# OpenId connect problem (no redirection to Identity Provider **URL:** \ **Category:** General\ **Tags:** service-mesh, kubernetes, kong-gateway\ **Created:** [June 21, 2020, 12:46pm UTC](https://discuss.konghq.com/t/openid-connect-problem-no-redirection-to-identity-provider/6585 "2020-06-21T12:46:35Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![jondow](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/jondow/32/2019_2.png) [@jondow](https://discuss.konghq.com/u/jondow)\ **Post date:** [June 21, 2020, 12:46pm UTC](https://discuss.konghq.com/t/openid-connect-problem-no-redirection-to-identity-provider/6585/1 "2020-06-21T12:46:35Z")
Hi, I have installed Kong Enterprise k8s and Kong Ingress Controller successfully with the manifests from > I was following the OpenId Connect guide from [https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/guides/using-oidc-plugin.md](https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/guides/using-oidc-plugin.md) to test the OpenId connect plugin with Google as an IdP. However, it looks like the OpenId-Connect plugin. does not redirect the request to Google for Authentication. Hereafter is the Kong Deployment manifest that I am using. Can you please tell me what could be the issue: kong\_deployment.yaml manifest: apiVersion: apps/v1 kind: Deployment metadata: labels: app: ingress-kong name: ingress-kong namespace: kong spec: replicas: 1 selector: matchLabels: app: ingress-kong template: metadata: annotations: [kuma.io/gateway:](http://kuma.io/gateway:) enabled [prometheus.io/port:](http://prometheus.io/port:) “8100” [prometheus.io/scrape:](http://prometheus.io/scrape:) “true” [traffic.sidecar.istio.io/includeInboundPorts:](http://traffic.sidecar.istio.io/includeInboundPorts:) “” labels: app: ingress-kong spec: containers: - env: - name: KONG\_LICENSE\_DATA valueFrom: secretKeyRef: key: license name: kong-enterprise-license - name: KONG\_PROXY\_LISTEN value: 0.0.0.0:8000, 0.0.0.0:8443 ssl http2 - name: KONG\_ADMIN\_LISTEN value: 127.0.0.1:8444 ssl - name: KONG\_STATUS\_LISTEN value: 0.0.0.0:8100 - name: KONG\_DATABASE value: “off” - name: KONG\_NGINX\_WORKER\_PROCESSES value: “1” - name: KONG\_ADMIN\_ACCESS\_LOG value: /dev/stdout - name: KONG\_ADMIN\_ERROR\_LOG value: /dev/stderr - name: KONG\_PROXY\_ERROR\_LOG value: /dev/stderr - name: KONG\_PLUGINS value: “oidc” #image: [kong-docker-kong-enterprise-k8s.bintray.io/kong-enterprise-k8s:2.0.4.1-alpine](http://kong-docker-kong-enterprise-k8s.bintray.io/kong-enterprise-k8s:2.0.4.1-alpine) image: jondow/kong-enterprise-k8s:2.0.4.1-alpine lifecycle: preStop: exec: command: - /bin/sh - -c - kong quit livenessProbe: failureThreshold: 3 httpGet: path: /status port: 8100 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: proxy ports: - containerPort: 8000 name: proxy protocol: TCP - containerPort: 8443 name: proxy-ssl protocol: TCP - containerPort: 8100 name: metrics protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /status port: 8100 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 securityContext: runAsUser: 1000 - env: - name: CONTROLLER\_KONG\_ADMIN\_URL value: [https://127.0.0.1:8444](https://127.0.0.1:8444) - name: CONTROLLER\_KONG\_ADMIN\_TLS\_SKIP\_VERIFY value: “true” - name: CONTROLLER\_PUBLISH\_SERVICE value: kong/kong-proxy - name: CONTROLLER\_WATCH\_NAMESPACE value: kong - name: POD\_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD\_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: [kong-docker-kubernetes-ingress-controller.bintray.io/kong-ingress-controller:0.9.1](http://kong-docker-kubernetes-ingress-controller.bintray.io/kong-ingress-controller:0.9.1) imagePullPolicy: Always livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: ingress-controller ports: - containerPort: 8080 name: webhook protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 imagePullSecrets: - name: regcred serviceAccountName: kong-kong Thanks Jon ---
**Author:** ![traines](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/traines/32/158_2.png) [@traines](https://discuss.konghq.com/u/traines)\ **Post date:** [June 23, 2020, 6:20pm UTC](https://discuss.konghq.com/t/openid-connect-problem-no-redirection-to-identity-provider/6585/2 "2020-06-23T18:20:57Z")
Hi, it looks like you’re using Kong Enterprise, have you [submitted a ticket](http://support.konghq.com/) for this issue? This forum is generally more for supporting non-Enterprise deployments. In general, at a baseline, you’ll want to check the controller container logs (e.g. `kubectl logs KONG_POD_NAME -c ingress-controller`) to see if it’s unable to apply your configuration for some reason, and if not, check the admin API (`GET /routes` to find the route matching your Ingress and then `GET /routes/ROUTE_NAME/plugins` to see if the OIDC configuration is present). Furthermore, when you say the redirect doesn’t occur, are you then allowed upstream (i.e. you get a 200 response) or are you then blocked by the plugin (you should receive a 403 or 401)? ---
**Author:** ![jondow](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/jondow/32/2019_2.png) [@jondow](https://discuss.konghq.com/u/jondow)\ **Post date:** [June 25, 2020, 6:22am UTC](https://discuss.konghq.com/t/openid-connect-problem-no-redirection-to-identity-provider/6585/3 "2020-06-25T06:22:48Z")
Hi Travis, Yes, I am using Kong Enterprise K8S. I was able to solve the issue. The Kong Enterprise K8S is different from the open source version as it requires Ingress Resource patch. So, there was an issue in my Ingress Resource. Anyway, now the OpenID Connect plugin works and we are going ahead with the Kong API Gateway in our company. I will wait for the official version of Kong Enterprise K8S not relying on ClusterRoles and ClusterRoleBindings. For now, we will use the fork of the Kong Ingress Controller 0.9.1 that I have created thanks to your help. Your support is amazing and this gives us more confidence to use Kong as an API Gateway in our organization. Thank you Regards Jon