pulumi-vault 7.1.0__py3-none-any.whl → 7.2.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +19 -1
- pulumi_vault/_inputs.py +873 -673
- pulumi_vault/ad/__init__.py +1 -1
- pulumi_vault/ad/get_access_credentials.py +27 -28
- pulumi_vault/ad/secret_backend.py +579 -580
- pulumi_vault/ad/secret_library.py +120 -121
- pulumi_vault/ad/secret_role.py +104 -105
- pulumi_vault/alicloud/__init__.py +1 -1
- pulumi_vault/alicloud/auth_backend_role.py +222 -223
- pulumi_vault/approle/__init__.py +1 -1
- pulumi_vault/approle/auth_backend_login.py +138 -139
- pulumi_vault/approle/auth_backend_role.py +292 -293
- pulumi_vault/approle/auth_backend_role_secret_id.py +202 -203
- pulumi_vault/approle/get_auth_backend_role_id.py +23 -24
- pulumi_vault/audit.py +103 -104
- pulumi_vault/audit_request_header.py +52 -53
- pulumi_vault/auth_backend.py +132 -133
- pulumi_vault/aws/__init__.py +1 -1
- pulumi_vault/aws/auth_backend_cert.py +86 -87
- pulumi_vault/aws/auth_backend_client.py +307 -308
- pulumi_vault/aws/auth_backend_config_identity.py +103 -104
- pulumi_vault/aws/auth_backend_identity_whitelist.py +69 -70
- pulumi_vault/aws/auth_backend_login.py +258 -259
- pulumi_vault/aws/auth_backend_role.py +486 -487
- pulumi_vault/aws/auth_backend_role_tag.py +155 -156
- pulumi_vault/aws/auth_backend_roletag_blacklist.py +69 -70
- pulumi_vault/aws/auth_backend_sts_role.py +86 -87
- pulumi_vault/aws/get_access_credentials.py +59 -60
- pulumi_vault/aws/get_static_access_credentials.py +19 -20
- pulumi_vault/aws/secret_backend.py +1016 -439
- pulumi_vault/aws/secret_backend_role.py +256 -257
- pulumi_vault/aws/secret_backend_static_role.py +137 -138
- pulumi_vault/azure/__init__.py +1 -1
- pulumi_vault/azure/_inputs.py +26 -27
- pulumi_vault/azure/auth_backend_config.py +222 -223
- pulumi_vault/azure/auth_backend_role.py +307 -308
- pulumi_vault/azure/backend.py +1057 -285
- pulumi_vault/azure/backend_role.py +194 -195
- pulumi_vault/azure/get_access_credentials.py +75 -76
- pulumi_vault/azure/outputs.py +16 -17
- pulumi_vault/cert_auth_backend_role.py +443 -444
- pulumi_vault/config/__init__.py +1 -1
- pulumi_vault/config/__init__.pyi +1 -2
- pulumi_vault/config/_inputs.py +13 -14
- pulumi_vault/config/outputs.py +380 -381
- pulumi_vault/config/ui_custom_message.py +140 -141
- pulumi_vault/config/vars.py +31 -32
- pulumi_vault/consul/__init__.py +1 -1
- pulumi_vault/consul/secret_backend.py +887 -256
- pulumi_vault/consul/secret_backend_role.py +222 -223
- pulumi_vault/database/__init__.py +1 -1
- pulumi_vault/database/_inputs.py +3167 -3168
- pulumi_vault/database/outputs.py +2123 -2124
- pulumi_vault/database/secret_backend_connection.py +259 -260
- pulumi_vault/database/secret_backend_role.py +205 -206
- pulumi_vault/database/secret_backend_static_role.py +218 -219
- pulumi_vault/database/secrets_mount.py +426 -380
- pulumi_vault/egp_policy.py +86 -87
- pulumi_vault/gcp/__init__.py +1 -1
- pulumi_vault/gcp/_inputs.py +98 -99
- pulumi_vault/gcp/auth_backend.py +322 -323
- pulumi_vault/gcp/auth_backend_role.py +347 -348
- pulumi_vault/gcp/get_auth_backend_role.py +91 -92
- pulumi_vault/gcp/outputs.py +66 -67
- pulumi_vault/gcp/secret_backend.py +878 -336
- pulumi_vault/gcp/secret_impersonated_account.py +112 -113
- pulumi_vault/gcp/secret_roleset.py +115 -116
