ezgh sso identity-providers update <identity-provider> [--name n] [--description d] [settings] [--domains d,…] [--group-mappings g=group,…] [flags]Change an identity provider. What’s given changes and the rest stays; --domains and --group-mappings replace their lists (“” for none). A new --issuer or --metadata-url is fetched at once. The protocol can’t change.
Part of ezgh sso identity-providers.
Examples
ezgh sso identity-providers update okta --domains acme.com,acme.io
ezgh sso identity-providers update okta --client-secret-stdin < new-secret.txtFlags
| Flag | Type | Default | Description |
|---|---|---|---|
--auth-method |
string | for oidc: client_secret_basic (the default with a secret), client_secret_post, or none | |
--clear-client-secret |
boolean | for oidc: remove the client secret (with --auth-method none) |
|
--client-id |
string | for oidc: the client ID the provider gave EZGH SSO | |
--client-secret-stdin |
boolean | for oidc: read the client secret from stdin (never an argument) | |
--description |
string | a description | |
--domains |
strings, comma-separated or repeated | the directory’s domains to route here, replacing the current ones; “” for none | |
--email-attribute |
string | for saml: the attribute with the email address (“”: the NameID when it’s an email, else common email attributes) | |
--email-claim |
string | for oidc: the claim with the email address (default: email) | |
--group-mappings |
strings, comma-separated or repeated | idp-group=directory-group pairs (* for everyone), replacing the current ones; “” for none | |
--groups-attribute |
string | for saml: the attribute with the person’s groups (default: groups) | |
--groups-claim |
string | for oidc: the claim with the person’s groups (default: groups) | |
--issuer |
string | for oidc: the provider’s https issuer URL (its discovery document is read from there) | |
--metadata-file |
string | for saml: a file with the identity provider’s metadata XML, used as it is (never refreshed) | |
--metadata-url |
string | for saml: the https URL of the identity provider’s metadata, fetched and refreshed every 6 hours | |
--name |
string | the identity provider’s name | |
--scopes |
strings, comma-separated or repeated | for oidc: the scopes to ask for, including openid (default: openid, email, profile) |
This command also takes the global flags.