# kindgi sso

> Sign-in with your organization's identity provider (single sign-on)

## `kindgi sso`

**Synopsis**

```sh signature
kindgi sso <command>
```

Sign-in with your organization's identity provider (single sign-on).

**Commands**

| Command                                                                                            | Description                                                                       |
| -------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- |
| [`kindgi sso providers`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers) | Your organization's identity providers (Google, Entra ID, Okta, Keycloak, SAML…). |

**See also**

- [Microsoft Entra ID](https://docs.kindgi.com/v0.1.9/guides/sso/entra-id.md)
- [Google Workspace](https://docs.kindgi.com/v0.1.9/guides/sso/google.md)
- [Set up SSO](https://docs.kindgi.com/v0.1.9/guides/sso.md)
- [Keycloak](https://docs.kindgi.com/v0.1.9/guides/sso/keycloak.md)

### `kindgi sso providers`

**Synopsis**

```sh signature
kindgi sso providers <command>
```

Your organization's identity providers (Google, Entra ID, Okta, Keycloak, SAML…).

**Commands**

| Command                                                                                                          | Description                                                                                         |
| ---------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| [`kindgi sso providers start`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers-start)   | Get the URLs to give your identity provider, before registering anything, and a message to send IT. |
| [`kindgi sso providers finish`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers-finish) | Register the provider with what your identity provider gave back.                                   |
| [`kindgi sso providers update`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers-update) | Change a provider; its URLs (on your identity provider's side) don't change.                        |
| [`kindgi sso providers get`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers-get)       | Show one provider, with the URLs your identity provider has.                                        |
| [`kindgi sso providers list`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers-list)     | List this tenant's sign-in providers.                                                               |
| [`kindgi sso providers test`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers-test)     | The link to try signing in with a provider, as a person at one of its domains.                      |
| [`kindgi sso providers remove`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers-remove) | Stop signing in with a provider.                                                                    |

**See also**

- [Microsoft Entra ID](https://docs.kindgi.com/v0.1.9/guides/sso/entra-id.md)
- [Google Workspace](https://docs.kindgi.com/v0.1.9/guides/sso/google.md)
- [Set up SSO](https://docs.kindgi.com/v0.1.9/guides/sso.md)
- [Keycloak](https://docs.kindgi.com/v0.1.9/guides/sso/keycloak.md)
- [`kindgi sso`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso)

#### `kindgi sso providers start`

**Synopsis**

```sh signature
kindgi sso providers start <provider-id> [--kind=oidc|saml] [--idp=google|entra|okta|keycloak]
```

Get the URLs to give your identity provider, before registering anything, and a message to send IT.

**Options**

| Option           | Default                                                                                                        | Description                                                                                                                                      |
| ---------------- | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| `--idp <value>`  | none                                                                                                           | Add the click-by-click steps for `google`, `entra`, `okta` or `keycloak` (OIDC).                                                                 |
| `--kind <value>` | none: the `--idp` preset's kind if given, else the registered provider's own (required before it's registered) | `oidc` (OpenID Connect) or `saml`. Needed until the provider is registered, unless `--idp` gives it; after that, the registered provider's kind. |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags).

**Examples**

From [Microsoft Entra ID](https://docs.kindgi.com/v0.1.9/guides/sso/entra-id.md):

```sh
npx --yes @kindgi/cli@0.1 sso providers start acme-entra --idp=entra
```

From [Google Workspace](https://docs.kindgi.com/v0.1.9/guides/sso/google.md):

```sh
npx --yes @kindgi/cli@0.1 sso providers start acme-google --idp=google
```

**See also**

- [Microsoft Entra ID](https://docs.kindgi.com/v0.1.9/guides/sso/entra-id.md)
- [Google Workspace](https://docs.kindgi.com/v0.1.9/guides/sso/google.md)
- [Set up SSO](https://docs.kindgi.com/v0.1.9/guides/sso.md)
- [Keycloak](https://docs.kindgi.com/v0.1.9/guides/sso/keycloak.md)
- [`kindgi sso providers`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers)

#### `kindgi sso providers finish`

**Synopsis**

```sh signature
kindgi sso providers finish <provider-id> --domains=<d> (--kind=oidc --issuer=<url> --client-id=<id> --client-secret-ref=<NAME> | --kind=saml --idp-metadata=@<file>) [--name=<text>] [...]
```

Register the provider with what your identity provider gave back.

