ezgh sso scim-tokens create

ezgh sso scim-tokens create <name> --identity-provider <identity-provider> [flags]

Create a directory SCIM token for an identity provider (Okta, Microsoft Entra ID…). The token (ezgh_dsc_…) is printed once, alone on stdout, and can’t be shown again; give it to the identity provider with the SCIM base URL printed on stderr.

The token provisions users and groups for the identity provider it names, only with emails in verified domains routed to it. While a token names an identity provider, federated sign-in through it admits only the users its SCIM provisioned (no just-in-time users), and those users and groups are locked: they’re changed at the identity provider, not here. To rotate, create a second token for the same identity provider, switch to it, then delete the first.

Part of ezgh sso scim-tokens.

Examples

ezgh sso scim-tokens create okta-scim --identity-provider Okta > scim-token.txt

Flags

This command also takes the global flags.