Configure Mission Control to use OpenID Connect (OIDC) for authentication

Mission Control can use the OpenID Connect (OIDC) or Lightweight Directory Access Protocol (LDAP) protocols for authentication. This topic explains how to configure the OIDC setup. See Configure Mission Control to use LDAP for the other supported authentication protocol.

Prerequisites

An instance of Mission Control, installed on your own Kubernetes cluster. See plan your installation.
A downloaded Mission Control license file.

Mission Control requires a license file to provide Kubernetes Off-The-Shelf (KOTS) or Helm with required information for installation. Information includes customer identifiers, software update channels, and entitlements.

Contact your IBM sales representative or IBM Support to request a license.

If you need a replacement license file or a non-community edition, or want to convert your Public Preview license to use a stable channel release version, contact your account team.
A prepared Mission Control environment on an existing Kubernetes cluster
Reference the OIDC configuration, connector fields and values information.

Configure Mission Control to use OIDC for authentication

To configure Mission Control to use OIDC for authentication, follow the steps for your installation type.

Enable OIDC for a KOTS installation

Access the KOTS admin console.
Edit the Mission Control configuration and enable the OIDC connector.

Complete the Authentication and Connector sections by providing your environment’s OIDC settings.

When you use Ingress to access Mission Control, you must configure the baseUrl in the Authentication section to match your Ingress hostname. For example, https://mission-control.example.com. This is required for OIDC authentication to function correctly.

See the Dex OIDC connector documentation for available fields and their descriptions.

Deploy the new configuration.
Navigate to the Mission Control UI, and then click Sign in with OpenID Connect to test the connection.
Optional: Remove the admin user in the Mission Control configuration to remove the Sign in with Email option.

Enable OIDC for a Helm installation

Configure the OIDC connector in your values.yaml file under the dex section:

dex:
  config:
    connectors:
      - type: oidc
        id: oidc
        name: OpenID Connect
        config:
          # Add your OIDC configuration here

See the Dex OIDC connector documentation for available fields and their descriptions.

Apply the updated configuration:

helm upgrade mission-control ./mission-control -f values.yaml

Navigate to the Mission Control UI, and then click Sign in with OpenID Connect to test the connection.
Optional: Remove the admin user in the Mission Control configuration to remove the Sign in with Email option.

Configure Mission Control to use OpenID Connect (OIDC) for authentication

Prerequisites

Configure Mission Control to use OIDC for authentication

Enable OIDC for a KOTS installation

Enable OIDC for a Helm installation

Was this helpful?

Give Feedback