# OidcIdentityProviderConfigProperty

An object representing the configuration for an OpenID Connect (OIDC) identity provider.

- Source: Generated code
- Type last changed: v2.268.0 · 2 Sep 2026

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_eks_v2 as eks_v2 } from 'aws-cdk-lib';
const oidcIdentityProviderConfigProperty: eks_v2.CfnIdentityProviderConfig.OidcIdentityProviderConfigProperty = {
  clientId: 'clientId',
  issuerUrl: 'issuerUrl',

  // the properties below are optional
  groupsClaim: 'groupsClaim',
  groupsPrefix: 'groupsPrefix',
  requiredClaims: [{
    key: 'key',
    value: 'value',
  }],
  usernameClaim: 'usernameClaim',
  usernamePrefix: 'usernamePrefix',
};
```

## Properties

- `clientId`: string (required) — This is also known as *audience* .

  The ID of the client application that makes authentication requests to the OIDC identity provider.

- `groupsClaim`: string — The JSON web token (JWT) claim that the provider uses to return your groups.

- `groupsPrefix`: string — The prefix that is prepended to group claims to prevent clashes with existing names (such as `system:` groups).

  For example, the value `oidc:` creates group names like `oidc:engineering` and `oidc:infra` . The prefix can't contain `system:`

- `issuerUrl`: string (required) — The URL of the OIDC identity provider that allows the API server to discover public signing keys for verifying tokens.

- `requiredClaims`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnIdentityProviderConfig.RequiredClaimProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_eks_v2.CfnIdentityProviderConfig.RequiredClaimProperty.html)[] — The key-value pairs that describe required claims in the identity token.

  If set, each claim is verified to be present in the token with a matching value.

- `usernameClaim`: string — The JSON Web token (JWT) claim that is used as the username.

- `usernamePrefix`: string — The prefix that is prepended to username claims to prevent clashes with existing names.

  The prefix can't contain `system:`