Kong / Kong/developer.konghq.com

Add an overview page for the OpenID Connect policy

Open
#6,393 1 comment 0 reactions 1 assignee View on GitHub

@cloudjumpercat is already working on this.

Since Sep 14, 2026.

internal product:ai-gateway
Dominant language
Ruby
Stars
28
Forks
121
Avg merge
1d 4h
Merged PRs (30d)
313

Description

Migrate or rewrite the OpenID Connect AI Gateway Policy page (app/_ai_gateway_policies/openid-connect/index.md) to include the overview content from the corresponding plugin page: https://developer.konghq.com/plugins/openid-connect/

Update:

Definition of done:

Draft brain dump

  • Need to fix anything on the AI Auth Strategies page that says anonymous (the strict param, not the concept) Consumers are supported. They don't seem to be in the schema, although you can allow unauthed requests.
  • Need to fix anything on the AI Auth Strategies and identify-ai-consumers-with-kong-identity.md that implies the request termination policy is automatic. We need to clarify that this is done under the hood and that this is the default set up. When consumer_optional: true or error_on_miss: false, valid tokens that don't match a consumer/principal are allowed, but again, those aren't the default.
  • Authentication types makes it seem too much like "pick one or the other" when this isn't always true. The notes and info about how you can configure both on one auth strategy should be here. As well as info about why you might want both on an auth strategy.

OIDC new page outline
Notes:

  • Needs the relevant content from https://developer.konghq.com/plugins/openid-connect/#multi-idp-support that we confirmed is supported in the AIGW 2.0 schema. But "OIDC plugin" type references should be something like "OpenID Connect auth strategy".
  • Will also need backlinks to and from the auth strategies page, and also possibly AI Models/AI MCP servers/AI agents pages as well if those reference OIDC auth strategy.

Title: OpenID Connect authentication with {{site.ai_gateway}} 2.0

Intro paragraph (adapted from the OIDC plugin page + what does OIDC do? from the original plugin page)

How it works

Need an explanation here of how this works in AIGW 2.0 with auth strategies and how those are applied to different entities. Also an explanation of the autotermination vs allowing a consumer or principal with the right token to pass through. Maybe also need to talk about how this interacts with ACLs.

Supported flows and grants

We need to carry over the flow descriptions in the middle along with their diagrams for just the flows etc. that AIGW 2.0 supports. For the flows that are and aren't supported, provide the proof from the schema source.

?

I'm not sure if FAPI or some of the other sections apply to AIGW 2.0, like token exchange, multi-IdP, multiple clients, Redis cloud authn. For all those sections, you must state your schema source about why it is or isn't supported. and then only add the ones that you can confirm are supported from the schema source.

Examples

I'm thinking that for the ones that are supported, we might want to port over some of the supported examples that are in https://developer.konghq.com/plugins/openid-connect/examples/. This section would be configured like https://developer.konghq.com/metering-and-billing/metering/#example-meter-use-cases except all the examples would just be in kongctl format. So you will need to migrate the supported ones and use the AIGW 2.0 schema to update the examples to the AIGW 2.0 auth strategy format. For those that relate to a particular flow, don't forget to link in the example prose to the description of the flow earlier.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.