- pulumi_vault/gcp/secret_static_account.py +115 -116
- pulumi_vault/generic/__init__.py +1 -1
- pulumi_vault/generic/endpoint.py +138 -139
- pulumi_vault/generic/get_secret.py +39 -40
- pulumi_vault/generic/secret.py +95 -96
- pulumi_vault/get_auth_backend.py +29 -30
- pulumi_vault/get_auth_backends.py +19 -20
- pulumi_vault/get_namespace.py +21 -22
- pulumi_vault/get_namespaces.py +19 -20
- pulumi_vault/get_nomad_access_token.py +25 -26
- pulumi_vault/get_policy_document.py +10 -11
- pulumi_vault/get_raft_autopilot_state.py +31 -32
- pulumi_vault/github/__init__.py +1 -1
- pulumi_vault/github/_inputs.py +50 -51
- pulumi_vault/github/auth_backend.py +285 -286
- pulumi_vault/github/outputs.py +34 -35
- pulumi_vault/github/team.py +69 -70
- pulumi_vault/github/user.py +69 -70
- pulumi_vault/identity/__init__.py +1 -1
- pulumi_vault/identity/entity.py +103 -104
- pulumi_vault/identity/entity_alias.py +86 -87
- pulumi_vault/identity/entity_policies.py +78 -79
- pulumi_vault/identity/get_entity.py +62 -63
- pulumi_vault/identity/get_group.py +75 -76
- pulumi_vault/identity/get_oidc_client_creds.py +19 -20
- pulumi_vault/identity/get_oidc_openid_config.py +39 -40
- pulumi_vault/identity/get_oidc_public_keys.py +17 -18
- pulumi_vault/identity/group.py +171 -172
- pulumi_vault/identity/group_alias.py +69 -70
- pulumi_vault/identity/group_member_entity_ids.py +69 -70
- pulumi_vault/identity/group_member_group_ids.py +69 -70
- pulumi_vault/identity/group_policies.py +78 -79
- pulumi_vault/identity/mfa_duo.py +183 -184
- pulumi_vault/identity/mfa_login_enforcement.py +147 -148
- pulumi_vault/identity/mfa_okta.py +166 -167
- pulumi_vault/identity/mfa_pingid.py +160 -161
- pulumi_vault/identity/mfa_totp.py +217 -218
- pulumi_vault/identity/oidc.py +35 -36
- pulumi_vault/identity/oidc_assignment.py +69 -70
- pulumi_vault/identity/oidc_client.py +155 -156
- pulumi_vault/identity/oidc_key.py +103 -104
- pulumi_vault/identity/oidc_key_allowed_client_id.py +52 -53
- pulumi_vault/identity/oidc_provider.py +112 -113
- pulumi_vault/identity/oidc_role.py +103 -104
- pulumi_vault/identity/oidc_scope.py +69 -70
- pulumi_vault/identity/outputs.py +42 -43
- pulumi_vault/jwt/__init__.py +1 -1
- pulumi_vault/jwt/_inputs.py +50 -51
- pulumi_vault/jwt/auth_backend.py +400 -354
- pulumi_vault/jwt/auth_backend_role.py +494 -495
- pulumi_vault/jwt/outputs.py +34 -35
- pulumi_vault/kmip/__init__.py +1 -1
- pulumi_vault/kmip/secret_backend.py +1006 -227
- pulumi_vault/kmip/secret_role.py +358 -359
- pulumi_vault/kmip/secret_scope.py +69 -70
- pulumi_vault/kubernetes/__init__.py +1 -1
- pulumi_vault/kubernetes/auth_backend_config.py +171 -172
- pulumi_vault/kubernetes/auth_backend_role.py +273 -274
- pulumi_vault/kubernetes/get_auth_backend_config.py +57 -58
- pulumi_vault/kubernetes/get_auth_backend_role.py +87 -88
- pulumi_vault/kubernetes/get_service_account_token.py +51 -52
- pulumi_vault/kubernetes/secret_backend.py +431 -385
- pulumi_vault/kubernetes/secret_backend_role.py +239 -240
- pulumi_vault/kv/__init__.py +1 -1
- pulumi_vault/kv/_inputs.py +25 -26
- pulumi_vault/kv/get_secret.py +25 -26
- pulumi_vault/kv/get_secret_subkeys_v2.py +39 -40
- pulumi_vault/kv/get_secret_v2.py +41 -42
- pulumi_vault/kv/get_secrets_list.py +17 -18
