ezgh sso applications create

ezgh sso applications create --name <name> [--kind oidc|saml|ezgh] [settings] | --catalog <id> [--param name=value]… [flags]

Create an application that directory users sign in to. Assign users or groups to it with ezgh sso assignments add: nobody can sign in until they’re assigned.

An oidc application is an OpenID Connect client of the directory’s issuer. --type is web (a server that keeps a client secret, or signs a private_key_jwt assertion), spa or native (public clients: no secret, PKCE required); it can’t change later. Give its exact --redirect-uri (https; http only on a loopback address; native applications may use a reverse-domain scheme, and a loopback IP redirect matches any port). Its client ID is the application’s ID. A web application that authenticates with a client secret gets its first one now: it’s printed with the application, once.

A saml application (--kind saml; implied by --catalog or a saml setting) is a SAML 2.0 service provider of the directory’s identity provider. Give its --entity-id and --acs-url, or import them (with its single logout URL and certificates) from its --metadata-url or --metadata-file, once; or start from the catalog: --catalog <id> fills the vendor’s settings, with --param for the values they need, such as your Slack domain. Flags given with metadata or --catalog win. Then register the IdP at the service provider: ezgh sso applications idp <application> shows its metadata URL, entity ID and SSO URL, and idp-certificate prints its certificate.

An ezgh application (--kind ezgh, or just --product) puts an EZGH product, such as MCP Central (--product mcpcentral), on the portal and sets how long its MCP clients’ resource tokens last. IAM, not assignments, decides what directory users may do in the product. MCP Central adds and manages its own application when its project is associated with the directory (ezgh mcp-central sso associate); that one can’t be changed here. Applications count against the sso.applications.count quota.

Part of ezgh sso applications.

Examples

ezgh sso applications create --name Wiki --redirect-uri https://wiki.acme.com/oauth/callback
ezgh sso applications create --name Dashboard --type spa --redirect-uri https://dash.acme.com/cb
ezgh sso applications create --name CLI --type native --redirect-uri http://127.0.0.1/callback
ezgh sso applications create --name Billing --auth-method private_key_jwt --jwks-uri https://billing.acme.com/jwks.json --redirect-uri https://billing.acme.com/cb
ezgh sso applications create --name "MCP Central" --product mcpcentral
ezgh sso applications create --catalog slack --param slackDomain=acme.slack.com
ezgh sso applications create --name Grafana --kind saml --metadata-url https://grafana.acme.com/saml/metadata
ezgh sso applications create --name Tool --entity-id https://tool.acme.com --acs-url https://tool.acme.com/saml/acs \
    --attribute 'email=${user.email}' --attribute 'groups=${user.groups}'

Flags

This command also takes the global flags.