setLoginBridge()

🎯API Stability

Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The setLoginBridge() mutation creates or replaces the login bridge configuration for an organization. A login bridge routes authentication requests through an external SAML identity provider, enabling single sign-on for your users. Use this mutation to establish the initial login bridge configuration. To update specific properties of an existing login bridge, use updateLoginBridge() instead.

After you configure a login bridge, use setLoginBridgeTermsState() to accept or decline the terms of service. To manage the list of users authorized to authenticate through the bridge, use addLoginBridgeAllowedUsers() and removeLoginBridgeAllowedUsers(). To update an existing login bridge, use updateLoginBridge(). To delete a login bridge, use removeLoginBridge().

Hide Allowed Users and Groups Query

Show Allowed Users and Groups Query

To get a list of allowed users and groups, execute the organization() query like this:

graphql

query {
     organization {
       configs {
         subdomains {
           loginBridge {
             allowedUsers
             groups
           }
         }
       }
     }
   }

Syntax

graphql

setLoginBridge(
      input: LoginBridgeInput!
   ): LoginBridge!

The mutation requires one argument: input, a LoginBridgeInput object containing the login bridge configuration, including the login URL and SAML identity provider details.

The mutation returns a non-null LoginBridge object. See the Input Parameters section for argument details and the Returned Values section for the fields available on the returned object.

Example

Raw

graphql

mutation {
  setLoginBridge( input:
    { name: "my-bridge",
      description: "My Login Bridge",
      issuer: "toll-taker",
      remoteId: "over-there-123",
      loginUrl: "https://bridge.company.com",
      relayStateUrl: "https://state.company.com",
      samlEntityId: "abc123",
      privateSamlCertificate: "something",
      publicSamlCertificate: "something",
      allowedUsers: ["bob", "ted"],
      groupAttribute: "something",
      groups: ["sales","managers"],
      organizationIdAttributeName: "something",
      generateUserName: false,
      termsDescription: "Terms of Login",
      termsLink: "https://bridge.company.com/terms.page"
    } 
  )
  { remoteId }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  setLoginBridge( input:
    { name: \"my-bridge\",
      description: \"My Login Bridge\",
      issuer: \"toll-taker\",
      remoteId: \"over-there-123\",
      loginUrl: \"https://bridge.company.com\",
      relayStateUrl: \"https://state.company.com\",
      samlEntityId: \"abc123\",
      privateSamlCertificate: \"something\",
      publicSamlCertificate: \"something\",
      allowedUsers: [\"bob\", \"ted\"],
      groupAttribute: \"something\",
      groups: [\"sales\",\"managers\"],
      organizationIdAttributeName: \"something\",
      generateUserName: false,
      termsDescription: \"Terms of Login\",
      termsLink: \"https://bridge.company.com/terms.page\"
    } 
  )
  { remoteId }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  setLoginBridge( input:
    { name: \"my-bridge\",
      description: \"My Login Bridge\",
      issuer: \"toll-taker\",
      remoteId: \"over-there-123\",
      loginUrl: \"https://bridge.company.com\",
      relayStateUrl: \"https://state.company.com\",
      samlEntityId: \"abc123\",
      privateSamlCertificate: \"something\",
      publicSamlCertificate: \"something\",
      allowedUsers: [\"bob\", \"ted\"],
      groupAttribute: \"something\",
      groups: [\"sales\",\"managers\"],
      organizationIdAttributeName: \"something\",
      generateUserName: false,
      termsDescription: \"Terms of Login\",
      termsLink: \"https://bridge.company.com/terms.page\"
    } 
  )
  { remoteId }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  setLoginBridge( input: ^
    { name: \"my-bridge\", ^
      description: \"My Login Bridge\", ^
      issuer: \"toll-taker\", ^
      remoteId: \"over-there-123\", ^
      loginUrl: \"https://bridge.company.com\", ^
      relayStateUrl: \"https://state.company.com\", ^
      samlEntityId: \"abc123\", ^
      privateSamlCertificate: \"something\", ^
      publicSamlCertificate: \"something\", ^
      allowedUsers: [\"bob\", \"ted\"], ^
      groupAttribute: \"something\", ^
      groups: [\"sales\",\"managers\"], ^
      organizationIdAttributeName: \"something\", ^
      generateUserName: false, ^
      termsDescription: \"Terms of Login\", ^
      termsLink: \"https://bridge.company.com/terms.page\" ^
    }  ^
  ) ^
  { remoteId } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  setLoginBridge( input:
    { name: \"my-bridge\",
      description: \"My Login Bridge\",
      issuer: \"toll-taker\",
      remoteId: \"over-there-123\",
      loginUrl: \"https://bridge.company.com\",
      relayStateUrl: \"https://state.company.com\",
      samlEntityId: \"abc123\",
      privateSamlCertificate: \"something\",
      publicSamlCertificate: \"something\",
      allowedUsers: [\"bob\", \"ted\"],
      groupAttribute: \"something\",
      groups: [\"sales\",\"managers\"],
      organizationIdAttributeName: \"something\",
      generateUserName: false,
      termsDescription: \"Terms of Login\",
      termsLink: \"https://bridge.company.com/terms.page\"
    } 
  )
  { remoteId }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  setLoginBridge( input:
    { name: \"my-bridge\",
      description: \"My Login Bridge\",
      issuer: \"toll-taker\",
      remoteId: \"over-there-123\",
      loginUrl: \"https://bridge.company.com\",
      relayStateUrl: \"https://state.company.com\",
      samlEntityId: \"abc123\",
      privateSamlCertificate: \"something\",
      publicSamlCertificate: \"something\",
      allowedUsers: [\"bob\", \"ted\"],
      groupAttribute: \"something\",
      groups: [\"sales\",\"managers\"],
      organizationIdAttributeName: \"something\",
      generateUserName: false,
      termsDescription: \"Terms of Login\",
      termsLink: \"https://bridge.company.com/terms.page\"
    } 
  )
  { remoteId }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  setLoginBridge( input:
    { name: \"my-bridge\",
      description: \"My Login Bridge\",
      issuer: \"toll-taker\",
      remoteId: \"over-there-123\",
      loginUrl: \"https://bridge.company.com\",
      relayStateUrl: \"https://state.company.com\",
      samlEntityId: \"abc123\",
      privateSamlCertificate: \"something\",
      publicSamlCertificate: \"something\",
      allowedUsers: [\"bob\", \"ted\"],
      groupAttribute: \"something\",
      groups: [\"sales\",\"managers\"],
      organizationIdAttributeName: \"something\",
      generateUserName: false,
      termsDescription: \"Terms of Login\",
      termsLink: \"https://bridge.company.com/terms.page\"
    } 
  )
  { remoteId }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  setLoginBridge( input:
    { name: \"my-bridge\",
      description: \"My Login Bridge\",
      issuer: \"toll-taker\",
      remoteId: \"over-there-123\",
      loginUrl: \"https://bridge.company.com\",
      relayStateUrl: \"https://state.company.com\",
      samlEntityId: \"abc123\",
      privateSamlCertificate: \"something\",
      publicSamlCertificate: \"something\",
      allowedUsers: [\"bob\", \"ted\"],
      groupAttribute: \"something\",
      groups: [\"sales\",\"managers\"],
      organizationIdAttributeName: \"something\",
      generateUserName: false,
      termsDescription: \"Terms of Login\",
      termsLink: \"https://bridge.company.com/terms.page\"
    } 
  )
  { remoteId }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "setLoginBridge": {
      "remoteId": "over-there-123",
      }
    }
  }
}

