keenauth_connection_oidc_config

The keenauth_connection_oidc_config resource sets the relying party configuration of an enterprise OIDC connection: the identity provider's issuer, the client ID registered there, the client authentication method, the provider profile and the client secret.

The client secret is write-only

client_secret_wo is a write-only argument. The provider sends it to the API and never writes it to state or plan files, and the API never returns it. Write-only arguments need OpenTofu 1.11 or Terraform 1.11 or later. An older version rejects the configuration before anything is sent; set the secret with keenauth connections oidc put instead.

Give the secret from an ephemeral variable, so that OpenTofu does not store it in the plan either:

variable "corp_idp_client_secret" {
  type      = string
  sensitive = true
  ephemeral = true
}

resource "keenauth_connection" "corp" {
  key      = "corp-oidc"
  type     = "enterprise"
  strategy = "oidc"
  name     = "corp-oidc"
}

resource "keenauth_connection_oidc_config" "corp" {
  connection_id      = keenauth_connection.corp.id
  sp_host            = "acme.eu.keenauth.app"
  issuer             = "https://login.idp.example.com"
  client_id          = "keenauth-rp"
  client_auth_method = "client_secret_basic"

  client_secret_wo         = var.corp_idp_client_secret
  client_secret_wo_version = 1
}

Register redirect_uri (https://<sp_host>/sso/<connection_id>/callback) at the identity provider. If your identity provider supports it, prefer client_auth_method = "private_key_jwt": the environment's key signs the client assertion and there is no secret at all.

Rotation

The provider cannot read the secret back, so it cannot see a change to it. It sends client_secret_wo when the resource is created and whenever client_secret_wo_version changes. To rotate, put the new secret in place and increase the version in the same change.

client_secret_expires_at is a reminder of when the identity provider invalidates the secret. The API writes it only together with the secret, so change it in the same change as the version.

Rules checked at plan time

Rule	Why
`client_secret_wo` is not allowed with `private_key_jwt`.	That method uses no secret; switching to it deletes the stored secret.
A `client_secret_*` method needs `client_secret_wo` on create, and a new version when no secret is stored.	The identity provider would reject the token request.
`sp_host` cannot change after the first write.	The callback is frozen when the configuration is first written.
`entra_tenant_id` is required with `provider_profile = "entra"` and allowed only there.	The API rule.
`client_secret_expires_at` is UTC with whole seconds, for example `2027-01-31T00:00:00Z`.	The API returns it in this form; another form would show a difference on every plan.

Import and destroy

Import with the connection ID. The API does not return sp_host, entra_tenant_id or the secret, so the next plan writes the configuration once with the values of your configuration.

The API has no delete for this configuration. Destroying the resource only removes it from state; the configuration is deleted together with its connection.