[Yandex Cloud documentation](../../../index.md) > [Yandex Identity Hub](../../index.md) > [Step-by-step guides](../index.md) > Managing apps (SSO) > OIDC apps > Updating an app

# Updating an OIDC application in Yandex Identity Hub


OIDC apps can be managed by users with the `organization-manager.oauthApplications.admin` [role](../../security/index.md#organization-manager-oauthApplications-admin) or higher.

## Update the app's basic settings {#update-basic-settings}

To update the [OIDC app's](../../concepts/applications.md#oidc) basic settings:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and select the OIDC application.
  1. On the top right, click ![pencil](../../../_assets/console-icons/pencil.svg) **Edit** and in the window that opens:

      1. Change the app's name in the **Name** field. The name must be unique within the organization and follow the naming requirements:

          * It must be from 1 to 63 characters long.
          * It may contain lowercase Latin letters, numbers, and hyphens.
          * It must start with a letter and cannot end with a hyphen.

      1. Change the app's description in the **Description** field.
      1. Add new [labels](../../../resource-manager/concepts/labels.md) by clicking **Labels** in the **Add label** field. Click ![xmark](../../../_assets/console-icons/xmark.svg) to delete an existing label.
      1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for updating an OIDC application:

     ```bash
     yc organization-manager idp application oauth application update --help
     ```
  
  1. Run this command:

     ```bash
     yc iam organization-manager idp application oauth application update \
       --id <app_ID> \
       --new-name <application_name> \
       --description <application_description> \
       --client-id <OAuth_client_ID> \
       --authorized-scopes <attribute>[,<attribute>] \
       --group-distribution-type all-groups \
       --labels <key>=<value>[,<key>=<value>]
     ```

     Where:

     * `--id`: OIDC app ID. This is a required setting.
     * `--name`: New name for the OIDC app. The name must be unique within the organization and follow the naming requirements:

       * It must be from 1 to 63 characters long.
       * It may contain lowercase Latin letters, numbers, and hyphens.
       * It must start with a letter and cannot end with a hyphen.

     * `--description`: New description for the OIDC app.
     * `--client-id`: ID of the new OAuth client.
     * `--authorized-scopes`: New user attributes that will be available to the service provider. Specify one or more attributes, comma-separated, in `<attribute1>,<attribute2>` format. Possible attributes:
       * `openid`: User ID. Required attribute.
       * `profile`: Additional user details, such as first name, last name, and avatar.
       * `email`: User email address.
       * `address`: User home address.
       * `phone`: User phone number.
       * `groups`: [User groups](../../concepts/groups.md) in the organization.

         {% note warning %}
         
         You need to specify the new user attributes in the [service provider configuration](#update-sp) first, using the `--scopes` parameters.
         
         {% endnote %}

     * `--group-distribution-type`: If you specified the `groups` attribute when creating or updating the OAuth client, update the user groups you want to send to your service provider. The possible values are:
       * `all-groups`: Service provider will get all groups the user belongs to.

          The maximum number of groups to change hands is 1,000. If the user belongs to more groups than this, only the first thousand will go to the service provider.
       * `assigned-groups`: Of all the user's groups, the service provider will only get the ones [explicitly specified](#users-and-groups).
       * `none`: Service provider will not get any of the groups the user belongs to.
     * `--labels`: New list of [labels](../../../resource-manager/concepts/labels.md). You can specify one or more labels separated by commas in `<key1>=<value1>,<key2>=<value2>` format.

