pulumi-azuread 5.48.0a1706744699__py3-none-any.whl → 6.8.0a1766208344__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pulumi-azuread might be problematic. Click here for more details.
- pulumi_azuread/__init__.py +48 -1
- pulumi_azuread/_inputs.py +3803 -919
- pulumi_azuread/_utilities.py +52 -12
- pulumi_azuread/access_package.py +84 -78
- pulumi_azuread/access_package_assignment_policy.py +202 -196
- pulumi_azuread/access_package_catalog.py +82 -76
- pulumi_azuread/access_package_catalog_role_assignment.py +73 -67
- pulumi_azuread/access_package_resource_catalog_association.py +73 -67
- pulumi_azuread/access_package_resource_package_association.py +79 -73
- pulumi_azuread/administrative_unit.py +120 -100
- pulumi_azuread/administrative_unit_member.py +66 -50
- pulumi_azuread/administrative_unit_role_member.py +75 -69
- pulumi_azuread/app_role_assignment.py +164 -264
- pulumi_azuread/application.py +766 -692
- pulumi_azuread/application_api_access.py +84 -80
- pulumi_azuread/application_app_role.py +120 -116
- pulumi_azuread/application_certificate.py +349 -211
- pulumi_azuread/application_fallback_public_client.py +50 -44
- pulumi_azuread/application_federated_identity_credential.py +142 -197
- pulumi_azuread/application_from_template.py +90 -84
- pulumi_azuread/application_identifier_uri.py +56 -52
- pulumi_azuread/application_known_clients.py +50 -44
- pulumi_azuread/application_optional_claims.py +87 -81
- pulumi_azuread/application_owner.py +76 -42
- pulumi_azuread/application_password.py +159 -205
- pulumi_azuread/application_permission_scope.py +160 -156
- pulumi_azuread/application_pre_authorized.py +120 -236
- pulumi_azuread/application_redirect_uris.py +75 -69
- pulumi_azuread/application_registration.py +315 -309
- pulumi_azuread/authentication_strength_policy.py +73 -67
- pulumi_azuread/claims_mapping_policy.py +48 -42
- pulumi_azuread/conditional_access_policy.py +248 -232
- pulumi_azuread/config/__init__.py +2 -1
- pulumi_azuread/config/__init__.pyi +23 -17
- pulumi_azuread/config/vars.py +47 -37
- pulumi_azuread/custom_directory_role.py +128 -122
- pulumi_azuread/directory_role.py +60 -54
- pulumi_azuread/directory_role_assignment.py +194 -181
- pulumi_azuread/directory_role_eligibility_schedule_request.py +86 -80
- pulumi_azuread/directory_role_member.py +54 -48
- pulumi_azuread/get_access_package.py +45 -31
- pulumi_azuread/get_access_package_catalog.py +40 -27
- pulumi_azuread/get_access_package_catalog_role.py +39 -25
- pulumi_azuread/get_administrative_unit.py +42 -27
- pulumi_azuread/get_application.py +135 -94
- pulumi_azuread/get_application_published_app_ids.py +42 -47
- pulumi_azuread/get_application_template.py +49 -33
- pulumi_azuread/get_client_config.py +24 -15
- pulumi_azuread/get_directory_object.py +32 -21
- pulumi_azuread/get_directory_role_templates.py +20 -12
- pulumi_azuread/get_directory_roles.py +23 -14
- pulumi_azuread/get_domains.py +65 -46
- pulumi_azuread/get_group.py +147 -88
- pulumi_azuread/get_group_role_management_policy.py +178 -0
- pulumi_azuread/get_groups.py +71 -51
- pulumi_azuread/get_named_location.py +47 -22
- pulumi_azuread/get_service_principal.py +108 -90
- pulumi_azuread/get_service_principals.py +60 -64
- pulumi_azuread/get_user.py +186 -118
- pulumi_azuread/get_users.py +96 -53
- pulumi_azuread/group.py +622 -464
- pulumi_azuread/group_member.py +56 -50
- pulumi_azuread/group_role_management_policy.py +544 -0
- pulumi_azuread/group_without_members.py +1610 -0
- pulumi_azuread/invitation.py +126 -120
- pulumi_azuread/named_location.py +90 -76
- pulumi_azuread/outputs.py +2844 -1308
- pulumi_azuread/privileged_access_group_assignment_schedule.py +695 -0
- pulumi_azuread/privileged_access_group_eligibility_schedule.py +695 -0
- pulumi_azuread/provider.py +292 -246
- pulumi_azuread/pulumi-plugin.json +2 -1
- pulumi_azuread/service_principal.py +400 -461
- pulumi_azuread/service_principal_certificate.py +230 -145
- pulumi_azuread/service_principal_claims_mapping_policy_assignment.py +53 -47
- pulumi_azuread/service_principal_delegated_permission_grant.py +146 -140
- pulumi_azuread/service_principal_password.py +156 -141
- pulumi_azuread/service_principal_token_signing_certificate.py +119 -124
- pulumi_azuread/synchronization_job.py +105 -111
- pulumi_azuread/synchronization_job_provision_on_demand.py +396 -0
- pulumi_azuread/synchronization_secret.py +64 -70
- pulumi_azuread/user.py +776 -730
- pulumi_azuread/user_flow_attribute.py +76 -70
- {pulumi_azuread-5.48.0a1706744699.dist-info → pulumi_azuread-6.8.0a1766208344.dist-info}/METADATA +21 -20
