`tenant oidc`¶

Q: Do tenant oidc commands require a login first?

Yes. Every tenant oidc command is a remote gRPC call, so you must first create a host profile with profile hosts create and authenticate with profile authn login.

Q: Does tenant oidc update replace the whole configuration?

No. tenant oidc update performs a partial merge: it fetches the current configuration, applies only the options you supply, and writes the merged result back. Omitted options stay unchanged.

Q: Is the introspection client secret included in tenant oidc view or tenant oidc backup?

No. The secret is never disclosed. tenant oidc view reports only whether a secret is configured, and tenant oidc backup redacts it server-side.

Q: What format does tenant oidc backup write?

A binary protocol-buffer (.pb) payload. With -o/--output-file it is written to a file; with -s/--print-to-screen it is Base64-encoded to the console. Exactly one of the two must be chosen.

tenant oidc administers the OpenID Connect (OIDC) resource-server configuration of a single {{ product_name }} tenant. Every leaf command targets one tenant by its UUID (-u/--uuid) and either reads, partial-merge updates, backs up, or restores that tenant's OIDC endpoint settings (issuer, audience, token-validation mode, discovery and endpoint URL overrides, timeouts, clock skew, and introspection client credentials).

Remote command group: a host profile and an active login are required

Every tenant oidc command is a remote gRPC call. Before running any of them you must:

Create a host profile with profile hosts create.
Log in with profile authn login.

The global -p/--profile option (default default-admin) selects which host profile to use for a single invocation and is placed before the command path. Host connection profiles — including their embedded OIDC logins (with PIN-sealed tokens) — are stored under ${HOME}/.config/alpinepki/hosts/.

The introspection client secret is never disclosed

tenant oidc view and tenant oidc backup never return the introspection client secret; view reports only whether one is configured. On tenant oidc update and tenant oidc restore, the stored secret is preserved unless a new value is supplied, in which case the backend seals it before persistence.

Commands in this group¶

Command	Purpose
`tenant oidc view`	Display a tenant's current OIDC configuration
`tenant oidc update`	Partial-merge update of a tenant's OIDC configuration
`tenant oidc backup`	Back up a tenant's OIDC configuration to a binary `.pb` file
`tenant oidc restore`	Restore a tenant's OIDC configuration from a binary `.pb` backup

Command group help¶

bin/admin.sh tenant oidc --help

`tenant oidc view`¶

Displays the current OIDC configuration of a tenant. The introspection client secret is omitted; its presence is reported through the introspection_client_secret_configured field.

Syntax¶

bin/admin.sh tenant oidc view [options]

Required options¶

Option	Description
`-u`, `--uuid`	UUID of the tenant

Optional options¶

Show optional options

Option	Default	Description
`-f`, `--out-format`	`YAML`	Output format: `JSON` or `YAML`

Example¶

bin/admin.sh tenant oidc view \
  -u 7c3f2c1a-9b4e-4d8f-bc11-2a6e9f0d3a51 \
  -f json

`tenant oidc update`¶

Updates a tenant's OIDC configuration with a partial merge: the current configuration is fetched, only the options you supply are applied on top, and the merged result is written back. Any option you omit leaves the corresponding field unchanged.

Syntax¶

bin/admin.sh tenant oidc update [options]

Required options¶

Option	Description
`-u`, `--uuid`	UUID of the tenant

Optional options¶

Show optional options

Every OIDC field below is optional. An unset option leaves the stored value unchanged.

Option	Default	Description
`--oidc-issuer-claim`	unchanged	OpenID issuer claim
`--oidc-audience-claim`	unchanged	OpenID audience claim
`--oidc-token-mode`	unchanged	Token validation mode: `OIDC_TOKEN_MODE_JWT_LOCAL`, `OIDC_TOKEN_MODE_JWT_USERINFO`, `OIDC_TOKEN_MODE_OPAQUE_INTROSPECT`, or `OIDC_TOKEN_MODE_AUTO`
`--[no-]oidc-use-discovery`	unchanged	Use OIDC discovery
`--[no-]oidc-allow-user-info-fallback`	unchanged	Allow OIDC UserInfo fallback
`--[no-]oidc-allow-introspection-fallback`	unchanged	Allow OIDC token introspection fallback
`--oidc-clock-skew-seconds`	unchanged	OIDC clock-skew allowance in seconds
`--oidc-connect-timeout-ms`	unchanged	OIDC connect timeout in milliseconds
`--oidc-read-timeout-ms`	unchanged	OIDC read timeout in milliseconds
`--oidc-discovery-url-override`	unchanged	OpenID discovery URL override
`--oidc-jwks-url-override`	unchanged	OpenID JWKS URL override
`--oidc-user-info-url-override`	unchanged	OpenID UserInfo URL override
`--oidc-introspection-url-override`	unchanged	OpenID introspection URL override
`--oidc-introspection-client-id`	unchanged	OpenID introspection client ID
`--oidc-introspection-client-secret`	unchanged (stored secret preserved)	OpenID introspection client secret (plaintext; sealed server-side)
`-f`, `--out-format`	`YAML`	Output format: `JSON` or `YAML`

Validation rules

At least one valid tenant UUID is required; the merge fails fast if the initial view of the tenant does not return OK.
The three boolean toggles are negatable: pass --oidc-use-discovery / --no-oidc-use-discovery (and likewise for the fallback toggles) to set the value; omitting the toggle leaves the stored value unchanged.
--oidc-introspection-client-secret is carried as plaintext only for the backend to seal. Omit it to keep the existing sealed secret; supply it to replace the secret.
--oidc-token-mode accepts only the four documented enum values; any other value is rejected as invalid input.