**Options**

| Option                         | Default  | Description                                                                                                   |
| ------------------------------ | -------- | ------------------------------------------------------------------------------------------------------------- |
| `--client-id <value>`          | none     | OIDC: the client ID.                                                                                          |
| `--client-secret-ref <value>`  | none     | OIDC: the NAME of the client secret in Kindgi's secret store (`kindgi secrets set <NAME>`), never the secret. |
| `--domains <value>`            | required | An email domain whose people sign in with it (`acme.com`); repeatable or comma-separated. Repeatable.         |
| `--idp-metadata <value>`       | none     | SAML: the identity provider's metadata XML, as `@<file>`.                                                     |
| `--issuer <value>`             | none     | OIDC: the issuer URL.                                                                                         |
| `--kind <value>`               | required | `oidc` (OpenID Connect: Google, Entra ID, Okta, Keycloak…) or `saml`.                                         |
| `--name <value>`               | none     | What the sign-in button says ("Sign in with …").                                                              |
| `--sp-signing-key-ref <value>` | none     | SAML: the NAME of the signing key, for identity providers that want signed requests.                          |
| `--spec <value>`               | none     | Any other provider fields, as inline JSON or `@<file>` (flags win).                                           |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags).

**Examples**

From [Microsoft Entra ID](https://docs.kindgi.com/v0.1.9/guides/sso/entra-id.md):

```sh
npx --yes @kindgi/cli@0.1 sso providers finish acme-entra --kind=oidc \
```

From [Google Workspace](https://docs.kindgi.com/v0.1.9/guides/sso/google.md):

```sh
npx --yes @kindgi/cli@0.1 sso providers finish acme-google --kind=oidc --issuer=https://accounts.google.com \
```

**See also**

- [Microsoft Entra ID](https://docs.kindgi.com/v0.1.9/guides/sso/entra-id.md)
- [Google Workspace](https://docs.kindgi.com/v0.1.9/guides/sso/google.md)
- [Set up SSO](https://docs.kindgi.com/v0.1.9/guides/sso.md)
- [Keycloak](https://docs.kindgi.com/v0.1.9/guides/sso/keycloak.md)
- [`kindgi sso providers`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers)

#### `kindgi sso providers update`

**Synopsis**

```sh signature
kindgi sso providers update <provider-id> [--client-id=<id>] [--client-secret-ref=<NAME>] [--domains=<d>] [--name=<text>] [--remove=<field>] [...]
```

Change a provider; its URLs (on your identity provider's side) don't change.

**Options**

| Option                         | Default | Description                                                                                                   |
| ------------------------------ | ------- | ------------------------------------------------------------------------------------------------------------- |
| `--client-id <value>`          | none    | OIDC: the client ID.                                                                                          |
| `--client-secret-ref <value>`  | none    | OIDC: the NAME of the client secret in Kindgi's secret store (`kindgi secrets set <NAME>`), never the secret. |
| `--domains <value>`            | none    | An email domain whose people sign in with it (`acme.com`); repeatable or comma-separated. Repeatable.         |
| `--idp-metadata <value>`       | none    | SAML: the identity provider's metadata XML, as `@<file>`.                                                     |
| `--issuer <value>`             | none    | OIDC: the issuer URL.                                                                                         |
| `--kind <value>`               | none    | `oidc` (OpenID Connect: Google, Entra ID, Okta, Keycloak…) or `saml`.                                         |
| `--name <value>`               | none    | What the sign-in button says ("Sign in with …").                                                              |
| `--remove <value>`             | none    | An optional field to remove (e.g. `displayName`, `domains`); repeatable. Repeatable.                          |
| `--sp-signing-key-ref <value>` | none    | SAML: the NAME of the signing key, for identity providers that want signed requests.                          |
| `--spec <value>`               | none    | Any other provider fields, as inline JSON or `@<file>` (flags win).                                           |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags).