- pulumi_azuread-6.8.0a1766208344.dist-info/RECORD +87 -0
- {pulumi_azuread-5.48.0a1706744699.dist-info → pulumi_azuread-6.8.0a1766208344.dist-info}/WHEEL +1 -1
- pulumi_azuread-5.48.0a1706744699.dist-info/RECORD +0 -81
- {pulumi_azuread-5.48.0a1706744699.dist-info → pulumi_azuread-6.8.0a1766208344.dist-info}/top_level.txt +0 -0
|
@@ -1,12 +1,17 @@
|
|
|
1
1
|
# coding=utf-8
|
|
2
|
-
# *** WARNING: this file was generated by
|
|
2
|
+
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
4
|
|
|
5
|
-
import
|
|
5
|
+
import builtins as _builtins
|
|
6
6
|
import warnings
|
|
7
|
+
import sys
|
|
7
8
|
import pulumi
|
|
8
9
|
import pulumi.runtime
|
|
9
10
|
from typing import Any, Mapping, Optional, Sequence, Union, overload
|
|
11
|
+
if sys.version_info >= (3, 11):
|
|
12
|
+
from typing import NotRequired, TypedDict, TypeAlias
|
|
13
|
+
else:
|
|
14
|
+
from typing_extensions import NotRequired, TypedDict, TypeAlias
|
|
10
15
|
from . import _utilities
|
|
11
16
|
|
|
12
17
|
__all__ = ['ServicePrincipalDelegatedPermissionGrantArgs', 'ServicePrincipalDelegatedPermissionGrant']
|
|
@@ -14,16 +19,16 @@ __all__ = ['ServicePrincipalDelegatedPermissionGrantArgs', 'ServicePrincipalDele
|
|
|
14
19
|
@pulumi.input_type
|
|
15
20
|
class ServicePrincipalDelegatedPermissionGrantArgs:
|
|
16
21
|
def __init__(__self__, *,
|
|
17
|
-
claim_values: pulumi.Input[Sequence[pulumi.Input[str]]],
|
|
18
|
-
resource_service_principal_object_id: pulumi.Input[str],
|
|
19
|
-
service_principal_object_id: pulumi.Input[str],
|
|
20
|
-
user_object_id: Optional[pulumi.Input[str]] = None):
|
|
22
|
+
claim_values: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]],
|
|
23
|
+
resource_service_principal_object_id: pulumi.Input[_builtins.str],
|
|
24
|
+
service_principal_object_id: pulumi.Input[_builtins.str],
|
|
25
|
+
user_object_id: Optional[pulumi.Input[_builtins.str]] = None):
|
|
21
26
|
"""
|
|
22
27
|
The set of arguments for constructing a ServicePrincipalDelegatedPermissionGrant resource.
|
|
23
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] claim_values: A set of claim values for delegated permission scopes which should be included in access tokens for the resource.
|
|
24
|
-
:param pulumi.Input[str] resource_service_principal_object_id: The object ID of the service principal representing the resource to be accessed. Changing this forces a new resource to be created.
|
|
25
|
-
:param pulumi.Input[str] service_principal_object_id: The object ID of the service principal for which this delegated permission grant should be created. Changing this forces a new resource to be created.
|
|
26
|
-
:param pulumi.Input[str] user_object_id: The object ID of the user on behalf of whom the service principal is authorized to access the resource. When omitted, the delegated permission grant will be consented for all users. Changing this forces a new resource to be created.
|
|
28
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] claim_values: A set of claim values for delegated permission scopes which should be included in access tokens for the resource.
|
|
29
|
+
:param pulumi.Input[_builtins.str] resource_service_principal_object_id: The object ID of the service principal representing the resource to be accessed. Changing this forces a new resource to be created.
|
|
30
|
+
:param pulumi.Input[_builtins.str] service_principal_object_id: The object ID of the service principal for which this delegated permission grant should be created. Changing this forces a new resource to be created.
|
|
31
|
+
:param pulumi.Input[_builtins.str] user_object_id: The object ID of the user on behalf of whom the service principal is authorized to access the resource. When omitted, the delegated permission grant will be consented for all users. Changing this forces a new resource to be created.
|
|
27
32
|
|
|
28
33
|
> **Granting Admin Consent** To grant admin consent for the service principal to impersonate all users, just omit the `user_object_id` property.
|
|
29
34
|
"""
|
|
@@ -33,45 +38,45 @@ class ServicePrincipalDelegatedPermissionGrantArgs:
|
|
|
33
38
|
if user_object_id is not None:
|
|
34
39
|
pulumi.set(__self__, "user_object_id", user_object_id)
|
|
35
40
|
|
|
36
|
-
@property
|
|
41
|
+
@_builtins.property
|
|
37
42
|
@pulumi.getter(name="claimValues")
|
|
38
|
-
def claim_values(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
|
|
43
|
+
def claim_values(self) -> pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]:
|
|
39
44
|
"""
|
|
40
45
|
A set of claim values for delegated permission scopes which should be included in access tokens for the resource.
