Skip to content
Kindgi

kindgi sso

View as Markdown

kindgi sso

Section titled “kindgi sso”

Synopsis

Terminal window
kindgi sso <command>
Signature

Sign-in with your organization's identity provider (single sign-on).

Commands

Command Description
kindgi sso providers Your organization's identity providers (Google, Entra ID, Okta, Keycloak, SAML…).

See also

kindgi sso providers

Section titled “kindgi sso providers”

Synopsis

Terminal window
kindgi sso providers <command>
Signature

Your organization's identity providers (Google, Entra ID, Okta, Keycloak, SAML…).

Commands

Command Description
kindgi sso providers start Get the URLs to give your identity provider, before registering anything, and a message to send IT.
kindgi sso providers finish Register the provider with what your identity provider gave back.
kindgi sso providers update Change a provider; its URLs (on your identity provider's side) don't change.
kindgi sso providers get Show one provider, with the URLs your identity provider has.
kindgi sso providers list List this tenant's sign-in providers.
kindgi sso providers test The link to try signing in with a provider, as a person at one of its domains.
kindgi sso providers remove Stop signing in with a provider.

See also

kindgi sso providers start

Section titled “kindgi sso providers start”

Synopsis

Terminal window
kindgi sso providers start <provider-id> [--kind=oidc|saml] [--idp=google|entra|okta|keycloak]
Signature

Get the URLs to give your identity provider, before registering anything, and a message to send IT.

Options

Option Default Description
--idp <value> none Add the click-by-click steps for google, entra, okta or keycloak (OIDC).
--kind <value> none: the --idp preset's kind if given, else the registered provider's own (required before it's registered) oidc (OpenID Connect) or saml. Needed until the provider is registered, unless --idp gives it; after that, the registered provider's kind.

Every command also takes the global flags.

Examples

From Microsoft Entra ID:

Terminal window
npx --yes @kindgi/cli@0.1 sso providers start acme-entra --idp=entra

From Google Workspace:

Terminal window
npx --yes @kindgi/cli@0.1 sso providers start acme-google --idp=google

See also

kindgi sso providers finish

Section titled “kindgi sso providers finish”

Synopsis

Terminal window
kindgi sso providers finish <provider-id> --domains=<d> (--kind=oidc --issuer=<url> --client-id=<id> --client-secret-ref=<NAME> | --kind=saml --idp-metadata=@<file>) [--name=<text>] [...]
Signature

Register the provider with what your identity provider gave back.

Options

Option Default Description
--client-id <value> none OIDC: the client ID.
--client-secret-ref <value> none OIDC: the NAME of the client secret in Kindgi's secret store (kindgi secrets set <NAME>), never the secret.
--domains <value> required An email domain whose people sign in with it (acme.com); repeatable or comma-separated. Repeatable.
--idp-metadata <value> none SAML: the identity provider's metadata XML, as @<file>.
--issuer <value> none OIDC: the issuer URL.
--kind <value> required oidc (OpenID Connect: Google, Entra ID, Okta, Keycloak…) or saml.
--name <value> none What the sign-in button says ("Sign in with …").
--sp-signing-key-ref <value> none SAML: the NAME of the signing key, for identity providers that want signed requests.
--spec <value> none Any other provider fields, as inline JSON or @<file> (flags win).

Every command also takes the global flags.

Examples

From Microsoft Entra ID:

Terminal window
npx --yes @kindgi/cli@0.1 sso providers finish acme-entra --kind=oidc \

From Google Workspace:

Terminal window
npx --yes @kindgi/cli@0.1 sso providers finish acme-google --kind=oidc --issuer=https://accounts.google.com \

See also

kindgi sso providers update

Section titled “kindgi sso providers update”

Synopsis

Terminal window
kindgi sso providers update <provider-id> [--client-id=<id>] [--client-secret-ref=<NAME>] [--domains=<d>] [--name=<text>] [--remove=<field>] [...]
Signature

Change a provider; its URLs (on your identity provider's side) don't change.

Options

Option Default Description
--client-id <value> none OIDC: the client ID.
--client-secret-ref <value> none OIDC: the NAME of the client secret in Kindgi's secret store (kindgi secrets set <NAME>), never the secret.
--domains <value> none An email domain whose people sign in with it (acme.com); repeatable or comma-separated. Repeatable.
--idp-metadata <value> none SAML: the identity provider's metadata XML, as @<file>.
--issuer <value> none OIDC: the issuer URL.
--kind <value> none oidc (OpenID Connect: Google, Entra ID, Okta, Keycloak…) or saml.
--name <value> none What the sign-in button says ("Sign in with …").
--remove <value> none An optional field to remove (e.g. displayName, domains); repeatable. Repeatable.
--sp-signing-key-ref <value> none SAML: the NAME of the signing key, for identity providers that want signed requests.
--spec <value> none Any other provider fields, as inline JSON or @<file> (flags win).

Every command also takes the global flags.

Examples

Point a provider at a rotated client secret.

Terminal window
kindgi sso providers update acme-okta --client-secret-ref=ACME_OKTA_SECRET_V2

Add a second sign-in domain and drop the display name.

Terminal window
kindgi sso providers update acme-okta --domains=acme.com,acme-ops.com --remove=displayName

See also

kindgi sso providers get

Section titled “kindgi sso providers get”

Synopsis

Terminal window
kindgi sso providers get <provider-id>
Signature

Show one provider, with the URLs your identity provider has.

Options

Every command also takes the global flags.

Examples

Show a provider and the URLs to give your identity provider.

Terminal window
kindgi sso providers get acme-okta

See also

kindgi sso providers list

Section titled “kindgi sso providers list”

Synopsis

Terminal window
kindgi sso providers list
Signature

List this tenant's sign-in providers.

Options

Every command also takes the global flags.

Examples

From Set up SSO:

Terminal window
npx --yes @kindgi/cli@0.1 sso providers list --table

See also

kindgi sso providers test

Section titled “kindgi sso providers test”

Synopsis

Terminal window
kindgi sso providers test <provider-id> [--email=<someone@your-domain>]
Signature

The link to try signing in with a provider, as a person at one of its domains.

Options

Option Default Description
--email <value> someone@ the provider's first domain Whose sign-in to try; default: someone at the provider's first domain.

Every command also takes the global flags.

Examples

From Set up SSO:

Terminal window
npx --yes @kindgi/cli@0.1 sso providers test acme-kc

See also

kindgi sso providers remove

Section titled “kindgi sso providers remove”

Synopsis

Terminal window
kindgi sso providers remove <provider-id>
Signature

Stop signing in with a provider. Registering the same id again gives it the same URLs, but nobody's earlier sign-in carries over.

Options

Every command also takes the global flags.

Examples

Stop signing in with a provider.

Terminal window
kindgi sso providers remove acme-okta

See also