Version: v5.6.1

opschain admin identity providers

Included from Basic tieridentity:builtinidentity:sso

Manage the IdentityProviderConnection registry federated sign-in rides: one connection per provider instance — kind (oidc | github | ldap), the sign-in presentation (display name and order), the kind's adapter configuration (issuer/host/claims/scopes, or the ldap directory fields), the step-up mode and an enabled flag — addressed by its code, the immutable /auth/login/{code} path segment. The client secret (OIDC/GitHub) or service bind password (ldap) is encrypted and write-only: requests carry it via env/prompt, reads report only whether one is stored.

Subcommand	Purpose
`list`	Every connection: code, kind, display name, step-up, enabled, order.
`show <code-or-id>`	One connection's full facts.
`create <code>`	Register a connection (credential via env/prompt, never argv).
`update <code-or-id>`	Change fields; a supplied credential rotates the stored secret.
`delete <code-or-id>`	Remove a connection (its users can no longer sign in through it).
`test <code-or-id>`	Probe the connection the way a sign-in would start.
`sweep <code-or-id>`	The ldap directory sweep: re-key, import, disable leavers.

Every verb rides the v2 IdentityProviderService, which authenticates user tokens only: the caller's own opschain login session is the primary credential (a static platform admin token never works on the v2 lane). An explicit --auth-token wins, and OPSCHAIN_ADMIN_TOKEN / the opschain admin login token remain the fallback for automation that runs without a login; the server still requires the /admin updatable determination (a superuser qualifies).

Exit codes: 0 on success, 1 when a call fails or the token is rejected, 2 for usage errors.

See also​

See also