> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# sazabi_sso_connection

> Terraform resource for the organization's SAML 2.0 or OIDC single sign-on connection.

Manages the organization's single sign-on connection to a SAML 2.0 or OIDC identity provider. An organization has at most one connection. Get the URLs to register at the identity provider from the `sazabi_sso_service_provider` data source.

Terraform cannot run the connection test, because it needs a person to sign in at the identity provider. `tested_at` stays null until someone runs the test from the dashboard, and changing the issuer, client ID, client secret, SSO URL, certificates or metadata URL clears it again. Settings changes (`default_role`, `jit_enabled`, `scim_only`, `max_session_age_seconds`, `disabled`) keep it.

Changing `protocol` replaces the connection. Destroying the resource deletes the connection and ends the sessions of everyone who signed in through it; the API refuses while a domain enforces SSO. Enforcement is not managed by Terraform.

The API key needs permission to manage SSO (`can_manage_sso`). A key without it can read the connection but not create, change or delete it.

## Example

```hcl theme={"system"}
resource "sazabi_sso_connection" "okta" {
  protocol          = "saml"
  issuer            = "http://www.okta.com/exk1example"
  saml_sso_url      = "https://example.okta.com/app/example/sso/saml"
  saml_certificates = [file("okta-signing.pem")]
  default_role      = "member"
}

resource "sazabi_sso_connection" "oidc" {
  protocol                   = "oidc"
  issuer                     = "https://login.example.com"
  oidc_client_id             = var.oidc_client_id
  oidc_client_secret         = var.oidc_client_secret
  oidc_client_secret_version = 1
}
```

## Arguments

| Attribute | Type | Behavior | Description |
| - | - | - | - |
| `protocol` | string | Required | `saml` or `oidc`. Changing it forces replacement. |
| `issuer` | string | Required | The SAML entity ID or the OIDC issuer URL. |
| `organization_id` | string | Optional, Computed | Owning organization. Defaults to the provider's organization, then to the API key's. Immutable. |
| `oidc_client_id` | string | Optional | OIDC client ID. Required for `oidc`. |
| `oidc_client_secret` | string | Optional, Sensitive, Write-only | OIDC client secret. Required to create an `oidc` connection. Never stored in plan or state. Needs Terraform 1.11 or later. |
| `oidc_client_secret_version` | number | Optional | Change it to send `oidc_client_secret` again, for example after rotating the secret. |
| `saml_sso_url` | string | Optional | Identity provider single sign-on URL. Required for `saml`. |
| `saml_certificates` | list(string) | Optional | One or two PEM signing certificates (two while rotating). Required for `saml`. |
| `saml_metadata_url` | string | Optional | Identity provider metadata URL, kept for reference. |
| `default_role` | string | Optional, Computed | Role for people added on first sign-in: `member` or `viewer`. |
| `jit_enabled` | bool | Optional, Computed | Whether people are added to the organization on first sign-in. |
| `scim_only` | bool | Optional, Computed | Whether a sign-in by someone SCIM never provisioned is refused instead of added on first sign-in. Needs SCIM on. |
| `max_session_age_seconds` | number | Optional | Longest a session from this connection may last. Unset means no limit. |
| `disabled` | bool | Optional, Computed | Whether the connection is disabled. |
| `id` | string | Computed | Connection ID. |
| `provider_id` | string | Computed | Identifier of the connection in the service provider URLs. |
| `has_oidc_client_secret` | bool | Computed | Whether Sazabi holds an OIDC client secret. |
| `saml_certificate_fingerprints` | list(string) | Computed | SHA-256 fingerprints of the certificates Sazabi holds. |
| `tested_at` | string | Computed | When a person last completed the connection test, or null. |
| `disabled_at` | string | Computed | When the connection was disabled, or null. |
| `created_at` | string | Computed | When the connection was created. |
| `updated_at` | string | Computed | When the connection last changed. |

The API returns only certificate fingerprints, so a certificate changed outside Terraform shows as a difference, and applying sends the configured certificates. The API never returns the client secret; the secret is sent when the connection is created and when `oidc_client_secret_version` changes.

Creating a connection when the organization already has one fails; import it instead. If someone else creates one while Terraform is creating its own, the apply fails and the configuration has already been written to their connection, so review it before importing.

## Import

```bash theme={"system"}
terraform import sazabi_sso_connection.example <organization_id>
terraform import sazabi_sso_connection.example -
```

`-` imports the API key's own organization. After import, the first apply sends the configured certificates (SAML), or the client secret when `oidc_client_secret_version` is set (OIDC).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.