@alicloud/eiam20211201 2.17.5 → 2.17.6

package/src/models/ListCredentialProvidersResponseBody.ts

@@ -10,7 +10,7 @@ export class ListCredentialProvidersResponseBodyCredentialProvidersCredentialPro
   allowedTokenIssuers?: string[];
   /**
    * @remarks
-   * Indicates whether the JWT derived short token feature is enabled.
+   * Specifies whether to enable the JWT-derived short token capability.
    * 
    * @example
    * false
@@ -26,7 +26,7 @@ export class ListCredentialProvidersResponseBodyCredentialProvidersCredentialPro
   expiration?: number;
   /**
    * @remarks
-   * Indicates whether JWT expiration cleanup is enabled.
+   * Specifies whether to enable JWT expiration cleanup.
    * 
    * @example
    * true
@@ -85,24 +85,58 @@ export class ListCredentialProvidersResponseBodyCredentialProvidersCredentialPro
 export class ListCredentialProvidersResponseBodyCredentialProvidersCredentialProviderConfigOAuthProviderConfig extends $dara.Model {
   /**
    * @remarks
-   * The client_id in the OAuth protocol, which is the client ID.
+   * The endpoint URL used to guide users through authorization. Conditionally required: this parameter is required when AuthorizationFlow is set to user_federation and ProviderVendor is set to custom. For preset vendors, this value can be automatically populated through DiscoveryUrl.
+   */
+  authorizationEndpoint?: string;
+  /**
+   * @remarks
+   * The OAuth authorization flow type. Valid values:
+   * - m2m: machine-to-machine (2LO, Client Credentials).
+   * - user_federation: user federation (3LO, Authorization Code).
+   */
+  authorizationFlow?: string;
+  /**
+   * @remarks
+   * The client_id in the OAuth protocol.
    * 
    * @example
    * client_id_example_xxx
    */
   clientId?: string;
+  /**
+   * @remarks
+   * The URL of the discovery document used to automatically obtain OAuth endpoint configurations. Conditionally optional: used when AuthorizationFlow is set to user_federation. If DiscoveryUrl is not provided, you must manually configure fields such as TokenEndpoint and AuthorizationEndpoint.
+   */
+  discoveryUrl?: string;
+  issuer?: string;
+  /**
+   * @remarks
+   * The method used to generate the PKCE code_challenge. Default value: s256.
+   */
+  pkceChallengeMethod?: string;
+  /**
+   * @remarks
+   * Specifies whether to use the PKCE extension to enhance security. We recommend that you always enable this feature.
+   */
+  pkceEnabled?: boolean;
+  /**
+   * @remarks
+   * The preset vendor or custom configuration. Optional. Default value: custom.
+   */
+  providerVendor?: string;
   /**
    * @remarks
    * The scope in the OAuth protocol, which specifies the permission scope.
    * 
-   * > The Scope configuration of the OAuth credential provider serves as the default value. If the scope parameter is not specified when calling the DeveloperAPI to obtain an OAuth access token, the Scope configuration of the credential provider is used for token issuance.
-   * 
-   * >Notice: Multiple Scope values are separated by spaces.
-   * 
    * @example
    * example:test_01 example:test_02
    */
   scope?: string;
+  /**
+   * @remarks
+   * The redirect URI automatically generated by the system when the credential provider is created. Configure this value as the redirect_uri in the OAuth provider.
+   */
+  systemRedirectUri?: string;
   /**
    * @remarks
    * The token endpoint of the OAuth protocol.
@@ -113,16 +147,32 @@ export class ListCredentialProvidersResponseBodyCredentialProvidersCredentialPro
   tokenEndpoint?: string;
   static names(): { [key: string]: string } {
     return {
+      authorizationEndpoint: 'AuthorizationEndpoint',
+      authorizationFlow: 'AuthorizationFlow',
       clientId: 'ClientId',
+      discoveryUrl: 'DiscoveryUrl',
+      issuer: 'Issuer',
+      pkceChallengeMethod: 'PkceChallengeMethod',
+      pkceEnabled: 'PkceEnabled',
+      providerVendor: 'ProviderVendor',
       scope: 'Scope',
+      systemRedirectUri: 'SystemRedirectUri',
       tokenEndpoint: 'TokenEndpoint',
     };
   }
 
