chainctl iam identity-providers scim token regenerate

chainctl iam identity-providers scim token regenerate

Regenerate the SCIM bearer token for an identity provider.

Synopsis

Regenerate the SCIM bearer token, whether the current one is live, expired, or revoked. A live token keeps authenticating for the overlap window (at most 24h) while the IdP connector is reconfigured with the new one. The new plaintext token is shown exactly once. If the current token may be exposed, do not rely on the overlap: revoke it, or regenerate with –overlap 0 for an immediate cutover.

chainctl iam identity-providers scim token regenerate IDENTITY_PROVIDER [--output=json] [flags]

Examples

  # Regenerate with a one-hour overlap for reconfiguring the IdP
  chainctl iam identity-providers scim token regenerate my-idp --overlap 1h

  # Regenerate with a one-year expiry and an immediate cutover
  chainctl iam identity-providers scim token regenerate my-idp --overlap 0 --expires-in 8760h

Options

      --expires-in duration   How long until the new token expires (maximum two years). Unset defaults to one year.
      --never-expires         Explicitly issue a token without a planned expiry.
      --overlap duration      How long a live previous token keeps authenticating (at most 24h). 0 cuts over immediately; unset defaults to one hour.

Options inherited from parent commands

      --api string         The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
      --audience string    The Chainguard token audience to request. (default "https://console-api.enforce.dev")
      --config string      A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
      --console string     The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
      --force-color        Force color output even when stdout is not a TTY.
  -h, --help               Help for chainctl
      --issuer string      The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
      --log-level string   Set the log level (debug, info) (default "ERROR")
  -o, --output string      Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
  -v, --v int              Set the log verbosity level.

SEE ALSO

• chainctl iam identity-providers scim token - Manage the SCIM provisioning bearer token for an identity provider.