---
title: "uptimeify_sso_oidc"
description: "Ressource uptimeify_sso_oidc: Beispiel, alle Attribute, Import."
---

<Callout>Die Beschreibungen auf dieser Seite kommen direkt aus dem Provider-Schema und sind deshalb englisch.</Callout>

Single sign-on of the organization with an OpenID Connect identity provider (`PUT /api/organization/sso`). One per organization; needs an organization admin token. Saving runs the issuer's discovery, so the issuer must be reachable over HTTPS from Uptimeify.

Register the client at your identity provider with `redirect_uri` and the `scopes` (both known before the first apply, see `GET /api/organization/sso`). Prove the domain with the DNS TXT record `verification_record` and `uptimeify_sso_domain_verification`. A new `domain` or `issuer` resets the verification, the first login and `enforce_sso`.

Destroying it removes SSO. A SAML configuration is not managed here: it reads as gone, and an apply replaces it with OIDC. Import with the id `sso`.

## Beispiel

```terraform
variable "oidc_client_secret" {
  type      = string
  sensitive = true
}

# Register the client at your identity provider first, with
# uptimeify_sso_oidc.corp.redirect_uri and the scopes openid, email, profile.
resource "uptimeify_sso_oidc" "corp" {
  issuer                   = "https://login.example.com/realms/corp"
  client_id                = "uptimeify"
  client_secret_wo         = var.oidc_client_secret
  client_secret_wo_version = 1
  domain                   = "example.com"
  default_role             = "editor"
  # enforce_sso = true  # only after the domain is verified and one SSO login worked
}
```

## Schema

### Pflichtfelder

- `client_id` (String)
- `domain` (String) Lowercase email domain of the users who sign in with SSO, e.g. `example.com`. One organization per domain.
- `issuer` (String) Issuer URL, `https://`, without trailing slash (the discovery document's `issuer` must match).

### Optional

> **NOTE**: [Write-only arguments](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments) are supported in Terraform 1.11 and later.

- `client_secret_wo` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Write-only client secret; required for the first save. Sent with create and whenever `client_secret_wo_version` changes; never stored in state. Removing it keeps the stored secret.
- `client_secret_wo_version` (Number) Change to resend `client_secret_wo`.
- `default_role` (String) Role of users created by their first SSO login: `readonly`, `editor`, `responder` or `admin`. Defaults to `readonly`.
- `enforce_sso` (Boolean) Only SSO (no password login) for users of `domain`. Needs a verified domain and one completed SSO login (`can_enforce`), else the apply fails with 409 `ssoEnforceNotAllowed`. Defaults to `false`.

### Nur lesbar

- `can_enforce` (Boolean) Whether `enforce_sso` may be switched on: domain verified and one SSO login done.
- `domain_verified` (Boolean) Whether the TXT record was verified (see `uptimeify_sso_domain_verification`).
- `id` (String) Always `sso`.
- `redirect_uri` (String) Redirect (callback) URI to register at the identity provider.
- `scopes` (List of String) Scopes Uptimeify requests at login (fixed: `openid`, `email`, `profile`).
- `verification_record` (Attributes) DNS TXT record that proves control of `domain`; publish it with your DNS provider. (siehe [verschachteltes Schema](#verschachteltes-schema-für-verification_record))

### Verschachteltes Schema für `verification_record`

Read-Only:

- `name` (String) Name of the TXT record, `_uptimeify-sso.<domain>`.
- `value` (String) Value of the TXT record.

## Import

Import geht so:

Mit [`tofu import` bzw. `terraform import`](https://developer.hashicorp.com/terraform/cli/commands/import), zum Beispiel:

```shell
# Always the id sso (one SSO configuration per organization)
terraform import uptimeify_sso_oidc.corp sso
```