OAuth2 Client Management

Kaniop manages OAuth2 client registrations in your Kanidm cluster using the KanidmOAuth2Client Custom Resource. This enables secure application integration with your identity provider.

Basic OAuth2 Client

Here’s a simple OAuth2 client configuration. You can reference the complete example at examples/oauth2.yaml:

# Basic configuration - see examples/oauth2.yaml for all options
apiVersion: kaniop.rs/v1beta1
kind: KanidmOAuth2Client
metadata:
  name: my-webapp
  namespace: default
spec:
  kanidmRef:
    name: my-idm
  displayName: My Web Application
  origin: https://myapp.example.com
  redirectUrl:
    - https://myapp.example.com/oauth2/callback

This will create an Oauth2 client secret named my-webapp-kanidm-oauth2-credentials in the same namespace as the OAuth2 client.

Refresh token lifetime

Kanidm refresh tokens expire after 16 hours by default. For clients that stay idle for longer periods, such as desktop sync applications, set spec.refreshTokenExpiry to a positive number of seconds:

spec:
  refreshTokenExpiry: 7776000 # 90 days

When configured, Kaniop reconciles this lifetime and restores it if changed directly in Kanidm. If omitted, Kaniop does not manage the attribute: existing values are left untouched, and new clients use Kanidm’s default. Removing the field later also leaves its last value in Kanidm; it does not reset it to the default. You can reset it using the Kanidm CLI if needed.

Longer refresh-token lifetimes increase exposure if a token is stolen. The OAuth2 session remains subject to other Kanidm session and account policies.

Kaniop Documentation

OAuth2 Client Management

Basic OAuth2 Client

Refresh token lifetime