SSO setup
Point the portal at a Secrets Manager secret with your OIDC config
Status: not configured — the portal is open until you set this up.
OIDC provider + client credentials for admin/dev sign-in. The pod's IAM role needs secretsmanager:GetSecretValue on it.
Only needed for OIDC kubeconfigs (kubectl oidc-login). Holds the desktop OAuth client. Leave empty if you only issue SA-token configs. The Jenkins agent's IAM needs read on it.
▾ Required secret formats (AWS Secrets Manager only) 
1 · SSO config secret:
{
  "provider": "google",                 // or "microsoft"
  "client_id": "...",
  "client_secret": "...",
  "tenant_id": "",                       // microsoft only (Azure tenant GUID)
  "admin_emails": ["[email protected]"],   // allowlist — works for both
  "admin_group": ""                      // optional, microsoft Entra group objectId
}

2 · kubelogin OAuth secret:
{
  "client_id":     "...apps.googleusercontent.com",
  "client_secret": "...",
  "issuer":        "https://accounts.google.com"
}
▾ How to create the OAuth client (Google / Microsoft) 
GOOGLE (Desktop app):
1. Google Cloud Console → APIs & Services → Credentials
2. Create credentials → OAuth client ID → Application type: "Desktop app"
3. Copy the Client ID + Client secret
   (no redirect URI to set — Desktop apps auto-allow http://localhost)
4. SM JSON:
   {"client_id":"…apps.googleusercontent.com","client_secret":"…",
    "issuer":"https://accounts.google.com"}

MICROSOFT (Entra ID / Azure AD):
1. Entra admin center → App registrations → New registration
2. Redirect URI: platform "Mobile and desktop applications" → http://localhost
3. Copy the Application (client) ID and Directory (tenant) ID
4. Certificates & secrets → New client secret → copy the value
5. SM JSON:
   {"client_id":"<app-id>","client_secret":"<secret>",
    "issuer":"https://login.microsoftonline.com/<tenant-id>/v2.0"}

The same OAuth client (client_id) must be set as the EKS OIDC IdP audience
(Terraform eks-oidc-identity-provider) for tokens to be accepted.