Configure the OIDC auth method to authenticate users via an external identity provider (Keycloak or DEX). Users log in through the IdP's web flow and receive an OpenBao token with policies mapped from OIDC claims and groups.
Prerequisites checklist
Confirm these before running steps:
1Enable the OIDC auth method
bao auth enable oidc→ Success! Enabled oidc auth method at: oidc/
2Configure OIDC with the identity provider details
full example in the Commands / YAML tab
3Create a role mapping OIDC claims to policies
Defines which redirect URIs are allowed and which token claims become the OpenBao username and groups.
bao write auth/oidc/role/default \
bound_audiences=openbao \
allowed_redirect_uris=https://openbao.apps.<cluster name>/ui/vault/auth/oidc/oidc/callback \
allowed_redirect_uris=http://localhost:8250/oidc/callback \
user_claim=preferred_username \
groups_claim=groups \
policies=default \
token_ttl=1h \
token_max_ttl=24h4Map OIDC groups to OpenBao policies via external groups
Ties the Keycloak group claim to an OpenBao identity group that carries policies.
Step 1 Read the OIDC mount accessor (needed to bind the alias to this auth method):
ACCESSOR=$(bao auth list -format=json | jq -r '."oidc/".accessor')Step 2 Create an external identity group and attach the
admin policy:bao write identity/group/name/admins type=external policies=adminStep 3 Read that group's ID:
GROUP_ID=$(bao read -field=id identity/group/name/admins)Step 4 Create a group alias —
name must match the Keycloak group (openbao-admins):bao write identity/group-alias name=openbao-admins mount_accessor=$ACCESSOR canonical_id=$GROUP_ID→ Users in Keycloak group openbao-admins get the admin policy on OIDC login
5Test OIDC login via the CLI
bao login -method=oidc role=default→ Browser opens IdP login;
→ Log in with the user (
bao-admin) and the password you set in PRE-10→ Returns OpenBao token on success
6Test OIDC login via the UI
Open the OpenBao Route and select OIDC as the auth method
→ Login redirects to the IdP; token policies match group mapping