# keenauth_connection_oidc_config

The `keenauth_connection_oidc_config` resource sets the relying party configuration of an enterprise OIDC connection: the identity provider's issuer, the client ID registered there, the client authentication method, the provider profile and the client secret.

## The client secret is write-only

`client_secret_wo` is a write-only argument. The provider sends it to the API and never writes it to state or plan files, and the API never returns it. Write-only arguments need OpenTofu 1.11 or Terraform 1.11 or later. An older version rejects the configuration before anything is sent; set the secret with `keenauth connections oidc put` instead.

Give the secret from an ephemeral variable, so that OpenTofu does not store it in the plan either:

```terraform
variable "corp_idp_client_secret" {
  type      = string
  sensitive = true
  ephemeral = true
}

resource "keenauth_connection" "corp" {
  key      = "corp-oidc"
  type     = "enterprise"
  strategy = "oidc"
  name     = "corp-oidc"
}

resource "keenauth_connection_oidc_config" "corp" {
  connection_id      = keenauth_connection.corp.id
  sp_host            = "acme.eu.keenauth.app"
  issuer             = "https://login.idp.example.com"
  client_id          = "keenauth-rp"
  client_auth_method = "client_secret_basic"

  client_secret_wo         = var.corp_idp_client_secret
  client_secret_wo_version = 1
}
```

Register `redirect_uri` (`https://<sp_host>/sso/<connection_id>/callback`) at the identity provider. If your identity provider supports it, prefer `client_auth_method = "private_key_jwt"`: the environment's key signs the client assertion and there is no secret at all.

## Rotation

The provider cannot read the secret back, so it cannot see a change to it. It sends `client_secret_wo` when the resource is created and whenever `client_secret_wo_version` changes. To rotate, put the new secret in place and increase the version in the same change.

`client_secret_expires_at` is a reminder of when the identity provider invalidates the secret. The API writes it only together with the secret, so change it in the same change as the version.

## Rules checked at plan time

| Rule | Why |
|---|---|
| `client_secret_wo` is not allowed with `private_key_jwt`. | That method uses no secret; switching to it deletes the stored secret. |
| A `client_secret_*` method needs `client_secret_wo` on create, and a new version when no secret is stored. | The identity provider would reject the token request. |
| `sp_host` cannot change after the first write. | The callback is frozen when the configuration is first written. |
| `entra_tenant_id` is required with `provider_profile = "entra"` and allowed only there. | The API rule. |
| `client_secret_expires_at` is UTC with whole seconds, for example `2027-01-31T00:00:00Z`. | The API returns it in this form; another form would show a difference on every plan. |

## Import and destroy

Import with the connection ID. The API does not return `sp_host`, `entra_tenant_id` or the secret, so the next plan writes the configuration once with the values of your configuration.

The API has no delete for this configuration. Destroying the resource only removes it from state; the configuration is deleted together with its connection.