opschain admin identity providers update

Included from Basic tieridentity:builtinidentity:sso

Updates an identity provider connection, addressed by code or row id. Only the flags you pass change; the code and kind are immutable. A supplied credential (via --credential-env / --credential-prompt) rotates the stored client secret or bind password.

opschain admin identity providers update okta-prod --display-name "Okta (prod)" --display-order 2
Updated identity provider okta-prod

-o, --output json|yaml emits the updated connection document.

Reference custody

Custody is reference-first: --credential-ref pins an existing secret-vault:// reference, resolved at write time through a registered server-resolved secrets provider - an unresolvable reference refuses by name - and clears any at-rest value. An inline credential is held encrypted at rest in the server's database on the record itself (never written into a vault) and clears the reference; a server with no secrets provider registered still holds it. No read ever carries the value.

Flags

Flag	Meaning
--display-name <name>	Sign-in button label the GUI renders.
--issuer <url>	OIDC issuer URL discovery runs against (oidc kind only).
--tenant-id <guid>	Microsoft Entra ID directory (tenant) id; derives and sends the issuer https://login.microsoftonline.com/<tenant id>/v2.0 (oidc kind; instead of --issuer, the two are mutually exclusive).
--host <host>	Provider instance host (github kind).
--client-id <id>	Registered client id (oidc/github kinds).
--credential-ref <ref>	secret-vault:// reference to pin as the credential (mutually exclusive with the inline channel).
--credential-prompt	Prompt for the replacement secret without echo.
--username-claim <claim>	Claim mapped to the shadow username.
--groups-claim <claim>	Claim read as the provider-group snapshot.
--scope <scope>	Requested scope (repeatable; a supplied list replaces the stored scopes).
--step-up <mode>	idp or platform (github/ldap kinds: platform only).
--enabled	Whether the connection serves sign-ins and appears on the login page.
--display-order <n>	Sign-in page rank (lowest first, code breaking ties).
--directory-url <url>	Directory URL (ldap kind only).
--require-tls	Refuse a plaintext (ldap://) directory connection.
--bind-dn <dn>	Service account DN the adapter binds as.
--user-base <dn>	User search base DN (ldap kind).
--user-attribute <attr>	Attribute logins match against.
--users-filter <filter>	Filter ANDed into user searches.
--group-base <dn>	Group search base DN.
--group-attribute <attr>	Group entry attribute holding member DNs.
--groups-filter <filter>	Filter ANDed into group searches.
--mail-attribute <attr>	User entry attribute holding the email address.
--entry-id-attribute <attr>	Attribute identities key on.
--default-group <group>	OpsChain group every identity matching no explicit group mapping resolves into (precedence: mapping > domain rule > default group).
--email-domain-rule <domain=group>	Place identities by verified email domain ahead of the default group (repeatable; a supplied set replaces the stored one, --email-domain-rule="" clears it).
--require-hosted-domain	Refuse sign-ins whose verified ID token carries no hd claim — work accounts only (oidc kind).
--deny-public-email-domains	Refuse auto-provisioning when the verified email's domain is on the public-provider deny list.
--public-email-domain <domain>	Deny-list entry overriding the built-in public-provider list (repeatable; a supplied set replaces the stored one, an empty set restores the built-in list).
--pseudonymous-provisioning	Give auto-provisioned users an opaque Visitor-<n> name; the real name and email stay on the user record, visible to administrators only.
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token (default: $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).

See also

• opschain docs cli/admin-identity-providers-show — the stored values.