Input Parameters

The mutation accepts one required input object, input, of type LoginBridgeInput. This object contains the login URL, SAML identity provider configuration, and other login bridge settings. The fields of LoginBridgeInput are described in the following table.

Table: LoginBridgeInput Input Datatype

Parameter	Type	Required	Stability	Description
additionalAttributes	String		`Long-Term`	Any additional attributes.
allowedUsers	String	yes	`Long-Term`	A list of users allowed to access the bridge.
description	String	yes	`Long-Term`	A description of the login bridge to update.
generateUserName	Boolean	yes	`Long-Term`	Whether to generate user names.
groupAttribute	String	yes	`Long-Term`	The group attributes.
groups	String	yes	`Long-Term`	Any groups associated with the login bridge.
issuer	String	yes	`Long-Term`	The issuer to update.
loginUrl	String	yes	`Long-Term`	The URL of the login bridge.
name	String	yes	`Long-Term`	The name of the login bridge to update.
organizationIdAttributeName	String	yes	`Long-Term`	The organization's unique identifier of the attribute name.
organizationNameAttribute	String		`Long-Term`	The organization's name of the attribute.
privateSamlCertificate	String	yes	`Long-Term`	The private SAML certificate.
publicSamlCertificate	String	yes	`Long-Term`	The public SAML certificate.
relayStateUrl	String	yes	`Long-Term`	The relay state URL.
remoteId	String	yes	`Long-Term`	The remote unique identifier of the login bridge.
samlEntityId	String	yes	`Long-Term`	The unique identifier of the SAML entity.
termsDescription	String	yes	`Long-Term`	A description of the terms.
termsLink	String	yes	`Long-Term`	A link to the terms and conditions.

Returned Values

The mutation returns a LoginBridge object containing the configured login bridge details, including the login URL, SAML response data, and relay state. The following table describes the available fields.

Table: LoginBridge Datatype

Parameter	Type	Required	Stability	Description
additionalAttributes	String		`Long-Term`	Any additional attributes.
allowedUsers	User	yes	`Long-Term`	A list of users allowed to access the bridge. See User.
anyUserAlreadyLoggedInViaLoginBridge	Boolean	yes	`Long-Term`	True if any user in this organization has logged in to CrowdStream via LogScale. Requires manage organizations permissions. Whether to generate user names.
description	String	yes	`Long-Term`	A description of the login bridge.
generateUserName	Boolean	yes	`Long-Term`	Whether to generate user names.
groupAttribute	String	yes	`Long-Term`	Any group attributes.
groups	String	yes	`Long-Term`	Any groups associated with the login bridge.
issuer	String	yes	`Long-Term`	The issuer of the login bridge.
loginUrl	String	yes	`Long-Term`	The URL for logging in.
name	String	yes	`Long-Term`	The name of the login bridge.
organizationIdAttributeName	String	yes	`Long-Term`	The organization's unique identifier of the attribute name.
organizationNameAttributeName	String		`Long-Term`	The organization's name of the attribute name.
publicSamlCertificate	String	yes	`Long-Term`	The public SAML certificate.
relayStateUUrl	String	yes	`Long-Term`	The relay state URL.
remoteId	String	yes	`Long-Term`	The unique identifier of the remote connection.
samlEntityId	String	yes	`Long-Term`	The unique identifier of the SAML entity.
showTermsAndConditions	Boolean	yes	`Long-Term`	Whether to show the terms and conditions.
termsDescription	String	yes	`Long-Term`	A description of the terms.
termsLink	String	yes	`Long-Term`	A link to the terms and conditions.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes

setLoginBridge()

Summary

Syntax

Example

Input Parameters

Returned Values

Enter search term

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes

setLoginBridge()

Summary

Related

Syntax

Example

Input Parameters

Returned Values

Enter search term