|
|
41
46
|
"""
|
|
42
47
|
return pulumi.get(self, "claim_values")
|
|
43
48
|
|
|
44
49
|
@claim_values.setter
|
|
45
|
-
def claim_values(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
|
|
50
|
+
def claim_values(self, value: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]):
|
|
46
51
|
pulumi.set(self, "claim_values", value)
|
|
47
52
|
|
|
48
|
-
@property
|
|
53
|
+
@_builtins.property
|
|
49
54
|
@pulumi.getter(name="resourceServicePrincipalObjectId")
|
|
50
|
-
def resource_service_principal_object_id(self) -> pulumi.Input[str]:
|
|
55
|
+
def resource_service_principal_object_id(self) -> pulumi.Input[_builtins.str]:
|
|
51
56
|
"""
|
|
52
57
|
The object ID of the service principal representing the resource to be accessed. Changing this forces a new resource to be created.
|
|
53
58
|
"""
|
|
54
59
|
return pulumi.get(self, "resource_service_principal_object_id")
|
|
55
60
|
|
|
56
61
|
@resource_service_principal_object_id.setter
|
|
57
|
-
def resource_service_principal_object_id(self, value: pulumi.Input[str]):
|
|
62
|
+
def resource_service_principal_object_id(self, value: pulumi.Input[_builtins.str]):
|
|
58
63
|
pulumi.set(self, "resource_service_principal_object_id", value)
|
|
59
64
|
|
|
60
|
-
@property
|
|
65
|
+
@_builtins.property
|
|
61
66
|
@pulumi.getter(name="servicePrincipalObjectId")
|
|
62
|
-
def service_principal_object_id(self) -> pulumi.Input[str]:
|
|
67
|
+
def service_principal_object_id(self) -> pulumi.Input[_builtins.str]:
|
|
63
68
|
"""
|
|
64
69
|
The object ID of the service principal for which this delegated permission grant should be created. Changing this forces a new resource to be created.
|
|
65
70
|
"""
|
|
66
71
|
return pulumi.get(self, "service_principal_object_id")
|
|
67
72
|
|
|
68
73
|
@service_principal_object_id.setter
|
|
69
|
-
def service_principal_object_id(self, value: pulumi.Input[str]):
|
|
74
|
+
def service_principal_object_id(self, value: pulumi.Input[_builtins.str]):
|
|
70
75
|
pulumi.set(self, "service_principal_object_id", value)
|
|
71
76
|
|
|
72
|
-
@property
|
|
77
|
+
@_builtins.property
|
|
73
78
|
@pulumi.getter(name="userObjectId")
|
|
74
|
-
def user_object_id(self) -> Optional[pulumi.Input[str]]:
|
|
79
|
+
def user_object_id(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
75
80
|
"""
|
|
76
81
|
The object ID of the user on behalf of whom the service principal is authorized to access the resource. When omitted, the delegated permission grant will be consented for all users. Changing this forces a new resource to be created.
|
|
77
82
|
|
|
@@ -80,23 +85,23 @@ class ServicePrincipalDelegatedPermissionGrantArgs:
|
|
|
80
85
|
return pulumi.get(self, "user_object_id")
|
|
81
86
|
|
|
82
87
|
@user_object_id.setter
|
|
83
|
-
def user_object_id(self, value: Optional[pulumi.Input[str]]):
|
|
88
|
+
def user_object_id(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
84
89
|
pulumi.set(self, "user_object_id", value)
|
|
85
90
|
|
|
86
91
|
|
|
87
92
|
@pulumi.input_type
|
|
88
93
|
class _ServicePrincipalDelegatedPermissionGrantState:
|
|
89
94
|
def __init__(__self__, *,
|
|
90
|
-
claim_values: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
91
|
-
resource_service_principal_object_id: Optional[pulumi.Input[str]] = None,
|
|
92
|
-
service_principal_object_id: Optional[pulumi.Input[str]] = None,
|
|
93
|
-
user_object_id: Optional[pulumi.Input[str]] = None):
|
|
95
|
+
claim_values: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
96
|
+
resource_service_principal_object_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
97
|
+
service_principal_object_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
98
|
+
user_object_id: Optional[pulumi.Input[_builtins.str]] = None):
|
|
94
99
|
"""
|
|
95
100
|
Input properties used for looking up and filtering ServicePrincipalDelegatedPermissionGrant resources.
|
|
96
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] claim_values: A set of claim values for delegated permission scopes which should be included in access tokens for the resource.
|
|
97
|
-
:param pulumi.Input[str] resource_service_principal_object_id: The object ID of the service principal representing the resource to be accessed. Changing this forces a new resource to be created.
|
|
98
|
-
:param pulumi.Input[str] service_principal_object_id: The object ID of the service principal for which this delegated permission grant should be created. Changing this forces a new resource to be created.
|
|
99
|
-
:param pulumi.Input[str] user_object_id: The object ID of the user on behalf of whom the service principal is authorized to access the resource. When omitted, the delegated permission grant will be consented for all users. Changing this forces a new resource to be created.
