keenauth_organization_domain

The keenauth_organization_domain resource adds a domain to an organization. A verified domain lets users with an e-mail address in it join the organization and routes their sign-in to the organization's SSO connection.

resource "keenauth_organization_domain" "acme" {
  organization_id = keenauth_organization.acme.id
  domain          = "acme.example.com"
}

output "txt_record" {
  value = {
    name  = keenauth_organization_domain.acme.txt_record_name
    value = keenauth_organization_domain.acme.txt_record_value
  }
}

Verification

• A dns_txt domain (the default) starts pending. Publish txt_record_name with the value txt_record_value as a TXT record at your DNS provider. The platform checks it on a schedule; to check at once, run keenauth organization-domains verify <id>.
• A domain not verified within 72 hours becomes expired. Run keenauth organization-domains verify <id> to start again; this issues a new txt_record_value.
• If the TXT record of a verified domain disappears, the domain becomes unverified, and revoked after 30 days.
• Verification is an action, not an attribute. The provider never runs it; it only reads status.
• verification_method = "manual" is your declaration that you own the domain. The domain is verified at once and the declaration is written to the management audit log.
• The TXT value is a public DNS value, not a secret. It is kept in state so that a DNS resource can use it.

Capture and SSO routing

• capture_mode is off (default), suggest or auto_join. sso_routing_enabled routes e-mail addresses in the domain to the organization's SSO connection.
• Both can be turned on only on a verified domain; the API answers 409 domain_not_verified otherwise. Turning them off is always allowed.
• For a new dns_txt domain, keep the defaults: the plan fails if you turn them on before the domain exists. Create the domain, publish the record, wait until status is verified, then set them and apply again.

Lifecycle

• Write domain in lower case without a trailing dot. Write internationalized names as A-labels (xn--…).
• Changing organization_id, domain or verification_method replaces the domain and starts a new verification.
• Removing the resource deletes the domain; capture and SSO routing stop with it.
• Deleting the organization deletes its domains. A domain deleted outside the provider is removed from state and planned again.

Import

Import by ID or by <org_id>/<domain>:

tofu import keenauth_organization_domain.acme odm_01j9zq3v8c5m2x7k4t6r1n0b3d
tofu import keenauth_organization_domain.acme org_01j9zq3v8c5m2x7k4t6r1n0b3d/acme.example.com