[Yandex Cloud documentation](../../../index.md) > [Yandex Identity Hub](../../index.md) > [Step-by-step guides](../index.md) > Managing apps (SSO) > OIDC apps > Creating an app

# Creating an OIDC application in Yandex Identity Hub


To authenticate your [organization](../../concepts/organization.md)'s users to external apps using SSO based on [OpenID connect](https://en.wikipedia.org/wiki/OpenID#OpenID_Connect_(OIDC)) (OIDC), create an [OIDC application](../../concepts/applications.md#oidc) in Yandex Identity Hub and configure it appropriately both in Yandex Identity Hub and on your service provider's side.

OIDC apps can be managed by users with the `organization-manager.oauthApplications.admin` [role](../../security/index.md#organization-manager-oauthApplications-admin) or higher.

## Create an app {#create-app}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps**.
  1. In the top-right corner, click ![Circles3Plus](../../../_assets/console-icons/circles-3-plus.svg) **Create application** and in the window that opens:
      1. Select the **OIDC (OpenID Connect)** single sign-on method.
      1. In the **Name** field, specify a name for your new app. The name must be unique within the organization and follow the naming requirements:

          * It must be from 1 to 63 characters long.
          * It may contain lowercase Latin letters, numbers, and hyphens.
          * It must start with a letter and cannot end with a hyphen.

      1. In the **Folder** field, select the folder where you want to create an OAuth client for your app.

          Every OIDC application requires an OAuth client, which is created and removed along with the app and is inherently linked to it.
      1. Optionally, in the **Description** field, enter a description for the new app.
      1. Optionally, add [labels](../../../resource-manager/concepts/labels.md):

          1. Click **Add label**.
          1. Add a label in `key: value` format.
          1. Press **Enter**.
      1. Click **Create application**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for creating an OIDC app:

     ```bash
     yc organization-manager idp application oauth application create --help
     ```

  1. Create an OAuth client:

     ```bash
     yc iam oauth-client create \
       --name <OAuth_client_name> \
       --scopes <attribute>[,<attribute>]
     ```

     Where:

     * `--name`: OAuth client name.
     * `--scopes`: User attributes that will be available to the service provider. Specify one or more attributes, comma-separated, in `<attribute1>,<attribute2>` format. Possible attributes:
       * `openid`: User ID. Required attribute.
       * `profile`: Additional user details, such as first name, last name, and avatar.
       * `email`: User email address.
       * `address`: User home address.
       * `phone`: User phone number.
       * `groups`: [User groups](../../concepts/groups.md) in the organization.

     Result:

     ```text
     id: ajeqqip130i1********
     name: test-oauth-client
     folder_id: b1g500m2195v********
     status: ACTIVE
     ```

     Save the `id` field value for when you need to create and configure your app.

  1. Create a secret for your OAuth client:

     ```bash
     yc iam oauth-client-secret create --oauth-client-id <OAuth_client_ID>
     ```

     Result:

     ```text
     oauth_client_secret:
       id: ajeq9jfrmc5t********
       oauth_client_id: ajeqqip130i1********
       masked_secret: yccs__939233b8ac****
       created_at: "2025-10-21T10:14:17.861652377Z"
     secret_value: yccs__939233b8ac********
     ```

     Save the `secret_value` field value: you will need it to [configure your app](#setup-application) on the service provider side.
  
  1. Create an OIDC app:

     ```bash
     yc organization-manager idp application oauth application create \
       --organization-id <organization_ID> \
       --name <application_name> \
       --description <application_description> \
       --client-id <OAuth_client_ID> \
       --authorized-scopes <attribute>[,<attribute>] \
       --group-distribution-type all-groups \
       --labels <key>=<value>[,<key>=<value>]
     ```

     Where:

     * `--organization-id`: [ID of the organization](../organization-get-id.md) you want to create your OIDC app in. This is a required setting.
     * `--name`: OIDC app name. This is a required setting. The name must be unique within the organization and follow the naming requirements:

       * It must be from 1 to 63 characters long.
       * It may contain lowercase Latin letters, numbers, and hyphens.
       * It must start with a letter and cannot end with a hyphen.

