AAC Docs

aac sso login

AAC CLI 0.2.11MarkdownDocs a4b073409b4b

Sign in via your tenant's IdP; caches an AAC session.

Signs in against one of the tenant's registered IdP connections (device
flow or loopback PKCE, selected per IdP capability), exchanges the ID
token at the AAC STS (RFC 8693), and caches the short-lived session token.
Success writes the config profile AND the credential in one motion.

Bind a local profile to an EXISTING tenant by authenticating:

    aac sso login --profile NAME --tenant-id <TENANT_ID>

No separate profile bind command is needed. Clear an invalid stored
binding first:

    aac profile update NAME --unbind

Sessions last 4 hours by default. Your administrator may configure a
different lifetime for the deployment or connection.

You can run login again before expiry. Successful authentication
replaces the cached session with a new one whose lifetime starts at
that login. Check its expiration with:

    aac sso whoami --profile NAME --output table

Sessions have no refresh token; if a session expires, run login again.

Synopsis

aac sso login
  [-h]
  [--profile PROFILE]
  [--admin-url ADMIN_URL]
  [--data-plane-url DATA_PLANE_URL]
  [--output {json,table}]
  [--tenant-id TENANT_ID]
  [--idp-url URL | --idp {github,google}]
  [--flow {device,pkce}]
  [--scope SCOPE]
  [--no-browser]

Arguments

Argument Type Required Default Description
-h, --help flag no — show this help message and exit
--profile value no — Profile to run under (selection: --profile > AAC_PROFILE > reserved baseline main). aac profile list shows what exists.
--admin-url value no — Admin-surface base URL (overrides profile).
--data-plane-url value no — Data-plane-surface base URL (overrides profile).
--output json | table no json Output mode: json (the default) or table.
--tenant-id value no — Tenant to sign in TO (default: profile/env tenant).
--idp-url value no — Which IdP connection to use, by the connection's exact URL (its issuer URL, as registered). With several registered, a terminal asks which one; a script gets exit 3 and the exact commands.
--idp github | google no — Short form of --idp-url for the shared developer sign-ins: github or google.
--flow device | pkce no — Override the per-IdP flow selection (pkce is not available for GitHub).
--scope value no — OAuth scope for the upstream flow (default: per IdP family — 'openid profile email' for OIDC families, none for GitHub).
--no-browser flag no — Print the sign-in URL instead of opening a browser tab, and do not offer to open the device-flow page.

At most one of --idp-url, --idp may be given.

Output

--output json (the default) prints one JSON document to standard output; --output table prints a readable table instead. Progress notes and diagnostics go to standard error, so the JSON stays parseable.

Exit codes

Code Meaning
0 Success.
1 The control plane or the identity provider rejected the request.
2 Usage error: an invalid flag, value or flag combination.
3 A local configuration or state problem: profile, credential file, cached session or agent.
4 Transport failure: an endpoint could not be reached.
130 Interrupted by the operator (Ctrl-C); a remote change may already have committed.

Notes

Choosing a connection: with no --idp/--idp-url, the tenant's own
connections take precedence over the shared developer sign-ins. When
several remain, a terminal gets a numbered list to choose from; without
a terminal (scripts, pipes) login exits 3 and prints one copy-ready
command per connection.

Flow selection: device flow by default (works on headless machines —
the browser can be anywhere); Google-family connections prefer loopback
PKCE (Google's device flow is scope-restricted). Override with --flow;
GitHub connections accept the device flow only.
Connections registered with jwks_static carry no flow endpoints and
cannot login interactively.