K8SPSMDB-1534 add oidc docs#344
Open
nmarukovich wants to merge 5 commits into
Open
Conversation
nmarukovich
commented
Jun 24, 2026
|
|
||
| The flow has been tested with Okta, Microsoft Entra ID, Ping Identity, and Keycloak. The IdP configuration is out of scope of this document. Please refer to [Percona Server for MongoDB documentation :octicons-link-external-16:](https://docs.percona.com/percona-server-for-mongodb/latest/oidc.html) and upstream documentation of your IdP for the configuration guidelines. | ||
|
|
||
| Use OIDC authentication only for application level users. The Operator's system users (`clusterAdmin`, `clusterMonitor`, the backup user, and others) authenticate with SCRAM. Therefore, keep `SCRAM-SHA-256` together with `MONGODB-OIDC` authentication mechanisms in Percona Server for MongoDB configuration. Remonong the SCRAM authentication mechanism locks the Operator out of the cluster. |
Contributor
Author
There was a problem hiding this comment.
Remonong -> removing?
nmarukovich
commented
Jun 24, 2026
|
|
||
| On the Microfost Entra side, you need to complete the following steps as part of your IdP setup: | ||
|
|
||
| - Create and configure an OIDC application with Okta |
nastena1606
force-pushed
the
K8SPSMDB-1534_oidc
branch
from
June 24, 2026 09:58
3c0a30c to
6a020e8
Compare
Contributor
Author
|
lgtm |
nastena1606
marked this pull request as ready for review
June 24, 2026 10:05
nastena1606
requested review from
egegunes,
eleo007,
gkech,
hors,
jvpasinatto,
mayankshah1607,
nastena1606,
pooknull and
valmiranogueira
as code owners
June 24, 2026 10:05
Contributor
There was a problem hiding this comment.
Pull request overview
Adds end-user documentation for configuring OpenID Connect (OIDC) authentication with Percona Server for MongoDB when managed by the Percona Operator for MongoDB, and exposes it in the MkDocs navigation.
Changes:
- Added a new HOWTO page documenting OIDC setup for several identity providers (Okta, Microsoft Entra ID, Ping Identity, Keycloak), plus role mapping, login flow, and limitations.
- Linked the new OIDC documentation page from the HOWTOs navigation.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.
| File | Description |
|---|---|
| mkdocs-base.yml | Adds the new “OIDC integration” entry to the HOWTOs nav so the page is discoverable. |
| docs/oidc.md | Introduces the new OIDC integration guide, including provider-specific configuration examples and operational limitations. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| OpenID Connect (OIDC) is an identity authentication protocol built on top of the OAuth 2.0 framework. OIDC is designed to verify user identities and provide authentication, ensuring that users are who they claim to be. OAuth 2.0 is used for user authorization to access resources. | ||
|
|
||
| If your organization already uses an identity provider (IdP) such as Okta or Microsoft Entra ID, you can connect Percona Server for MongoDB to it through OpenID Connect (OIDC). This lets your users to sign in with familiar corporate credentials while you can manage user credentials, access policies and roles in a centralized place - on the IdP side. |
|
|
||
| === "Microsoft Entra ID" | ||
|
|
||
| On the Microfost Entra side, you need to complete the following steps as part of your IdP setup: |
Comment on lines
+165
to
+167
| On the Keykloak side, you need to complete the following steps as part of your IdP setup: | ||
|
|
||
| * Create a new realm in KeyCloak |
Comment on lines
+59
to
+63
| Once the IdP is configured, add the following to the `configuration` field. | ||
|
|
||
| This example shows the configuration for database Pods. | ||
| For instructions on how to configure a sharded cluster, refer to the [Where to add OIDC configuration](#where-to-add-oidc-configuration) section above. | ||
|
|
Comment on lines
+177
to
+179
| Once it is configured, the following Percona Server for MongoDB configuration to the `configuration` field of the Custom Resource. | ||
|
|
||
| This example shows the configuration for database Pods. For instructions on how to configure a sharded cluster, refer to the [Where to add OIDC configuration](#where-to-add-oidc-configuration) section above. |
Comment on lines
+236
to
+238
| ```json | ||
| db.runCommand({connectionStatus:1}) | ||
| ``` |
|
|
||
| !!! important | ||
|
|
||
| When using Keycloak, you must provide the certificate signed by the trusted CA. Otherwise, Percona Server for MongoDB cannot verify the connection and login attempts fail. See [Limitations](#limitations). |
nastena1606
added
the
pending release
egegunes
approved these changes
Jul 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.