|
|
101
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] claim_values: A set of claim values for delegated permission scopes which should be included in access tokens for the resource.
|
|
102
|
+
:param pulumi.Input[_builtins.str] resource_service_principal_object_id: The object ID of the service principal representing the resource to be accessed. Changing this forces a new resource to be created.
|
|
103
|
+
:param pulumi.Input[_builtins.str] service_principal_object_id: The object ID of the service principal for which this delegated permission grant should be created. Changing this forces a new resource to be created.
|
|
104
|
+
:param pulumi.Input[_builtins.str] user_object_id: The object ID of the user on behalf of whom the service principal is authorized to access the resource. When omitted, the delegated permission grant will be consented for all users. Changing this forces a new resource to be created.
|
|
100
105
|
|
|
101
106
|
> **Granting Admin Consent** To grant admin consent for the service principal to impersonate all users, just omit the `user_object_id` property.
|
|
102
107
|
"""
|
|
@@ -109,45 +114,45 @@ class _ServicePrincipalDelegatedPermissionGrantState:
|
|
|
109
114
|
if user_object_id is not None:
|
|
110
115
|
pulumi.set(__self__, "user_object_id", user_object_id)
|
|
111
116
|
|
|
112
|
-
@property
|
|
117
|
+
@_builtins.property
|
|
113
118
|
@pulumi.getter(name="claimValues")
|
|
114
|
-
def claim_values(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
119
|
+
def claim_values(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
115
120
|
"""
|
|
116
121
|
A set of claim values for delegated permission scopes which should be included in access tokens for the resource.
|
|
117
122
|
"""
|
|
118
123
|
return pulumi.get(self, "claim_values")
|
|
119
124
|
|
|
120
125
|
@claim_values.setter
|
|
121
|
-
def claim_values(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
126
|
+
def claim_values(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
122
127
|
pulumi.set(self, "claim_values", value)
|
|
123
128
|
|
|
124
|
-
@property
|
|
129
|
+
@_builtins.property
|
|
125
130
|
@pulumi.getter(name="resourceServicePrincipalObjectId")
|
|
126
|
-
def resource_service_principal_object_id(self) -> Optional[pulumi.Input[str]]:
|
|
131
|
+
def resource_service_principal_object_id(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
127
132
|
"""
|
|
128
133
|
The object ID of the service principal representing the resource to be accessed. Changing this forces a new resource to be created.
|
|
129
134
|
"""
|
|
130
135
|
return pulumi.get(self, "resource_service_principal_object_id")
|
|
131
136
|
|
|
132
137
|
@resource_service_principal_object_id.setter
|
|
133
|
-
def resource_service_principal_object_id(self, value: Optional[pulumi.Input[str]]):
|
|
138
|
+
def resource_service_principal_object_id(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
134
139
|
pulumi.set(self, "resource_service_principal_object_id", value)
|
|
135
140
|
|
|
136
|
-
@property
|
|
141
|
+
@_builtins.property
|
|
137
142
|
@pulumi.getter(name="servicePrincipalObjectId")
|
|
138
|
-
def service_principal_object_id(self) -> Optional[pulumi.Input[str]]:
|
|
143
|
+
def service_principal_object_id(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
139
144
|
"""
|
|
140
145
|
The object ID of the service principal for which this delegated permission grant should be created. Changing this forces a new resource to be created.
|
|
141
146
|
"""
|
|
142
147
|
return pulumi.get(self, "service_principal_object_id")
|
|
143
148
|
|
|
144
149
|
@service_principal_object_id.setter
|
|
145
|
-
def service_principal_object_id(self, value: Optional[pulumi.Input[str]]):
|
|
150
|
+
def service_principal_object_id(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
146
151
|
pulumi.set(self, "service_principal_object_id", value)
|
|
147
152
|
|
|
148
|
-
@property
|
|
153
|
+
@_builtins.property
|
|
149
154
|
@pulumi.getter(name="userObjectId")
|
|
150
|
-
def user_object_id(self) -> Optional[pulumi.Input[str]]:
|
|
155
|
+
def user_object_id(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
151
156
|
"""
|
|
152
157
|
The object ID of the user on behalf of whom the service principal is authorized to access the resource. When omitted, the delegated permission grant will be consented for all users. Changing this forces a new resource to be created.