- pulumi_vault/kv/get_secrets_list_v2.py +25 -26
- pulumi_vault/kv/outputs.py +17 -18
- pulumi_vault/kv/secret.py +61 -62
- pulumi_vault/kv/secret_backend_v2.py +86 -87
- pulumi_vault/kv/secret_v2.py +184 -185
- pulumi_vault/ldap/__init__.py +1 -1
- pulumi_vault/ldap/auth_backend.py +716 -717
- pulumi_vault/ldap/auth_backend_group.py +69 -70
- pulumi_vault/ldap/auth_backend_user.py +86 -87
- pulumi_vault/ldap/get_dynamic_credentials.py +27 -28
- pulumi_vault/ldap/get_static_credentials.py +29 -30
- pulumi_vault/ldap/secret_backend.py +732 -693
- pulumi_vault/ldap/secret_backend_dynamic_role.py +154 -155
- pulumi_vault/ldap/secret_backend_library_set.py +120 -121
- pulumi_vault/ldap/secret_backend_static_role.py +120 -121
- pulumi_vault/managed/__init__.py +1 -1
- pulumi_vault/managed/_inputs.py +274 -275
- pulumi_vault/managed/keys.py +27 -28
- pulumi_vault/managed/outputs.py +184 -185
- pulumi_vault/mfa_duo.py +137 -138
- pulumi_vault/mfa_okta.py +137 -138
- pulumi_vault/mfa_pingid.py +149 -150
- pulumi_vault/mfa_totp.py +154 -155
- pulumi_vault/mongodbatlas/__init__.py +1 -1
- pulumi_vault/mongodbatlas/secret_backend.py +78 -79
- pulumi_vault/mongodbatlas/secret_role.py +188 -189
- pulumi_vault/mount.py +380 -334
- pulumi_vault/namespace.py +78 -79
- pulumi_vault/nomad_secret_backend.py +909 -271
- pulumi_vault/nomad_secret_role.py +103 -104
- pulumi_vault/oci_auth_backend.py +683 -0
- pulumi_vault/oci_auth_backend_role.py +798 -0
- pulumi_vault/okta/__init__.py +1 -1
- pulumi_vault/okta/_inputs.py +31 -32
- pulumi_vault/okta/auth_backend.py +305 -306
- pulumi_vault/okta/auth_backend_group.py +69 -70
- pulumi_vault/okta/auth_backend_user.py +86 -87
- pulumi_vault/okta/outputs.py +21 -22
- pulumi_vault/outputs.py +234 -82
- pulumi_vault/pkisecret/__init__.py +1 -1
- pulumi_vault/pkisecret/_inputs.py +55 -56
- pulumi_vault/pkisecret/backend_acme_eab.py +116 -117
- pulumi_vault/pkisecret/backend_config_acme.py +175 -176
- pulumi_vault/pkisecret/backend_config_auto_tidy.py +394 -395
- pulumi_vault/pkisecret/backend_config_cluster.py +71 -72
- pulumi_vault/pkisecret/backend_config_cmpv2.py +132 -133
- pulumi_vault/pkisecret/backend_config_est.py +149 -150
- pulumi_vault/pkisecret/backend_config_scep.py +205 -159
- pulumi_vault/pkisecret/get_backend_cert_metadata.py +37 -38
- pulumi_vault/pkisecret/get_backend_config_cmpv2.py +32 -33
- pulumi_vault/pkisecret/get_backend_config_est.py +30 -31
- pulumi_vault/pkisecret/get_backend_config_scep.py +50 -31
- pulumi_vault/pkisecret/get_backend_issuer.py +63 -64
- pulumi_vault/pkisecret/get_backend_issuers.py +23 -24
- pulumi_vault/pkisecret/get_backend_key.py +29 -30
- pulumi_vault/pkisecret/get_backend_keys.py +23 -24
- pulumi_vault/pkisecret/outputs.py +61 -62
- pulumi_vault/pkisecret/secret_backend_cert.py +415 -416
- pulumi_vault/pkisecret/secret_backend_config_ca.py +54 -55
- pulumi_vault/pkisecret/secret_backend_config_issuers.py +75 -76
- pulumi_vault/pkisecret/secret_backend_config_urls.py +105 -106
- pulumi_vault/pkisecret/secret_backend_crl_config.py +241 -242
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +515 -516
- pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +78 -79
- pulumi_vault/pkisecret/secret_backend_issuer.py +286 -287
- pulumi_vault/pkisecret/secret_backend_key.py +146 -147
