OpenID-Connect (OIDC) support

Landscape offers support for OpenID-Connect (OIDC) authentication. Common OIDC providers include Okta, Keycloak, Amazon Cognito, Google Identity Platform and Microsoft Entra ID (formerly Azure Active Directory).


Enable OIDC support in Landscape

To enable OIDC support, add oidc-issuer, oidc-client-id and oidc-client-secret to /etc/landscape/service.conf in the [landscape] section. For example:

oidc-issuer = <> oidc-client-id = oidc-client-secret = a4sDFAsdfA4F52as-asDfAsd

The oidc-issuer is the URL of the issuer. That URL should also be a discovery configuration file available by appending .well-known/openid-configuration, such as

The oidc-client-id and oidc-client-secret should be provided by your OIDC provider when you create the client credentials. The provider may require setting an authorization redirect URI. This should look like https://your_landscape/login/handle-openid. If your provider also requires a logout redirect URL, this should be the address of your Landscape server such as https://your_landscape/.

Restart all Landscape services

To restart all Landscape services, run:

sudo lsctl restart

(Optional) Configure a logout URL

A logout URL can be configured with oidc-logout-url if the provider doesn’t expose one. For example:

[landscape] … oidc-logout-url = <>

There is no provision yet to upgrade current users to OIDC authentication. Most providers return pairwise subject identifiers (sub) which are not easily available. For this reason, we do not provide a user migration method and recommend recreating users.

Hello @yanisa-hs,

I am a customer and I have two questions for you:

  • When will OIDC be supported for Landscape SaaS?
  • Will JumpCloud (OIDC provider) be supported as well?

Thank you in advance.
Andrea P.

Hi @andreapancrazi -

OIDC support is planned for Landscape SaaS, but there’s no timeline yet for its release. I don’t believe JumpCloud will officially be tested when OIDC support gets added to Landscape SaaS, although you may still be able to configure JumpCloud with these instructions intended for general OIDC configuration.