     * `--description`: OIDC app description. This is an optional setting.
     * `--client-id`: OAuth client ID you got in Step 2. This is a required setting.
     * `--authorized-scopes`: Specify the same attributes as when creating the OAuth client.
     * `--group-distribution-type`: If you provided the `groups` attribute when creating the OAuth client, specify which user groups you want to go to the service provider. The possible values are:
       * `all-groups`: Service provider will get all groups the user belongs to.

          The maximum number of groups to change hands is 1,000. If the user belongs to more groups than this, only the first thousand will go to the service provider.
       * `assigned-groups`: Of all the user's groups, the service provider will only get the ones explicitly [specified](#users-and-groups).
       * `none`: Service provider will not get any of the groups the user belongs to.
     * `--labels`: List of [labels](../../../resource-manager/concepts/labels.md). This is an optional setting. You can specify one or more labels separated by commas in `<key1>=<value1>,<key2>=<value2>` format.

     Result:

     ```text     
     id: ek0o663g4rs2********
     name: oidc-app
     organization_id: bpf2c65rqcl8********
     group_claims_settings:
       group_distribution_type: NONE
     client_grant:
       client_id: ajeqqip130i1********
       authorized_scopes:
         - openid
     status: ACTIVE
     created_at: "2025-10-21T10:51:28.790866Z"
     updated_at: "2025-10-21T12:37:19.274522Z"
     ```

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. Describe the [OAuth client](../../concepts/applications.md) parameters in the Terraform configuration file:

     ```hcl
     resource "yandex_iam_oauth_client" "example_oauth_client" {
       name      = "<OAuth_client_name>"
       folder_id = "<folder_ID>"
       scopes    = ["<attribute_1>", "<attribute_2>"]
     }
     ```

     Where:

     * `name`: OAuth client name.
     * `folder_id`: ID of the folder where you want to create your OAuth server.
     * `scopes`: User attributes that will be available to the service provider. Specify one or more attributes in square brackets. Possible attributes:
       * `openid`: User ID. Required attribute.
       * `profile`: Additional user details, such as first name, last name, and avatar.
       * `email`: User email address.
       * `address`: User home address.
       * `phone`: User phone number.
       * `groups`: User groups in the organization.

     For more on the properties of the `yandex_iam_oauth_client` resource, see [this provider guide](../../../terraform/resources/iam_oauth_client.md).

  1. In the Terraform configuration file, describe the OAuth client [secret](../../concepts/applications.md#oidc-secret) parameters:

     ```hcl
     resource "yandex_iam_oauth_client_secret" "example_oauth_client_secret" {
       oauth_client_id = "<OAuth_client_ID>"
     }
     ```

     Where:

     * `oauth_client_id`: ID of the OAuth client for which you are creating the secret.

     For more on the properties of the `yandex_iam_oauth_client_secret` resource, see [this provider guide](../../../terraform/resources/iam_oauth_client_secret.md).

  1. Describe the [OIDC application](../../concepts/applications.md#oidc) parameters in the Terraform configuration file:

     ```hcl
     resource "yandex_organizationmanager_idp_application_oauth_application" "example_oidc_app" {
       organization_id = "<organization_ID>"
       name            = "<application_name>"
       description     = "<application_description>"
       
       client_grant = {
         client_id         = "<OAuth_client_ID>"
         authorized_scopes = ["<attribute_1>", "<attribute_2>"]
       }
       
       group_claims_settings = {
         group_distribution_type = "ALL_GROUPS"
       }
       
       labels = {
         "<key_1>" = "<value_1>"
         "<key_2>" = "<value_2>"
       }
     }
     ```

     Where:

     * `organization_id`: [ID of the organization](../organization-get-id.md) you want to create your OIDC app in. This is a required setting.
     * `name`: OIDC app name. This is a required setting. The name must be unique within the organization and follow the naming requirements:

       * It must be from 1 to 63 characters long.
       * It may contain lowercase Latin letters, numbers, and hyphens.
       * It must start with a letter and cannot end with a hyphen.

