Terraform example for Google-based OIDC on an AWS Application Loadbalancer (ALB)

website_listener_rule_oidc.tf

resource "aws_lb_listener_rule" "website" {
  listener_arn = aws_lb_listener.https.arn
  priority     = 99

  dynamic "action" {
    for_each = var.website_enable_sso ? [1] : []
    content {
      type = "authenticate-oidc"

      authenticate_oidc {
        authentication_request_extra_params = {}
        authorization_endpoint              = "https://accounts.google.com/o/oauth2/auth"
        client_id                           = ""
        client_secret                       = ""
        issuer                              = "https://accounts.google.com"
        on_unauthenticated_request          = "authenticate"
        scope                               = "openid"
        session_cookie_name                 = "AWSELBAuthSessionCookie"
        session_timeout                     = 604800
        token_endpoint                      = "https://oauth2.googleapis.com/token"
        user_info_endpoint                  = "https://openidconnect.googleapis.com/v1/userinfo"
      }
    }
  }

  dynamic "action" {
    for_each = var.website_enable_sso ? [1] : []

    content {
      order            = 2
      type             = "forward"
      target_group_arn = aws_lb_target_group.website.arn
    }
  }


  dynamic "action" {
    for_each = var.website_enable_sso ? [] : [1]

    content {
      type             = "forward"
      target_group_arn = aws_lb_target_group.website.arn
    }
  }

  condition {
    host_header {
      values = ["www.${data.aws_route53_zone.zone.name}"]
    }
  }
}