updateMspSso

If idp_type==saml, a URL we will redirect the user after user logout from Mist (for some IdP which supports a custom logout URL that is different from SP-initiated SLO process)

If idp_type==saml, default role to assign if there’s no match. By default, an assertion is treated as invalid when there’s no role matched

Required if ldap_type==custom, LDAP filter that will identify the type of group

If idp_type==saml. IDP Cert (used to verify the signed response)

SAML assertion signing algorithm. Required if idp_type==saml. enum: sha1, sha256, sha384, sha512.

Required if idp_type==saml, IDP Single-Sign-On URL

Identity provider type for this SSO configuration. enum: ldap, mxedge_proxy, oauth, saml, openroaming.

If idp_type==saml, ignore any unmatched roles provided in assertion. By default, an assertion is treated as invalid for any unmatched role

If idp_type==saml. IDP issuer URL

Required if idp_type==ldap, whole domain or a specific organization unit (container) in Search base to specify where users and groups are found in the LDAP tree

Required if idp_type==ldap, the account used to authenticate against the LDAP

Required if idp_type==ldap, the password used to authenticate against the LDAP

CA certificates used to validate LDAP or LDAPS server certificates. Required if idp_type==ldap

If idp_type==ldap, LDAPS Client certificate

If idp_type==ldap, Key for the ldap_client_cert

Group attribute used to resolve LDAP memberships. If ldap_type==custom

Group search base used for custom LDAP group lookup. If ldap_type==custom

If idp_type==ldap, whether to recursively resolve LDAP groups

Server hostnames or IP addresses for LDAP or LDAPS when idp_type==ldap

Provider template for LDAP SSO when idp_type==ldap. enum: azure, custom, google, okta.

Required if ldap_type==custom, LDAP filter that will identify the type of user

Required if ldap_type==custom,LDAP filter that will identify the type of member

Mist Edge proxy settings used when idp_type==mxedge_proxy

Display name of the SSO configuration

SAML NameID format used when idp_type==saml. enum: email, unspecified.

Required if idp_type==oauth, Client Credentials

Required if idp_type==oauth, oauth_cc_client_secret is RSA private key, of the form "-----BEGIN RSA PRIVATE KEY--...."

OAuth discovery document URL used when idp_type==oauth

Ping Identity region for OAuth SSO when oauth_type==ping_identity. enum: asia, au, ca, eu, us.

Provider domain for Okta OAuth SSO when oauth_type==okta. enum: okta.com, oktapreview.com, okta-emea.com, okta-gov.com, okta.mil, mtls.okta.com.

If idp_type==oauth, ropc = Resource Owner Password Credentials

If oauth_type==azure or oauth_type==azure-gov. oauth_ropc_client_secret can be empty

Required if idp_type==oauth, oauth_tenant_id

Provider type for OAuth SSO when idp_type==oauth. enum: azure, azure-gov, okta, ping_identity.

SSIDs that support OpenRoaming, used when idp_type==openroaming

Optional WBA-issued client certificate for OpenRoaming. If not provided, the default WBA-issued certificate for Juniper will be used.

Optional WBA-issued client private key for OpenRoaming. If not provided, the default WBA-issued key for Juniper will be used.

If idp_type==saml, custom role attribute parsing scheme. Supported Role Parsing Schemes NameSchemecnThe expected role attribute format in SAML Assertion is "CN=cn,OU=ou1,OU=ou2,…"CN (the key) is case-insensitive and exactly 1 CN is expected (or the entire entry will be ignored)E.g. if role attribute is "CN=cn,OU=ou1,OU=ou2" then parsed role value is "cn"

If idp_type==saml, name of the attribute in SAML Assertion to extract role from

If idp_type==oauth, indicates if SCIM provisioning is enabled for the OAuth IDP

If idp_type==oauth, scim_secret_token (auto-generated when not provided by caller and scim_enabled==true, empty string when scim_enabled==false) is used as the Bearer token in the Authorization header of SCIM provisioning requests by the IDP