CreateSsoProviderRequest

Register an SSO provider. protocol selects the field set: OIDC requires clientId + clientSecret; SAML requires either idpMetadataXml or the entryPoint + cert pair. Fields for the other protocol are rejected.

domain
Type: string
required
issuer
Type: stringFormat: uri
required

OIDC issuer URL, or the IdP entityID for SAML
providerId
Type: string
required

Unique, URL-safe identifier for this provider
authorizationEndpoint
Type: stringFormat: uri
cert
Type: string

SAML only — IdP signing certificate (PEM or bare base64); requires entryPoint
clientId
Type: string

OIDC only — required for an OIDC provider
clientSecret
Type: string

OIDC only — required for an OIDC provider
disableImplicitSignUp
Type: boolean
discoveryEndpoint
Type: stringFormat: uri
entryPoint
Type: stringFormat: uri

SAML only — IdP SSO entry point; requires cert
identifierFormat
Type: string

SAML only — NameID format the SP requests
idpMetadataXml
Type: string

SAML only — full IdP federation metadata XML (mutually sufficient with entryPoint + cert)
jwksEndpoint
Type: stringFormat: uri
label
Type: string
mapping
Type:

SAML assertion-attribute mapping (SAML only). All keys optional; unset keys use the plugin defaults.

Properties: 5
protocol
Type: "oidc" or "saml"enum

Defaults to oidc when omitted, so an OIDC body needs no protocol key
scopes
Type: array of string
tokenEndpoint
Type: stringFormat: uri

PreviewSsoMetadataRequest

SamlAttributeMapping