Example (switch to local JWT validation and pin endpoint URLs)¶

bin/admin.sh tenant oidc update \
  -u 7c3f2c1a-9b4e-4d8f-bc11-2a6e9f0d3a51 \
  --oidc-issuer-claim https://idp.example.com/realms/alpine \
  --oidc-audience-claim alpine-pki \
  --oidc-token-mode OIDC_TOKEN_MODE_JWT_LOCAL \
  --no-oidc-use-discovery \
  --oidc-jwks-url-override https://idp.example.com/realms/alpine/protocol/openid-connect/certs \
  --oidc-clock-skew-seconds 60 \
  -f json

Example (configure opaque-token introspection credentials)¶

bin/admin.sh tenant oidc update \
  -u 7c3f2c1a-9b4e-4d8f-bc11-2a6e9f0d3a51 \
  --oidc-token-mode OIDC_TOKEN_MODE_OPAQUE_INTROSPECT \
  --oidc-allow-introspection-fallback \
  --oidc-introspection-url-override https://idp.example.com/realms/alpine/protocol/openid-connect/token/introspect \
  --oidc-introspection-client-id alpine-introspection \
  --oidc-introspection-client-secret 's3cr3t-value' \
  -f yaml

`tenant oidc backup`¶

Backs up a tenant's OIDC configuration to a binary protocol-buffer (.pb) payload. The backup never contains the introspection client secret (redacted server-side). The output is written either to a file or, as Base64, to the console.

Syntax¶

bin/admin.sh tenant oidc backup [options]

Required options¶

Option	Description
`-u`, `--uuid`	UUID of the tenant

Required output mode options (choose exactly one)¶

Option	Description	Example
`-o`, `--output-file`	Write the binary `.pb` backup to a file (creates or truncates)	`-o ./tenant-oidc.pb`
`-s`, `--print-to-screen`	Print the backup to the console as Base64	`-s true`

Validation rules

Exactly one of -o/--output-file or -s/--print-to-screen must be supplied (enforced as a mutually exclusive, required argument group).
The .pb payload is binary; when printed to screen it is Base64-encoded so it can be captured from the console.

Optional options¶

Show optional options

Option	Default	Description
`-f`, `--out-format`	`YAML`	Output format for error reporting: `JSON` or `YAML`

Example¶

bin/admin.sh tenant oidc backup \
  -u 7c3f2c1a-9b4e-4d8f-bc11-2a6e9f0d3a51 \
  -o ./tenant-oidc.pb

`tenant oidc restore`¶

Restores a tenant's OIDC configuration from a binary .pb backup produced by tenant oidc backup. The stored introspection client secret is preserved unless the backup file carries one.

Syntax¶

bin/admin.sh tenant oidc restore [options]

Required options¶

Option	Description	Example
`-u`, `--uuid`	UUID of the tenant	`-u 7c3f2c1a-9b4e-4d8f-bc11-2a6e9f0d3a51`
`-i`, `--input-file`	Binary `.pb` backup file to restore	`-i ./tenant-oidc.pb`

Optional options¶

Show optional options

Option	Default	Description
`-f`, `--out-format`	`YAML`	Output format: `JSON` or `YAML`

Example¶

bin/admin.sh tenant oidc restore \
  -u 7c3f2c1a-9b4e-4d8f-bc11-2a6e9f0d3a51 \
  -i ./tenant-oidc.pb \
  -f json

Standard CLI options are documented in Global options.

FAQ¶

Do tenant oidc commands require a login first?

Yes. Every tenant oidc command is a remote gRPC call, so you must first create a host profile with profile hosts create and authenticate with profile authn login.

Does tenant oidc update replace the whole configuration?

No. tenant oidc update performs a partial merge: it fetches the current configuration, applies only the options you supply, and writes the merged result back. Omitted options stay unchanged.

Is the introspection client secret included in tenant oidc view or tenant oidc backup?

No. The secret is never disclosed. tenant oidc view reports only whether a secret is configured, and tenant oidc backup redacts it server-side.

What format does tenant oidc backup write?

A binary protocol-buffer (.pb) payload. With -o/--output-file it is written to a file; with -s/--print-to-screen it is Base64-encoded to the console. Exactly one of the two must be chosen.

tenant oidc¶

Commands in this group¶

Command group help¶

tenant oidc view¶

Syntax¶

Required options¶

Optional options¶

Example¶

tenant oidc update¶

Syntax¶

Required options¶

Optional options¶

Example (switch to local JWT validation and pin endpoint URLs)¶

Example (configure opaque-token introspection credentials)¶

tenant oidc backup¶

Syntax¶

Required options¶

Required output mode options (choose exactly one)¶

Optional options¶

Example¶

tenant oidc restore¶

Syntax¶

Required options¶

Optional options¶

Example¶

FAQ¶

Related¶

`tenant oidc`¶

`tenant oidc view`¶

`tenant oidc update`¶

`tenant oidc backup`¶

`tenant oidc restore`¶