ezgh sso <command>EZGH SSO gives the organization a directory of its people, separate from its console members, and makes EZGH Cloud their identity provider. Directory users sign in at the directory’s portal, https://<alias>.sso.ezgh.app, with a password, passkeys and TOTP, or through your Okta, Microsoft Entra ID or Google Workspace, whose SCIM can also provision the directory; applications trust the directory over OpenID Connect or SAML 2.0, and can have their users pushed to them over SCIM.
Who exists, who’s in which group, how they sign in and which applications they may use are the directory’s decisions. IAM decides who may manage the directory: these commands need sso.* actions (SsoFullAccess, or SsoReadOnlyAccess to read). An organization has at most one directory.
Flags
This command also takes the global flags.
Subcommands
| Command | Description |
|---|---|
ezgh sso applications |
Applications: OpenID Connect clients, SAML service providers and EZGH apps people sign in to |
ezgh sso assignments |
Assignments: which users and groups may sign in to an application |
ezgh sso catalog |
The application catalog: SaaS applications’ SAML, OIDC and SCIM settings |
ezgh sso custom-domains |
Custom domains: serve the directory on your own hostname |
ezgh sso directory |
The organization’s directory: its portal, sign-in policy and branding |
ezgh sso domains |
Email domains: verified by DNS, then routed to an identity provider |
ezgh sso groups |
Directory groups: who’s in which team, for assignments and EZGH access |
ezgh sso identity-providers |
Identity providers: federate sign-in to Okta, Microsoft Entra ID, Google Workspace… |
ezgh sso scim-tokens |
Directory SCIM tokens: how identity providers provision the directory (ezgh_dsc_…) |
ezgh sso users |
Directory users: the people who sign in at the portal |