Skip to main content

Identity providers

An identity provider record describes an upstream service that a connector authenticates against. This is separate from platform sign-in:

  • Your corporate identity provider signs users in to the platform. It is set once at install time. See Configure identity.
  • Connector identity providers let the Connector Gateway broker OAuth to upstream services.

Where to find them​

In the admin console, go to Identity providers.

The corporate provider appears here, read-only​

The console lists the corporate identity provider as a read-only record sourced from platform configuration. To change it, update the platform values and upgrade the release.

At startup, the directory copies its client secret into managed-secret storage. Restart the directory after rotating the source Secret.

If the directory cannot store the secret, it logs the error and omits the provider record while continuing to serve other directory operations.

Register a provider​

Create a managed secret for the client secret, or allowlist a Kubernetes Secret that holds it in enterprise-manager.directory.kubernetesSecretRefs.allowed. Then add the provider's issuer or OAuth endpoints, the client identifier, and the secret reference. A provider that needs extra parameters on its authorization request takes them under Additional authorization parameters: for example, Google issues refresh tokens only with access_type=offline and prompt=consent.

The console displays the callback derived from the Connector Gateway issuer: {issuer}/oauth/callback. Register this URI in the upstream provider's OAuth application. A mismatch causes the upstream provider to reject authorization.

Once registered, a provider becomes selectable when you configure a connector's authentication.

Create a provider from the connector wizard​

When you add a connector whose MCP server uses OAuth, the setup wizard reads the server's metadata. If one of your providers already serves its authorization server, the wizard offers it under Choose an identity provider. Otherwise, the Set up an identity provider step drafts a new OAuth2 provider with the authorization URL, token URL, and scopes filled in. Add any Additional authorization parameters the provider needs, then set up its client:

  • If the authorization server supports dynamic client registration (DCR), the gateway registers its own client from the Discovery URL, so you don't need a client ID or secret.
  • Otherwise, enter the Client ID of the OAuth app you registered with the provider, and choose the Client secret from a managed secret or an allowlisted Kubernetes Secret. New secret creates a managed secret without leaving the wizard.

The wizard creates the provider when you finish, and it appears under Identity providers for other connectors to use.

Next steps​