Skip to main content
A requirement to run your own Chainloop instance is to configure an OIDC provider to authenticate users who interact with the control plane.

​
Pre-requisites

To configure your Chainloop instance with Ory Hydra you’ll need the following information:
  • Ory Hydra instance running
  • Access to your OIDC provider configuration

​
Configure Ory Hydra

First, you’ll need to have an Ory Hydra instance running. You can follow the official documentation to set up your own instance. Then simply create a new OAuth2 client in your Ory Hydra instance. You can do this by running the following command:
Chainloop client will only request openid, email and profile scopes. Relevant information that can be noted from the command signature is:
  • name: The name of the OAuth2 client
  • grant-type: The grant type of the client it needs to be set authorization_code and refresh_token
  • response-type: The response type of the client: code
  • scope: The scopes that the client will request: openid, email, profile
  • redirect-uri: The redirect URI of the client: Whenever is the Chainloop instance URL plus /auth/callback
  • endpoint: The endpoint of the Ory Hydra instance
Once the command is run, it will give back something similar to the following:

​
Configure Chainloop deployment

As explained in the deployment guide, you can configure the ODIC configuration oidc section of the values.yaml file. Just put the information we gathered from the previous steps like this.
And deploy your Chainloop Control Plane with the update values to take effect. Now your Chainloop instance will automatically authenticating users using the Ory Hydra instance you just configured.