- pulumi_vault/pkisecret/secret_backend_role.py +873 -874
- pulumi_vault/pkisecret/secret_backend_root_cert.py +677 -678
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +660 -661
- pulumi_vault/pkisecret/secret_backend_sign.py +346 -347
- pulumi_vault/plugin.py +154 -155
- pulumi_vault/plugin_pinned_version.py +52 -53
- pulumi_vault/policy.py +52 -53
- pulumi_vault/provider.py +160 -161
- pulumi_vault/pulumi-plugin.json +1 -1
- pulumi_vault/quota_lease_count.py +103 -104
- pulumi_vault/quota_rate_limit.py +171 -172
- pulumi_vault/rabbitmq/__init__.py +1 -1
- pulumi_vault/rabbitmq/_inputs.py +50 -51
- pulumi_vault/rabbitmq/outputs.py +34 -35
- pulumi_vault/rabbitmq/secret_backend.py +902 -231
- pulumi_vault/rabbitmq/secret_backend_role.py +79 -80
- pulumi_vault/raft_autopilot.py +137 -138
- pulumi_vault/raft_snapshot_agent_config.py +477 -478
- pulumi_vault/rgp_policy.py +69 -70
- pulumi_vault/saml/__init__.py +1 -1
- pulumi_vault/saml/auth_backend.py +188 -189
- pulumi_vault/saml/auth_backend_role.py +290 -291
- pulumi_vault/scep_auth_backend_role.py +252 -253
- pulumi_vault/secrets/__init__.py +1 -1
- pulumi_vault/secrets/_inputs.py +19 -20
- pulumi_vault/secrets/outputs.py +13 -14
- pulumi_vault/secrets/sync_association.py +88 -89
- pulumi_vault/secrets/sync_aws_destination.py +180 -181
- pulumi_vault/secrets/sync_azure_destination.py +180 -181
- pulumi_vault/secrets/sync_config.py +52 -53
- pulumi_vault/secrets/sync_gcp_destination.py +129 -130
- pulumi_vault/secrets/sync_gh_destination.py +163 -164
- pulumi_vault/secrets/sync_github_apps.py +78 -79
- pulumi_vault/secrets/sync_vercel_destination.py +146 -147
- pulumi_vault/ssh/__init__.py +1 -1
- pulumi_vault/ssh/_inputs.py +13 -14
- pulumi_vault/ssh/get_secret_backend_sign.py +65 -66
- pulumi_vault/ssh/outputs.py +9 -10
- pulumi_vault/ssh/secret_backend_ca.py +217 -124
- pulumi_vault/ssh/secret_backend_role.py +446 -447
- pulumi_vault/terraformcloud/__init__.py +1 -1
- pulumi_vault/terraformcloud/secret_backend.py +833 -155
- pulumi_vault/terraformcloud/secret_creds.py +93 -94
- pulumi_vault/terraformcloud/secret_role.py +117 -118
- pulumi_vault/token.py +301 -302
- pulumi_vault/tokenauth/__init__.py +1 -1
- pulumi_vault/tokenauth/auth_backend_role.py +324 -325
- pulumi_vault/transform/__init__.py +1 -1
- pulumi_vault/transform/alphabet.py +69 -70
- pulumi_vault/transform/get_decode.py +57 -58
- pulumi_vault/transform/get_encode.py +57 -58
- pulumi_vault/transform/role.py +69 -70
- pulumi_vault/transform/template.py +137 -138
- pulumi_vault/transform/transformation.py +171 -172
- pulumi_vault/transit/__init__.py +1 -1
- pulumi_vault/transit/get_cmac.py +47 -48
- pulumi_vault/transit/get_decrypt.py +25 -26
- pulumi_vault/transit/get_encrypt.py +29 -30
- pulumi_vault/transit/get_sign.py +71 -72
- pulumi_vault/transit/get_verify.py +83 -84
- pulumi_vault/transit/secret_backend_key.py +377 -350
- pulumi_vault/transit/secret_cache_config.py +52 -53
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/METADATA +1 -1
- pulumi_vault-7.2.0.dist-info/RECORD +270 -0
- pulumi_vault-7.1.0.dist-info/RECORD +0 -268
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/WHEEL +0 -0
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/top_level.txt +0 -0
