opschain admin identity mappings
Included from Basic tieridentity:sso
Manage the group→role mapping entries: each entry grants a
provider group, as snapshotted at interactive sign-in, exactly one target —
a role (admin today), or an OpsChain group name the existing path-RBAC
policy assignments key on. Resolution reads the stored snapshot, never the
IdP: IdP-side group changes apply at the user's next sign-in; mapping
writes apply to the next authorisation decision.
| Subcommand | Purpose |
|---|---|
list | Every entry, or one connection's with --provider. |
create | Add one entry: --provider + --provider-group + one of --role / --group-name. |
delete <id> | Remove one entry; its grant stops applying immediately. |
Every verb rides the v2 IdentityProviderService under the same credential
conventions as admin identity providers.
See also
opschain docs cli/admin-identity-providers— the connections mapped.