Identity provider

Included from Basic tieridentity:builtinidentity:sso

An identity provider connection is one registered sign-in provider instance — an OIDC issuer, a GitHub instance or an LDAP directory — addressed by its code on the sign-in surface (/auth/login/{code}). Secrets never ride the record: the client secret or bind password is write-only, held at a secret-vault:// reference. Group mappings translate the provider's group snapshot into OpsChain groups or roles at sign-in. Served by the v2 IdentityProviderService (ListIdentityProviders, GetIdentityProvider, CreateIdentityProvider, UpdateIdentityProvider, DeleteIdentityProvider, TestIdentityProvider, SweepIdentityProvider, and the ListIdentityProviderGroupMappings / CreateIdentityProviderGroupMapping / DeleteIdentityProviderGroupMapping mapping verbs). The packaged built-in providers — GitHub on github.com, Google, and Microsoft Entra ID on a tenant-derived issuer (https://login.microsoftonline.com/<tenant id>/v2.0) — ride the identity:builtin entitlement; customer-configured OIDC instances and group-to-role mapping ride identity:sso.

IdentityProviderConnection

IdentityProviderConnection is one registered sign-in provider instance.

Field	Type	Meaning
bind_dn	string	The service account DN the adapter binds as to resolve logins and read entries; its password rides the client_secret seam (write-only, encrypted at rest). ldap kind only.
client_id	string	The registered client id.
client_secret_ref	string	The canonical secret-vault:// reference the client secret (or ldap bind password) lives at (reference-first custody) — an address, never a value. Empty on a grandfathered record whose inline secret predates reference-first custody.
client_secret_set	boolean	Whether a client secret is stored; the value itself is write-only.
code	string	The provider instance code — the path segment: /auth/login/{code} and /auth/callback/{code}. Lowercase letters, digits, '-' and '_'.
created_at	timestamp	When the record was created.
default_group	string	The OpsChain group every identity of this connection that matches no explicit group mapping resolves into. Precedence: explicit group mapping > email-domain rule > default group. Empty means no catch-all.
deny_public_email_domains	boolean	Refuse auto-provisioning when the verified primary email's domain is on the public-provider deny list (public_domain_denylist when set, the built-in list otherwise). The refusal names the posture, never the visitor's address.
directory_url	string	The directory URL the ldap kind connects to: ldap:// or ldaps://, host[:port], no path. ldap kind only.
display_name	string	The sign-in button label the GUI renders.
display_order	integer	The sign-in surface rank (login-surface amendment): GET /auth/providers serves enabled connections ordered by (display_order ascending, code ascending) and the login page renders them in that order. Admin-edited beside display_name; defaults to 0.
email_domain_rules	array of EmailDomainRule	Rules placing identities by verified email domain ahead of the default group — for example a company domain to a staff group. A rule yields to any explicit group-mapping match on the same connection.
enabled	boolean	Disabled connections are hidden from the sign-in discovery read and refuse both HTTP legs.
entry_id_attribute	string	The attribute identities key on. Empty detects at test verb / sign-in time: entryUUID (RFC 4530) when the directory serves it, objectGUID (Active Directory) otherwise. "dn" is the explicit, documented last resort for directories exposing neither — a directory rename then strands the identity. Never the username, never mail.
group_attribute	string	The group entry attribute holding member DNs; empty means "member".
group_base	string	The group search base DN; empty snapshots no directory groups.
groups_claim	string	The claim read as the provider-group snapshot; empty means "groups". A provider that emits no such claim (Google) simply snapshots no groups.
groups_filter	string	The filter ANDed into group searches; empty means "(objectClass=groupOfNames)".
host	string	The provider instance host (github.com, or a GHES host — by-host Enterprise gating arrives in a later release). Empty for oidc kind, whose instance identity is the issuer.
id	string	The record's identity.
issuer	string	The OIDC issuer URL discovery runs against (https; e.g. https://accounts.google.com). oidc kind only. The discovery document's own issuer must match it exactly, so a Microsoft Entra ID connection carries the tenant form https://login.microsoftonline.com/<tenant id>/v2.0 (opschain admin identity providers create … --tenant-id <guid> derives it); the multi-tenant common endpoint names the literal {tenantid} template as its issuer and is not supported.
kind	string	The adapter kind, an open set: "oidc", "github", and "ldap" (the one non-redirect kind: sign-in is a credentials POST to /auth/login/{code}; no callback leg exists).
mail_attribute	string	The user entry attribute holding the email address; empty means "mail".
pseudonymous_provisioning	boolean	Give auto-provisioned users an opaque Visitor-<n> username (monotonic, estate-wide, never reused) at first provisioning only; the real name and email persist on the user record and its federated identity, visible to administrators and exports only. Existing users keep their names.
public_domain_denylist	array of string	The connection's own public-provider deny list (email domains). Empty means the built-in list: gmail, googlemail, outlook, hotmail, live, yahoo, proton, protonmail, icloud, aol, gmx and mail.com.
require_hosted_domain	boolean	Refuse a sign-in whose verified ID token carries no hd (hosted-domain) claim — work accounts only; consumer accounts refuse with a use-your-work-account message. oidc kind only.
require_tls	boolean	Refuse a plaintext (ldap://) directory connection at create, update and use — the re-anchor of security.ldap_require_tls onto the connection. Defaults to true; disabling it is an explicit, documented opt-out for lab directories. ldap kind only.
scopes	array of string	The requested scopes; empty means "openid email profile".
step_up	string	The step-up mode seam (enforcement arrives in a later release): "idp" or "platform".
updated_at	timestamp	When the record was last updated.
user_attribute	string	The attribute logins are matched against; empty means "uid".
user_base	string	The user search base DN. ldap kind only.
username_claim	string	The claim mapped to the shadow username; empty means the default chain (preferred_username, falling back to email).
users_filter	string	The filter ANDed into user searches; empty means "(objectClass=inetOrgPerson)".

EmailDomainRule

EmailDomainRule maps one verified email domain to the OpsChain group its identities resolve into when no explicit group mapping matches.

Field	Type	Meaning
domain	string	The email domain, matched case-insensitively (for example limepoint.com).
group_name	string	The OpsChain group name identities of this domain resolve into.

EmailDomainRuleList

EmailDomainRuleList wraps a replaceable rule list on the update verb, so a request distinguishes "leave unchanged" (absent) from "clear" (present and empty).

Field	Type	Meaning
values	array of EmailDomainRule	The replacement rule set.

IdentityProviderGroupMapping

IdentityProviderGroupMapping is one mapping entry: a provider group, as snapshotted at sign-in, granting exactly one target — role or group_name, never both.

Field	Type	Meaning
created_at	timestamp	When the record was created.
group_name	string	The OpsChain group name this entry grants — the name existing path-RBAC policy assignments key on. Empty when role is set.
id	string	The record's identity.
provider_code	string	The owning connection's code.
provider_group	string	The provider group value as the snapshot carries it (the OIDC groups claim entry; GitHub org / org/team in a later release).
role	string	The role this entry grants. "admin" (the superuser grant) today; security_administrator and auditor join when their grant lanes land. Empty when group_name is set.
updated_at	timestamp	When the record was last updated.

Related pages

• opschain docs identity — the component page: adapters, shadow accounts and the group snapshot.
• opschain docs resources/user — the accounts sign-in creates and reconciles.
• opschain docs resources/group — the groups mappings grant.
• opschain docs resources/session — what a successful sign-in establishes.