Version: v5.7.0

opschain admin identity providers create

Included from Basic tieridentity:builtinidentity:sso

Registers an identity provider connection. The code (the /auth/login/{code} path segment the instance is addressed by — 1-64 lowercase letters, digits, - or _) and the kind are immutable after create; everything else can change through the update verb. The client secret (oidc/github) or service bind password (ldap) is write-only: supply it through --credential-env (the name of an environment variable holding it) or --credential-prompt (a no-echo prompt), never on the command line; it is encrypted at rest and no read ever returns it.

OPSCHAIN_IDP_SECRET=cs.xxxx opschain admin identity providers create okta-prod \
  --kind oidc --issuer https://example.okta.com --client-id my-client \
  --display-name Okta --credential-env OPSCHAIN_IDP_SECRET
Created identity provider okta-prod (kind oidc) — run 'opschain admin identity providers test okta-prod'

The built-in Microsoft Entra ID provider takes your directory (tenant) id instead of an issuer — --tenant-id derives https://login.microsoftonline.com/<tenant id>/v2.0, the issuer your tenant's discovery document names. The multi-tenant common endpoint is not supported: its discovery document names the literal {tenantid} template as its issuer, so no sign-in through it can pass the issuer check, and the verb refuses it by name.

OPSCHAIN_IDP_SECRET=cs.xxxx opschain admin identity providers create entra \
  --kind oidc --tenant-id 11111111-2222-3333-4444-555555555555 \
  --client-id <application (client) id> --display-name Microsoft \
  --credential-env OPSCHAIN_IDP_SECRET

An ldap connection carries the directory fields instead of issuer/host/client-id:

OPSCHAIN_BIND_PW=pw opschain admin identity providers create corp \
  --kind ldap --directory-url ldaps://corp.example.com \
  --bind-dn 'cn=svc,dc=example,dc=com' --user-base 'ou=people,dc=example,dc=com' \
  --credential-env OPSCHAIN_BIND_PW

-o, --output json|yaml emits the created connection document.

Reference custody

Custody is reference-first: --credential-ref pins an existing secret-vault:// reference, resolved at write time through a registered server-resolved secrets provider - an unresolvable reference refuses by name - and clears any at-rest value. An inline credential is held encrypted at rest in the server's database on the record itself (never written into a vault) and clears the reference; a server with no secrets provider registered still holds it. No read ever carries the value.

Flags

Flag	Meaning
`--kind <kind>`	Adapter kind: `oidc`, `github` or `ldap` (immutable).
`--display-name <name>`	Sign-in button label the GUI renders.
`--issuer <url>`	OIDC issuer URL discovery runs against (oidc kind only).
`--tenant-id <guid>`	Microsoft Entra ID directory (tenant) id; derives the issuer `https://login.microsoftonline.com/<tenant id>/v2.0` (oidc kind; instead of `--issuer`, the two are mutually exclusive). The GUID form only — a domain name is refused.
`--host <host>`	Provider instance host (github kind: github.com or a GHES host).
`--client-id <id>`	Registered client id (oidc/github kinds).
`--credential-ref <ref>`	`secret-vault://` reference to pin as the credential (mutually exclusive with the inline channel).
`--credential-prompt`	Prompt for the client secret or bind password without echo.
`--username-claim <claim>`	Claim mapped to the shadow username (empty: preferred_username, falling back to email).
`--groups-claim <claim>`	Claim read as the provider-group snapshot (empty: groups).
`--scope <scope>`	Requested scope (repeatable; empty: openid email profile).
`--step-up <mode>`	`idp` or `platform` (github/ldap kinds: platform only).
`--enabled`	Whether the connection serves sign-ins and appears on the login page (default true).
`--display-order <n>`	Sign-in page rank (lowest first, code breaking ties; default 0).
`--directory-url <url>`	Directory URL, `ldap://host[:port]` or `ldaps://host[:port]` (ldap kind only).
`--require-tls`	Refuse a plaintext (`ldap://`) directory connection (default true; `--require-tls=false` is an explicit lab-only opt-out).
`--bind-dn <dn>`	Service account DN the adapter binds as (its password rides the credential flags).
`--user-base <dn>`	User search base DN (ldap kind).
`--user-attribute <attr>`	Attribute logins match against (empty: uid).
`--users-filter <filter>`	Filter ANDed into user searches (empty: `(objectClass=inetOrgPerson)`).
`--group-base <dn>`	Group search base DN (empty: snapshot no directory groups).
`--group-attribute <attr>`	Group entry attribute holding member DNs (empty: member).
`--groups-filter <filter>`	Filter ANDed into group searches (empty: `(objectClass=groupOfNames)`).
`--mail-attribute <attr>`	User entry attribute holding the email address (empty: mail).
`--entry-id-attribute <attr>`	Attribute identities key on (empty: detect entryUUID, falling back to objectGUID).
`--default-group <group>`	OpsChain group every identity matching no explicit group mapping resolves into (precedence: mapping > domain rule > default group).
`--email-domain-rule <domain=group>`	Place identities by verified email domain ahead of the default group (repeatable), e.g. `example.com=staff`.
`--require-hosted-domain`	Refuse sign-ins whose verified ID token carries no `hd` claim — work accounts only (oidc kind).
`--deny-public-email-domains`	Refuse auto-provisioning when the verified email's domain is on the public-provider deny list.
`--public-email-domain <domain>`	Deny-list entry overriding the built-in public-provider list (repeatable; empty keeps the built-in list).
`--pseudonymous-provisioning`	Give auto-provisioned users an opaque `Visitor-<n>` name; the real name and email stay on the user record, visible to administrators only.
`--server <url>`	Server base URL (default: the active context / `OPSCHAIN_SERVER`).
`--auth-token <token>`	Admin bearer token (default: `$OPSCHAIN_ADMIN_TOKEN`, then the token stored by `opschain admin login`).

Reference custody​

Flags​

See also​

Reference custody

Flags

See also