ts auth-provider

Show, create, adjust, or remove an OIDC or SAML2 single sign-on provider. Reach for it to check what a provider is pointed at, or to rotate a client secret without opening the Administration site.

Usage

ts auth-providers
ts auth-provider <name>
ts auth-provider new <name> --type=oidc --metadata-url=URL --client-id=ID --client-secret=SECRET
ts auth-provider new <name> --type=saml2 --metadata-url=URL --issuer=URI
ts auth-provider set <name> <property> <value>
ts auth-provider delete <name> [--force]

Description

An authentication provider is the identity provider users sign in through — ts login --auth=sso, the Portal, and the Administration site all go through the same set. ts auth-providers lists them with type, metadata URL, and how many tenants each carries. Every singular form accepts either the provider's name or its id.

Secrets are write-only, everywhere. Reads never return a stored secret: an OIDC client secret shows as configured (…4f2a) or (not set), and a SAML request-signing key shows only as configured or not. That is true of the JSON output as well, so --format=json is safe to capture in a build log.

The same rule governs writes. set sends only the property you name, and the server keeps every stored value you did not send — including secrets. Omitting a secret on an update preserves it, so renaming a provider or repointing its metadata URL never silently blanks its credentials. To change a secret you have to supply the new value; there is no "clear it" gesture.

new requires --type. An OIDC provider also needs --metadata-url, --client-id, and --client-secret; a SAML2 provider needs --metadata-url and an absolute --issuer URI, and is created with single logout enabled. The server rejects an incomplete request rather than creating a half-configured provider.

set accepts these properties. Which ones apply depends on the provider's type:

• Both — name, metadata-url
• OIDC — client-id, client-secret, native-application-id, scopes
• SAML2 — issuer, name-id-format, request-signing, sign-key, signature-algorithm, name-id-attribute, given-name-attribute, surname-attribute, groups-attribute, graph-client-id, graph-client-secret, enable-single-logout

request-signing and enable-single-logout take true or false and nothing else. A property that does not apply to the provider's type is still accepted, and the command still reports it as set — but the server ignores it, so check the type before assuming a SAML property landed on an OIDC provider. Tenants are not editable from ts; the list command shows the count, and the Administration site edits them under Identity → Authentication.

delete confirms first, then marks the provider deleted and drops it from the list. Users who signed in through it keep their accounts; they simply lose that route in. Creating, changing, and deleting a provider are all written to the operator audit log with the acting administrator, which is what makes an SSO configuration change traceable afterwards.

Options

Flag	Description	Default/Values	Notes
--type	Provider type.	oidc, saml2	new only, and required there.
--metadata-url	Provider metadata URL.	http(s) URL	new only; required for both types.
--client-id	OIDC client id.		new only; required for oidc.
--client-secret	OIDC client secret.		new only; required for oidc. Lands in shell history — see below.
--issuer	SAML2 issuer URI.	Absolute URI, urn: allowed	new only; required for saml2.
--force, -f	Delete without confirming.		delete only. Required when there is no terminal.

Examples

# What providers are configured?
ts auth-providers

# One provider, including whether its secret is set
ts auth-provider Entra

# Add an OIDC provider
ts auth-provider new Entra --type=oidc \
  --metadata-url=https://login.example.com/.well-known/openid-configuration \
  --client-id=6f21c8e0-91a4-4b7d-8e33-2a6f5c1d0b88 \
  --client-secret="$OIDC_SECRET"

# Add a SAML2 provider
ts auth-provider new Okta --type=saml2 \
  --metadata-url=https://example.okta.com/app/abc123/sso/saml/metadata \
  --issuer=urn:turbo:example

# Repoint the metadata URL; the client secret is untouched
ts auth-provider set Entra metadata-url https://login.example.com/v2/.well-known/openid-configuration

# Rotate the secret after rotating it at the identity provider
ts auth-provider set Entra client-secret "$NEW_OIDC_SECRET"

# Retire a provider
ts auth-provider delete Okta --force

# Full metadata URLs, untruncated
ts auth-providers --no-trunc

# A secret typed literally is recorded in shell history and visible in the
# process list. Read it from an environment variable or a prompt instead.
ts auth-provider set Entra client-secret hunter2

Output

NAME   TYPE   METADATA URL                                                  TENANTS  ID
Entra  oidc   https://login.example.com/.well-known/openid-configuration    2        4f21c8e0-91a4-4b7d-8e33-2a6f5c1d0b88
Okta   saml2  https://example.okta.com/app/abc123/sso/saml/metadata         0        8a1c7e42-90bb-4d15-a3f7-6c2e0b9d4517

Name:     Entra
Type:     oidc
Metadata: https://login.example.com/.well-known/openid-configuration
Client:   6f21c8e0-91a4-4b7d-8e33-2a6f5c1d0b88
Secret:   configured (…4f2a)

For a SAML2 provider, the last lines are the issuer and whether request signing is enabled and has a key.

Exit Codes

0 on success. -1 when set is given a property outside the list above, when a boolean property gets something other than true or false, when new is missing --type or a field its type requires, or when a provider by that name already exists. -4 when no account is signed in. -5 when the account is not a Server Administrator. -6 when no provider matches the name or id.

Related Commands

• ts login — --auth=sso signs in through one of these providers.
• ts directory-service — Directory-backed sign-in, the other route into the server.
• ts audit — Who changed the SSO configuration, and when.
• ts user — The accounts that arrive through a provider.