|
|
153
158
|
|
|
@@ -156,19 +161,20 @@ class _ServicePrincipalDelegatedPermissionGrantState:
|
|
|
156
161
|
return pulumi.get(self, "user_object_id")
|
|
157
162
|
|
|
158
163
|
@user_object_id.setter
|
|
159
|
-
def user_object_id(self, value: Optional[pulumi.Input[str]]):
|
|
164
|
+
def user_object_id(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
160
165
|
pulumi.set(self, "user_object_id", value)
|
|
161
166
|
|
|
162
167
|
|
|
168
|
+
@pulumi.type_token("azuread:index/servicePrincipalDelegatedPermissionGrant:ServicePrincipalDelegatedPermissionGrant")
|
|
163
169
|
class ServicePrincipalDelegatedPermissionGrant(pulumi.CustomResource):
|
|
164
170
|
@overload
|
|
165
171
|
def __init__(__self__,
|
|
166
172
|
resource_name: str,
|
|
167
173
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
168
|
-
claim_values: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
169
|
-
resource_service_principal_object_id: Optional[pulumi.Input[str]] = None,
|
|
170
|
-
service_principal_object_id: Optional[pulumi.Input[str]] = None,
|
|
171
|
-
user_object_id: Optional[pulumi.Input[str]] = None,
|
|
174
|
+
claim_values: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
175
|
+
resource_service_principal_object_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
176
|
+
service_principal_object_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
177
|
+
user_object_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
172
178
|
__props__=None):
|
|
173
179
|
"""
|
|
174
180
|
Manages a delegated permission grant for a service principal, on behalf of a single user, or all users.
|
|
@@ -191,25 +197,25 @@ class ServicePrincipalDelegatedPermissionGrant(pulumi.CustomResource):
|
|
|
191
197
|
|
|
192
198
|
well_known = azuread.get_application_published_app_ids()
|
|
193
199
|
msgraph = azuread.ServicePrincipal("msgraph",
|
|
194
|
-
|
|
200
|
+
client_id=well_known.result["microsoftGraph"],
|
|
195
201
|
use_existing=True)
|
|
196
|
-
|
|
202
|
+
example = azuread.Application("example",
|
|
197
203
|
display_name="example",
|
|
198
|
-
required_resource_accesses=[
|
|
199
|
-
resource_app_id
|
|
200
|
-
resource_accesses
|
|
201
|
-
|
|
202
|
-
id
|
|
203
|
-
type
|
|
204
|
-
|
|
205
|
-
|
|
206
|
-
id
|
|
207
|
-
type
|
|
208
|
-
|
|
204
|
+
required_resource_accesses=[{
|
|
205
|
+
"resource_app_id": well_known.result["microsoftGraph"],
|
|
206
|
+
"resource_accesses": [
|
|
207
|
+
{
|
|
208
|
+
"id": msgraph.oauth2_permission_scope_ids["openid"],
|
|
209
|
+
"type": "Scope",
|
|
210
|
+
},
|
|
211
|
+
{
|
|
212
|
+
"id": msgraph.oauth2_permission_scope_ids["User.Read"],
|
|
213
|
+
"type": "Scope",
|
|
214
|
+
},
|
|
209
215
|
],
|
|
210
|
-
|
|
211
|
-
example_service_principal = azuread.ServicePrincipal("
|
|
212
|
-
example_service_principal_delegated_permission_grant = azuread.ServicePrincipalDelegatedPermissionGrant("
|
|
216
|
+
}])
|
|
217
|
+
example_service_principal = azuread.ServicePrincipal("example", client_id=example.client_id)
|
|
218
|
+
example_service_principal_delegated_permission_grant = azuread.ServicePrincipalDelegatedPermissionGrant("example",
|
|
213
219
|
service_principal_object_id=example_service_principal.object_id,
|
|
214
220
|
resource_service_principal_object_id=msgraph.object_id,
|
|
215
221
|
claim_values=[
|
|
@@ -226,30 +232,30 @@ class ServicePrincipalDelegatedPermissionGrant(pulumi.CustomResource):
|
|
|
226
232
|
|
|
227
233
|
well_known = azuread.get_application_published_app_ids()
|
|
228
234
|
msgraph = azuread.ServicePrincipal("msgraph",
|
|
229
|
-
|
|
235
|
+
client_id=well_known.result["microsoftGraph"],
|
|
230
236
|
use_existing=True)
|
|
231
|
-
|
|
237
|
+
example = azuread.Application("example",
|
|
232
238
|
display_name="example",
|
|
233
|
-
required_resource_accesses=[
|
|
234
|
-
resource_app_id
|
|
235
|
-
resource_accesses
|
|
236
|
-
|
|
237
|
-
id
|
|
238
|
-
type
|
|
239
|
-
|
|
240
|
-
|
|
241
|
-
id
|
|
242
|
-
type
|
|
243
|
-
|
|
239
|
+
required_resource_accesses=[{
|
|
240
|
+
"resource_app_id": well_known.result["microsoftGraph"],
|
|
241
|
+
"resource_accesses": [
|
|
242
|
+
{
|
|
243
|
+
"id": msgraph.oauth2_permission_scope_ids["openid"],
|
|
244
|
+
"type": "Scope",
|
|
245
|
+
},
|
|
246
|
+
{
|
|
247
|
+
"id": msgraph.oauth2_permission_scope_ids["User.Read"],
|
|
248
|
+
"type": "Scope",
|
|
249
|
+
},
|
|
244
250
|
],
|
|
245
|
-
|
|
246
|
-
example_service_principal = azuread.ServicePrincipal("
|
|
247
|
-
example_user = azuread.User("
|
|
251
|
+
}])
|
|
252
|
+
example_service_principal = azuread.ServicePrincipal("example", client_id=example.client_id)
|
|
253
|
+
example_user = azuread.User("example",
|
|
248
254
|
display_name="J. Doe",
|
|
249
|
-
user_principal_name="jdoe@
|
|
255
|
+
user_principal_name="jdoe@example.com",
|
|
250
256
|
mail_nickname="jdoe",
|
|
251
257
|
password="SecretP@sswd99!")