   static types(): { [key: string]: any } {
     return {
+      authorizationEndpoint: 'string',
+      authorizationFlow: 'string',
       clientId: 'string',
+      discoveryUrl: 'string',
+      issuer: 'string',
+      pkceChallengeMethod: 'string',
+      pkceEnabled: 'boolean',
+      providerVendor: 'string',
       scope: 'string',
+      systemRedirectUri: 'string',
       tokenEndpoint: 'string',
     };
   }
@@ -139,19 +189,17 @@ export class ListCredentialProvidersResponseBodyCredentialProvidersCredentialPro
 export class ListCredentialProvidersResponseBodyCredentialProvidersCredentialProviderConfig extends $dara.Model {
   /**
    * @remarks
-   * The configuration of the JWT credential provider.
+   * The configuration of the JWT-type credential provider.
    */
   jwtProviderConfig?: ListCredentialProvidersResponseBodyCredentialProvidersCredentialProviderConfigJwtProviderConfig;
   /**
    * @remarks
-   * The configuration of the OAuth credential provider.
+   * The configuration of the OAuth-type credential provider.
    */
   OAuthProviderConfig?: ListCredentialProvidersResponseBodyCredentialProvidersCredentialProviderConfigOAuthProviderConfig;
   /**
    * @remarks
-   * The list of credential IDs that correspond to the sensitive configuration of the credential provider.
-   * 
-   * > The system securely stores the sensitive configuration of the credential provider as credentials.
+   * The list of credential IDs that correspond to the sensitive configurations of the credential provider.
    */
   providerCredentialIds?: string[];
   static names(): { [key: string]: string } {
@@ -191,7 +239,7 @@ export class ListCredentialProvidersResponseBodyCredentialProvidersCredentialPro
 export class ListCredentialProvidersResponseBodyCredentialProviders extends $dara.Model {
   /**
    * @remarks
-   * The creation time of the credential provider. This value is a UNIX timestamp in milliseconds.
+   * The time when the credential provider was created. The value is a UNIX timestamp in milliseconds.
    * 
    * @example
    * 1649830225000
@@ -199,16 +247,13 @@ export class ListCredentialProvidersResponseBodyCredentialProviders extends $dar
   createTime?: number;
   /**
    * @remarks
-   * The credential provider configuration.
+   * The configuration of the credential provider.
    */
   credentialProviderConfig?: ListCredentialProvidersResponseBodyCredentialProvidersCredentialProviderConfig;
   /**
    * @remarks
    * The creation type of the credential provider. Valid values:
    * 
-   * - system_init: Created by the system.
-   * - user_custom: Created by the user.
-   * 
    * @example
    * user_custom
    */
@@ -223,7 +268,7 @@ export class ListCredentialProvidersResponseBodyCredentialProviders extends $dar
   credentialProviderId?: string;
   /**
    * @remarks
-   * The credential provider identifier.
+   * The business identifier of the credential provider.
    * 
    * @example
    * test_example_identifier
@@ -231,7 +276,7 @@ export class ListCredentialProvidersResponseBodyCredentialProviders extends $dar
   credentialProviderIdentifier?: string;
   /**
    * @remarks
-   * The credential provider name.
+   * The name of the credential provider.
    * 
    * @example
    * test_example_name
@@ -241,16 +286,13 @@ export class ListCredentialProvidersResponseBodyCredentialProviders extends $dar
    * @remarks
    * The credential provider type. Valid values:
    * 
-   * - oauth: OAuth credential provider.
-   * - jwt: JWT credential provider.
-   * 
    * @example
    * oauth
    */
   credentialProviderType?: string;
   /**
    * @remarks
-   * The description.
+   * The description of the credential provider.
    * 
    * @example
    * This is an example description
@@ -268,16 +310,13 @@ export class ListCredentialProvidersResponseBodyCredentialProviders extends $dar
    * @remarks
    * The credential provider status. Valid values:
    * 
-   * - enabled: Enabled.
-   * - disabled: Disabled.
-   * 
    * @example
    * enabled
    */
   status?: string;
   /**
    * @remarks
-   * The update time of the credential provider. This value is a UNIX timestamp in milliseconds.
+   * The time when the credential provider was last updated. The value is a UNIX timestamp in milliseconds.
    * 
    * @example
    * 1649830225000
@@ -343,7 +382,7 @@ export class ListCredentialProvidersResponseBody extends $dara.Model {
   maxResults?: number;
   /**
    * @remarks
-   * The pagination token returned by this call.
+   * The pagination token returned in this call.
    * 
    * @example
    * NTxxxexample

