OIDC - Retrieving Your Organization Subject Identifier

env0 OIDC token contains a unique Subject Identifier per env0 Organization.

There are three methods for retrieving your subject identifier.

A. From the App
B. Use Run Task
C. Use env0 OIDC script template
D. Manually from env0 deployment

A. From the App

Go to Organization Settings -> Policies
Next to the "Enable OIDC" checkbox, click "show" ( the "show" button will only appear if OIDC is enabled )

B. Use Run Task

This simple node script will help decode the OIDC Token.

1. “Enable OIDC”
   1. Under Organization > Settings > Policy - Check “Enable OIDC during deployments”
      
2. Run a Task - under any existing env0 environment, select "Run a Task" from the env0 environment menu. Note: You will need administrative access to see this option.
3. Copy and Paste this script:

node -e "console.log(JSON.parse(Buffer.from(process.env.ENV0_OIDC_TOKEN.split('.')[1], 'base64')));"

4. Hit Run a Task and open the console outputs under "Task Commands" step.

C. Using env0 OIDC Script Template

This env0 template, will run a decode script to help you view the contents of the OIDC token.

1. “Enable OIDC”

   1. Under Organization > Settings > Policy - Check “Enable OIDC during deployments”
      

2. Clone or Fork the Repo: https://github.com/env0/customer-tools

3. Run an Environment - from VCS, and configure it with the repo you've cloned/forked to, and the folder path: iam/oidc/decode-oidc

4. This will generate a step in the deployment that outputs the OIDC contents similar to this screenshot:

D. Manually from env0 deployment

To retrieve your organization’s unique Subject Identifier:

1. “Enable OIDC”

   1. Under Organization > Settings > Policy - Check “Enable OIDC during deployments”
      

2. Go to an existing environment and “Run a Task”
   

3. Run the following command: echo $ENV0_OIDC_TOKEN | base64
   

   

4. Copy and Base64 Decode the Token: echo “ZVXMU5pSXNJblI1Y0NJNklrcFhWQ0lzSW10cFpDSTZJazETmEwWkdU…” | base64 -d

   

5. Copy the Token and Inspect the decoded token using jwt.io
   

6. Copy the Subject Identifier ”sub” (In this example: auth0|632b8219674bde0224a96141)