     Result:

     ```text
     id: ek0o663g4rs2********
     name: oidc-app
     organization_id: bpf2c65rqcl8********
     group_claims_settings:
       group_distribution_type: NONE
     client_grant:
       client_id: ajeqqip130i1********
       authorized_scopes:
         - openid
     status: ACTIVE
     created_at: "2025-10-21T10:51:28.790866Z"
     updated_at: "2025-10-21T12:37:19.274522Z"
     ```

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. In the Terraform configuration file, edit the [OIDC application](../../concepts/applications.md#oidc) settings:

    ```hcl
    resource "yandex_organizationmanager_idp_application_oauth_application" "example_oidc_app" {
      application_id   = "<app_ID>"
      organization_id = "<organization_ID>"
      name            = "<new_application_name>"
      description     = "<new_application_description>"
      
      client_grant = {
        client_id         = "<OAuth_client_ID>"
        authorized_scopes = ["<attribute_1>", "<attribute_2>"]
      }
      
      group_claims_settings = {
        group_distribution_type = "ALL_GROUPS"
      }
      
      labels = {
        "<key_1>" = "<value_1>"
        "<key_2>" = "<value_2>"
      }
    }
    ```

    Where:

    * `application_id`: OIDC app ID. This is a required setting.
    * `organization_id`: [ID of the organization](../organization-get-id.md) the OIDC application belongs to. This is a required setting.
    * `--name`: New name for the OIDC app. The name must be unique within the organization and follow the naming requirements:

      * It must be from 1 to 63 characters long.
      * It may contain lowercase Latin letters, numbers, and hyphens.
      * It must start with a letter and cannot end with a hyphen.

    * `description`: New description for the OIDC app. This is an optional setting.
    * `client_grant`: OAuth client connection settings:
      * `client_id`: OAuth client ID. This is a required setting.
      * `authorized_scopes`: New user attributes that will be available to the service provider. Specify one or more attributes in square brackets. Possible attributes:
        * `openid`: User ID. Required attribute.
        * `profile`: Additional user details, such as first name, last name, and avatar.
        * `email`: User email address.
        * `address`: User home address.
        * `phone`: User phone number.
        * `groups`: User groups in the organization.
    * `group_claims_settings`: Settings for sending user group claims to the service provider:
      * `group_distribution_type`: If you provided the `groups` attribute when creating the OAuth client, specify which user groups you want to go to the service provider. The possible values are:
        * `ALL_GROUPS`: Service provider will get all groups the user belongs to.
        * `ASSIGNED_GROUPS`: Of all the user's groups, the service provider will only get the ones explicitly specified.
        * `NONE`: Service provider will not get any of the groups the user belongs to.
    * `labels`: List of [labels](../../../resource-manager/concepts/labels.md). This is an optional setting.

    For more on the properties of the `yandex_organizationmanager_idp_application_oauth_application` resource, see [this provider guide](../../../terraform/resources/organizationmanager_idp_application_oauth_application.md).

  1. Apply the changes:

    1. In the terminal, navigate to the configuration file directory.
    1. Make sure the configuration is correct using this command:
    
       ```bash
       terraform validate
       ```
    
       If the configuration is valid, you will get this message:
    
       ```bash
       Success! The configuration is valid.
       ```
    
    1. Run this command:
    
       ```bash
       terraform plan
       ```
    
       You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
    1. Apply the configuration changes:
    
       ```bash
       terraform apply
       ```
    
    1. Type `yes` and press **Enter** to confirm the changes.

    You can check the updates of resources and their settings either in the [Cloud Center UI](https://center.yandex.cloud/organization) or using this [CLI](../../../cli/index.md) command:

    ```bash
    yc organization-manager idp application oauth application get <app_ID>
    ```

- API {#api}

  Use the [Application.Update](../../idp/application/oauth/api-ref/Application/update.md) REST API method for the [Application](../../idp/application/oauth/api-ref/Application/index.md) resource or the [ApplicationService/Update](../../idp/application/oauth/api-ref/grpc/Application/update.md) gRPC API call.

{% endlist %}

## Update the service provider configuration {#update-sp}

To update the service provider configuration in an OIDC app:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and select the OIDC app.
  1. On the top right, click ![pencil](../../../_assets/console-icons/pencil.svg) **Edit** and in the window that opens:
     
     1. Specify the address you got from the service provider in the **Redirect URI** field.
     
         Click **Add URI** to specify multiple redirect URIs at once.
     1. In the **Scopes** field, select user attributes that will be available to the service provider.
     
