// Module included in the following assemblies:
//
// * rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc
:_mod-docs-content-type: PROCEDURE
[id="rosa-hcp-sts-creating-a-cluster-external-auth-provider-cli_{context}"]
= Creating an external authentication provider
:source-highlighter: pygments
:pygments-style: emacs
:icons: font

[role="_abstract"]
After you have created a {product-title} cluster with the enabled option for external authentication providers, you must create a provider using the ROSA CLI.

[NOTE]
====
Similar to the `rosa create|delete|list idp[s]` command in the ROSA CLI, you cannot edit an existing identity provider that you created using `rosa create external-auth-provider`. Instead, you must delete the external authentication provider and create a new one.
====

.Procedure

* Do one of the following:
** To create your external authentication provider using interactive mode, run the following command:
+
[source,terminal]
----
$ rosa create external-auth-provider -c <cluster_name>
----

** To create your external authentication provider by entering each argument, run the following command:
+
[source,terminal]
----
$ rosa create external-auth-provider --cluster=<cluster_name> \
    --name=<provider_name> \
    --issuer-url=<issuing_url> \
    --issuer-audiences=<audience_id> \ 
    --issuer-ca-file=<ca_file_path> \
    --claim-mapping-username-claim=<claim_username> \ 
    --claim-mapping-groups-claim=<method> \
    --console-client-id=<client_id_for_app_registration> \
    --console-client-secret=<client_secret> \
    --claim-validation-rule=<claim_validation_rule>
----
+
--
where:

`<cluster_id>`:: The name or the ID of your cluster.
`<provider_name>`:: The name of your external authentication provider. This name should be a lower-case with numbers and dashes.
`<issuing_url>`:: The URL of the token issuer.
`<audience_id>`:: The audience IDs that this authentication provider issues tokens for. This is a comma-separated list of token audiences.
`<ca_file_path>`:: Optional. The certificate file to use when making requests.
`<claim_username>`:: The name of the claim that is used to construct the user names for cluster identity, such as using `email`.
`<method>`:: The method with which to transform the ID token into a cluster identity, such as using `groups`.
`<client_id_for_app_registration>`:: Optional. The application or client ID that your app registration uses for the console.
`<client_secret>`:: The client secret that is used to associate your account with the application. If you do not include the client secret, this command uses a public OIDC OAuthClient.
`<claim_validation_rule>`:: Optional. The rules that help validate token claims which authenticate your users. This field should be formatted as `:<required_value>`.
--
+
.Example output
[source,terminal]
----
I: Successfully created an external authentication provider for cluster 'ext-auth-test'
----