     * `description`: OIDC app description. This is an optional setting.
     * `client_grant`: OAuth client connection settings:
       * `client_id`: OAuth client ID. This is a required setting.
       * `authorized_scopes`: Specify the same attributes as when creating the OAuth client.
     * `group_claims_settings`: Settings for sending user group claims to the service provider:
       * `group_distribution_type`: If you provided the `groups` attribute when creating the OAuth client, specify which user groups you want to go to the service provider. The possible values are:
         * `ALL_GROUPS`: Service provider will get all groups the user belongs to.
         * `ASSIGNED_GROUPS`: Of all the user's groups, the service provider will only get the ones explicitly specified.
         * `NONE`: Service provider will not get any of the groups the user belongs to.
     * `labels`: List of [labels](../../../resource-manager/concepts/labels.md). This is an optional setting.

     For more on the properties of the `yandex_organizationmanager_idp_application_oauth_application` resource, see [this provider guide](../../../terraform/resources/organizationmanager_idp_application_oauth_application.md).

  1. Create the resources:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     Terraform will create all the required resources. You can check the new resources and their settings in the [Cloud Center UI](https://center.yandex.cloud/organization) or using this [CLI](../../../cli/index.md) command:

     ```bash
     yc organization-manager idp application oauth application list --organization-id <organization_ID>
     ```

- API {#api}

  1. Use the [OAuthClient.Create](../../../iam/api-ref/OAuthClient/create.md) REST API method for the [OAuthClient](../../../iam/api-ref/grpc/OAuthClient/index.md) resource or the [OAuthClientService/Create](../../../iam/api-ref/grpc/OAuthClient/create.md) gRPC API call.
  1. Use the [OAuthClientSecret.Create](../../../iam/api-ref/OAuthClientSecret/create.md) REST API method for the [OAuthClientSecret](../../../iam/api-ref/OAuthClientSecret/index.md) resource or the [OAuthClientSecretService/Create](../../../iam/api-ref/grpc/OAuthClientSecret/create.md) gRPC API call.
  1. Use the [Application.Create](../../idp/application/oauth/api-ref/Application/create.md) REST API method for the [Application](../../idp/application/oauth/api-ref/Application/index.md) resource or the [ApplicationService/Create](../../idp/application/oauth/api-ref/grpc/Application/create.md) gRPC API call.  

{% endlist %}

## Set up your application {#setup-application}

To integrate an external application with the OIDC application you created in Yandex Identity Hub, complete the setup both on the service provider side and in Yandex Identity Hub.

### Set up integration on the service provider side {#setup-sp}

You can look up the values of integration settings to use on the service provider side on the app info page in the [Cloud Center](https://center.yandex.cloud/organization/apps) interface.

Depending on the options supported by your service provider, you can configure the required settings manually or automatically by specifying a configuration URL:

{% list tabs %}

- Manual setup

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and select the OIDC app.
  1. On the **Overview** tab, under **Identity provider (IdP) configuration**, expand the **Additional attributes** section and copy the parameter values to use on the service provider side:

      * `ClientID`: Unique application ID.
      * `Authorization endpoint`: Address in Yandex Cloud to which the service provider will redirect the user for authentication.
      * `Token endpoint`: Address to which the external application sends a request to obtain an ID token and access token.
      * `Userinfo endpoint`: Address the external application can use to obtain user attributes.

  1. Under **App secrets**, click **Add secret**, and in the window that opens:
     
     1. Optionally, add a description for the new secret.
     1. Click **Create**.
     
     The window will display the generated [application secret](../../concepts/applications.md#oidc-secret). Save this value.
     
     {% note warning %}
     
     If you refresh or close the application information page, you will not be able to view the secret again.
     
     {% endnote %}
     
     If you closed or refreshed the page before saving the secret, click **Add secret** to create a new one.
     
     To delete a secret, in the list of secrets on the OIDC app page, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) in the secret row and select ![trash-bin](../../../_assets/console-icons/trash-bin.svg) **Delete**.
  1. On the service provider side, set up integration with your Yandex Identity Hub OIDC application by specifying the parameters you copied and the generated secret. If you need help, refer to your service provider's documentation or support team.

- Configuration URL

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and select the OIDC app.
  1. On the **Overview** tab, under **Identity provider (IdP) configuration**, copy the **OpenID Configuration** field value.

      This URL exposes all configuration values required on the service provider side (except for the secret).
  1. Under **App secrets**, click **Add secret**, and in the window that opens:
     
     1. Optionally, add a description for the new secret.
     1. Click **Create**.
     
     The window will display the generated [application secret](../../concepts/applications.md#oidc-secret). Save this value.
     
