What is the current state of OpenID Connect support?

Support
1

From this page in the documentation it would seem that openId connect is fully supported but this blog post sort of implies that it is in fact not?
I previously had problem with tyk returning “access to this api has been disallowed” for the openId connect configured api. Sometimes restarting tyk and the dashboard fixed the problem.
Resently updated to dashboard 1.3.9 and gateway 2.3.10. Now I get the error message “{ “error”: “Key has expired, please renew” }” on non expired keys until they actually expire and then the error message changes to “{ “error”: “Key not authorised” }”

I created the api by:

  1. Creating an api in the dashboard and setting the authentication mode to “Open ID Connect”
  2. Create a policy for for the api from step 1.
  3. Edit the api from step on and add the policy and my google Client ID.

So what is up with this behaviour?

2

Hi - the docs are accurate - Tyk does support OIDC (I think that blog post is very old)

Just to confirm, did you follow this from the documentation:

Setting up OIDC

To set up an API Definition to use OIDC, add the following block to the definition, and ensure no other access methods are enabled:

"use_openid": true,
"openid_options": {
    "providers": [
        {
            "issuer": "accounts.google.com",
            "client_ids": {
                "MTIzNDU2Nzc4OQ==": "5654566b30c55e3904000003"
            }
        }
    ],
    "segregate_by_client": false
}

use_openid: Set to true to enable the OpenID Connect check.
openid_options.providers: A list of authorised providers and their client IDs/Matched Policies.
openid_options.providers.client_ids: The list of client IDs and policy IDs to apply to users thereof. Note: Client IDs are Base64 encoded, so the map is base64(clientid):policy_id .When a valid user appears from a matching IDP/Client ID, the policy listed in this entry will be applied to their token across OIDC ID Tokens.
openid_options.segregate_by_client: Enable this to have the policy applied to the combination of the User ID AND the Client ID. For example:

If disabled: when alice uses the mobile app to log into the API, Tyk applies the same rate limit and access rules as if she had logged in via the web app or the desktop client.
If enabled: when alice uses the mobile app to log into the API, Tyk applies different rate limit and access rules than if she had logged in via the web app or the desktop client, in fact, each client and user combination will have its own internal representation.

3

Yes I followed that guide. Here is my is the relevant segment from my tyk definition but with my b64 encoded client ID replaced:

"use_basic_auth": false,
"enable_jwt": false,
"use_standard_auth": false,
"use_keyless": false,
"use_oauth2": false,
"use_openid": true,
"openid_options": {
    "providers": [
        {
            "issuer": "accounts.google.com",
            "client_ids": {
                "ZHVtbXk=": "59fb196bf5b4e20001ad77cb"
            }
        }
    ],
    "segregate_by_client": false
},