---
page_title: "ona_sso_configuration Resource - ona"
subcategory: "Organization"
description: |-
  Custom Ona OIDC SSO configuration for the organization associated with the configured provider token.
---

# ona_sso_configuration (Resource)

Custom Ona OIDC SSO configuration for the organization associated with the configured provider token.

For product context, see [Single sign-on (SSO)](https://ona.com/docs/ona/sso/overview).

## Example Usage

```terraform
resource "ona_sso_configuration" "corp" {
  display_name = "Acme Okta"
  issuer_url   = "https://acme.okta.com"
  client_id    = var.oidc_client_id

  client_secret         = var.oidc_client_secret
  client_secret_version = var.oidc_client_secret_version

  email_domains     = ["acme.com"]
  additional_scopes = ["groups"]
  claims_expression = "claims.email_verified"
  state             = "active"
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `client_id` (String) OIDC application client ID from the identity provider.
- `issuer_url` (String) OIDC issuer URL for the identity provider.

### Optional

> **NOTE**: [Write-only arguments](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments) are supported in Terraform 1.11 and later.

- `additional_scopes` (Set of String) Additional OIDC scopes requested during sign-in. An explicitly empty set clears all additional scopes.
- `claims_expression` (String) Optional CEL expression evaluated against OIDC token claims during login. Set an empty string to clear the expression.
- `client_secret` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) OIDC application client secret. This write-only value is sent to Ona but not stored in Terraform plan or state.
- `client_secret_version` (String) User-managed version marker for resubmitting `client_secret` during rotation.
- `display_name` (String) Display name shown for this SSO configuration. Maximum length is 128 characters.
- `email_domains` (Set of String) Email domains allowed to sign in through this SSO configuration. The Ona API cannot clear all domains through Terraform; omit this attribute to leave it unmanaged.
- `state` (String) SSO configuration state. Supported values are `active` and `inactive`.

### Read-Only

- `id` (String) SSO configuration ID.
- `provider_type` (String) SSO provider type. Terraform-managed configurations are `custom`.

## Import

Import is supported using the following syntax:

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
#!/usr/bin/env sh

terraform import ona_sso_configuration.corp 01980ed3-a090-7b5b-a74c-9bf5d8cfe53c
```