ezgh sso identity-providers create --name <name> --protocol oidc|saml [settings] [--domains d,…] [--group-mappings g=group,…] [flags]Add an upstream identity provider that people federate from. Its metadata is fetched at once.
OIDC: --issuer, --client-id and, for a confidential client, the client secret on stdin with --client-secret-stdin. Register the redirect URI that get shows at the provider: https://<alias>.sso.ezgh.app/federation/oidc/callback.
SAML: --metadata-url (refreshed every 6 hours) or --metadata-file (used as given). Register the service provider that get shows at the provider: its entity ID and metadata URL, https://<alias>.sso.ezgh.app/federation/saml/metadata/<id>, and its ACS URL. Responses and assertions must both be signed.
--domains routes verified domains of the directory here: people with an address in one are sent to this provider to sign in, and get a user the first time (just in time). --group-mappings adds them to hosted directory groups by their upstream groups at every sign-in. Identity providers count against the sso.identityProviders.count quota.
Part of ezgh sso identity-providers.
Examples
ezgh sso identity-providers create --name Okta --protocol oidc --issuer https://acme.okta.com \
--client-id 0oa1b2c3 --client-secret-stdin --domains acme.com < okta-secret.txt
ezgh sso identity-providers create --name Entra --protocol saml \
--metadata-url https://login.microsoftonline.com/<tenant>/federationmetadata/2007-06/federationmetadata.xml?appid=<app>
ezgh sso identity-providers create --name Google --protocol saml --metadata-file GoogleIDPMetadata.xml \
--group-mappings "*=everyone"Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--auth-method |
string | for oidc: client_secret_basic (the default with a secret), client_secret_post, or none | |
--client-id |
string | for oidc: the client ID the provider gave EZGH SSO | |
--client-secret-stdin |
boolean | for oidc: read the client secret from stdin (never an argument) | |
--description |
string | a description | |
--domains |
strings, comma-separated or repeated | the directory’s domains to route here, replacing the current ones; “” for none | |
--email-attribute |
string | for saml: the attribute with the email address (“”: the NameID when it’s an email, else common email attributes) | |
--email-claim |
string | for oidc: the claim with the email address (default: email) | |
--group-mappings |
strings, comma-separated or repeated | idp-group=directory-group pairs (* for everyone), replacing the current ones; “” for none | |
--groups-attribute |
string | for saml: the attribute with the person’s groups (default: groups) | |
--groups-claim |
string | for oidc: the claim with the person’s groups (default: groups) | |
--issuer |
string | for oidc: the provider’s https issuer URL (its discovery document is read from there) | |
--metadata-file |
string | for saml: a file with the identity provider’s metadata XML, used as it is (never refreshed) | |
--metadata-url |
string | for saml: the https URL of the identity provider’s metadata, fetched and refreshed every 6 hours | |
--name |
string | the identity provider’s name | |
--protocol |
string | oidc or saml; can’t change later | |
--scopes |
strings, comma-separated or repeated | for oidc: the scopes to ask for, including openid (default: openid, email, profile) |
This command also takes the global flags.