ezgh sso applications update <application> [--name n] [--description d] [settings] [--logo file | --remove-logo] [flags]Change an application. What’s given changes and the rest stays; --redirect-uri, --post-logout-redirect-uri, --acs-url and --attribute replace their lists, and --signing-certificate and --encryption-certificate replace the service provider’s certificates of that use. --initiate-login-uri, --backchannel-logout-uri, --jwks-uri, --jwks, --access-token-audience, --launch-url, --slo-url and --default-relay-state take “” to clear them. A saml application’s --metadata-url or --metadata-file imports the service provider’s metadata again (flags given with it win). An application’s kind and type can’t change.
--logo uploads a PNG or JPEG (at most 512 KiB and 1024×1024) that the portal shows on the application’s tile, instead of its EZGH product’s mark or its initials; --remove-logo removes it. An application MCP Central manages can’t be given a logo.
Part of ezgh sso applications.
Examples
ezgh sso applications update wiki --redirect-uri https://wiki.acme.com/cb --redirect-uri https://wiki.acme.com/cb2
ezgh sso applications update wiki --groups-claim all --access-token-lifetime 30m
ezgh sso applications update slack --encrypt-assertions --encryption-certificate slack-encryption.pem
ezgh sso applications update wiki --logo wiki.pngFlags
| Flag | Type | Default | Description |
|---|---|---|---|
--access-token-audience |
string | for oidc: the access tokens’ aud (default: the client ID) | |
--access-token-lifetime |
duration | 15m0s |
for oidc: how long access tokens last, 5m to 1h |
--acs-url |
strings, comma-separated or repeated | for saml: an exact assertion consumer service URL, HTTP-POST (repeat, at most 10; the first is the default) | |
--attribute |
string, repeatable | for saml: an attribute name=template, such as email=${user.email} (repeat; replaces the list; “” for none) | |
--attribute-name-format |
string | for saml: the NameFormat of the --attribute values given: unspecified (the default), uri or basic |
|
--auth-method |
string | for oidc web applications: client_secret_basic (the default), client_secret_post or private_key_jwt | |
--backchannel-logout-uri |
string | for oidc: where to send OpenID Connect back-channel logout tokens (https) | |
--default-relay-state |
string | for saml: the RelayState of IdP-initiated sign-in, where the service provider lands (“” for none) | |
--description |
string | a description | |
--encrypt-assertions |
boolean | for saml: encrypt assertions to the service provider’s encryption certificate | |
--encryption-algorithm |
string | for saml: aes128-gcm (the default) or aes256-cbc | |
--encryption-certificate |
string, repeatable | for saml: a PEM file with the service provider’s encryption certificate (repeat; “” for none) | |
--entity-id |
string | for saml: the service provider’s entity ID (the assertion’s audience) | |
--groups-claim |
string | for oidc: which groups the groups claim lists, assigned (the default: groups assigned to the application) or all | |
--groups-filter |
string | for saml: which groups ${user.groups} lists, assigned (the default) or all | |
--id-token-alg |
string | for oidc: how ID and access tokens are signed, RS256 (the default) or ES256 | |
--idp-initiated |
boolean | true |
for saml: allow IdP-initiated sign-in (the portal’s tile) |
--initiate-login-uri |
string | for oidc: where the portal’s tile sends people to start signing in (https) | |
--jwks |
string | for private_key_jwt: the client’s public keys as a JWK Set, @file or - for stdin | |
--jwks-uri |
string | for private_key_jwt: the https URL of the client’s public keys | |
--launch-url |
string | for ezgh: where the portal’s tile opens, under the product’s URL | |
--logo |
string | a PNG or JPEG file (at most 512 KiB and 1024×1024) for the application’s portal tile | |
--metadata-file |
string | for saml: import the service provider’s metadata from this XML file | |
--metadata-url |
string | for saml: import the service provider’s metadata from this https URL (once; never refreshed) | |
--name |
string | the application’s name, shown on the portal | |
--name-id-format |
string | for saml: email (the default), persistent (the user’s ID) or transient | |
--post-logout-redirect-uri |
strings, comma-separated or repeated | for oidc: an exact URI to return to after logout (repeat) | |
--product |
string | for ezgh: the EZGH product (mcpcentral) | |
--redirect-uri |
strings, comma-separated or repeated | for oidc: an exact redirect URI (repeat for several, at most 20) | |
--remove-logo |
boolean | remove the application’s logo: its tile shows its EZGH product’s mark or its initials | |
--resource-token-lifetime |
duration | 1h0m0s |
for ezgh: how long MCP clients’ resource tokens last, 5m to 1h |
--sign-assertion |
boolean | true |
for saml: sign the Assertion |
--sign-response |
boolean | true |
for saml: sign the Response |
--signing-certificate |
string, repeatable | for saml: a PEM file with the service provider’s signing certificate (repeat; “” for none) | |
--slo-binding |
string | for saml: HTTP-Redirect (the default) or HTTP-POST | |
--slo-url |
string | for saml: the service provider’s single logout URL (“” for none) |
This command also takes the global flags.