Authentication

Users log in to Cockpit through an OpenID Connect (OIDC) provider, for example Keycloak. Register a confidential client for Cockpit with the redirect URI <base URL>/api/auth/callback/oidc.

auth:
  baseUrl: https://cockpit.example.com (1)
  oidc:
    discoveryUrl: https://keycloak.example.com/realms/sdp/.well-known/openid-configuration
    clientId: cockpit
    clientSecret:
      secretKeyRef:
        name: cockpit
        key: oidc-client-secret
    extraScopes: [] (2)
sessionSecret:
  secretKeyRef:
    name: "" (3)

1	The URL users open in the browser.
2	Scopes requested in addition to `openid`, `profile` and `email`.
3	The secret that signs session cookies. If empty, the chart generates a Secret (`cockpit-session` for the release `cockpit`) and keeps it across `helm upgrade`. Set it explicitly when deploying with `helm template` or Argo CD. They cannot read the existing Secret, so every deployment would generate a new one and log out all users.

The OIDC claim that becomes the Trino user is configured in the Trino module.

With auth.oidc.enabled: false, Cockpit has no login and all visitors share one anonymous user. Use this only for local testing.