         * `openid (user ID)`: User ID. This is a required setting.
         * `email address`: User email address.
         * `profile (full name, first name, last name, avatar, etc.)`: Additional user details.
         * `groups (user's groups in the organization)`: Organization [user groups](../../concepts/groups.md) to which the user getting authenticated belongs. The possible values are:
         
             * `All groups`: Service provider will get all groups the user belongs to.
         
                 The maximum number of groups is 1,000. If the user belongs to more groups than this, only the first thousand will go to the service provider. 
             * `Assigned groups only`: Of all the user's groups, the service provider will only get the ones explicitly specified in the **Users and groups** tab of the OIDC application.
     
     1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for setting up the OAuth client:

     ```bash
     yc iam oauth-client update --help
     ```

  1. Run this command:

     ```bash
     yc iam oauth-client update \
       --id <OAuth_client_ID> \
       --new-name <new_name_for_OAuth_client> \
       --redirect-uris <address>[,<address>] \
       --scopes <attribute>[,<attribute>]
     ```

     Where:

     * `--id`: OAuth client ID.
     * `--new-name`: New name for the OAuth client.
     * `--scopes`: New user attributes that will be available to the service provider. Specify one or more attributes, comma-separated, in `<attribute1>,<attribute2>` format. Possible attributes:
       * `openid`: User ID. Required attribute.
       * `profile`: Additional user details, such as first name, last name, and avatar.
       * `email`: User email address.
       * `address`: User home address.
       * `phone`: User phone number.
       * `groups`: [User groups](../../concepts/groups.md) in the organization.

         {% note warning %}
         
         You also need to specify the new user attributes in the [app's basic settings](#update-basic-settings) using the `--authorized-scopes` parameters.
         
         {% endnote %}

     * `--redirect-uris`: Specify the new address or addresses you got from the service provider in `<address1>,<address2>` format.

     Result:

     ```text
     id: ajejklv8g9kh********
     name: my-oauth-client
     redirect_uris:
       - https://example2.com
       - https://example2.ru
     scopes:
       - openid
       - profile
     folder_id: b1g500m2195v********
     status: ACTIVE
     ```

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. In the Terraform configuration file, edit the OIDC client settings:

    ```hcl
    resource "yandex_iam_oauth_client" "example_oauth_client" {
      oauth_client_id = "<OAuth_client_ID>"
      name           = "<new_name_for_OAuth_client>"
      redirect_uris  = ["<address_1>", "<address_2>"]
      scopes         = ["<attribute_1>", "<attribute_2>"]
    }
    ```

    Where:

    * `oauth_client_id`: OAuth client ID. This is a required setting.
    * `name`: New name for the OAuth client. This is an optional setting.
    * `redirect_uris`: New list of redirect URIs. Specify one or more URIs in square brackets. This is an optional setting.
    * `scopes`: New user attributes that will be available to the service provider. Specify one or more attributes in square brackets. Possible attributes:
      * `openid`: User ID. Required attribute.
      * `profile`: Additional user details, such as first name, last name, and avatar.
      * `email`: User email address.
      * `address`: User home address.
      * `phone`: User phone number.
      * `groups`: User groups in the organization.

    For more on the properties of the `yandex_iam_oauth_client` resource, see [this provider guide](../../../terraform/resources/iam_oauth_client.md).

  1. Apply the changes:

    1. In the terminal, navigate to the configuration file directory.
    1. Make sure the configuration is correct using this command:
    
       ```bash
       terraform validate
       ```
    
       If the configuration is valid, you will get this message:
    
       ```bash
       Success! The configuration is valid.
       ```
    
    1. Run this command:
    
       ```bash
       terraform plan
       ```
    
       You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
    1. Apply the configuration changes:
    
       ```bash
       terraform apply
       ```
    
    1. Type `yes` and press **Enter** to confirm the changes.

    You can check the updates of resources and their settings either in the [Cloud Center interface](https://center.yandex.cloud/organization) or using this [CLI](../../../cli/index.md) command:

    ```bash
    yc iam oauth-client get <OAuth_client_ID>
    ```

- API {#api}

  Use the [OAuthClient.Update](../../../iam/api-ref/OAuthClient/update.md) REST API method for the [OAuthClient](../../../iam/api-ref/grpc/OAuthClient/index.md) resource or the [OAuthClientService/Update](../../../iam/api-ref/grpc/OAuthClient/update.md) gRPC API call.


