mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
Wim Van LaerandGitHub
699ed17918
# Which Problems Are Solved naming inconsistencies: Configuration <-> Settings # How the Problems Are Solved # Additional Changes # Additional Context - Closes #11282
60 lines
2.6 KiB
Plaintext
60 lines
2.6 KiB
Plaintext
---
|
|
title: Migrate from Generic Provider to specific Identity Provider
|
|
sidebar_label: Migrate IdP
|
|
---
|
|
|
|
## Migrate Generic OIDC Provider
|
|
|
|
You can migrate from a generic OIDC provider to the following supported templates:
|
|
|
|
- Entra ID (former Azure Active Directory)
|
|
- Google
|
|
|
|
To migrate, you either use the [Migrate Generic OIDC Identity Provider (Instance)](/reference/api/admin/zitadel.admin.v1.AdminService.MigrateGenericOIDCProvider) or [Migrate Generic OIDC Identity Provider (Organization)](/reference/api/management/zitadel.management.v1.ManagementService.MigrateGenericOIDCProvider) API request.
|
|
These calls change the type of the provider and don't delete any linked users.
|
|
|
|
<Callout title="Linked users will not notice the change and be able to login as usual.">
|
|
</Callout>
|
|
|
|
### Google Configuration
|
|
|
|
The available settings are described in [Google Configuration](./google).
|
|
|
|
### Entra ID Configuration
|
|
|
|
The available settings are described in [Entra ID Configuration](./azure-ad-oidc).
|
|
|
|
## Migrate with Terraform
|
|
|
|
Please note that you only have to perform this migration if you already have an existing IDP with linked users, that should not loose the connection to the provider.
|
|
If that isn't your case please just add a new provider from scratch.
|
|
To migrate to a specific provider, you need to follow a few essential steps:
|
|
1. Create a desired IDP as Terraform resource for example [Google](https://registry.terraform.io/providers/zitadel/zitadel/latest/docs/resources/idp_google).
|
|
2. Remove the old terraform resource from the state as to not destroy the migrated IDP accidentally.
|
|
```bash
|
|
# terraform state rm *address*
|
|
terraform state rm zitadel_idp_oidc.oidc_idp
|
|
```
|
|
|
|
After this command you can also remove the resource from the terraform files, as it is not managed anymore but also not deleted.
|
|
|
|
3. Make the corresponding API call to [migrate the IDP](./migrate#migrate-generic-oidc-provider), save the ID of the IDP for the import
|
|
4. Before applying the Terraform resources again, import the new IDP resource.
|
|
```bash
|
|
#resource "zitadel_idp_google" "google" {
|
|
# name = "Google"
|
|
# client_id = "182902..."
|
|
# client_secret = "GOCSPX-*****"
|
|
# scopes = ["openid", "profile", "email"]
|
|
# is_linking_allowed = false
|
|
# is_creation_allowed = true
|
|
# is_auto_creation = false
|
|
# is_auto_update = true
|
|
#}
|
|
|
|
# terraform import zitadel_idp_google.*resource_name* *id*:*client_secret*
|
|
terraform import zitadel_idp_google.google 222302827723096428:GOCSPX-*****
|
|
```
|
|
|
|
You have now migrated your provider and you should be able to apply the resource again. There should be no changes and the IDP is maintained by Terraform again.
|