package/src/models/UpdateCredentialProviderRequest.ts

@@ -9,12 +9,12 @@ export class UpdateCredentialProviderRequestCredentialProviderConfigJwtProviderC
    * 
    * > The list cannot contain more than 200 entries.
    * 
-   * >Notice: To clear the issuer list, pass an empty list or an empty string.
+   * >Notice: To clear the issuer list, pass an empty list or an empty string when calling the API.
    */
   allowedTokenIssuers?: string[];
   /**
    * @remarks
-   * Specifies whether to enable the JWT derived short token feature.
+   * Specifies whether to enable the JWT derived short token capability.
    * 
    * @example
    * false
@@ -69,7 +69,19 @@ export class UpdateCredentialProviderRequestCredentialProviderConfigJwtProviderC
 export class UpdateCredentialProviderRequestCredentialProviderConfigOAuthProviderConfig extends $dara.Model {
   /**
    * @remarks
-   * The client_secret in the OAuth protocol, which is the client secret.
+   * The endpoint URL used to guide users through authorization. Conditionally required: this parameter is required when AuthorizationFlow is set to user_federation and ProviderVendor is set to custom. For preset vendors, this value can be automatically populated through DiscoveryUrl.
+   */
+  authorizationEndpoint?: string;
+  /**
+   * @remarks
+   * The OAuth authorization flow type. Valid values:
+   * - m2m: Machine-to-machine (2LO, Client Credentials).
+   * - user_federation: User federation (3LO, Authorization Code).
+   */
+  authorizationFlow?: string;
+  /**
+   * @remarks
+   * The client_secret in the OAuth protocol.
    * 
    * > The value cannot exceed 1024 characters in length.
    * 
@@ -77,15 +89,36 @@ export class UpdateCredentialProviderRequestCredentialProviderConfigOAuthProvide
    * client_secret_example_xxx
    */
   clientSecret?: string;
+  /**
+   * @remarks
+   * The Discovery document URL used to automatically retrieve OAuth endpoint configurations. Conditionally optional: this parameter is used when AuthorizationFlow is set to user_federation. If DiscoveryUrl is not provided, you must manually configure fields such as TokenEndpoint and AuthorizationEndpoint.
+   */
+  discoveryUrl?: string;
+  issuer?: string;
+  /**
+   * @remarks
+   * The PKCE code_challenge generation method. Default value: s256.
+   */
+  pkceChallengeMethod?: string;
+  /**
+   * @remarks
+   * Specifies whether to use the PKCE extension for enhanced security. We recommend that you always enable this feature.
+   */
+  pkceEnabled?: boolean;
+  /**
+   * @remarks
+   * The preset vendor or custom configuration. This parameter is optional. Default value: custom.
+   */
+  providerVendor?: string;
   /**
    * @remarks
    * The scope in the OAuth protocol, which specifies the permission scope.
    * 
-   * > The Scope configuration at the credential provider serves as the default value. If the scope parameter is not specified when calling the DeveloperAPI to obtain an OAuth Access Token, the Scope configuration at the credential provider is used for issuance.
+   * > The Scope configuration on the OAuth credential provider serves as a fallback value. If the scope parameter is not specified when calling the DeveloperAPI to obtain an OAuth Access Token, the Scope configuration on the credential provider is used for token issuance.
    * 
    * >Notice: Separate multiple Scope values with spaces. To clear the Scope configuration, pass an empty string.
    * 
-   * Restrictions on a single Scope value:
+   * Restrictions for each individual Scope value:
    * 1. Allowed characters: lowercase letters, digits, and special characters `|/:_-.`
    * 2. Must contain at least one lowercase letter or digit.
    * 3. Must start with a special character `.`, a lowercase letter, or a digit.
@@ -107,7 +140,14 @@ export class UpdateCredentialProviderRequestCredentialProviderConfigOAuthProvide
   tokenEndpoint?: string;
   static names(): { [key: string]: string } {
     return {
+      authorizationEndpoint: 'AuthorizationEndpoint',
+      authorizationFlow: 'AuthorizationFlow',
       clientSecret: 'ClientSecret',
+      discoveryUrl: 'DiscoveryUrl',
+      issuer: 'Issuer',
+      pkceChallengeMethod: 'PkceChallengeMethod',
+      pkceEnabled: 'PkceEnabled',
+      providerVendor: 'ProviderVendor',
       scope: 'Scope',
       tokenEndpoint: 'TokenEndpoint',
     };
@@ -115,7 +155,14 @@ export class UpdateCredentialProviderRequestCredentialProviderConfigOAuthProvide
 
   static types(): { [key: string]: any } {
     return {
+      authorizationEndpoint: 'string',
+      authorizationFlow: 'string',
       clientSecret: 'string',
+      discoveryUrl: 'string',
+      issuer: 'string',
+      pkceChallengeMethod: 'string',
+      pkceEnabled: 'boolean',
+      providerVendor: 'string',
       scope: 'string',
       tokenEndpoint: 'string',
     };
@@ -175,7 +222,7 @@ export class UpdateCredentialProviderRequest extends $dara.Model {
    * @remarks
    * The idempotency token that ensures the idempotence of the request.
    * 
-   * Generate a unique parameter value from your client to ensure that the value is unique among different requests. ClientToken supports only ASCII characters and cannot exceed 64 characters in length. For more information, see References: [How to ensure idempotence](https://www.alibabacloud.com/help/zh/ecs/developer-reference/how-to-ensure-idempotence).
+   * Generate a unique parameter value from your client to ensure uniqueness across different requests. ClientToken supports only ASCII characters and cannot exceed 64 characters in length. For more information, see References: [How to ensure idempotence](https://www.alibabacloud.com/help/zh/ecs/developer-reference/how-to-ensure-idempotence).
    * 
    * This parameter is required.
    *