opschain admin identity providers sweep
Included from Basic tier
Runs the directory sweep against an ldap-kind connection:
one service-bind read of the directory's users serving three outcomes in
one mechanism — legacy auth_provider='ldap' rows are eagerly re-keyed
onto their directory entry id (user id preserved, grants carried), directory
users with no row yet are imported as administrable shadow identities, and
held identities whose directory entry has vanished are disabled as leavers
with their live credentials revoked. An unreachable directory refuses and
disables nothing.
opschain admin identity providers sweep corp
Swept identity provider corp: 42 directory users — 40 already linked, 1 re-keyed, 1 imported, 0 leavers disabled
-o, --output json|yaml emits the full report, including the
unresolved_legacy usernames (renamed or deleted entries the operator must
resolve) and the skipped entries with their reasons.
Flags
| Flag | Meaning |
|---|---|
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token (default: $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
See also
opschain docs cli/admin-identity-providers-test— the connection probe.