sng iam
Deployed and supported. The fields and commands described here are stable within version v1alpha1.
The sng iam group administers the directory of your applications' users: the people who sign in to what you build, their roles and permissions, their invitations, the sign-in methods and the sign-in page. These accounts sign in to your applications through OIDC; they have no rights on StackNGO. Rights on the platform are set with sng tenant policy.
sng tenant use acme
sng iam role create support --permission tickets:read
sng iam user invite alice@acme.example --role support
sng iam login-page show
The guided path is Users of your applications. The global flags (--config, --json, -v, --version) are described in the CLI index.
Target tenant. The directory is that of the session's tenant (sng tenant use): there is no tenant flag.
Output. A table, or the objects' JSON with --json.
Deletions. Any command that removes something asks for confirmation (type oui) unless --yes / -y is given; without a terminal: confirmation requise : relancez avec --yes ou depuis un terminal interactif.
Applications and providers are created by manifest: sng template gen IAMApplication or sng template gen IAMProvider, then sng apply (Authentication for your applications, Sign-in providers).
sng iam user
| Command | Effect |
|---|---|
sng iam user list [--search Q] [--limit N] | lists users (--search: name or email; --limit: 50 by default) |
sng iam user describe ID | a user's record: roles, last sign-in, sign-in methods |
sng iam user invite EMAIL [--role R]… [--expires-in-hours N] | invites a person; the invitation link is shown only once |
sng iam user disable ID / enable ID | blocks / restores an account (no new sign-in or token) |
sng iam user roles ID --set R[,R] | replaces the user's list of roles |
sng iam user delete ID [--yes] | deletes the account and its sign-in methods |
ID is the account's stable identifier (sub), shown by user list.
sng iam user invite alice@acme.example --role support --expires-in-hours 72
Invitation created for alice@acme.example
Invitation link (shown only once): https://auth.dev.stackngo.fr/t/acme/invitation/…
sng iam invitation
| Command | Effect |
|---|---|
sng iam invitation list [--pending] | lists invitations (never their link); --pending: those not yet accepted |
sng iam invitation delete ID [--yes] | cancels an invitation |
sng iam role
| Command | Effect |
|---|---|
sng iam role list | lists roles |
sng iam role describe NAME | role, description, permissions |
sng iam role create NAME [--permission P]… [--description D] | creates a role; refused if it already exists |
sng iam role update NAME [--permission P]… [--description D] | changes only the flags given; --permission replaces the permissions; refused if the role was modified in the meantime |
sng iam role delete NAME [--yes] | deletes the role |
A role name is lowercase letters, digits and hyphens (63 characters at most); a role holds up to 50 permissions of the form tickets:read (letters, digits, :._*/-, 128 characters at most).
sng iam app
| Command | Effect |
|---|---|
sng iam app list | lists the applications that use your directory |
sng iam app describe NAME | an application's manifest and status |
sng iam app credentials NAME | an application's clientId, clientSecret and issuer (action auth:ReadCredentials, policy admin) |
sng iam app rotate NAME [--yes] | renews the clientSecret; the old one is refused within seconds, the clientId does not change (action auth:RotateCredentials, policy admin). Interactive confirmation, unless --yes is given |
sng iam provider
| Command | Effect |
|---|---|
sng iam provider list | lists sign-in methods |
sng iam provider describe NAME | a sign-in method's manifest and status |
sng iam login-page
| Command | Effect |
|---|---|
sng iam login-page show | sign-in page settings (defaults if never saved) |
sng iam login-page set [--logo-url URL] [--primary-color C] [--signup open|invite] | modifies the page; only the flags given change, an empty value removes the logo or color |
The console gives access to all the page's settings (Sign-in page). After a change, the page updates within a few minutes.
Common errors
| Message | Cause | What to do |
|---|---|---|
tenant required: use -t or sng tenant use NAME | no current tenant | sng tenant use NAME |
403 forbidden | auth:* action missing from your policies | see Action catalog |
404 | your tenant's directory is not enabled | contact support |
409 on role create | the role already exists | role update |
409 on login-page set | write from a cluster that is not the tenant's primary one | rerun from the primary cluster |
422 on login-page set | color or address rejected | the output lists the fields at fault |