Configuring OpenID Connect for Doppler

This document outlines the steps required to configure Pulumi to use OpenID Connect to authenticate with Doppler. OIDC in Doppler uses service account identities to access Doppler resources. Access to the temporary credentials is authorized using identities that validate the contents of the OIDC token issued by the Pulumi Cloud.

Prerequisites

• Your Doppler workplace must be on the Team or Enterprise plan in order to use service account identities.
• You must be an admin of your Doppler workplace to create and configure service account identities.

Creating a Service Account

To create a new service account, in the navigation pane of the Doppler dashboard:

1. Select Team, Service Accounts and then click New Service Account.
2. Provide a name for your service account (ex: pulumi-esc-oidc-app).
3. Click Create.
4. Select a Role for the service account or manually grant project access.

Add an Identity (OIDC Authentication)

To add an identity to a service account:

1. Navigate to the service account from Team, Service Accounts
2. Click New Identity.
3. Fill in the form fields as follows:
   • Discovery URL: https://api.pulumi.com/oidc.
   • Audience: This is different between Pulumi deployments and ESC. For Deployments this is only the name of your Pulumi organization. For ESC this is the name of your Pulumi organization prefixed with doppler: (e.g. doppler:{org}).
   • Subject: pulumi:environments:org:<your-pulumi-org>:env:<your-project>/<your-environment> (see more examples at the end of this section).
4. Click Create Identity.
   For environments in the default project the audience will use just the Pulumi organization name. This is to prevent regressions for legacy environments.

After the Identity has been created, take note of the Identity ID. This value will be necessary when enabling OIDC for your service.

Configure ESC for OIDC

To configure OIDC for Pulumi ESC, create a new environment in the Pulumi Console. Make sure that you have the correct organization selected in the left-hand navigation menu. Then:

1. Click the Environments link.

2. Click the Create environment button.

3. Provide a project to create your new environment in and a name for your environment.

   • This should be the same as the identifier provided in the subject claim of your federated credentials.

4. Click the Create environment button.

5. You will be presented with a split-pane view. Delete the default placeholder content in the editor and replace it with the following code:

   values:
     doppler:
       login:
         fn::open::doppler-login:
           oidc:
             identityId: <your-identity-id>
     environmentVariables:
       DOPPLER_TOKEN: ${doppler.login.accessToken}
   

6. Replace <your-identity-id> with the value from the previous steps.

7. Click Save.

You can validate that your configuration is working by running either of the following:

• pulumi env open <your-org>/<your-project>/<your-environment> command of the Pulumi CLI
• pulumi env open <your-org>/<your-project>/<your-environment> command of the Pulumi CLI

Make sure to replace <your-org>, <your-project>, and <your-environment> with the values of your Pulumi organization, project, and environment file respectively. You should see output similar to the following:

{
  "doppler": {
    "login": {
      "accessToken": "dp.said.XXX..."
    }
  },
  "environmentVariables": {
    "DOPPLER_TOKEN": "dp.said.XXX..."
  }
}

To learn more about how to set up and use the various providers in Pulumi ESC, please refer to the relevant Pulumi documentation

Subject claim customization

You can customize the subject claim in the OIDC token to control which Pulumi environments or users are allowed to assume a given identity. This allows for more granular access control than the default organization-level permissions. Use the subjectAttributes property in your login configuration; see Custom token claim for the full list of available attributes and how the subject is composed.

For example, consider the following environment:

values:
  doppler:
    login:
      fn::open::doppler-login:
        oidc:
          identityId: <your-identity-id>
          subjectAttributes:
            - currentEnvironment.name
            - pulumi.user.login

The subject will be pulumi:environments:pulumi.organization.login:contoso:currentEnvironment.name:project/development:pulumi.user.login:userLogin. Note how the keys and values are appended along with the prefix.

Subject claim example