IAMProvider

Available

Deployed and supported. The fields and commands described here are stable within version v1alpha1.

apiVersion	iam.stackngo.io/v1alpha1
kind	IAMProvider
Applied by	sng apply, or the Authentication → Providers section of the console
Related commands	sng template gen IAMProvider, sng kind get IAMProvider, sng kind delete IAMProvider, sng iam provider list · describe

What it is for

An IAMProvider declares a sign-in method offered on the sign-in page of your applications' users: a link sent by email (Email) or an account with a third party (Google, GitHub, GitLab, Microsoft, LinkedIn, or any OpenID Connect provider). There is no password. The Sign-in providers guide details the paths.

Minimal example

email.yml

apiVersion: iam.stackngo.io/v1alpha1
kind: IAMProvider
metadata:
  name: email
spec:
  category: OAuth
  type: Email

sng apply email.yml
sng iam provider list

Example with credentials

google.yml

apiVersion: iam.stackngo.io/v1alpha1
kind: IAMProvider
metadata:
  name: google
spec:
  category: OAuth
  type: Google
  credentialsSecretRef:
    name: google-oauth          # secret with the client-id and client-secret keys

Fields

Cross-validation rules

• type: Email accepts none of credentialsSecretRef, baseURL, issuer, azureTenant, scopes.
• The other types require credentialsSecretRef.
• issuer is required for OIDC and rejected for the other types; displayName is then required (40 characters).
• baseURL is reserved for GitLab, azureTenant for Microsoft.

IAMProvider

Champ	Description	Défaut	Validation
apiVersion string	iam.stackngo.io/v1alpha1
kind string	IAMProvider
metadata ObjectMeta	Seul metadata.name est à renseigner (nom de la ressource dans votre tenant).
spec IAMProviderSpec
status IAMProviderStatus

IAMProviderSpec

Champ	Description	Défaut	Validation
category string	Catégorie du fournisseur : OAuth (seule admise ; ni mot de passe ni SAML).
type string	Email, Google, GitHub, GitLab, LinkedIn, Microsoft ou OIDC.		Enum
displayName string	Libellé du bouton de connexion (40 caractères au plus). Obligatoire pour OIDC.		Optional: {}
credentialsSecretRef SecretReference	Secret contenant client-id et client-secret chez le fournisseur. Obligatoire, sauf pour Email qui le refuse.		Optional: {}
baseURL string	GitLab auto-hébergé (ex. https://git.example.com) ; vide = gitlab.com. Type GitLab seulement.		MaxLength: 2048 Pattern: ^https:// Optional: {}
issuer string	Émetteur d'un fournisseur OpenID Connect générique. Obligatoire pour OIDC, refusé ailleurs.		MaxLength: 2048 Pattern: ^https:// Optional: {}
azureTenant string	Annuaire Microsoft : common, organizations, consumers ou un identifiant d'annuaire ; vide = common. Type Microsoft seulement.		Optional: {}
scopes string array	Scopes demandés au fournisseur en plus de openid, profile et email (16 au plus).		MaxItems: 16 Optional: {}
deletionPolicy DeletionPolicy	Sort du fournisseur quand le manifeste est supprimé : Block (défaut), Orphan ou Delete.	Block	Enum: [Block Orphan Delete]

Status and conditions

Ready=True when the sign-in method is active on the sign-in page. Otherwise status.conditions gives the cause (validation rejected, credentials secret missing, service temporarily unreachable: automatic retry).

What happens when you delete

sng kind delete IAMProvider <name>. With deletionPolicy: Block (default), deletion waits until the provider is no longer in use, then completes; Orphan keeps the sign-in method; Delete removes it without checking. Accounts already created are never deleted along with a provider: their users keep their other sign-in methods.

See also

• Guides: Sign-in providers, Sign-in page
• CLI: sng iam provider
• Other kinds: IAMApplication