SsoConnectionRequest

Shape

• protocolSsoProtocolsamloidcThe IdP protocol an org's connection speaks.
• attribute_mappingSsoAttributeMapping or nulloptional

  • The SsoAttributeMapping schema
  • emailstringThe claim or attribute carrying the person's email address. Defaults to email.
  • groupsstring or nulloptionalThe claim listing the person's groups at the identity provider, if any. Teams linked to those groups follow it.
  • usernamestring or nulloptionalThe claim a new account's username is derived from, if any.
• auto_provisionbooleanoptionalWhether to create an account for a person from a verified domain the first time they sign in. Defaults to false.
• default_roleRoleRef or nulloptionalThe role newcomers are given at the top-level group — a built-in role, or one of the organization's own (default Reporter). Invites without a role of their own use it too.
• enforcedbooleanoptionalWhether people from a verified domain must sign in through SSO. Defaults to false.
• idp_sync_max_age_daysinteger · int32 or nulloptional0–∞Days, 1–365, a person's place on a team linked to an identity-provider group lasts without them signing in again to confirm it (default 30).
• oidcOidcConfigRequest or nulloptional

  • The OidcConfigRequest schema
  • client_idstring or nulloptional
  • client_secretstring or nulloptionalThe client secret. Write-only: it is stored encrypted and never returned.
  • issuer_urlstring or nulloptionalThe OIDC issuer URL. Its settings are discovered from /.well-known/openid-configuration.
  • scopesarray of string or nulloptionalThe scopes to request. Defaults to ["openid", "email", "profile"].
• samlSamlConfigRequest or nulloptional

  • The SamlConfigRequest schema
  • metadata_urlstring or nulloptionalThe URL of the identity provider's SAML metadata, which is fetched and refreshed from there. Give this or metadata_xml.
  • metadata_xmlstring or nulloptionalThe identity provider's SAML metadata document itself, as XML. Give this or metadata_url.

Graph

Used by