ezgh sso applications provisioning set

ezgh sso applications provisioning set <application> [--base-url u] [--bearer-token-stdin | --bearer-token-file f] [settings] [flags]

Configure an oidc or saml application’s outbound SCIM provisioning: EZGH SSO creates, updates and deactivates the users assigned to it (and with --push-groups, its assigned groups) at the application’s SCIM 2.0 API.

What’s given changes and the rest stays: ezgh reads the current settings and sends them whole with your changes, with the ETag it read, so if someone changed them in between nothing is changed and ezgh says so. The bearer token is read from stdin (--bearer-token-stdin: typed without echo on a terminal, or the first line piped in) or a file (--bearer-token-file), never from an argument. It’s required the first time and whenever the base URL changes, and is never shown again. A new base URL starts over: everyone is pushed to it, and nothing is deprovisioned at the old one.

--attribute-mapping target=source replaces the mappings (they must map userName); a source is text with ${user.email}, ${user.name}, ${user.givenName}, ${user.familyName}, ${user.department}, ${user.id}, ${user.slug} or ${user.tags.<key>}. --default-mappings goes back to the defaults. --catalog <id> takes the catalog application’s base URL (with --param for its parameters) and mappings. --enabled=false stops pushing and drops pending pushes. Unassigning or suspending someone always deactivates them there; --hard-delete also deletes users deleted here.

Part of ezgh sso applications provisioning.

Examples

ezgh sso applications provisioning set Slack --catalog slack --bearer-token-stdin < slack-token.txt
ezgh sso applications provisioning set Wiki --base-url https://wiki.acme.com/scim/v2 --bearer-token-file token.txt \
    --attribute-mapping 'userName=${user.email}' --attribute-mapping 'displayName=${user.name}' --push-groups
ezgh sso applications provisioning set Wiki --enabled=false

Flags

Flag	Type	Default	Description
`--attribute-mapping`	string, repeatable		a SCIM attribute target=source, such as userName=${user.email} (repeat; replaces the mappings)
`--base-url`	string		the application’s SCIM 2.0 base URL (https, a public host)
`--bearer-token-file`	string		read the application’s SCIM bearer token from this file
`--bearer-token-stdin`	boolean		read the application’s SCIM bearer token from stdin (never an argument)
`--catalog`	string		take the base URL and mappings from this catalog application’s SCIM settings
`--default-mappings`	boolean		use the default attribute mappings
`--enabled`	boolean	`true`	push changes (false stops pushing and drops pending pushes)
`--hard-delete`	boolean		delete users at the application when they’re deleted here (otherwise they’re deactivated)
`--param`	string, repeatable		for `--catalog`: a parameter of the catalog application, name=value (repeat)
`--push-groups`	boolean		push the groups assigned to the application, with their provisioned members

This command also takes the global flags.