OIDC config encrypted?

[illyoon]

We want our clients to be able to set up SSO by storing their client_id, client_secret, etc. As a new client sets this up or an existing one updates something, we'd load the updated information into the Kratos config.

A way we came up with to support this is by updating the OIDC configuration via CLI (ory update identity-config) or the Go client (the latter one, however, returns Requested url does not match any rules).

Now, this requires setting the client_secret as plain text. Is it going to be encrypted on Ory's side?

[aeneasr]

Hi @Illias1 - we have it on our backlog to improve the security model around these secrets when using the APIs. Our idea is something along the lines of GitHub repository secrets.

To answer your question - yes, all data at Ory is encrypted in transport and at rest!