---
title: "ezgh sso identity-providers create"
description: "Add an OIDC or SAML identity provider (Okta, Microsoft Entra ID, Google Workspace…)."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ezgh sso identity-providers create

{/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */}

```sh
ezgh sso identity-providers create --name <name> --protocol oidc|saml [settings] [--domains d,…] [--group-mappings g=group,…] [flags]
```

Add an upstream identity provider that people federate from. Its metadata is fetched at once.

OIDC: `--issuer`, `--client-id` and, for a confidential client, the client secret on stdin with `--client-secret-stdin`. Register the redirect URI that `get` shows at the provider: https://&lt;alias&gt;.sso.ezgh.app/federation/oidc/callback.

SAML: `--metadata-url` (refreshed every 6 hours) or `--metadata-file` (used as given). Register the service provider that `get` shows at the provider: its entity ID and metadata URL, https://&lt;alias&gt;.sso.ezgh.app/federation/saml/metadata/&lt;id&gt;, and its ACS URL. Responses and assertions must both be signed.

`--domains` routes verified domains of the directory here: people with an address in one are sent to this provider to sign in, and get a user the first time (just in time). `--group-mappings` adds them to hosted directory groups by their upstream groups at every sign-in. Identity providers count against the sso.identityProviders.count quota.

Part of [`ezgh sso identity-providers`](/cli/reference/sso-identity-providers).

## Examples

```sh
ezgh sso identity-providers create --name Okta --protocol oidc --issuer https://acme.okta.com \
    --client-id 0oa1b2c3 --client-secret-stdin --domains acme.com < okta-secret.txt
ezgh sso identity-providers create --name Entra --protocol saml \
    --metadata-url https://login.microsoftonline.com/<tenant>/federationmetadata/2007-06/federationmetadata.xml?appid=<app>
ezgh sso identity-providers create --name Google --protocol saml --metadata-file GoogleIDPMetadata.xml \
    --group-mappings "*=everyone"
```

## Flags

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--auth-method` | string |  | for oidc: client_secret_basic (the default with a secret), client_secret_post, or none |
| `--client-id` | string |  | for oidc: the client ID the provider gave EZGH SSO |
| `--client-secret-stdin` | boolean |  | for oidc: read the client secret from stdin (never an argument) |
| `--description` | string |  | a description |
| `--domains` | strings, comma-separated or repeated |  | the directory's domains to route here, replacing the current ones; "" for none |
| `--email-attribute` | string |  | for saml: the attribute with the email address ("": the NameID when it's an email, else common email attributes) |
| `--email-claim` | string |  | for oidc: the claim with the email address (default: email) |
| `--group-mappings` | strings, comma-separated or repeated |  | idp-group=directory-group pairs (\* for everyone), replacing the current ones; "" for none |
| `--groups-attribute` | string |  | for saml: the attribute with the person's groups (default: groups) |
| `--groups-claim` | string |  | for oidc: the claim with the person's groups (default: groups) |
| `--issuer` | string |  | for oidc: the provider's https issuer URL (its discovery document is read from there) |
| `--metadata-file` | string |  | for saml: a file with the identity provider's metadata XML, used as it is (never refreshed) |
| `--metadata-url` | string |  | for saml: the https URL of the identity provider's metadata, fetched and refreshed every 6 hours |
| `--name` | string |  | the identity provider's name |
| `--protocol` | string |  | oidc or saml; can't change later |
| `--scopes` | strings, comma-separated or repeated |  | for oidc: the scopes to ask for, including openid (default: openid, email, profile) |

This command also takes the [global flags](/cli/reference#global-flags).

Source: https://docs.ezghcloud.com/cli/reference/sso-identity-providers-create/index.mdx