|
|
252
|
-
example_service_principal_delegated_permission_grant = azuread.ServicePrincipalDelegatedPermissionGrant("
|
|
258
|
+
example_service_principal_delegated_permission_grant = azuread.ServicePrincipalDelegatedPermissionGrant("example",
|
|
253
259
|
service_principal_object_id=example_service_principal.object_id,
|
|
254
260
|
resource_service_principal_object_id=msgraph.object_id,
|
|
255
261
|
claim_values=[
|
|
@@ -264,15 +270,15 @@ class ServicePrincipalDelegatedPermissionGrant(pulumi.CustomResource):
|
|
|
264
270
|
Delegated permission grants can be imported using their ID, e.g.
|
|
265
271
|
|
|
266
272
|
```sh
|
|
267
|
-
|
|
273
|
+
$ pulumi import azuread:index/servicePrincipalDelegatedPermissionGrant:ServicePrincipalDelegatedPermissionGrant example /oauth2PermissionGrants/aaBBcDDeFG6h5JKLMN2PQrrssTTUUvWWxxxxxyyyzzz
|
|
268
274
|
```
|
|
269
275
|
|
|
270
276
|
:param str resource_name: The name of the resource.
|
|
271
277
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
272
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] claim_values: A set of claim values for delegated permission scopes which should be included in access tokens for the resource.
|
|
273
|
-
:param pulumi.Input[str] resource_service_principal_object_id: The object ID of the service principal representing the resource to be accessed. Changing this forces a new resource to be created.
|
|
274
|
-
:param pulumi.Input[str] service_principal_object_id: The object ID of the service principal for which this delegated permission grant should be created. Changing this forces a new resource to be created.
|
|
275
|
-
:param pulumi.Input[str] user_object_id: The object ID of the user on behalf of whom the service principal is authorized to access the resource. When omitted, the delegated permission grant will be consented for all users. Changing this forces a new resource to be created.
|
|
278
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] claim_values: A set of claim values for delegated permission scopes which should be included in access tokens for the resource.
|
|
279
|
+
:param pulumi.Input[_builtins.str] resource_service_principal_object_id: The object ID of the service principal representing the resource to be accessed. Changing this forces a new resource to be created.
|
|
280
|
+
:param pulumi.Input[_builtins.str] service_principal_object_id: The object ID of the service principal for which this delegated permission grant should be created. Changing this forces a new resource to be created.
|
|
281
|
+
:param pulumi.Input[_builtins.str] user_object_id: The object ID of the user on behalf of whom the service principal is authorized to access the resource. When omitted, the delegated permission grant will be consented for all users. Changing this forces a new resource to be created.
|
|
276
282
|
|
|
277
283
|
> **Granting Admin Consent** To grant admin consent for the service principal to impersonate all users, just omit the `user_object_id` property.
|
|
278
284
|
"""
|
|
@@ -303,25 +309,25 @@ class ServicePrincipalDelegatedPermissionGrant(pulumi.CustomResource):
|
|
|
303
309
|
|
|
304
310
|
well_known = azuread.get_application_published_app_ids()
|
|
305
311
|
msgraph = azuread.ServicePrincipal("msgraph",
|
|
306
|
-
|
|
312
|
+
client_id=well_known.result["microsoftGraph"],
|
|
307
313
|
use_existing=True)
|
|
308
|
-
|
|
314
|
+
example = azuread.Application("example",
|
|
309
315
|
display_name="example",
|
|
310
|
-
required_resource_accesses=[
|
|
311
|
-
resource_app_id
|
|
312
|
-
resource_accesses
|
|
313
|
-
|
|
314
|
-
id
|
|
315
|
-
type
|
|
316
|
-
|
|
317
|
-
|
|
318
|
-
id
|
|
319
|
-
type
|
|
320
|
-
|
|
316
|
+
required_resource_accesses=[{
|
|
317
|
+
"resource_app_id": well_known.result["microsoftGraph"],
|
|
318
|
+
"resource_accesses": [
|
|
319
|
+
{
|
|
320
|
+
"id": msgraph.oauth2_permission_scope_ids["openid"],
|
|
321
|
+
"type": "Scope",
|
|
322
|
+
},
|
|
323
|
+
{
|
|
324
|
+
"id": msgraph.oauth2_permission_scope_ids["User.Read"],
|
|
325
|
+
"type": "Scope",
|
|
326
|
+
},
|
|
321
327
|
],
|
|
322
|
-
|
|
323
|
-
example_service_principal = azuread.ServicePrincipal("
|
|
324
|
-
example_service_principal_delegated_permission_grant = azuread.ServicePrincipalDelegatedPermissionGrant("
|
|
328
|
+
}])
|
|
329
|
+
example_service_principal = azuread.ServicePrincipal("example", client_id=example.client_id)
|
|
330
|
+
example_service_principal_delegated_permission_grant = azuread.ServicePrincipalDelegatedPermissionGrant("example",
|
|
325
331
|
service_principal_object_id=example_service_principal.object_id,
|
|
326
332
|
resource_service_principal_object_id=msgraph.object_id,
|
|
327
333
|
claim_values=[
