# Setting up OpenId Connect with DEX using ood-ansible

**URL:** <https://discourse.openondemand.org/t/setting-up-openid-connect-with-dex-using-ood-ansible/4969>\
**Category:** Get Help\
**Created:** [September 2, 2026, 2:02pm UTC](https://discourse.openondemand.org/t/setting-up-openid-connect-with-dex-using-ood-ansible/4969 "2026-09-02T14:02:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeremyfix](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeremyfix/32/996_2.png) [@jeremyfix](https://discourse.openondemand.org/u/jeremyfix)\
**Post date:** [September 2, 2026, 2:02pm UTC](https://discourse.openondemand.org/t/setting-up-openid-connect-with-dex-using-ood-ansible/4969/1 "2026-09-02T14:02:27Z")

</div>

Hello,

We have difficulties setting up OpenID + DEX + LDAP. We deploy OpenOnDemand using ood-ansible in v4.2.1 on a Ubuntu 24.04. Can anyone confirm we have correctly understood the configuration ?

It is unclear to use exactly which variables should be defined in the inventory.

In our ansible inventory, we set :

```auto
servername: portail.dce.metz.centralesupelec.fr
httpd_port: 443 # I believe could be set to null
oidc_uri: /oidc
install_ondemand_dex: true
oidc_settings_samefile: true

# Use OIDC authentication
httpd_auth:
  - "AuthType openid-connect"
  - "Require valid-user"
ood_auth_openidc:

dex_settings: |
   dex:
      connectors:
      - type: ldap
      ...

```

The dex\_settings part is following [OpenID Connect with Dex — Open OnDemand 4.2.0 documentation](https://osc.github.io/ood-documentation/latest/authentication/dex.html#configuring-ondemand-dex-for-ldap)

We are not sure we are not mixing the two options for setting up Open Id between the “first and simplest” and “the second”.

It seems to me:

- `httpd_port` should be set, either to null or `443` if we use SSL, otherwise, I believe it is defined as `80` in the defaults.
- should `oidc_uri` be set to `/oidc` ?
- `httpd_auth` must be set so that `AuthType` is correctly set to `openid-connect`
- `ood_auth_openidc` has to be defined, although empty, otherwise some tasks are skipped , in particular the “Add OpenIDC config to apache” [ood-ansible/tasks/configure.yml at b5c082d9827b0768adac4682461cab061eb7648b · OSC/ood-ansible · GitHub](https://github.com/OSC/ood-ansible/blob/b5c082d9827b0768adac4682461cab061eb7648b/tasks/configure.yml#L89)
- in the ood-ansible doc, it is said `oidc_settings_samefile` must be set to true for the second option which would maybe mean it is should be kept to false for the first;

If someone can gear us in the right direction on which options should be set, that would greatly help

Thank you

Best

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 2, 2026, 3:45pm UTC](https://discourse.openondemand.org/t/setting-up-openid-connect-with-dex-using-ood-ansible/4969/2 "2026-09-02T15:45:26Z")

</div>

When you have dex configured, OnDemand supplies a lot of configurations automatically outside of ansible.

- You need to supply `oidc_crypto_passphrase` - we no longer supply a default
- `oidc_uri` will likely default when you have dex set, so I don’t think you need to set it, though I believe that’s the default.
- `ood_auth_openidc` is a complementary file in the ansible role specifically. I would avoid using it for now as dex (OnDemand) will supply most things and even so you still specify things that get put into `ood-portal.yml`. That complimentary file exists if you have multiple virtual hosts that all need a shared oidc configuration. So if you don’t need a shared oidc configuration, then I would not use it and in-fact it may not even work with dex and how we provide OIDC configs in the ood virtualhost.
- `oidc_settings_samefile` appears to be vestigial and not used anymore.

---

<div class="post-metadata">

**Author:** ![jeremyfix](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeremyfix/32/996_2.png) [@jeremyfix](https://discourse.openondemand.org/u/jeremyfix)\
**Post date:** [September 4, 2026, 12:17pm UTC](https://discourse.openondemand.org/t/setting-up-openid-connect-with-dex-using-ood-ansible/4969/3 "2026-09-04T12:17:04Z")

</div>

Thank you for your quick feedback Jeff;

We solved our authentication issue although I may not completely guarantee which are the critical settings as we repeated applications of the playbook with different variable settings and I did not remove all the installed softwares before reapplying the playbooks.

Still, I have the feeling that `oidc_uri` has to be defined. If I remove its declaration, I get the following error with the ood-ansible role :

```auto
TASK [ood_role : Add OpenIDC config to Apache] *******************************************************************************************************************************************************************************************************************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ansible.errors.AnsibleUndefinedVariable: {'OIDCRedirectURI': 'https://{{ servername }}{{ oidc_uri }}', 'OIDCSessionInactivityTimeout': 28800, 'OIDCSessionMaxDuration': 28800, 'OIDCRemot
eUserClaim': 'preferred_username', 'OIDCPassClaimsAs': 'environment', 'OIDCStripCookies': 'mod_auth_openidc_session mod_auth_openidc_session_chunks mod_auth_openidc_session_0 mod_auth_openidc_session_1'}: 'oidc_uri' is undefined. 'oidc_uri' is undefined. {'OIDCRedirectURI': 'https:
//{{ servername }}{{ oidc_uri }}', 'OIDCSessionInactivityTimeout': 28800, 'OIDCSessionMaxDuration': 28800, 'OIDCRemoteUserClaim': 'preferred_username', 'OIDCPassClaimsAs': 'environment', 'OIDCStripCookies': 'mod_auth_openidc_session mod_auth_openidc_session_chunks mod_auth_openidc_
session_0 mod_auth_openidc_session_1'}: 'oidc_uri' is undefined. 'oidc_uri' is undefined                                                                                                                                                                                                  
fatal: [chome2]: FAILED! => {"changed": false, "msg": "AnsibleUndefinedVariable: {'OIDCRedirectURI': 'https://{{ servername }}{{ oidc_uri }}', 'OIDCSessionInactivityTimeout': 28800, 'OIDCSessionMaxDuration': 28800, 'OIDCRemoteUserClaim': 'preferred_username', 'OIDCPassClaimsAs': 'e
nvironment', 'OIDCStripCookies': 'mod_auth_openidc_session mod_auth_openidc_session_chunks mod_auth_openidc_session_0 mod_auth_openidc_session_1'}: 'oidc_uri' is undefined. 'oidc_uri' is undefined. {'OIDCRedirectURI': 'https://{{ servername }}{{ oidc_uri }}', 'OIDCSessionInactivity
Timeout': 28800, 'OIDCSessionMaxDuration': 28800, 'OIDCRemoteUserClaim': 'preferred_username', 'OIDCPassClaimsAs': 'environment', 'OIDCStripCookies': 'mod_auth_openidc_session mod_auth_openidc_session_chunks mod_auth_openidc_session_0 mod_auth_openidc_session_1'}: 'oidc_uri' is und
efined. 'oidc_uri' is undefined"}    

```

Thank you !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [September 6, 2026, 12:17pm UTC](https://discourse.openondemand.org/t/setting-up-openid-connect-with-dex-using-ood-ansible/4969/4 "2026-09-06T12:17:38Z")

</div>

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.