Spinnaker – OAuth 2.0

Docs: Azure

Mon, 01 Jan 0001 00:00:00 +0000

This page instructs you on how to obtain an OAuth 2.0 client ID and client secret for use with your Microsoft Azure tenant. More extensive documentation is available on Microsoft’s site .

Setting up an Azure Application Registration

Navigate to https://portal.azure.com and log in with your Azure credentials.
On the left hand navigation pane, click “Azure Active Directory” –> “App registrations”.
Click “New application registration”, and fill in the details:
- Name of the application: (eg Spinnaker),
- Application type: Web app / API
- Sign-on URL: https://localhost:8084/login/oauth2/code/azure (replace localhost with your Gate address if known, and https with http if appropriate). For Spinnaker below v2025.2.0, it should be just https://localhost:8084/login
- Click “Create”
Note the “Application ID”, this is the client ID. Copy it to a safe place.
Click “Settings” -> “Keys”. Under “Passwords”, add a Key Description (eg Spinnaker), set the expiry and then click “Save”. “Value” will now be populated. This is your client secret; copy it to a safe place.

Configure Gate

Current configurations

Add the following to gate-local.yml. Note the Tenant ID of your organization is required for Azure OAuth 2.0 login. To obtain it:

Navigate to https://portal.azure.com and log in with your Azure credentials.
On the left hand navigation pane, click “Azure Active Directory” –> “Properties”.
“Directory ID” is your Tenant ID.

In order to pass the Tenant ID to gate, set it in the issuer-uri below

spring:
  security:
    oauth2:
      client:
        registration:
          azure:
            client-id: ${AZURE_CLIENT_ID}
            client-secret: ${AZURE_CLIENT_SECRET}
            scope: openid, profile, email
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/azure"
        provider:
          azure:
            issuer-uri: https://login.microsoftonline.com/${AZURE_TENANT_ID}/v2.0

For old versions of spinnaker, these would be added to `gate-local.yml`. These no longer work as of 2025.2.0

REMINDER: These configuration properties are no longer used in current releases. See the 2025.2.0 release notes for information on migrating to a current configuration like the above example

security:
  authn:
    oauth2:
      enabled: true
      client:
        clientId: # client ID from above
        clientSecret: # client secret from above
        accessTokenUri: https://login.microsoftonline.com/${azureTenantId}/v2.0/oauth2/token
        userAuthorizationUri: https://login.microsoftonline.com/${azureTenantId}/v2.0/oauth2/authorize
        clientAuthenticationScheme: query
        scope: profile
      # You may want to restrict access to your Spinnaker by adding
      # userInfoRequirements to further restrict access beyond beyond simply
      # requiring that users have a valid account in your Azure AD Tenant.
      userInfoRequirements: {}
      resource:
        userInfoUri: https://graph.windows.net/v1.0/me
      userInfoMapping:
        email: userPrincipalName
        firstName: givenName
        lastName: surname
      provider: AZURE

Docs: G Suite

Mon, 01 Jan 0001 00:00:00 +0000

This page instructs you on how to obtain an OAuth 2.0 client ID and client secret for use with your G Suite organization (previously known as Google Apps for Work).

Get client ID and secret

Navigate to https://console.developers.google.com/apis/credentials .
Click “Create credentials” –> OAuth client ID.
Select “Web Application”, and enter a name.
Under “Authorized redirect URIs”, add https://localhost:8084/login/oauth2/code/google (For Spinnaker below v2025.2.0, it should be https://localhost:8084/login), replacing domain with your Gate address, if known, and https with http if appropriate. Click Create.
Note the generated client ID and client secret. Copy these to a safe place.

Configure Gate

Spinnaker uses spring properties as seen in their documentation for configuring oauth2 today. Add the following properties to gate-local.yml

spring:
  security:
    oauth2:
      client:
        registration:
          userInfoMapping:
            email: email
            firstName: given_name
            lastName: family_name
          userInfoRequirements:
            hd: <domain>
          google:
            client-secret: <client-secret>
            scope: profile,email
            client-id: <client-id>
        provider:
          google:
            user-info-uri: https://www.googleapis.com/oauth2/v3/userinfo
            authorization-uri: https://accounts.google.com/o/oauth2/v2/auth
            token-uri: https://www.googleapis.com/oauth2/v4/token

Note that userInfoRequirements is a spinnaker specific extension to do validation on attributes from the user info. See the main oauth docs for more information.

For spinnaker versions before 2025.2.0

Though no longer supported, these would work on versions prior to 2025.2.0

security:
  authn:
    oauth2:
      enabled: true
      client:
        clientId: # client ID from above
        clientSecret: # client secret from above
        accessTokenUri: https://www.googleapis.com/oauth2/v4/token
        userAuthorizationUri: https://accounts.google.com/o/oauth2/v2/auth
        scope: profile,email # for Spinnaker below v2025.2.0, it should be "profile email" without double quotes
      resource:
        userInfoUri: https://www.googleapis.com/oauth2/v3/userinfo
      userInfoRequirements:
        # You almost certainly want to restrict access to your Spinnaker to
        # users whose account is from your hosted domain; without this any
        # user with a Google account will have access.
        hd: # hosted domain
      userInfoMapping:
        email: email
        firstName: given_name
        lastName: family_name
      provider: GOOGLE

Docs: GitHub Organizations

Mon, 01 Jan 0001 00:00:00 +0000

WARNING

IF YOU ARE NOT CAREFUL you can configure spinnaker to allow ANY github user, not just the ones in your organization access to spinnaker. As such, please make sure to set the restrictions as appropriate for your org! Specifically spring.security.oauth2.client.registration.github.provider-requirements restriction to limit access to a specific github org! Failure to set this places your spinnaker installation at risk of unintended access! For this to work, your users MUST be public members to validate their membership in the github organization.

