oz0 oidc set
Add an identity provider, or change one: only the flags given change.
For: Operators and developers looking up a command.
Add an identity provider, or change one: only the flags given change. --group-role and --cluster-role replace the provider's group rules, which apply at every sign-in: a cluster role for members of a group, or a role in a tenant. A membership an owner set by hand stays as it is. Without --client-secret-stdin the server is a public client and PKCE alone protects the code.
Usage
oz0 oidc set ID [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--assume-email-verified | bool | with --username-claim email, take the provider's addresses as verified when its tokens have no email_verified claim, for a provider that verifies or sets every address itself, such as Microsoft Entra ID; without it such a token names no account, since an unverified address could be anyone's (--assume-email-verified=false to undo) | |
--client-id | string | the client ID the provider gave this server | |
--client-secret-stdin | bool | read the client secret from stdin; it is sealed with the master key and never shown again | |
--cluster-role | stringArray | GROUP=ROLE: members of the group get the cluster role admin, reader or member; repeatable | |
--create-users | bool | create an account for someone who has none at their first sign-in | |
--default-role | string | member | the cluster role of accounts the provider creates: member or reader |
--disabled | bool | turn the provider off (and sign out everyone who signed in through it), or on again with --disabled=false | |
--display-name | string | the ID | what the sign-in button names, as in "Sign in with Okta" |
--group-role | stringArray | GROUP=TENANT:ROLE[:content|:no-content]: members of the group get the role in the tenant; repeatable | |
--groups-claim | string | groups | the claim that lists a person's groups |
--groups-source | string | where people's groups come from at sign-in: token (the groups claim, the default) or directory (what a provisioner set with account groups) | |
--issuer | string | the issuer URL, such as https://acme.okta.com; https, or http on a loopback address | |
--no-client-secret | bool | remove the stored client secret: a public client, with PKCE | |
--scope | strings | openid, profile, email | scopes to ask for; repeatable |
--username-claim | string | preferred_username | the ID token claim an account's name comes from |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.