vault_oidc_auth.tf

resource "vault_jwt_auth_backend" "oidc" {
  description        = "vault + OKTA + oidc"
  path               = "oidc"
  type               = "oidc"
  oidc_discovery_url = "${var.OKTA_URL}"
  oidc_client_id     = "${var.OKTA_CLIENT_ID}"
  oidc_client_secret = "${var.OKTA_CLIENT_SECRET}"
  bound_issuer       = "${var.OKTA_URL}"
  default_role       = "oidc"

  tune = {
    listing_visibility = "unauth"
  }
}

resource "vault_jwt_auth_backend_role" "oidc" {
  backend               = "${vault_jwt_auth_backend.oidc.path}"
  role_name             = "oidc"
  token_policies        = ["cred_mgr"]
  bound_audiences       = ["${var.OKTA_CLIENT_ID}"]
  user_claim            = "sub"
  allowed_redirect_uris = ["${var.VAULT_ADDR}/ui/vault/auth/oidc/oidc/callback", "http://localhost:8250/oidc/callback"]
  role_type             = "oidc"
  oidc_scopes           = ["profile","groups"]
  # verbose_oidc_logging  = true
  # vault write auth/oidc/role/oidc verbose_oidc_logging=true
}