Configure the OIDC authentication method

To configure the OIDC authentication method in HashiCorp Vault, you can Use a CLI command or Use the API. For the API method, you can use either HCP Vault Dedicated or HCP Vault.

Use a CLI command

This configuration uses the default oidc mount path. If you've created a custom path (for example, okta-oidc), then you need to update the path variable for the integration in Okta.

Run this command to make OIDC the default authentication method:
```
#!/bin/bash 
vault auth enable oidc
```

Run this command to create a role named vault-role-okta-default:

#!/bin/bash 
vault write auth/oidc/role/vault-role-okta-default \
	bound_audiences="$OKTA_CLIENT_ID" \
	allowed_redirect_uris="$VAULT_ADDR/ui/vault/auth/oidc/oidc/callback" \
	allowed_redirect_uris="http://localhost:8250/oidc/callback" \
	user_claim="sub" \
	token_policies="default"

Run this command to configure the OIDC authentication method:

#!/bin/bash 
vault write auth/oidc/config \
	oidc_discovery_url="https://$OKTA_DOMAIN" \
	oidc_client_id="$OKTA_CLIENT_ID" \
	oidc_client_secret="$OKTA_CLIENT_SECRET" \
	default_role="vault-role-okta-default"

In HCP Vault, the oidc_discovery_url, oidc_client_id, and oidc_client_secret are set to the variables that you configured in the previous section.

Run this command to view the enabled authentication methods:
```
#!/bin/bash 
vault auth list
```

Use the API

Complete these steps in either HCP Vault Dedicated or HCP Vault.

HCP Vault Dedicated

Send a request that enables the OIDC authentication method at the sys/auth/oidc endpoint:

curl --header "X-Vault-Token: $VAULT_TOKEN" \
	--header "X-Vault-Namespace: $VAULT_NAMESPACE" \
	--request POST \
	--data '{"type": "oidc"}' \
	$VAULT_ADDR/v1/sys/auth/oidc

Send a request that contains the vault-role-okta-default role definition:
```
#!/bin/bash 
tee vault-role-okta-default.json <<EOF
{
	"bound_audiences": "$OKTA_CLIENT_ID",
	"allowed_redirect_uris": [
		"$VAULT_ADDR/ui/vault/auth/oidc/oidc/callback",
		"http://localhost:8250/oidc/callback"
	],
	"user_claim": "sub",
	"token_policies": ["default"]
}
EOF
```
The allowed_redirect_uris in the request use the callback URLs that you defined in the previous section. The user_claim tells the app how to identify each unique user. See OpenID Connect and OAuth 2.0 for more information.

Send a request to set up the vault-role-okta-admin role:

curl --header "X-Vault-Token: $VAULT_TOKEN" \
	--header "X-Vault-Namespace: $VAULT_NAMESPACE" \
	--request POST \
	--data @vault-role-okta-default.json \
	$VAULT_ADDR/v1/auth/oidc/role/vault-role-okta-default

Send a request that contains the OIDC configuration definition:
```
tee oidc_config.json <<EOF
{
	"oidc_discovery_url": "https://$OKTA_DOMAIN",
	"oidc_client_id": "$OKTA_CLIENT_ID",
	"oidc_client_secret": "$OKTA_CLIENT_SECRET",
	"default_role": "vault-role-okta-default"
}
EOF
```
In HCP Vault, the oidc_discovery_url, oidc_client_id, and oidc_client_secret are set to the variables that you configured in the previous section. Also, the default_role is set to vault-role-okta-default.

Send a request that enables the OIDC authentication method:

curl --header "X-Vault-Token: $VAULT_TOKEN" \
	--header "X-Vault-Namespace: $VAULT_NAMESPACE" \
	--request POST \
	--data @oidc_config.json \
			$VAULT_ADDR/v1/auth/oidc/config

HCP Vault

Send a request that enables the OIDC authentication method at the auth/oidc endpoint:

curl --header "X-Vault-Token: $VAULT_TOKEN" \
	--request POST \
	--data '{"type": "oidc"}' \
	$VAULT_ADDR/v1/sys/auth/oidc

Send a request that contains the vault-role-okta-default role definition.

#!/bin/bash
tee vault-role-okta-default.json <<EOF
{
	"bound_audiences": "$OKTA_CLIENT_ID",
	"allowed_redirect_uris": [
	"$VAULT_ADDR/ui/vault/auth/oidc/oidc/callback",
	"http://localhost:8250/oidc/callback"
	],
	"user_claim": "sub",
	"token_policies": ["default"]
}
EOF

Send a request that creates the vault-role-okta-default role:

curl --header "X-Vault-Token: $VAULT_TOKEN" \
	--request POST \
	--data @vault-role-okta-default.json \
	$VAULT_ADDR/v1/auth/oidc/role/vault-role-okta-default

Send a request that contains the definition of the OIDC configuration:

#!/bin/bash
tee oidc_config.json <<EOF
{
	"oidc_discovery_url": "https://$OKTA_DOMAIN",
	"oidc_client_id": "$OKTA_CLIENT_ID",
	"oidc_client_secret": "$OKTA_CLIENT_SECRET",
	"default_role": "vault-role-okta-default"}
EOF

Send a request that enables the OIDC authentication method:

curl --header "X-Vault-Token: $VAULT_TOKEN" \
	--request POST \
	--data @oidc_config.json \
	$VAULT_ADDR/v1/auth/oidc/config

Next step

Configure groups and policies