Version: v5.6.1

opschain admin identity providers create

Included from Basic tieridentity:builtinidentity:sso

Registers an identity provider connection. The code (the /auth/login/{code} path segment the instance is addressed by — 1-64 lowercase letters, digits, - or _) and the kind are immutable after create; everything else can change through the update verb. The client secret (oidc/github) or service bind password (ldap) is write-only: supply it through --credential-env (the name of an environment variable holding it) or --credential-prompt (a no-echo prompt), never on the command line; it is encrypted at rest and no read ever returns it.

OPSCHAIN_IDP_SECRET=cs.xxxx opschain admin identity providers create okta-prod \
  --kind oidc --issuer https://example.okta.com --client-id my-client \
  --display-name Okta --credential-env OPSCHAIN_IDP_SECRET
Created identity provider okta-prod (kind oidc) — run 'opschain admin identity providers test okta-prod'

The built-in Microsoft Entra ID provider takes your directory (tenant) id instead of an issuer — --tenant-id derives https://login.microsoftonline.com/<tenant id>/v2.0, the issuer your tenant's discovery document names. The multi-tenant common endpoint is not supported: its discovery document names the literal {tenantid} template as its issuer, so no sign-in through it can pass the issuer check, and the verb refuses it by name.

OPSCHAIN_IDP_SECRET=cs.xxxx opschain admin identity providers create entra \
  --kind oidc --tenant-id 11111111-2222-3333-4444-555555555555 \
  --client-id <application (client) id> --display-name Microsoft \
  --credential-env OPSCHAIN_IDP_SECRET

An ldap connection carries the directory fields instead of issuer/host/client-id:

OPSCHAIN_BIND_PW=pw opschain admin identity providers create corp \
  --kind ldap --directory-url ldaps://corp.example.com \
  --bind-dn 'cn=svc,dc=example,dc=com' --user-base 'ou=people,dc=example,dc=com' \
  --credential-env OPSCHAIN_BIND_PW

-o, --output json|yaml emits the created connection document.

Reference custody

Custody is reference-first: the record stores a secret-vault:// reference, never a value. --credential-ref pins an existing reference, resolved at write time - an unresolvable reference refuses by name. An inline credential is vault-write sugar: the value lands in the platform vault under the reserved path and only the resulting reference is stored. Records created before the retrofit keep their inline encrypted credential until the next credential write, which moves custody to the vault.

Flags

Flag	Meaning
`--kind <kind>`	Adapter kind: `oidc`, `github` or `ldap` (immutable).
`--display-name <name>`	Sign-in button label the GUI renders.
`--issuer <url>`	OIDC issuer URL discovery runs against (oidc kind only).
`--tenant-id <guid>`	Microsoft Entra ID directory (tenant) id; derives the issuer `https://login.microsoftonline.com/<tenant id>/v2.0` (oidc kind; instead of `--issuer`, the two are mutually exclusive). The GUID form only — a domain name is refused.
`--host <host>`	Provider instance host (github kind: github.com or a GHES host).
`--client-id <id>`	Registered client id (oidc/github kinds).
`--credential-ref <ref>`	`secret-vault://` reference to pin as the credential (mutually exclusive with the inline channel).
`--credential-prompt`	Prompt for the client secret or bind password without echo.
`--username-claim <claim>`	Claim mapped to the shadow username (empty: preferred_username, falling back to email).
`--groups-claim <claim>`	Claim read as the provider-group snapshot (empty: groups).
`--scope <scope>`	Requested scope (repeatable; empty: openid email profile).
`--step-up <mode>`	`idp` or `platform` (github/ldap kinds: platform only).
`--enabled`	Whether the connection serves sign-ins and appears on the login page (default true).
`--display-order <n>`	Sign-in page rank (lowest first, code breaking ties; default 0).
`--directory-url <url>`	Directory URL, `ldap://host[:port]` or `ldaps://host[:port]` (ldap kind only).
`--require-tls`	Refuse a plaintext (`ldap://`) directory connection (default true; `--require-tls=false` is an explicit lab-only opt-out).
`--bind-dn <dn>`	Service account DN the adapter binds as (its password rides the credential flags).
`--user-base <dn>`	User search base DN (ldap kind).
`--user-attribute <attr>`	Attribute logins match against (empty: uid).
`--users-filter <filter>`	Filter ANDed into user searches (empty: `(objectClass=inetOrgPerson)`).
`--group-base <dn>`	Group search base DN (empty: snapshot no directory groups).
`--group-attribute <attr>`	Group entry attribute holding member DNs (empty: member).
`--groups-filter <filter>`	Filter ANDed into group searches (empty: `(objectClass=groupOfNames)`).
`--mail-attribute <attr>`	User entry attribute holding the email address (empty: mail).
`--entry-id-attribute <attr>`	Attribute identities key on (empty: detect entryUUID, falling back to objectGUID).
`--default-group <group>`	OpsChain group every identity matching no explicit group mapping resolves into (precedence: mapping > domain rule > default group).
`--email-domain-rule <domain=group>`	Place identities by verified email domain ahead of the default group (repeatable), e.g. `example.com=staff`.
`--require-hosted-domain`	Refuse sign-ins whose verified ID token carries no `hd` claim — work accounts only (oidc kind).
`--deny-public-email-domains`	Refuse auto-provisioning when the verified email's domain is on the public-provider deny list.
`--public-email-domain <domain>`	Deny-list entry overriding the built-in public-provider list (repeatable; empty keeps the built-in list).
`--pseudonymous-provisioning`	Give auto-provisioned users an opaque `Visitor-<n>` name; the real name and email stay on the user record, visible to administrators only.
`--server <url>`	Server base URL (default: the active context / `OPSCHAIN_SERVER`).
`--auth-token <token>`	Admin bearer token (default: `$OPSCHAIN_ADMIN_TOKEN`, then the token stored by `opschain admin login`).

Reference custody​

Flags​

See also​

Reference custody

Flags

See also