It’s recommended to use something like keycloak to terminate and control access and federate access than directly using github authentication via spinnaker. OR an alternative SSO provider!

Setup

Get Client ID and Secret

Consult the GitHub OAuth 2.0 documentation and register a new OAuth 2.0 application to obtain a client ID and client secret.

Note: While registering the application in github, under “Authorized redirect URIs”, add https://localhost:8084/login/oauth2/code/github (For Spinnaker below v2025.2.0, it should be https://localhost:8084/login)

Configure Gate

Add to gate-local.yml the following configuration

spring:
  security:
    oauth2:
      client:
        registration:
          userInfoMapping:
            email: email
            firstName: ''
            lastName: name
            username: login
          github:
            client-secret: client-secret
            scope: user,email
            client-id: client-id
        provider:
          github:
            user-info-uri: https://api.github.com/user
            authorization-uri: https://github.com/login/oauth/authorize
            token-uri: https://github.com/login/oauth/access_token

For spinnaker before 2025.2.0

For older versions of spinnaker you’d have this configuration in gate-local.yml:

security:
  authn:
    oauth2:
      enabled: true
      client:
        clientId: # client ID from above
        clientSecret: # client secret from above
        accessTokenUri: https://github.com/login/oauth/access_token
        userAuthorizationUri: https://github.com/login/oauth/authorize
        scope: user,email # for Spinnaker below v2025.2.0, it should be "user:email" without double quotes
      resource:
        userInfoUri: https://api.github.com/user
      # You almost certainly want to restrict access to your Spinnaker by adding
      # userInfoRequirements; otherwise any user with a GitHub account will be
      # able to access it.
      userInfoRequirements: {}
      userInfoMapping:
        email: email
        firstName: ''
        lastName: name
        username: login
      provider: GITHUB

Docs: Oracle Cloud

Mon, 01 Jan 0001 00:00:00 +0000

Configuring Oracle Cloud OAuth 2.0

Consult the Oracle Cloud Documentation to set up OAuth 2.0 and obtain a client ID and client secret.

Note: While registering the application in Oracle Cloud OAuth 2.0, application redirect URI that should be used is https://localhost:8084/login/oauth2/code/oracle (For Spinnaker below v2025.2.0, it should be https://localhost:8084/login)

Configure Gate

Add the following to gate-local.yml

spring:
  security:
    oauth2:
      client:
        registration:
          userInfoMapping:
            email: ''
            firstName: given_name
            lastName: family_name
            username: preferred_username
          oracle:
            client-secret: <client-secret>
            scope: openid,urn:opc:idm:__myscopes__
            client-id: <client-id>
            redirect-uri: https://<your-domain>/login/oauth2/code/<providerid-aka-google>
        provider:
          oracle:
            user-info-uri: https://idcs-${idcsTenantId}.identity.oraclecloud.com/oauth2/v1/userinfo
            authorization-uri: https://idcs-${idcsTenantId}.identity.oraclecloud.com/oauth2/v1/authorize
            token-uri: https://idcs-${idcsTenantId}.identity.oraclecloud.com/oauth2/v1/token

For versions prior to 2025.2.0

Add the following to gate-local.yml

security:
  authn:
    oauth2:
      enabled: true
      client:
        clientId: # client ID from above
        clientSecret: # client secret from above
        accessTokenUri: https://idcs-${idcsTenantId}.identity.oraclecloud.com/oauth2/v1/token
        userAuthorizationUri: https://idcs-${idcsTenantId}.identity.oraclecloud.com/oauth2/v1/authorize
        scope: openid urn:opc:idm:__myscopes__
      resource:
        userInfoUri: https://idcs-${idcsTenantId}.identity.oraclecloud.com/oauth2/v1/userinfo
      # You may want to restrict access to your Spinnaker by adding
      # userInfoRequirements to further restrict access beyond simply requiring
      # that users have a valid account.
      userInfoRequirements: {}
      userInfoMapping:
        email: ''
        firstName: given_name
        lastName: family_name
        username: preferred_username
      provider: ORACLE

Spinnaker – OAuth 2.0

Docs: Azure

Setting up an Azure Application Registration

Configure Gate

Current configurations

For old versions of spinnaker, these would be added to gate-local.yml. These no longer work as of 2025.2.0

Docs: G Suite

Get client ID and secret

Configure Gate

For spinnaker versions before 2025.2.0

Docs: GitHub Organizations

WARNING

Setup

Get Client ID and Secret

Configure Gate

For spinnaker before 2025.2.0

Docs: Oracle Cloud

Configuring Oracle Cloud OAuth 2.0

Configure Gate

For versions prior to 2025.2.0

For old versions of spinnaker, these would be added to `gate-local.yml`. These no longer work as of 2025.2.0