{% endlist %}

## Updating an app's secret {#update-secret}

There is no way you can view or update an app’s [secret](../../concepts/applications.md#oidc-secret). Instead, you can generate a new one:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and select the OIDC app.
  1. Under **App secrets**, click **Add secret**, and in the window that opens:
     
     1. Optionally, add a description for the new secret.
     1. Click **Create**.
     
     The window will display the generated [application secret](../../concepts/applications.md#oidc-secret). Save this value.
     
     {% note warning %}
     
     If you refresh or close the application information page, you will not be able to view the secret again.
     
     {% endnote %}
     
     If you closed or refreshed the page before saving the secret, click **Add secret** to create a new one.
     
     To delete a secret, in the list of secrets on the OIDC app page, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) in the secret row and select ![trash-bin](../../../_assets/console-icons/trash-bin.svg) **Delete**.
  1. Remember to provide the new secret in the settings on the service provider side. If you need help, refer to your service provider's documentation or support team.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for creating a new OIDC app secret:

     ```bash
     yc iam oauth-client-secret create --help
     ```

  1. Run this command:

     ```bash
     yc iam oauth-client-secret create --oauth-client-id <OAuth_client_ID>
     ```

     Result:

     ```text
     oauth_client_secret:
       id: aje0hjqp68u6********
       oauth_client_id: ajejklv8g9kh********
       masked_secret: yccs__9e1d5f6d5c****
       created_at: "2025-10-23T11:44:50.739768533Z"
     secret_value: yccs__9e1d5f6d5c********
     ```

     Remember to provide the new secret in the settings on the service provider side. If you need help, refer to your service provider's documentation or support team.

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. In the Terraform configuration file, create a new secret for the OAuth client:

    ```hcl
    resource "yandex_iam_oauth_client_secret" "example_oauth_client_secret" {
      oauth_client_id = "<OAuth_client_ID>"
    }
    ```

    Where:

    * `oauth_client_id`: ID of the OAuth client for which you are creating a new secret. This is a required setting.

    For more on the properties of the `yandex_iam_oauth_client_secret` resource, see [this provider guide](../../../terraform/resources/iam_oauth_client_secret.md).

  1. Apply the changes:

    1. In the terminal, navigate to the configuration file directory.
    1. Make sure the configuration is correct using this command:
    
       ```bash
       terraform validate
       ```
    
       If the configuration is valid, you will get this message:
    
       ```bash
       Success! The configuration is valid.
       ```
    
    1. Run this command:
    
       ```bash
       terraform plan
       ```
    
       You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
    1. Apply the configuration changes:
    
       ```bash
       terraform apply
       ```
    
    1. Type `yes` and press **Enter** to confirm the changes.

    You can check the updates of resources and their settings either in the [Cloud Center interface](https://center.yandex.cloud/organization) or using this [CLI](../../../cli/index.md) command:

    ```bash
    yc iam oauth-client-secret list --oauth-client-id <OAuth_client_ID>
    ```


- API {#api}

  Use the [OAuthClientSecret.Create](../../../iam/api-ref/OAuthClientSecret/create.md) REST API method for the [OAuthClientSecret](../../../iam/api-ref/OAuthClientSecret/index.md) resource or the [OAuthClientSecretService/Create](../../../iam/api-ref/grpc/OAuthClientSecret/create.md) gRPC API call.

