mirror of
https://github.com/zitadel/zitadel.git
synced 2025-05-30 07:58:21 +00:00
58 lines
2.6 KiB
Plaintext
58 lines
2.6 KiB
Plaintext
---
|
|
title: Migrate from Generic Provider to specific Identity Provider
|
|
sidebar_label: Migrate IDP
|
|
---
|
|
|
|
## Migrate Generic OIDC Provider
|
|
|
|
You can migrate from a generic OIDC provider to the following supported templates:
|
|
- AzureAD
|
|
- Google
|
|
|
|
To migrate, you either use the [Migrate Generic OIDC Identity Provider (Instance)](/docs/apis/resources/admin/admin-service-migrate-generic-oidc-provider#migrate-generic-oidc-identity-provider) or [Migrate Generic OIDC Identity Provider (Organization)](/docs/apis/resources/mgmt/management-service-migrate-generic-oidc-provider#migrate-generic-oidc-identity-provider) API request.
|
|
These calls change the type of the provider and don't delete any linked users.
|
|
|
|
:::note Linked users will not notice the change and be able to login as usual.
|
|
:::
|
|
|
|
### Google Configuration
|
|
|
|
The available configuration is described in [Google Configuration](./google).
|
|
|
|
### AzureAD Configuration
|
|
|
|
The available configuration is described in [AzureAD Configuration](./azure-ad).
|
|
|
|
## Migrate with Terraform
|
|
Please note that you only have to perform this migration if you already have an existing IDP with linked users, that should not loose the connection to the provider.
|
|
If that isn't your case please just add a new provider from scratch.
|
|
To migrate to a specific provider, you need to follow a few essential steps:
|
|
1. Create a desired IDP as Terraform resource for example [Google](https://registry.terraform.io/providers/zitadel/zitadel/latest/docs/resources/idp_google).
|
|
2. Remove the old terraform resource from the state as to not destroy the migrated IDP accidentally.
|
|
```bash
|
|
# terraform state rm *address*
|
|
terraform state rm zitadel_idp_oidc.oidc_idp
|
|
```
|
|
|
|
After this command you can also remove the resource from the terraform files, as it is not managed anymore but also not deleted.
|
|
|
|
3. Make the corresponding API call to [migrate the IDP](./migrate#migrate-generic-oidc-provider), save the ID of the IDP for the import
|
|
4. Before applying the Terraform resources again, import the new IDP resource.
|
|
```bash
|
|
#resource "zitadel_idp_google" "google" {
|
|
# name = "Google"
|
|
# client_id = "182902..."
|
|
# client_secret = "GOCSPX-*****"
|
|
# scopes = ["openid", "profile", "email"]
|
|
# is_linking_allowed = false
|
|
# is_creation_allowed = true
|
|
# is_auto_creation = false
|
|
# is_auto_update = true
|
|
#}
|
|
|
|
# terraform import zitadel_idp_google.*resource_name* *id*:*client_secret*
|
|
terraform import zitadel_idp_google.google 222302827723096428:GOCSPX-*****
|
|
```
|
|
|
|
You have now migrated your provider and you should be able to apply the resource again. There should be no changes and the IDP is maintained by Terraform again.
|