OAuth 2.0 on Spinnaker

Azure

Mon, 01 Jan 0001 00:00:00 +0000

This page instructs you on how to obtain an OAuth 2.0 client ID and client secret for use with your Microsoft Azure tenant. More extensive documentation is available on Microsoft’s site .

Setting up an Azure Application Registration

Navigate to https://portal.azure.com and log in with your Azure credentials.
On the left hand navigation pane, click “Azure Active Directory” –> “App registrations”.
Click “New application registration”, and fill in the details:
- Name of the application: (eg Spinnaker),
- Application type: Web app / API
- Sign-on URL: https://localhost:8084/login/oauth2/code/azure (replace localhost with your Gate address if known, and https with http if appropriate). For Spinnaker below v2025.2.0, it should be just https://localhost:8084/login
- Click “Create”
Note the “Application ID”, this is the client ID. Copy it to a safe place.
Click “Settings” -> “Keys”. Under “Passwords”, add a Key Description (eg Spinnaker), set the expiry and then click “Save”. “Value” will now be populated. This is your client secret; copy it to a safe place.

Configure Gate

Current configurations

Add the following to gate-local.yml. Note the Tenant ID of your organization is required for Azure OAuth 2.0 login. To obtain it:

G Suite

Mon, 01 Jan 0001 00:00:00 +0000

This page instructs you on how to obtain an OAuth 2.0 client ID and client secret for use with your G Suite organization (previously known as Google Apps for Work).

Get client ID and secret

Navigate to https://console.developers.google.com/apis/credentials .
Click “Create credentials” –> OAuth client ID.
Select “Web Application”, and enter a name.
Under “Authorized redirect URIs”, add https://localhost:8084/login/oauth2/code/google (For Spinnaker below v2025.2.0, it should be https://localhost:8084/login), replacing domain with your Gate address, if known, and https with http if appropriate. Click Create.
Note the generated client ID and client secret. Copy these to a safe place.

GitHub Organizations

Mon, 01 Jan 0001 00:00:00 +0000

WARNING

IF YOU ARE NOT CAREFUL you can configure spinnaker to allow ANY github user, not just the ones in your organization access to spinnaker. As such, please make sure to set the restrictions as appropriate for your org! Specifically spring.security.oauth2.client.registration.github.provider-requirements restriction to limit access to a specific github org! Failure to set this places your spinnaker installation at risk of unintended access! For this to work, your users MUST be public members to validate their membership in the github organization.

Oracle Cloud

Mon, 01 Jan 0001 00:00:00 +0000

Configuring Oracle Cloud OAuth 2.0

Consult the Oracle Cloud Documentation to set up OAuth 2.0 and obtain a client ID and client secret.

Note: While registering the application in Oracle Cloud OAuth 2.0, application redirect URI that should be used is https://localhost:8084/login/oauth2/code/oracle (For Spinnaker below v2025.2.0, it should be https://localhost:8084/login)

Configure Gate

Add the following to gate-local.yml

spring:
  security:
    oauth2:
      client:
        registration:
          userInfoMapping:
            email: ''
            firstName: given_name
            lastName: family_name
            username: preferred_username
          oracle:
            client-secret: <client-secret>
            scope: openid,urn:opc:idm:__myscopes__
            client-id: <client-id>
            redirect-uri: https://<your-domain>/login/oauth2/code/<providerid-aka-google>
        provider:
          oracle:
            user-info-uri: https://idcs-${idcsTenantId}.identity.oraclecloud.com/oauth2/v1/userinfo
            authorization-uri: https://idcs-${idcsTenantId}.identity.oraclecloud.com/oauth2/v1/authorize
            token-uri: https://idcs-${idcsTenantId}.identity.oraclecloud.com/oauth2/v1/token

For versions prior to 2025.2.0

Add the following to gate-local.yml