{% endlist %}

## Update the list of app users and groups {#users-and-groups}

Update the list of your [organization's](../../concepts/organization.md) users who can use the OIDC app to authenticate to an external application:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../_assets/console-icons/shapes-4.svg) **Apps** and then, the OIDC app.
  1. Navigate to the **Users and groups** tab.
  1. To add a user or user group to the app:

      1. Click ![person-plus](../../../_assets/console-icons/person-plus.svg) **Add users**.
      1. In the window that opens, select the required user or user group.
      1. Click **Add**.
  1. To delete a user or user group from the app:

      1. In the list of users and groups, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![trash-bin](../../../_assets/console-icons/trash-bin.svg) **Delete** next to the user or user group.
      1. Confirm the deletion.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. Get the [user ID](../users-get.md) or [user group ID](../group-get-id.md).

  1. To add a user or user group to the app:
  
     1. See the description of the CLI command for adding users to an app:
   
        ```bash
        yc organization-manager idp application oauth application add-assignments --help
        ```
   
     1. Run this command:
   
        ```bash
        yc organization-manager idp application oauth application add-assignments \
          --id <app_ID> \
          --subject-id ek0omvvcb9vv********
        ```
   
        Where:
   
        * `--id`: App ID.
        * `--subject-id`: User or user group ID.
   
        Result:
   
        ```text
        assignment_deltas:
          - action: ADD
            assignment:
              subject_id: ajetvnq2mil8********
        ```

  1. To delete a user or user group from the app:

     1. See the description of the CLI command for removing users from an app:
   
        ```bash
        yc organization-manager idp application oauth application remove-assignments --help
        ```
   
     1. Run this command:
   
        ```bash
        yc organization-manager idp application oauth application remove-assignments \
          --id <app_ID> \
          --subject-id <user_ID>
        ```
   
        Where:
   
        * `--id`: OIDC app ID.
        * `--subject-id`: User or user group ID.
   
        Result:
   
        ```text
        assignment_deltas:
          - action: REMOVE
            assignment:
              subject_id: ajetvnq2mil8********
        ```

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. Describe the parameters for assigning users and groups to your application in a configuration file:

      ```hcl
      resource "yandex_organizationmanager_idp_application_oauth_application_assignment" "example_assignment" {
        application_id = "<app_ID>"
        subject_id     = "<user_or_group_ID>"
      }
      ```

      Where:

      * `application_id`: OIDC app ID.
      * `subject_id`: User or user group ID.

      For more on the properties of the `yandex_organizationmanager_idp_application_oauth_application_assignment` resource, see [this provider guide](../../../terraform/resources/organizationmanager_idp_application_oauth_application_assignment.md).

  1. Create the resources:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.

      Terraform will create all the required resources. You can check the new resources and their settings in the [Cloud Center UI](https://center.yandex.cloud/organization) or using this [CLI](../../../cli/index.md) command:

      ```bash
      yc organization-manager idp application oauth application list-assignments <app_ID>
      ```

- API {#api}

  Use the [Application.UpdateAssignments](../../idp/application/oauth/api-ref/Application/updateAssignments.md) REST API method for the [Application](../../idp/application/oauth/api-ref/Application/index.md) resource or the [ApplicationService/UpdateAssignments](../../idp/application/oauth/api-ref/grpc/Application/updateAssignments.md) gRPC API call.

{% endlist %}

{% note tip %}

If you want to fine-tune user authentication in your applications, including authentication only from specific IP addresses, use [authentication policies](*authentication_policies).

{% endnote %}

[*authentication_policies]: Authentication policies are a Yandex Identity Hub tool that allows you to flexibly configure access to applications by denying or allowing authentication for specific users in specific applications and/or from specific IP addresses. For more information, see [Authentication policies in Yandex Identity Hub](../../concepts/authentication-policy.md).

#### Useful links {#see-also}

* [Creating an OIDC application in Yandex Identity Hub](oidc-create.md)
* [Deactivating and deleting an OIDC application in Yandex Identity Hub](oidc-deactivate-remove.md)
* [Adding a user](../add-account.md)
* [OIDC apps](../../concepts/applications.md#oidc)
* [Managing user groups](../manage-groups.md)