ezgh iam oidc-providers create <name> --issuer <url> [--audiences a,…] [flags]Register an OpenID Connect identity provider. Workloads holding its ID tokens can exchange them for API keys of bots whose OIDC trust matches (ezgh iam bots oidc-trust add). The issuer is compared with tokens’ iss exactly and can’t change; EZGH Cloud reads its discovery document now, and its keys on every exchange.
--audiences are the aud values accepted (default: the profile’s domain, which ezgh auth oidc-exchange asks GitHub for). For GitHub Actions:
ezgh iam oidc-providers create github --issuer https://token.actions.githubusercontent.comPart of ezgh iam oidc-providers.
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--audiences |
strings, comma-separated or repeated | the audiences accepted, 1 to 10 (default: the profile’s domain) | |
--issuer |
string | the issuer URL, exactly as tokens’ iss says it (required) |
This command also takes the global flags.