pulumi_vault/jwt/auth_backend.py
CHANGED
|
@@ -2,8 +2,7 @@
|
|
|
2
2
|
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
4
|
|
|
5
|
-
import builtins
|
|
6
|
-
import copy
|
|
5
|
+
import builtins as _builtins
|
|
7
6
|
import warnings
|
|
8
7
|
import sys
|
|
9
8
|
import pulumi
|
|
@@ -22,57 +21,59 @@ __all__ = ['AuthBackendArgs', 'AuthBackend']
|
|
|
22
21
|
@pulumi.input_type
|
|
23
22
|
class AuthBackendArgs:
|
|
24
23
|
def __init__(__self__, *,
|
|
25
|
-
bound_issuer: Optional[pulumi.Input[
|
|
26
|
-
default_role: Optional[pulumi.Input[
|
|
27
|
-
description: Optional[pulumi.Input[
|
|
28
|
-
disable_remount: Optional[pulumi.Input[
|
|
29
|
-
jwks_ca_pem: Optional[pulumi.Input[
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
24
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
25
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
26
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
27
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
28
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
29
|
+
jwks_pairs: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]] = None,
|
|
30
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
31
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
32
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
33
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
34
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
35
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
36
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
37
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
38
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
39
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
40
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
41
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
42
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
43
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
44
44
|
tune: Optional[pulumi.Input['AuthBackendTuneArgs']] = None,
|
|
45
|
-
type: Optional[pulumi.Input[
|
|
45
|
+
type: Optional[pulumi.Input[_builtins.str]] = None):
|
|
46
46
|
"""
|
|
47
47
|
The set of arguments for constructing a AuthBackend resource.
|
|
48
|
-
:param pulumi.Input[
|
|
49
|
-
:param pulumi.Input[
|
|
50
|
-
:param pulumi.Input[
|
|
51
|
-
:param pulumi.Input[
|
|
48
|
+
:param pulumi.Input[_builtins.str] bound_issuer: The value against which to match the iss claim in a JWT
|
|
49
|
+
:param pulumi.Input[_builtins.str] default_role: The default role to use if none is provided during login
|
|
50
|
+
:param pulumi.Input[_builtins.str] description: The description of the auth backend
|
|
51
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
52
52
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
53
|
-
:param pulumi.Input[
|
|
54
|
-
:param pulumi.Input[
|
|
55
|
-
:param pulumi.Input[
|
|
56
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
57
|
-
:param pulumi.Input[
|
|
58
|
-
:param pulumi.Input[
|
|
53
|
+
:param pulumi.Input[_builtins.str] jwks_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
54
|
+
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]] jwks_pairs: List of JWKS URL and optional CA certificate pairs. Cannot be used with `jwks_url` or `jwks_ca_pem`. Requires Vault 1.16+.
