🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The newAzureAdOidcIdentityProvider() mutation creates a new Azure Active Directory OIDC identity provider in LogScale. This is a root operation that requires root-level access. Use this mutation to configure Azure AD as the OIDC authentication source for a LogScale organization. To update an existing provider, use updateOIDCIdentityProvider() instead.

Syntax

graphql
newAzureAdOidcIdentityProvider(
      name: String!,
      tenantId: String!,
      clientID: String!,
      clientSecret: String!,
      domains: [String!]!,
      enableDebug: Boolean = false,
      scopeClaim: String
   ): OidcIdentityProvider!

Five arguments are required: name, tenantId, clientID, clientSecret, and domains. The domains argument accepts a non-null list of non-null strings representing the email domains associated with this provider. Two optional arguments, enableDebug and scopeClaim, control debug logging and the JWT scope claim respectively. The mutation returns a non-null OidcIdentityProvider! object.

The returned OidcIdentityProvider type exposes the authentication method, endpoint URLs, and configuration fields for the newly created provider. Request id to obtain the provider identifier for use with subsequent mutations. See the Returned Values section for all available fields.

Example

Raw
graphql
mutation {
  newAzureAdOidcIdentityProvider( 
     name: "myAzure-IDP",
     tenantId: "123abc",
     clientID: "456efg",
     clientSecret: "MD39xf83M301",
     domains: ["humio"],
     enableDebug: false    
  ) 
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  newAzureAdOidcIdentityProvider( 
     name: \"myAzure-IDP\",
     tenantId: \"123abc\",
     clientID: \"456efg\",
     clientSecret: \"MD39xf83M301\",
     domains: [\"humio\"],
     enableDebug: false    
  ) 
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  newAzureAdOidcIdentityProvider( 
     name: \"myAzure-IDP\",
     tenantId: \"123abc\",
     clientID: \"456efg\",
     clientSecret: \"MD39xf83M301\",
     domains: [\"humio\"],
     enableDebug: false    
  ) 
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  newAzureAdOidcIdentityProvider(  ^
     name: \"myAzure-IDP\", ^
     tenantId: \"123abc\", ^
     clientID: \"456efg\", ^
     clientSecret: \"MD39xf83M301\", ^
     domains: [\"humio\"], ^
     enableDebug: false     ^
  )  ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  newAzureAdOidcIdentityProvider( 
     name: \"myAzure-IDP\",
     tenantId: \"123abc\",
     clientID: \"456efg\",
     clientSecret: \"MD39xf83M301\",
     domains: [\"humio\"],
     enableDebug: false    
  ) 
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  newAzureAdOidcIdentityProvider( 
     name: \"myAzure-IDP\",
     tenantId: \"123abc\",
     clientID: \"456efg\",
     clientSecret: \"MD39xf83M301\",
     domains: [\"humio\"],
     enableDebug: false    
  ) 
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  newAzureAdOidcIdentityProvider( 
     name: \"myAzure-IDP\",
     tenantId: \"123abc\",
     clientID: \"456efg\",
     clientSecret: \"MD39xf83M301\",
     domains: [\"humio\"],
     enableDebug: false    
  ) 
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  newAzureAdOidcIdentityProvider( 
     name: \"myAzure-IDP\",
     tenantId: \"123abc\",
     clientID: \"456efg\",
     clientSecret: \"MD39xf83M301\",
     domains: [\"humio\"],
     enableDebug: false    
  ) 
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "newAzureAdOidcIdentityProvider": {
      "id": "abc123"
    }
  }
}

Input Parameters

The following table lists all input parameters for this mutation. The required parameters identify the Azure AD tenant, the registered application credentials, and the email domains to associate with this provider.

Table: Input Parameters & Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this mutation.
clientID string yes   The application (client) ID registered in Azure AD for this identity provider.
clientSecret string yes   The client secret generated for the registered Azure AD application. This value authenticates LogScale with Azure AD.
domains [string] yes   The list of email domains associated with this identity provider. Users with addresses in these domains are authenticated through this Azure AD provider.
enableDebug boolean   false When set to true, enables debug logging for this identity provider. Omitting this argument defaults to false.
name string yes   The human-readable name for this identity provider as it appears in LogScale.
scopeClaim string     The OIDC claim in the JWT token used to carry scope or group membership information. Specify this when the Azure AD application uses a non-default claim for scopes. If omitted, LogScale uses the provider's default scope claim.
tenantId string yes   The Azure AD tenant ID (directory ID) that identifies the Azure AD organization. This value scopes authentication to users in that tenant.

Returned Values

The mutation returns a non-null OidcIdentityProvider! object representing the newly created provider. Request id to obtain the provider identifier for use with subsequent mutations and queries. The domains field returns the list of email domains associated with the provider, and authMethod confirms the authentication method in use.

Table: OidcIdentityProvider Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
authenticationMethodAuthenticationMethodAuthyes Long-Term The authentication method used. See AuthenticationMethodAuth.
authorizationEndpointstring  Long-Term A URL to the endpoint a user should be redirected to when authorizing.
clientIdstringyes Long-Term The unique identifier for the client.
clientSecretstringyes Long-Term The password for the client.
debugbooleanyes Long-Term Whether debugging is enabled.
defaultIdpbooleanyes Long-Term Whether the identity provider is the default.
domains[string]yes Long-Term The domains authorized by the OIDC identity providers.
federatedIdpstring  Long-Term The Federated IdP.
groupsClaimstring  Long-Term The name of the claim to interpret as the groups in LogScale. The value in the claim must be an array of strings. Optional. Defaults to humio-groups.
humioManagedbooleanyes Long-Term Whether authentication is managed by LogScale.
idstringyes Long-Term The unique identifier for the OIDC identity provider.
issuerstringyes Long-Term The issuer of the OIDC authentication.
jwksEndpointstring  Long-Term A URL to the JWKS endpoint for retrieving keys for validating tokens. Required.
lazyCreateUsersbooleanyes Long-Term Whether to wait to create users until necessary.
namestringyes Long-Term The name of the OIDC identity provider.
registrationEndpointstring  Long-Term To use OIDC as a client, PUBLIC_URL must be set, LogScale must be registered as a client with your OpenID provider, and the provider must allow %PUBLIC_URL%/auth/oidc as a valid redirect endpoint for the client.
scopeClaimstring  Long-Term The scope claim.
scopes[string]yes Long-Term Comma-separated list of scopes to add in addition to the default requested scopes (openid, email, and profile).
tokenEndpointstring  Long-Term A URL to the token endpoint used to exchange a authentication code to an access token. Required for clients.
tokenEndpointAuthMethodstringyes Long-Term A URL to the token endpoint used to exchange a authentication code to an access token. Required for clients.
userClaimstringyes Long-Term The name of the claim to interpret as username in LogScale. The value in the claim must be a string. Defaults to humio-user. Can be set to email if using emails as usernames.
userInfoEndpointstring  Long-Term A URL to the user info endpoint used to retrieve user information from an access token.