Kong / Kong/developer.konghq.com
Add an overview page for the OpenID Connect policy
@cloudjumpercat is already working on this.
Since Sep 14, 2026.
- Dominant language
- Ruby
- Stars
- 28
- Forks
- 121
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 313
Description
Migrate or rewrite the OpenID Connect AI Gateway Policy page (app/_ai_gateway_policies/openid-connect/index.md) to include the overview content from the corresponding plugin page: https://developer.konghq.com/plugins/openid-connect/
Update:
Definition of done:
- Test how this works
- Migrate the information from the plugin page to the policy page
- Make sure there are no references to decK.
- Link to the overview page here https://release-ai-gateway-2-0--kongdeveloper.netlify.app/ai-gateway/entities/ai-identity-provider/
Draft brain dump
- Need to fix anything on the AI Auth Strategies page that says anonymous (the strict param, not the concept) Consumers are supported. They don't seem to be in the schema, although you can allow unauthed requests.
- Need to fix anything on the AI Auth Strategies and identify-ai-consumers-with-kong-identity.md that implies the request termination policy is automatic. We need to clarify that this is done under the hood and that this is the default set up. When
consumer_optional: trueorerror_on_miss: false, valid tokens that don't match a consumer/principal are allowed, but again, those aren't the default. - Authentication types makes it seem too much like "pick one or the other" when this isn't always true. The notes and info about how you can configure both on one auth strategy should be here. As well as info about why you might want both on an auth strategy.
OIDC new page outline
Notes:
- Needs the relevant content from https://developer.konghq.com/plugins/openid-connect/#multi-idp-support that we confirmed is supported in the AIGW 2.0 schema. But "OIDC plugin" type references should be something like "OpenID Connect auth strategy".
- Will also need backlinks to and from the auth strategies page, and also possibly AI Models/AI MCP servers/AI agents pages as well if those reference OIDC auth strategy.
Title: OpenID Connect authentication with {{site.ai_gateway}} 2.0
Intro paragraph (adapted from the OIDC plugin page + what does OIDC do? from the original plugin page)
How it works
Need an explanation here of how this works in AIGW 2.0 with auth strategies and how those are applied to different entities. Also an explanation of the autotermination vs allowing a consumer or principal with the right token to pass through. Maybe also need to talk about how this interacts with ACLs.
Supported flows and grants
We need to carry over the flow descriptions in the middle along with their diagrams for just the flows etc. that AIGW 2.0 supports. For the flows that are and aren't supported, provide the proof from the schema source.
?
I'm not sure if FAPI or some of the other sections apply to AIGW 2.0, like token exchange, multi-IdP, multiple clients, Redis cloud authn. For all those sections, you must state your schema source about why it is or isn't supported. and then only add the ones that you can confirm are supported from the schema source.
Examples
I'm thinking that for the ones that are supported, we might want to port over some of the supported examples that are in https://developer.konghq.com/plugins/openid-connect/examples/. This section would be configured like https://developer.konghq.com/metering-and-billing/metering/#example-meter-use-cases except all the examples would just be in kongctl format. So you will need to migrate the supported ones and use the AIGW 2.0 schema to update the examples to the AIGW 2.0 auth strategy format. For those that relate to a particular flow, don't forget to link in the example prose to the description of the flow earlier.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.