|
|
@@ -338,30 +344,30 @@ class ServicePrincipalDelegatedPermissionGrant(pulumi.CustomResource):
|
|
|
338
344
|
|
|
339
345
|
well_known = azuread.get_application_published_app_ids()
|
|
340
346
|
msgraph = azuread.ServicePrincipal("msgraph",
|
|
341
|
-
|
|
347
|
+
client_id=well_known.result["microsoftGraph"],
|
|
342
348
|
use_existing=True)
|
|
343
|
-
|
|
349
|
+
example = azuread.Application("example",
|
|
344
350
|
display_name="example",
|
|
345
|
-
required_resource_accesses=[
|
|
346
|
-
resource_app_id
|
|
347
|
-
resource_accesses
|
|
348
|
-
|
|
349
|
-
id
|
|
350
|
-
type
|
|
351
|
-
|
|
352
|
-
|
|
353
|
-
id
|
|
354
|
-
type
|
|
355
|
-
|
|
351
|
+
required_resource_accesses=[{
|
|
352
|
+
"resource_app_id": well_known.result["microsoftGraph"],
|
|
353
|
+
"resource_accesses": [
|
|
354
|
+
{
|
|
355
|
+
"id": msgraph.oauth2_permission_scope_ids["openid"],
|
|
356
|
+
"type": "Scope",
|
|
357
|
+
},
|
|
358
|
+
{
|
|
359
|
+
"id": msgraph.oauth2_permission_scope_ids["User.Read"],
|
|
360
|
+
"type": "Scope",
|
|
361
|
+
},
|
|
356
362
|
],
|
|
357
|
-
|
|
358
|
-
example_service_principal = azuread.ServicePrincipal("
|
|
359
|
-
example_user = azuread.User("
|
|
363
|
+
}])
|
|
364
|
+
example_service_principal = azuread.ServicePrincipal("example", client_id=example.client_id)
|
|
365
|
+
example_user = azuread.User("example",
|
|
360
366
|
display_name="J. Doe",
|
|
361
|
-
user_principal_name="jdoe@
|
|
367
|
+
user_principal_name="jdoe@example.com",
|
|
362
368
|
mail_nickname="jdoe",
|
|
363
369
|
password="SecretP@sswd99!")
|
|
364
|
-
example_service_principal_delegated_permission_grant = azuread.ServicePrincipalDelegatedPermissionGrant("
|
|
370
|
+
example_service_principal_delegated_permission_grant = azuread.ServicePrincipalDelegatedPermissionGrant("example",
|
|
365
371
|
service_principal_object_id=example_service_principal.object_id,
|
|
366
372
|
resource_service_principal_object_id=msgraph.object_id,
|
|
367
373
|
claim_values=[
|
|
@@ -376,7 +382,7 @@ class ServicePrincipalDelegatedPermissionGrant(pulumi.CustomResource):
|
|
|
376
382
|
Delegated permission grants can be imported using their ID, e.g.
|
|
377
383
|
|
|
378
384
|
```sh
|
|
379
|
-
|
|
385
|
+
$ pulumi import azuread:index/servicePrincipalDelegatedPermissionGrant:ServicePrincipalDelegatedPermissionGrant example /oauth2PermissionGrants/aaBBcDDeFG6h5JKLMN2PQrrssTTUUvWWxxxxxyyyzzz
|
|
380
386
|
```
|
|
381
387
|
|
|
382
388
|
:param str resource_name: The name of the resource.
|
|
@@ -394,10 +400,10 @@ class ServicePrincipalDelegatedPermissionGrant(pulumi.CustomResource):
|
|
|
394
400
|
def _internal_init(__self__,
|
|
395
401
|
resource_name: str,
|
|
396
402
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
397
|
-
claim_values: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
398
|
-
resource_service_principal_object_id: Optional[pulumi.Input[str]] = None,
|
|
399
|
-
service_principal_object_id: Optional[pulumi.Input[str]] = None,
|
|
400
|
-
user_object_id: Optional[pulumi.Input[str]] = None,
|
|
403
|
+
claim_values: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
404
|
+
resource_service_principal_object_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
405
|
+
service_principal_object_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
406
|
+
user_object_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
401
407
|
__props__=None):
|
|
402
408
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
403
409
|
if not isinstance(opts, pulumi.ResourceOptions):
|
|
@@ -427,10 +433,10 @@ class ServicePrincipalDelegatedPermissionGrant(pulumi.CustomResource):
|
|
|
427
433
|
def get(resource_name: str,
|
|
428
434
|
id: pulumi.Input[str],
|
|
429
435
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
430
|
-
claim_values: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
431
|
-
resource_service_principal_object_id: Optional[pulumi.Input[str]] = None,
|
|
432
|
-
service_principal_object_id: Optional[pulumi.Input[str]] = None,
|
|
433
|
-
user_object_id: Optional[pulumi.Input[str]] = None) -> 'ServicePrincipalDelegatedPermissionGrant':
|
|
436
|
+
claim_values: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
437
|
+
resource_service_principal_object_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
438
|
+
service_principal_object_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
439
|
+
user_object_id: Optional[pulumi.Input[_builtins.str]] = None) -> 'ServicePrincipalDelegatedPermissionGrant':
|
|
434
440
|
"""
|
|
435
441
|
Get an existing ServicePrincipalDelegatedPermissionGrant resource's state with the given name, id, and optional extra
|
|
436
442
|
properties used to qualify the lookup.