     {% note warning %}
     
     If you refresh or close the application information page, you will not be able to view the secret again.
     
     {% endnote %}
     
     If you closed or refreshed the page before saving the secret, click **Add secret** to create a new one.
     
     To delete a secret, in the list of secrets on the OIDC app page, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) in the secret row and select ![trash-bin](../../../_assets/console-icons/trash-bin.svg) **Delete**.
  1. If your service provider supports using a configuration URL to configure the application, set up integration with your Yandex Identity Hub OIDC application on the service provider side by specifying the copied link and secret. If you need help, refer to your service provider's documentation or support team.

{% endlist %}

### Configure your OIDC application in Yandex Identity Hub {#setup-idp}

Before configuring your OIDC application in Yandex Identity Hub, get the redirect URI address (addresses) from your service provider. Then, navigate to the OIDC application settings in Yandex Identity Hub:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and select the OIDC app.
  1. On the top right, click ![pencil](../../../_assets/console-icons/pencil.svg) **Edit** and in the window that opens:
     
     1. Specify the address you got from the service provider in the **Redirect URI** field.
     
         Click **Add URI** to specify multiple redirect URIs at once.
     1. In the **Scopes** field, select user attributes that will be available to the service provider.
     
         * `openid (user ID)`: User ID. This is a required setting.
         * `email address`: User email address.
         * `profile (full name, first name, last name, avatar, etc.)`: Additional user details.
         * `groups (user's groups in the organization)`: Organization [user groups](../../concepts/groups.md) to which the user getting authenticated belongs. The possible values are:
         
             * `All groups`: Service provider will get all groups the user belongs to.
         
                 The maximum number of groups is 1,000. If the user belongs to more groups than this, only the first thousand will go to the service provider. 
             * `Assigned groups only`: Of all the user's groups, the service provider will only get the ones explicitly specified in the **Users and groups** tab of the OIDC application.
     
     1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for setting up the OAuth client:

     ```bash
     yc iam oauth-client update --help
     ```

  1. Run this command:

     ```bash
     yc iam oauth-client update \
       --id <OAuth_client_ID> \
       --redirect-uris <address>[,<address>]
     ```

     Where:

     * `--id`: OAuth client ID.
     * `--redirect-uris`: Specify the address or addresses you got from the service provider in `<address1>,<address2>` format.

     Result:

     ```text
     id: ajeqqip130i1********
     name: test-oauth-client
     redirect_uris:
       - https://example.com
       - https://example.ru
     folder_id: b1g500m2195v********
     status: ACTIVE
     ```


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. In the Terraform configuration file, specify the `redirect_uris` parameter for the `yandex_iam_oauth_client` resource:

     ```hcl
     resource "yandex_iam_oauth_client" "example_oauth_client" {
       name          = "<OAuth_client_name>"
       folder_id     = "<folder_ID>"

       ...

       redirect_uris = ["<address_1>", "<address_2>"]
     }
     ```

     Where:

     * `name`: OAuth client name.
     * `folder_id`: ID of the folder where you want to create your OAuth server.
     * `redirect_uris`: Specify the address or addresses you got from the service provider in square brackets.

     For more on the properties of the `yandex_iam_oauth_client` resource, see [this provider guide](../../../terraform/resources/iam_oauth_client.md).

  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     You can check the updates of resources and their settings either in the [Cloud Center interface](https://center.yandex.cloud/organization) or using this [CLI](../../../cli/index.md) command:

     ```bash
     yc iam oauth-client get <OAuth_client_ID>
     ```

- API {#api}

  Use the [OAuthClient.Update](../../../iam/api-ref/OAuthClient/update.md) REST API method for the [OAuthClient](../../../iam/api-ref/grpc/OAuthClient/index.md) resource or the [OAuthClientService/Update](../../../iam/api-ref/grpc/OAuthClient/update.md) gRPC API call.

{% endlist %}

### Configure users and groups {#users-and-groups}

For your organization's users to be able to authenticate in an external app with a Yandex Identity Hub OIDC application, you need to explicitly add these users and/or [user groups](../../concepts/groups.md) to this OIDC application:

{% note info %}

Users and groups added to an OIDC application can be managed by a user with the `organization-manager.oauthApplications.userAdmin` [role](../../security/index.md#organization-manager-oauthApplications-userAdmin) or higher.

