opschain admin identity mappings create

Included from Basic tieridentity:sso

Adds one group mapping entry: a provider group (as the sign-in snapshot carries it — an OIDC groups-claim entry, a GitHub org / org/team, or a directory group name) granting exactly one of --role or --group-name.

opschain admin identity mappings create --provider okta-prod \
  --provider-group platform-admins --role admin
Created group mapping 019a…2e11: okta-prod:platform-admins -> role admin

-o, --output json|yaml emits the created entry document.

Flags

Flag	Meaning
--provider <code-or-id>	The owning connection.
--provider-group <group>	The provider group value as the sign-in snapshot carries it.
--role <role>	The role this entry grants (exactly one of --role / --group-name).
--group-name <name>	The OpsChain group name this entry grants (exactly one of --role / --group-name).
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token (default: $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).

See also

• opschain docs cli/admin-identity-mappings-delete — removing one.