Okta, and Auth0. OIDC is built on top of OAuth 2.0, adding an authentication layer that enables applications to verify user identities while also obtaining authorization tokens. By enforcing OIDC authentication at the network edge, you can: 🔐 Ensure only authenticated users can access your services.
⚡ Offload authentication to a trusted provider, simplifying backend logic.
🛡 Enhance security by requiring identity verification before forwarding requests.

​
🔍 What are the Benefits of Using OIDC for Authentication?

OIDC provides secure, standardized authentication that integrates seamlessly with modern identity providers. It enables single sign-on (SSO), multi-factor authentication (MFA), and user identity verification. Key Benefits:
  • User Authentication & Identity Verification: Verify who is accessing your service, not just what permissions they have.
  • Seamless Single Sign-On (SSO): Allow users to sign in once and access multiple applications.
  • Supports Major Identity Providers: Works with Google, Microsoft, Okta, Auth0, and other IdPs.
  • Enhances Security: Enforces secure login flows, multi-factor authentication (MFA), and token-based verification.
  • Reduces Backend Complexity: Authentication happens before requests reach your application, eliminating the need for custom auth logic.

​
OIDC Examples

The following examples show how to provide your app with an authentication step. When you create your own OIDC app, you must specify a ‘Callback URL’ or ‘Redirect URL’ to the OIDC provider. When using ngrok’s OIDC action, that Callback URL is always: 
https://idp.ngrok.com/oauth2/callback
Check out the OIDC traffic policy action page for more details about how it functions and the parameters it accepts. Consult the list of supported providers for step-by-step integration guides for each. 
apiVersion: ngrok.k8s.ngrok.com/v1alpha1
kind: AgentEndpoint
metadata:
name: example-agent-endpoint
spec:
url: https://example-hostname.ngrok.io
upstream:
  url: http://my-service.my-namespace:8080
trafficPolicy:
  inline:
    on_http_request:
      - actions:
          - type: openid-connect
            config:
              issuer_url: "{your issuer url}"
              client_id: "{your app's oauth client id}"
              client_secret: "{your app's oauth client secret}"
              scopes:
                - openid
                - profile
                - email