**Examples**

Point a provider at a rotated client secret.

```sh
kindgi sso providers update acme-okta --client-secret-ref=ACME_OKTA_SECRET_V2
```

Add a second sign-in domain and drop the display name.

```sh
kindgi sso providers update acme-okta --domains=acme.com,acme-ops.com --remove=displayName
```

**See also**

- [Microsoft Entra ID](https://docs.kindgi.com/v0.1.9/guides/sso/entra-id.md)
- [Google Workspace](https://docs.kindgi.com/v0.1.9/guides/sso/google.md)
- [Set up SSO](https://docs.kindgi.com/v0.1.9/guides/sso.md)
- [Keycloak](https://docs.kindgi.com/v0.1.9/guides/sso/keycloak.md)
- [`kindgi sso providers`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers)

#### `kindgi sso providers get`

**Synopsis**

```sh signature
kindgi sso providers get <provider-id>
```

Show one provider, with the URLs your identity provider has.

**Options**

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags).

**Examples**

Show a provider and the URLs to give your identity provider.

```sh
kindgi sso providers get acme-okta
```

**See also**

- [Microsoft Entra ID](https://docs.kindgi.com/v0.1.9/guides/sso/entra-id.md)
- [Google Workspace](https://docs.kindgi.com/v0.1.9/guides/sso/google.md)
- [Set up SSO](https://docs.kindgi.com/v0.1.9/guides/sso.md)
- [Keycloak](https://docs.kindgi.com/v0.1.9/guides/sso/keycloak.md)
- [`kindgi sso providers`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers)

#### `kindgi sso providers list`

**Synopsis**

```sh signature
kindgi sso providers list
```

List this tenant's sign-in providers.

**Options**

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags).

**Examples**

From [Set up SSO](https://docs.kindgi.com/v0.1.9/guides/sso.md):

```sh
npx --yes @kindgi/cli@0.1 sso providers list --table
```

**See also**

- [Set up SSO](https://docs.kindgi.com/v0.1.9/guides/sso.md)
- [`kindgi sso providers`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers)

#### `kindgi sso providers test`

**Synopsis**

```sh signature
kindgi sso providers test <provider-id> [--email=<someone@your-domain>]
```

The link to try signing in with a provider, as a person at one of its domains.

**Options**

| Option            | Default                                | Description                                                            |
| ----------------- | -------------------------------------- | ---------------------------------------------------------------------- |
| `--email <value>` | `someone@` the provider's first domain | Whose sign-in to try; default: someone at the provider's first domain. |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags).

**Examples**

From [Set up SSO](https://docs.kindgi.com/v0.1.9/guides/sso.md):

```sh
npx --yes @kindgi/cli@0.1 sso providers test acme-kc
```

**See also**

- [Set up SSO](https://docs.kindgi.com/v0.1.9/guides/sso.md)
- [`kindgi sso providers`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers)

#### `kindgi sso providers remove`

**Synopsis**

```sh signature
kindgi sso providers remove <provider-id>
```

Stop signing in with a provider. Registering the same id again gives it the same URLs, but nobody's earlier sign-in carries over.

**Options**

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.9/reference/cli.md#global-flags).

**Examples**

Stop signing in with a provider.

```sh
kindgi sso providers remove acme-okta
```

**See also**

- [Microsoft Entra ID](https://docs.kindgi.com/v0.1.9/guides/sso/entra-id.md)
- [Google Workspace](https://docs.kindgi.com/v0.1.9/guides/sso/google.md)
- [Set up SSO](https://docs.kindgi.com/v0.1.9/guides/sso.md)
- [Keycloak](https://docs.kindgi.com/v0.1.9/guides/sso/keycloak.md)
- [`kindgi sso providers`](https://docs.kindgi.com/v0.1.9/reference/cli/sso.md#kindgi-sso-providers)