---
title: "ezgh sso identity-providers update"
description: "Change an identity provider's settings, domains or group mappings."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ezgh sso identity-providers update

{/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */}

```sh
ezgh sso identity-providers update <identity-provider> [--name n] [--description d] [settings] [--domains d,…] [--group-mappings g=group,…] [flags]
```

Change an identity provider. What's given changes and the rest stays; `--domains` and `--group-mappings` replace their lists ("" for none). A new `--issuer` or `--metadata-url` is fetched at once. The protocol can't change.

Part of [`ezgh sso identity-providers`](/cli/reference/sso-identity-providers).

## Examples

```sh
ezgh sso identity-providers update okta --domains acme.com,acme.io
ezgh sso identity-providers update okta --client-secret-stdin < new-secret.txt
```

## Flags

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--auth-method` | string |  | for oidc: client_secret_basic (the default with a secret), client_secret_post, or none |
| `--clear-client-secret` | boolean |  | for oidc: remove the client secret (with `--auth-method` none) |
| `--client-id` | string |  | for oidc: the client ID the provider gave EZGH SSO |
| `--client-secret-stdin` | boolean |  | for oidc: read the client secret from stdin (never an argument) |
| `--description` | string |  | a description |
| `--domains` | strings, comma-separated or repeated |  | the directory's domains to route here, replacing the current ones; "" for none |
| `--email-attribute` | string |  | for saml: the attribute with the email address ("": the NameID when it's an email, else common email attributes) |
| `--email-claim` | string |  | for oidc: the claim with the email address (default: email) |
| `--group-mappings` | strings, comma-separated or repeated |  | idp-group=directory-group pairs (\* for everyone), replacing the current ones; "" for none |
| `--groups-attribute` | string |  | for saml: the attribute with the person's groups (default: groups) |
| `--groups-claim` | string |  | for oidc: the claim with the person's groups (default: groups) |
| `--issuer` | string |  | for oidc: the provider's https issuer URL (its discovery document is read from there) |
| `--metadata-file` | string |  | for saml: a file with the identity provider's metadata XML, used as it is (never refreshed) |
| `--metadata-url` | string |  | for saml: the https URL of the identity provider's metadata, fetched and refreshed every 6 hours |
| `--name` | string |  | the identity provider's name |
| `--scopes` | strings, comma-separated or repeated |  | for oidc: the scopes to ask for, including openid (default: openid, email, profile) |

This command also takes the [global flags](/cli/reference#global-flags).

Source: https://docs.ezghcloud.com/cli/reference/sso-identity-providers-update/index.mdx