Change an application

One of the following:

• EzghSettings{ … }

  View EzghSettings schema →

  4 properties

  • consoleSessionSecondsinteger | nullrequired

    The console application's federated console session lifetime (the assertion's SessionNotOnOrAfter, never past the SSO session's end): 900–43200, default 43200. null for every other product.

    maximum: 43200, minimum: 900
  • launchUrlstring | nullrequired

    The portal tile's link. For mcpcentral it's always MCP Central's portal on the directory's current alias, https://.mcp.ezgh.app/, whatever was stored (read-only); for the console application, the directory's https://.sso.ezgh.app/console/start (read-only).

    format: uri
  • productmcpcentralorconsolerequired

    The EZGH product: mcpcentral (MCP Central), or console (the console application: at most one per directory, 409 console_application_exists on a second). Can't change.

  • resourceTokenLifetimeSecondsintegerrequired

    Lifetime of the opaque ezgh_sat_ resource tokens EZGH SSO issues for the product (stage 4). Default 3600. The console application issues no resource tokens: always 3600, inert.

    maximum: 3600, minimum: 300
• null

One of the following:

• OidcSettings{ … }

  View OidcSettings schema →

  17 properties

  • accessTokenAudiencestring | nullrequired

    The access token's aud; null is the client ID.

    maxLength: 256
  • accessTokenLifetimeSecondsintegerrequired

    The RFC 9068 JWT access token's lifetime. Default 900.

    maximum: 3600, minimum: 300
  • applicationTypeweborspaornativerequired

    web is confidential; spa and native are public clients that must use PKCE (S256). Can't change.

  • backchannelLogoutUristring | nullrequired

    A public https URL that receives OpenID Connect back-channel logout tokens, through hardened egress.

    format: uri
  • clientIdstringrequired
  • clientSecretsarray ofobject{ … }required

    Live client secrets' metadata, oldest first. Never a secret.

    5 properties

    • createdAtstringrequired

      format: date-time
    • createdByobject{ … }required

      2 properties

      • idstringrequired
      • typestringrequired
    • idstringrequired

      format: uuid
    • lastUsedAtstring | nullrequired

      format: date-time
    • prefixstringrequired

      The first 13 characters (ezgh_scs_ and four more).

  • groupsClaimassignedorallrequired

    With the groups scope: the user's groups that are assigned to this application (the default), or all of them.

  • idTokenSignedResponseAlgRS256orES256required

    Signs the ID token and the access token. Default RS256.

  • initiateLoginUristring | nullrequired

    https; the portal tile opens it with ?iss= (OpenID Connect third-party-initiated login).

    format: uri
  • issuerstringrequired

    format: uri
  • jwksobject | nullrequired

    The client's public keys by value, a JWK set ({ keys: [...] }), for private_key_jwt. 1–10 RSA (2048+ bits) or EC (P-256/384/521) signing keys, a kid on each when there are several.

  • jwksFetchErrorstring | nullrequired
  • jwksFetchedAtstring | nullrequired

    format: date-time
  • jwksUristring | nullrequired

    A public https URL of the client's JWK set, for private_key_jwt; fetched through hardened egress and stored.

    format: uri
  • postLogoutRedirectUrisarray ofstringrequired

    format: uri
  • redirectUrisarray ofstringrequired

    Exact URIs. https, or http on loopback; a native application may use a reverse-domain private scheme, and its loopback IP redirects match any port (RFC 8252).

    format: uri
  • tokenEndpointAuthMethodclient_secret_basicorclient_secret_postorprivate_key_jwtornonerequired

    web: client_secret_basic (the default), client_secret_post or private_key_jwt; spa and native: none.

