---
title: "oz0 oidc set"
description: "Add an identity provider, or change one: only the flags given change."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/oidc/set"
---
# oz0 oidc set

> Add an identity provider, or change one: only the flags given change.

For: Operators and developers looking up a command.

Add an identity provider, or change one: only the flags given change. --group-role and --cluster-role replace the provider's group rules, which apply at every sign-in: a cluster role for members of a group, or a role in a tenant. A membership an owner set by hand stays as it is. Without --client-secret-stdin the server is a public client and PKCE alone protects the code.

## Usage

```bash
oz0 oidc set ID [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --assume-email-verified
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --username-claim email, take the provider's addresses as verified when its tokens have no email_verified claim, for a provider that verifies or sets every address itself, such as Microsoft Entra ID; without it such a token names no account, since an unverified address could be anyone's (--assume-email-verified=false to undo)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --client-id
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the client ID the provider gave this server
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --client-secret-stdin
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      read the client secret from stdin; it is sealed with the master key and never shown again
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --cluster-role
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      GROUP=ROLE: members of the group get the cluster role admin, reader or member; repeatable
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --create-users
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      create an account for someone who has none at their first sign-in
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --default-role
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        member
      </code>
    </td>
    
    <td>
      the cluster role of accounts the provider creates: member or reader
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --disabled
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      turn the provider off (and sign out everyone who signed in through it), or on again with --disabled=false
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --display-name
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        the ID
      </code>
    </td>
    
    <td>
      what the sign-in button names, as in "Sign in with Okta"
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --group-role
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      GROUP=TENANT:ROLE[:content|:no-content]: members of the group get the role in the tenant; repeatable
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --groups-claim
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        groups
      </code>
    </td>
    
    <td>
      the claim that lists a person's groups
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --groups-source
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      where people's groups come from at sign-in: token (the groups claim, the default) or directory (what a provisioner set with account groups)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --issuer
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the issuer URL, such as <code>
        https://acme.okta.com
      </code>
      
      ; https, or http on a loopback address
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --no-client-secret
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      remove the stored client secret: a public client, with PKCE
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --scope
      </code>
    </td>
    
    <td>
      strings
    </td>
    
    <td>
      <code>
        openid, profile, email
      </code>
    </td>
    
    <td>
      scopes to ask for; repeatable
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --username-claim
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        preferred_username
      </code>
    </td>
    
    <td>
      the ID token claim an account's name comes from
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.