sazabi_sso_connection

Manages the organization’s single sign-on connection to a SAML 2.0 or OIDC identity provider. An organization has at most one connection. Get the URLs to register at the identity provider from the sazabi_sso_service_provider data source. Terraform cannot run the connection test, because it needs a person to sign in at the identity provider. tested_at stays null until someone runs the test from the dashboard, and changing the issuer, client ID, client secret, SSO URL, certificates or metadata URL clears it again. Settings changes (default_role, jit_enabled, scim_only, max_session_age_seconds, disabled) keep it. Changing protocol replaces the connection. Destroying the resource deletes the connection and ends the sessions of everyone who signed in through it; the API refuses while a domain enforces SSO. Enforcement is not managed by Terraform. The API key needs permission to manage SSO (can_manage_sso). A key without it can read the connection but not create, change or delete it.

Example

resource "sazabi_sso_connection" "okta" {
  protocol          = "saml"
  issuer            = "http://www.okta.com/exk1example"
  saml_sso_url      = "https://example.okta.com/app/example/sso/saml"
  saml_certificates = [file("okta-signing.pem")]
  default_role      = "member"
}

resource "sazabi_sso_connection" "oidc" {
  protocol                   = "oidc"
  issuer                     = "https://login.example.com"
  oidc_client_id             = var.oidc_client_id
  oidc_client_secret         = var.oidc_client_secret
  oidc_client_secret_version = 1
}

Arguments

Attribute	Type	Behavior	Description
`protocol`	string	Required	`saml` or `oidc`. Changing it forces replacement.
`issuer`	string	Required	The SAML entity ID or the OIDC issuer URL.
`organization_id`	string	Optional, Computed	Owning organization. Defaults to the provider’s organization, then to the API key’s. Immutable.
`oidc_client_id`	string	Optional	OIDC client ID. Required for `oidc`.
`oidc_client_secret`	string	Optional, Sensitive, Write-only	OIDC client secret. Required to create an `oidc` connection. Never stored in plan or state. Needs Terraform 1.11 or later.
`oidc_client_secret_version`	number	Optional	Change it to send `oidc_client_secret` again, for example after rotating the secret.
`saml_sso_url`	string	Optional	Identity provider single sign-on URL. Required for `saml`.
`saml_certificates`	list(string)	Optional	One or two PEM signing certificates (two while rotating). Required for `saml`.
`saml_metadata_url`	string	Optional	Identity provider metadata URL, kept for reference.
`default_role`	string	Optional, Computed	Role for people added on first sign-in: `member` or `viewer`.
`jit_enabled`	bool	Optional, Computed	Whether people are added to the organization on first sign-in.
`scim_only`	bool	Optional, Computed	Whether a sign-in by someone SCIM never provisioned is refused instead of added on first sign-in. Needs SCIM on.
`max_session_age_seconds`	number	Optional	Longest a session from this connection may last. Unset means no limit.
`disabled`	bool	Optional, Computed	Whether the connection is disabled.
`id`	string	Computed	Connection ID.
`provider_id`	string	Computed	Identifier of the connection in the service provider URLs.
`has_oidc_client_secret`	bool	Computed	Whether Sazabi holds an OIDC client secret.
`saml_certificate_fingerprints`	list(string)	Computed	SHA-256 fingerprints of the certificates Sazabi holds.
`tested_at`	string	Computed	When a person last completed the connection test, or null.
`disabled_at`	string	Computed	When the connection was disabled, or null.
`created_at`	string	Computed	When the connection was created.
`updated_at`	string	Computed	When the connection last changed.

The API returns only certificate fingerprints, so a certificate changed outside Terraform shows as a difference, and applying sends the configured certificates. The API never returns the client secret; the secret is sent when the connection is created and when oidc_client_secret_version changes. Creating a connection when the organization already has one fails; import it instead. If someone else creates one while Terraform is creating its own, the apply fails and the configuration has already been written to their connection, so review it before importing.

Import

terraform import sazabi_sso_connection.example <organization_id>
terraform import sazabi_sso_connection.example -

- imports the API key’s own organization. After import, the first apply sends the configured certificates (SAML), or the client secret when oidc_client_secret_version is set (OIDC).

Overview

Get started

Guides

Catalogs

Reference

Security & trust

cve.now

sazabi_sso_connection

Example

Arguments

Import

​Example

​Arguments

​Import

Example

Arguments

Import