• null

One of the following:

• SamlSettings{ … }

  View SamlSettings schema →

  17 properties

  • acsUrlsarray ofstringrequired

    Exact assertion consumer service URLs (HTTP-POST binding), https (http only on loopback); the first is the default. A response only ever goes to one of these, never to a URL taken from a request.

    format: uri
  • attributesarray ofobject{ … }required

    3 properties

    • namestringrequired

      The attribute's Name, as the service provider expects it.

      maxLength: 256, minLength: 1
    • valuestringrequired

      A template: literal text with ${user.id}, ${user.email}, ${user.name}, ${user.givenName}, ${user.familyName} or ${user.department}; or exactly ${user.groups}, one value per group (filtered by groupsFilter). A value that is a single variable the user has no value for is left out.

      maxLength: 1024, minLength: 1
    • nameFormatoptionalunspecifiedoruriorbasic

      The attribute's NameFormat. Default unspecified.

  • defaultRelayStatestring | nullrequired

    The RelayState sent with IdP-initiated sign-in (where the service provider lands).

    maxLength: 1024
  • encryptAssertionsbooleanrequired

    Encrypt the assertion to the service provider's encryption certificate. Default false.

  • encryptionAlgorithmaes128-gcmoraes256-cbcrequired

    The content encryption (the key is transported with RSA-OAEP). Default aes128-gcm.

  • entityIdstringrequired

    The service provider's entity ID: the assertion's audience, and the Issuer its AuthnRequests must carry.

    maxLength: 1024, minLength: 1
  • groupsFilterassignedorallrequired

    ${user.groups}: only the groups assigned to the application (the default), or all of the user's groups.

  • idpobject{ … }required

    The directory's identity provider for this application, on its host.

    6 properties

    • certificatesarray ofobject{ … }required

      9 properties

      • activatesAtstringrequired

        format: date-time
      • certificatestringrequired

        The X.509 certificate, base64 DER.

      • fingerprintSha256stringrequired
      • idstringrequired

        format: uuid
      • notAfterstringrequired

        format: date-time
      • notBeforestringrequired

        format: date-time
      • statusactiveornextrequired

        active signs now; next is published and starts signing when the active certificate expires (made 90 days before).

      • subjectstringrequired
      • warnAtstringrequired

        60 days before notAfter: from then the console warns that service providers need the next certificate.

        format: date-time
    • entityIdstringrequired

      The IdP's entity ID for this application (its metadata URL).

    • initiateUrlstringrequired

      Opening it starts IdP-initiated sign-in (the portal tile), when idpInitiated is on.

      format: uri
    • metadataUrlstringrequired

      format: uri
    • sloUrlstringrequired

      Single logout, HTTP-Redirect and HTTP-POST bindings.

      format: uri
    • ssoUrlstringrequired

      Single sign-on, HTTP-Redirect and HTTP-POST bindings.

      format: uri
  • idpInitiatedbooleanrequired

    Allow IdP-initiated sign-in (a portal tile). Default true.

  • metadataImportedAtstring | nullrequired

    format: date-time
  • metadataUrlstring | nullrequired

    Where the service provider's metadata was imported from, if a URL.

    format: uri
  • nameIdFormatemailorpersistentortransientrequired

    email (the default), persistent (the user's ID) or transient (new for every assertion).

  • signAssertionbooleanrequired

    Sign the Assertion. Default true. At least one of the two is signed.

  • signResponsebooleanrequired

    Sign the Response. Default true.

  • sloBindingHTTP-RedirectorHTTP-POSTrequired

    Default HTTP-Redirect.

  • sloUrlstring | nullrequired

    The service provider's single logout endpoint, where logout responses go.

    format: uri
  • spCertificatesarray ofobject{ … }required

    5 properties

    • certificatestringrequired

      The X.509 certificate, base64 DER (PEM is accepted on input).

    • usesigningorencryptionrequired
    • fingerprintSha256optionalstring

      Read-only: the certificate's SHA-256 fingerprint, hex.

    • notAfteroptionalstring

      Read-only.

      format: date-time
    • subjectoptionalstring

      Read-only.

• null