|
|
@@ -438,10 +444,10 @@ class ServicePrincipalDelegatedPermissionGrant(pulumi.CustomResource):
|
|
|
438
444
|
:param str resource_name: The unique name of the resulting resource.
|
|
439
445
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
440
446
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
441
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] claim_values: A set of claim values for delegated permission scopes which should be included in access tokens for the resource.
|
|
442
|
-
:param pulumi.Input[str] resource_service_principal_object_id: The object ID of the service principal representing the resource to be accessed. Changing this forces a new resource to be created.
|
|
443
|
-
:param pulumi.Input[str] service_principal_object_id: The object ID of the service principal for which this delegated permission grant should be created. Changing this forces a new resource to be created.
|
|
444
|
-
:param pulumi.Input[str] user_object_id: The object ID of the user on behalf of whom the service principal is authorized to access the resource. When omitted, the delegated permission grant will be consented for all users. Changing this forces a new resource to be created.
|
|
447
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] claim_values: A set of claim values for delegated permission scopes which should be included in access tokens for the resource.
|
|
448
|
+
:param pulumi.Input[_builtins.str] resource_service_principal_object_id: The object ID of the service principal representing the resource to be accessed. Changing this forces a new resource to be created.
|
|
449
|
+
:param pulumi.Input[_builtins.str] service_principal_object_id: The object ID of the service principal for which this delegated permission grant should be created. Changing this forces a new resource to be created.
|
|
450
|
+
:param pulumi.Input[_builtins.str] user_object_id: The object ID of the user on behalf of whom the service principal is authorized to access the resource. When omitted, the delegated permission grant will be consented for all users. Changing this forces a new resource to be created.
|
|
445
451
|
|
|
446
452
|
> **Granting Admin Consent** To grant admin consent for the service principal to impersonate all users, just omit the `user_object_id` property.
|
|
447
453
|
"""
|
|
@@ -455,33 +461,33 @@ class ServicePrincipalDelegatedPermissionGrant(pulumi.CustomResource):
|
|
|
455
461
|
__props__.__dict__["user_object_id"] = user_object_id
|
|
456
462
|
return ServicePrincipalDelegatedPermissionGrant(resource_name, opts=opts, __props__=__props__)
|
|
457
463
|
|
|
458
|
-
@property
|
|
464
|
+
@_builtins.property
|
|
459
465
|
@pulumi.getter(name="claimValues")
|
|
460
|
-
def claim_values(self) -> pulumi.Output[Sequence[str]]:
|
|
466
|
+
def claim_values(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
461
467
|
"""
|
|
462
468
|
A set of claim values for delegated permission scopes which should be included in access tokens for the resource.
|
|
463
469
|
"""
|
|
464
470
|
return pulumi.get(self, "claim_values")
|
|
465
471
|
|
|
466
|
-
@property
|
|
472
|
+
@_builtins.property
|
|
467
473
|
@pulumi.getter(name="resourceServicePrincipalObjectId")
|
|
468
|
-
def resource_service_principal_object_id(self) -> pulumi.Output[str]:
|
|
474
|
+
def resource_service_principal_object_id(self) -> pulumi.Output[_builtins.str]:
|
|
469
475
|
"""
|
|
470
476
|
The object ID of the service principal representing the resource to be accessed. Changing this forces a new resource to be created.
|
|
471
477
|
"""
|
|
472
478
|
return pulumi.get(self, "resource_service_principal_object_id")
|
|
473
479
|
|
|
474
|
-
@property
|
|
480
|
+
@_builtins.property
|
|
475
481
|
@pulumi.getter(name="servicePrincipalObjectId")
|
|
476
|
-
def service_principal_object_id(self) -> pulumi.Output[str]:
|
|
482
|
+
def service_principal_object_id(self) -> pulumi.Output[_builtins.str]:
|
|
477
483
|
"""
|
|
478
484
|
The object ID of the service principal for which this delegated permission grant should be created. Changing this forces a new resource to be created.
|
|
479
485
|
"""
|
|
480
486
|
return pulumi.get(self, "service_principal_object_id")
|
|
481
487
|
|
|
482
|
-
@property
|
|
488
|
+
@_builtins.property
|
|
483
489
|
@pulumi.getter(name="userObjectId")
|
|
484
|
-
def user_object_id(self) -> pulumi.Output[Optional[str]]:
|
|
490
|
+
def user_object_id(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
485
491
|
"""
|
|
486
492
|
The object ID of the user on behalf of whom the service principal is authorized to access the resource. When omitted, the delegated permission grant will be consented for all users. Changing this forces a new resource to be created.
|
|
487
493
|
|