|
|
55
|
+
:param pulumi.Input[_builtins.str] jwks_url: JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
56
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_supported_algs: A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
57
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_validation_pubkeys: A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
58
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
59
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
59
60
|
The value should not contain leading or trailing forward slashes.
|
|
60
61
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
61
62
|
*Available only for Vault Enterprise*.
|
|
62
|
-
:param pulumi.Input[
|
|
63
|
+
:param pulumi.Input[_builtins.bool] namespace_in_state: Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
63
64
|
|
|
64
65
|
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
65
66
|
|
|
66
67
|
The `tune` block is used to tune the auth backend:
|
|
67
|
-
:param pulumi.Input[
|
|
68
|
-
:param pulumi.Input[
|
|
69
|
-
:param pulumi.Input[
|
|
70
|
-
:param pulumi.Input[
|
|
71
|
-
:param pulumi.Input[
|
|
72
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
73
|
-
:param pulumi.Input[
|
|
74
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
75
|
-
:param pulumi.Input[
|
|
68
|
+
:param pulumi.Input[_builtins.str] oidc_client_id: Client ID used for OIDC backends
|
|
69
|
+
:param pulumi.Input[_builtins.str] oidc_client_secret: Client Secret used for OIDC backends
|
|
70
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
71
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_url: The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
72
|
+
:param pulumi.Input[_builtins.str] oidc_response_mode: The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
73
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] oidc_response_types: List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
74
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the JWT/OIDC auth backend
|
|
75
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] provider_config: Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
76
|
+
:param pulumi.Input[_builtins.str] type: Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
76
77
|
"""
|
|
77
78
|
if bound_issuer is not None:
|
|
78
79
|
pulumi.set(__self__, "bound_issuer", bound_issuer)
|
|
@@ -84,6 +85,8 @@ class AuthBackendArgs:
|
|
|
84
85
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
85
86
|
if jwks_ca_pem is not None:
|
|
86
87
|
pulumi.set(__self__, "jwks_ca_pem", jwks_ca_pem)
|
|
88
|
+
if jwks_pairs is not None:
|
|
89
|
+
pulumi.set(__self__, "jwks_pairs", jwks_pairs)
|
|
87
90
|
if jwks_url is not None:
|
|
88
91
|
pulumi.set(__self__, "jwks_url", jwks_url)
|
|
89
92
|
if jwt_supported_algs is not None:
|
|
@@ -117,45 +120,45 @@ class AuthBackendArgs:
|
|
|
117
120
|
if type is not None:
|
|
118
121
|
pulumi.set(__self__, "type", type)
|
|
119
122
|
|
|
120
|
-
@property
|
|
123
|
+
@_builtins.property
|
|
121
124
|
@pulumi.getter(name="boundIssuer")
|
|
122
|
-
def bound_issuer(self) -> Optional[pulumi.Input[
|
|
125
|
+
def bound_issuer(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
123
126
|
"""
|
|
124
127
|
The value against which to match the iss claim in a JWT
|
|
125
128
|
"""
|
|
126
129
|
return pulumi.get(self, "bound_issuer")
|
|
127
130
|
|
|
128
131
|
@bound_issuer.setter
|
|
129
|
-
def bound_issuer(self, value: Optional[pulumi.Input[
|
|
132
|
+
def bound_issuer(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
130
133
|
pulumi.set(self, "bound_issuer", value)
|
|
131
134
|
|
|
132
|
-
@property
|
|
135
|
+
@_builtins.property
|
|
133
136
|
@pulumi.getter(name="defaultRole")
|
|
134
|
-
def default_role(self) -> Optional[pulumi.Input[
|
|
137
|
+
def default_role(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
135
138
|
"""
|
|
136
139
|
The default role to use if none is provided during login
|
|
137
140
|
"""
|
|
138
141
|
return pulumi.get(self, "default_role")
|
|
139
142
|
|
|
140
143
|
@default_role.setter
|
|
141
|
-
def default_role(self, value: Optional[pulumi.Input[
|
|
144
|
+
def default_role(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
142
145
|
pulumi.set(self, "default_role", value)
|
|
143
146
|
|
|
144
|
-
@property
|
|
147
|
+
@_builtins.property
|
|
145
148
|
@pulumi.getter
|
|
146
|
-
def description(self) -> Optional[pulumi.Input[
|
|
149
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
147
150
|
"""
|
|
148
151
|
The description of the auth backend
|
|
149
152
|
"""
|
|
150
153
|
return pulumi.get(self, "description")
|
|
151
154
|
|
|
152
155
|
@description.setter
|
|
153
|
-
def description(self, value: Optional[pulumi.Input[
|
|
156
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
154
157
|
pulumi.set(self, "description", value)
|
|
155
158
|
|
|
156
|
-
@property
|
|
159
|
+
@_builtins.property
|
|
157
160
|
@pulumi.getter(name="disableRemount")
|
|
158
|
-
def disable_remount(self) -> Optional[pulumi.Input[
|
|
161
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
159
162
|
"""
|
|
160
163
|
If set, opts out of mount migration on path updates.