{% endnote %}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and then, the OIDC app.
  1. Navigate to the **Users and groups** tab.
  1. To add a user or user group to the app:

      1. Click ![person-plus](../../../_assets/console-icons/person-plus.svg) **Add users**.
      1. In the window that opens, select the required user or user group.
      1. Click **Add**.
  1. To delete a user or user group from the app:

      1. In the list of users and groups, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![trash-bin](../../../_assets/console-icons/trash-bin.svg) **Delete** next to the user or user group.
      1. Confirm the deletion.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. Get the [user ID](../users-get.md) or [user group ID](../group-get-id.md).

  1. To add a user or user group to the app:
  
     1. See the description of the CLI command for adding users to an app:
   
        ```bash
        yc organization-manager idp application oauth application add-assignments --help
        ```
   
     1. Run this command:
   
        ```bash
        yc organization-manager idp application oauth application add-assignments \
          --id <app_ID> \
          --subject-id ek0omvvcb9vv********
        ```
   
        Where:
   
        * `--id`: App ID.
        * `--subject-id`: User or user group ID.
   
        Result:
   
        ```text
        assignment_deltas:
          - action: ADD
            assignment:
              subject_id: ajetvnq2mil8********
        ```

  1. To delete a user or user group from the app:

     1. See the description of the CLI command for removing users from an app:
   
        ```bash
        yc organization-manager idp application oauth application remove-assignments --help
        ```
   
     1. Run this command:
   
        ```bash
        yc organization-manager idp application oauth application remove-assignments \
          --id <app_ID> \
          --subject-id <user_ID>
        ```
   
        Where:
   
        * `--id`: OIDC app ID.
        * `--subject-id`: User or user group ID.
   
        Result:
   
        ```text
        assignment_deltas:
          - action: REMOVE
            assignment:
              subject_id: ajetvnq2mil8********
        ```

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. Describe the parameters for assigning users and groups to your application in a configuration file:

      ```hcl
      resource "yandex_organizationmanager_idp_application_oauth_application_assignment" "example_assignment" {
        application_id = "<app_ID>"
        subject_id     = "<user_or_group_ID>"
      }
      ```

      Where:

      * `application_id`: OIDC app ID.
      * `subject_id`: User or user group ID.

      For more on the properties of the `yandex_organizationmanager_idp_application_oauth_application_assignment` resource, see [this provider guide](../../../terraform/resources/organizationmanager_idp_application_oauth_application_assignment.md).

  1. Create the resources:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.

      Terraform will create all the required resources. You can check the new resources and their settings in the [Cloud Center UI](https://center.yandex.cloud/organization) or using this [CLI](../../../cli/index.md) command:

      ```bash
      yc organization-manager idp application oauth application list-assignments <app_ID>
      ```

- API {#api}

  Use the [Application.UpdateAssignments](../../idp/application/oauth/api-ref/Application/updateAssignments.md) REST API method for the [Application](../../idp/application/oauth/api-ref/Application/index.md) resource or the [ApplicationService/UpdateAssignments](../../idp/application/oauth/api-ref/grpc/Application/updateAssignments.md) gRPC API call.

{% endlist %}

{% note tip %}

If you want to fine-tune user authentication in your applications, including authentication only from specific IP addresses, use [authentication policies](*authentication_policies).

{% endnote %}

[*authentication_policies]: Authentication policies are a Yandex Identity Hub tool that allows you to flexibly configure access to applications by denying or allowing authentication for specific users in specific applications and/or from specific IP addresses. For more information, see [Authentication policies in Yandex Identity Hub](../../concepts/authentication-policy.md).

## Make sure your application works correctly {#validate}

To make sure both your OIDC application and service provider integration work correctly, get authenticated in the external app as one of the users you added to the application.

#### Useful links {#see-also}

* [Updating an OIDC application in Yandex Identity Hub](oidc-update.md)
* [Deactivating and deleting an OIDC application in Yandex Identity Hub](oidc-deactivate-remove.md)
* [Adding a user](../add-account.md)
* [OIDC apps](../../concepts/applications.md#oidc)
* [Managing user groups](../manage-groups.md)