opschain admin identity providers update

Included from Basic tieridentity:builtinidentity:sso

Updates an identity provider connection, addressed by code or row id. Only the flags you pass change; the code and kind are immutable. A supplied credential (via --credential-env / --credential-prompt) rotates the stored client secret or bind password.

opschain admin identity providers update okta-prod --display-name "Okta (prod)" --display-order 2
Updated identity provider okta-prod

-o, --output json|yaml emits the updated connection document.

Reference custody

Custody is reference-first: the record stores a secret-vault:// reference, never a value. --credential-ref pins an existing reference, resolved at write time - an unresolvable reference refuses by name. An inline credential is vault-write sugar: the value lands in the platform vault under the reserved path and only the resulting reference is stored. Records created before the retrofit keep their inline encrypted credential until the next credential write, which moves custody to the vault.

Flags

Flag	Meaning
--display-name <name>	Sign-in button label the GUI renders.
--issuer <url>	OIDC issuer URL discovery runs against (oidc kind only).
--tenant-id <guid>	Microsoft Entra ID directory (tenant) id; derives and sends the issuer https://login.microsoftonline.com/<tenant id>/v2.0 (oidc kind; instead of --issuer, the two are mutually exclusive).
--host <host>	Provider instance host (github kind).
--client-id <id>	Registered client id (oidc/github kinds).
--credential-ref <ref>	secret-vault:// reference to pin as the credential (mutually exclusive with the inline channel).
--credential-prompt	Prompt for the replacement secret without echo.
--username-claim <claim>	Claim mapped to the shadow username.
--groups-claim <claim>	Claim read as the provider-group snapshot.
--scope <scope>	Requested scope (repeatable; a supplied list replaces the stored scopes).
--step-up <mode>	idp or platform (github/ldap kinds: platform only).
--enabled	Whether the connection serves sign-ins and appears on the login page.
--display-order <n>	Sign-in page rank (lowest first, code breaking ties).
--directory-url <url>	Directory URL (ldap kind only).
--require-tls	Refuse a plaintext (ldap://) directory connection.
--bind-dn <dn>	Service account DN the adapter binds as.
--user-base <dn>	User search base DN (ldap kind).
--user-attribute <attr>	Attribute logins match against.
--users-filter <filter>	Filter ANDed into user searches.
--group-base <dn>	Group search base DN.
--group-attribute <attr>	Group entry attribute holding member DNs.
--groups-filter <filter>	Filter ANDed into group searches.
--mail-attribute <attr>	User entry attribute holding the email address.
--entry-id-attribute <attr>	Attribute identities key on.
--default-group <group>	OpsChain group every identity matching no explicit group mapping resolves into (precedence: mapping > domain rule > default group).
--email-domain-rule <domain=group>	Place identities by verified email domain ahead of the default group (repeatable; a supplied set replaces the stored one, --email-domain-rule="" clears it).
--require-hosted-domain	Refuse sign-ins whose verified ID token carries no hd claim — work accounts only (oidc kind).
--deny-public-email-domains	Refuse auto-provisioning when the verified email's domain is on the public-provider deny list.
--public-email-domain <domain>	Deny-list entry overriding the built-in public-provider list (repeatable; a supplied set replaces the stored one, an empty set restores the built-in list).
--pseudonymous-provisioning	Give auto-provisioned users an opaque Visitor-<n> name; the real name and email stay on the user record, visible to administrators only.
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token (default: $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).

See also

• opschain docs cli/admin-identity-providers-show — the stored values.