Identity Provider

Upstream Identity Provider

By default, Arminius comes with the Nuss IdP in dev mode, providing no real authentication. Instead of using dev mode, you can configure an upstream IdP in Nuss by setting the environment variables of Nuss.

These are the instructions to configure Zitadel as an upstream IdP:

arminius-server-scim

1. In the organisation you want to sync, create the Service User “arminius” (Access Token Type: JWT).
2. Click on “Actions” > “Generate Client Secret”. Set SCIM_CLIENT_ID and SCIM_CLIENT_SECRET environment variables of arminius-server-scim to the shown credentials.
3. Set SCIM_TOKEN_ENDPOINT of arminius-server-scim to http://$ZITADEL/oauth/v2/token.

Nuss

1. In the same organisation, create the Service User “nuss” in the Zitadel Console (Access Token Type: Bearer).
2. Click on “Actions” > “Generate Client Secret”. Set CLIENT_ID and CLIENT_SECRET environment variables of nuss to the shown credentials.
3. Add the Service User as a manager to the organisation, with the permission “Org Owner Viewer”.
4. Set SCIM_BASE_URL to http://$ZITADEL/scim/v2/$ORG_ID/ (replace the variables) and SCOPES to openid urn:zitadel:iam:org:project:id:zitadel:aud.
5. Add an application in Zitadel (in any project in any organisation). Select “Web” > “PKCE”. The Redirect URI should be configured to http://$NUSS_SERVER/login (by default, it’s localhost:9000).
6. Set OIDC_CLIENT_ID to the shown client id. Set OIDC_BASE_URL to http://$ZITADEL/.
7. Set BASE_URL to the user-facing URL for Nuss.
8. Under “Token Settings” set the “Auth Token Type” to “JWT”.

Custom Identity Provider

If your IdP directly provides the required custom extensions, you can omit Nuss and configure the OIDC-related environment variables directly in Arminius.

Set OIDC_BASE_URL to the OIDC provider.