kindgi sso
Sign-in with your organization's identity provider (single sign-on).
kindgi sso providers
Section titled “kindgi sso providers”Your organization's identity providers (Google, Entra ID, Okta, Keycloak, SAML…).
kindgi sso providers start
Section titled “kindgi sso providers start”Get the URLs to give your identity provider, before registering anything, and a message to send IT.
kindgi sso providers start <provider-id> --kind=oidc|saml [--idp=google|entra|okta|keycloak]Flags:
--idp <value>: Add the click-by-click steps forgoogle,entra,oktaorkeycloak(OIDC).--kind <value>:oidc(OpenID Connect: Google, Entra ID, Okta, Keycloak…) orsaml.
kindgi sso providers finish
Section titled “kindgi sso providers finish”Register the provider with what your identity provider gave back.
kindgi sso providers finish <provider-id> --domains=<d> (--kind=oidc --issuer=<url> --client-id=<id> --client-secret-ref=<NAME> | --kind=saml --idp-metadata=@<file>) [--name=<text>] [...]Flags:
--client-id <value>: OIDC: the client ID.--client-secret-ref <value>: OIDC: the NAME of the client secret in Kindgi's secret store (kindgi secrets set <NAME>), never the secret.--domains <value>: An email domain whose people sign in with it (acme.com); repeatable or comma-separated. (repeatable)--idp-metadata <value>: SAML: the identity provider's metadata XML, as@<file>.--issuer <value>: OIDC: the issuer URL.--kind <value>:oidc(OpenID Connect: Google, Entra ID, Okta, Keycloak…) orsaml.--name <value>: What the sign-in button says ("Sign in with …").--sp-signing-key-ref <value>: SAML: the NAME of the signing key, for identity providers that want signed requests.--spec <value>: Any other provider fields, as inline JSON or@<file>(flags win).
kindgi sso providers update
Section titled “kindgi sso providers update”Change a provider; its URLs (on your identity provider's side) don't change.
kindgi sso providers update <provider-id> [--client-id=<id>] [--client-secret-ref=<NAME>] [--domains=<d>] [--name=<text>] [--remove=<field>] [...]Flags:
--client-id <value>: OIDC: the client ID.--client-secret-ref <value>: OIDC: the NAME of the client secret in Kindgi's secret store (kindgi secrets set <NAME>), never the secret.--domains <value>: An email domain whose people sign in with it (acme.com); repeatable or comma-separated. (repeatable)--idp-metadata <value>: SAML: the identity provider's metadata XML, as@<file>.--issuer <value>: OIDC: the issuer URL.--kind <value>:oidc(OpenID Connect: Google, Entra ID, Okta, Keycloak…) orsaml.--name <value>: What the sign-in button says ("Sign in with …").--remove <value>: An optional field to remove (e.g.displayName,domains); repeatable. (repeatable)--sp-signing-key-ref <value>: SAML: the NAME of the signing key, for identity providers that want signed requests.--spec <value>: Any other provider fields, as inline JSON or@<file>(flags win).
kindgi sso providers get
Section titled “kindgi sso providers get”Show one provider, with the URLs your identity provider has.
kindgi sso providers get <provider-id>kindgi sso providers list
Section titled “kindgi sso providers list”List this tenant's sign-in providers.
kindgi sso providers listkindgi sso providers test
Section titled “kindgi sso providers test”The link to try signing in with a provider, as a person at one of its domains.
kindgi sso providers test <provider-id> [--email=<someone@your-domain>]Flags:
--email <value>: Whose sign-in to try; default: someone at the provider's first domain.
kindgi sso providers remove
Section titled “kindgi sso providers remove”Stop signing in with a provider. Registering the same id again gives it the same URLs, but nobody's earlier sign-in carries over.
kindgi sso providers remove <provider-id>Every command also takes the global flags.