Set the team's OpenID Connect provider up, or change it

Needs sso:manage (owner, admin, security) and a verified account.
The issuer's discovery document is read at once, so a wrong URL is
this request's error. The issuer is https (a loopback issuer may be
http) with no query or fragment. The secret is required the first
time, sealed, and never returned; leave it out on a change to keep the
one set. Identities are bound to the issuer that made them: after the
issuer changes, no subject linked under the old one signs anybody in,
and members link again (accounts that linked from their own session do
so with POST /sso/link; accounts the team's sign-in created, in a role
without sso:manage, are re-linked by their confirmed address at a
verified domain).

domains are the email domains whose people join the team on first
sign-in, with defaultRole. Each is a claim, pending until the
team proves it with a DNS TXT record (

POST
/teams/{teamId}/sso/domains/{domain}/verify

); a pending claim admits
nobody and discovery does not name it. enforced refuses members'
passwords at sign-in (the owner is exempt) and needs enabled.
Audited.

Capability: sso:manage (area team).

curl --location --request PUT 'https://api.prod-orm.io/teams//sso' \ --header 'Content-Type: application/json' \ --data '{ "issuer": "http://example.com", "clientId": "string", "clientSecret": "string", "domains": [ "string" ], "defaultRole": "string", "enabled": true, "enforced": true }'

{ "sso": { "id": 0, "teamId": 0, "provider": "oidc", "issuer": "http://example.com", "clientId": "string", "hasSecret": true, "endpoints": { "authorization": "http://example.com", "token": "http://example.com", "userinfo": "http://example.com", "fetchedAt": "2019-08-24T14:15:22.123Z" }, "domains": [ "string" ], "defaultRole": "string", "enabled": true, "enforced": true, "createdAt": "2019-08-24T14:15:22.123Z", "updatedAt": "2019-08-24T14:15:22.123Z", "domainClaims": [ { "domain": "example.com", "state": "pending", "challenge": { "type": "TXT", "name": "_prorm-challenge.example.com", "value": "prorm-domain-verification=4f1c…" }, "verifiedAt": "2019-08-24T14:15:22.123Z", "lastCheckedAt": "2019-08-24T14:15:22.123Z", "lastError": "string" } ] }, "callbackUrl": "http://example.com", "startUrl": "http://example.com" }

Set the team's OpenID Connect provider up, or change it

Request

Responses