SSO Strategies
An SSOStrategy is a way for users to sign in via another identity provider, such as Okta or Auth0.
It is rare that you will need to use API endpoints for managing these, and we recommend instead managing these via the web interface. Nevertheless, we share the API documentation here.
Data Source Schema
Required
| Property | Description |
|---|---|
| id Int64 | ID |
Read Only
| Property | Description |
|---|---|
| protocol String | SSO Protocol Possible values: oauth2, saml, active_directory, open_ldap, scim |
| provider_ String | Provider name Possible values: google, auth0, okta, azure, box, dropbox, slack, onelogin, saml, idaptive, ldap, scim, jumpcloud, duo |
| label String | Custom label for the SSO provider on the login page. |
| logo_url String | URL holding a custom logo for the SSO provider on the login page. |
| enabled Bool | Is strategy enabled? This may become automatically set to false after a high number and duration of failures. |
| user_count Int64 | Count of users with this SSO Strategy |
| saml_provider_cert_fingerprint String | Identity provider sha256 cert fingerprint if saml_provider_metadata_url is not available. |
| saml_provider_issuer_url String | Identity provider issuer url |
| saml_provider_metadata_content String | Custom identity provider metadata |
| saml_provider_metadata_url String | Metadata URL for the SAML identity provider |
| saml_provider_slo_target_url String | Identity provider SLO endpoint |
| saml_provider_sso_target_url String | Identity provider SSO endpoint if saml_provider_metadata_url is not available. |
| scim_authentication_method String | SCIM authentication type. Possible values: none, basic, token |
| scim_username String | SCIM username. |
| scim_oauth_access_token String | SCIM OAuth Access Token. |
| scim_oauth_access_token_expires_at String | SCIM OAuth Access Token Expiration Time. |
| subdomain String | Subdomain or domain name for your auth provider. Example: https://[subdomain].okta.com/ |
| provision_users Bool | Auto-provision users? |
| provision_groups Bool | Auto-provision group membership based on group memberships on the SSO side? |
| deprovision_users Bool | Auto-deprovision users? |
| deprovision_groups Bool | Auto-deprovision group membership based on group memberships on the SSO side? |
| deprovision_behavior String | Method used for deprovisioning users. Possible values: disable, delete |
| provision_group_default String | Comma-separated list of group names for groups to automatically add all auto-provisioned users to. |
| provision_group_exclusion String | Comma-separated list of group names for groups (with optional wildcards) that will be excluded from auto-provisioning. |
| provision_group_inclusion String | Comma-separated list of group names for groups (with optional wildcards) that will be auto-provisioned. |
| provision_group_required String | Comma or newline separated list of group names (with optional wildcards) to require membership for user provisioning. |
| provision_email_signup_groups String | Comma-separated list of group names whose members will be created with email_signup authentication. |
| provision_readonly_site_admin_groups String | Comma-separated list of group names whose members will be created as Read-Only Site Admins. |
| provision_site_admin_groups String | Comma-separated list of group names whose members will be created as Site Admins. |
| provision_group_admin_groups String | Comma-separated list of group names whose members will be provisioned as Group Admins. |
| provision_attachments_permission Bool | |
| provision_dav_permission Bool | Auto-provisioned users get WebDAV permission? |
| provision_ftp_permission Bool | Auto-provisioned users get FTP permission? |
| provision_sftp_permission Bool | Auto-provisioned users get SFTP permission? |
| provision_time_zone String | Default time zone for auto provisioned users. |
| provision_company String | Default company for auto provisioned users. |
| provision_require_2fa String | 2FA required setting for auto provisioned users. use_system_setting uses the site-wide setting, including SSO exemptions. always_require and never_require override the site-wide setting when user-level overrides are allowed.Possible values: use_system_setting, always_require, never_require |
| provision_filesystem_layout String | File System layout to use for auto provisioned users. Possible values: site_root, user_root, partner_root, integration_centric |
| provider_identifier String | URL-friendly, unique identifier for Azure SAML configuration |
| ldap_base_dn String | Base DN for looking up users in LDAP server |
| ldap_domain String | Domain name that will be appended to LDAP usernames |
| display_on_login_page Bool | Should this strategy be displayed on the login page? |
| ldap_host String | LDAP host |
| ldap_host_2 String | LDAP backup host |
| ldap_host_3 String | LDAP backup host |
| ldap_port Int64 | LDAP port |
| ldap_provisioning_enabled Bool | Use LDAP server settings for scheduled provisioning while using this SSO provider for authentication? |
| ldap_secure Bool | Use secure LDAP? |
| ldap_type String | LDAP server type Possible values: active_directory, open_ldap |
| ldap_username String | Username for signing in to LDAP server. |
| ldap_username_field String | LDAP username field Possible values: sAMAccountName, userPrincipalName |