sso-provider
Set, get, verify and delete an organization's OIDC or SAML provider and its email domain with hotcodepush sso-provider.
hotcodepush sso-provider manages the single sign-on provider of an organization: one OIDC or SAML provider, bound to an email domain verified through a TXT record.
Owners and Admins run it with a session from login, not an API token. Organizations covers SSO.
get
Print the organization's SSO provider with its sign-in link and, until the domain is verified, the TXT record to set. The redirect URI or the ACS URL and the TXT record print in the text output only.
hotcodepush sso-provider get
hotcodepush sso-provider get --organization Acme --jsonset
Set the organization's OIDC or SAML provider and its email domain, replacing the one before. A new domain starts unverified.
Any --oidc-* flag makes it OIDC and any --saml-* flag SAML, never both.
| Option | Type | Description |
|---|---|---|
--domain <domain> | string | The email domain whose addresses sign in through the provider, such as example.com. |
--oidc-client-id <id> | string | OIDC: the client ID the identity provider issued. |
--oidc-client-secret <secret> | string | OIDC: the client secret the identity provider issued. |
--oidc-discovery-endpoint <url> | string | OIDC: the discovery document's URL, the issuer's /.well-known/openid-configuration by default. |
--oidc-issuer <url> | string | OIDC: the identity provider's issuer URL. |
--oidc-scopes <scopes> | string | OIDC: the scopes to request, comma-separated. |
--saml-cert-path <file> | string | SAML: the identity provider's signing certificate file, sent with --saml-entity-id when no metadata is. |
--saml-entity-id <id> | string | SAML: the identity provider's entity ID. |
--saml-entry-point <url> | string | SAML: the identity provider's sign-in URL. |
--saml-issuer <issuer> | string | SAML: the identity provider's issuer. |
--saml-metadata-path <file> | string | SAML: the identity provider's metadata XML file. |
hotcodepush sso-provider set --domain example.com --oidc-issuer https://login.example.com --oidc-client-id hotcodepush --oidc-client-secret "$OIDC_CLIENT_SECRET"
hotcodepush sso-provider set --domain example.com --saml-entry-point https://idp.example.com/sso --saml-issuer https://idp.example.com --saml-metadata-path idp-metadata.xml --jsondelete
Delete the organization's SSO provider: password sign-in works again for its members, and the domain is forgotten.
Confirms once (--yes in a script).
hotcodepush sso-provider delete
hotcodepush sso-provider delete --organization Acme --yes --jsonverify
Look up the domain's TXT record and mark the domain verified when it is there. A record set a moment ago may not be visible yet. Run the command again.
hotcodepush sso-provider verify
hotcodepush sso-provider verify --organization Acme --jsonLast updated on