|
|
161
164
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
@@ -163,72 +166,84 @@ class AuthBackendArgs:
|
|
|
163
166
|
return pulumi.get(self, "disable_remount")
|
|
164
167
|
|
|
165
168
|
@disable_remount.setter
|
|
166
|
-
def disable_remount(self, value: Optional[pulumi.Input[
|
|
169
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
167
170
|
pulumi.set(self, "disable_remount", value)
|
|
168
171
|
|
|
169
|
-
@property
|
|
172
|
+
@_builtins.property
|
|
170
173
|
@pulumi.getter(name="jwksCaPem")
|
|
171
|
-
def jwks_ca_pem(self) -> Optional[pulumi.Input[
|
|
174
|
+
def jwks_ca_pem(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
172
175
|
"""
|
|
173
176
|
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
174
177
|
"""
|
|
175
178
|
return pulumi.get(self, "jwks_ca_pem")
|
|
176
179
|
|
|
177
180
|
@jwks_ca_pem.setter
|
|
178
|
-
def jwks_ca_pem(self, value: Optional[pulumi.Input[
|
|
181
|
+
def jwks_ca_pem(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
179
182
|
pulumi.set(self, "jwks_ca_pem", value)
|
|
180
183
|
|
|
181
|
-
@property
|
|
184
|
+
@_builtins.property
|
|
185
|
+
@pulumi.getter(name="jwksPairs")
|
|
186
|
+
def jwks_pairs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]]:
|
|
187
|
+
"""
|
|
188
|
+
List of JWKS URL and optional CA certificate pairs. Cannot be used with `jwks_url` or `jwks_ca_pem`. Requires Vault 1.16+.
|
|
189
|
+
"""
|
|
190
|
+
return pulumi.get(self, "jwks_pairs")
|
|
191
|
+
|
|
192
|
+
@jwks_pairs.setter
|
|
193
|
+
def jwks_pairs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]]):
|
|
194
|
+
pulumi.set(self, "jwks_pairs", value)
|
|
195
|
+
|
|
196
|
+
@_builtins.property
|
|
182
197
|
@pulumi.getter(name="jwksUrl")
|
|
183
|
-
def jwks_url(self) -> Optional[pulumi.Input[
|
|
198
|
+
def jwks_url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
184
199
|
"""
|
|
185
200
|
JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
186
201
|
"""
|
|
187
202
|
return pulumi.get(self, "jwks_url")
|
|
188
203
|
|
|
189
204
|
@jwks_url.setter
|
|
190
|
-
def jwks_url(self, value: Optional[pulumi.Input[
|
|
205
|
+
def jwks_url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
191
206
|
pulumi.set(self, "jwks_url", value)
|
|
192
207
|
|
|
193
|
-
@property
|
|
208
|
+
@_builtins.property
|
|
194
209
|
@pulumi.getter(name="jwtSupportedAlgs")
|
|
195
|
-
def jwt_supported_algs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
210
|
+
def jwt_supported_algs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
196
211
|
"""
|
|
197
212
|
A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
198
213
|
"""
|
|
199
214
|
return pulumi.get(self, "jwt_supported_algs")
|
|
200
215
|
|
|
201
216
|
@jwt_supported_algs.setter
|
|
202
|
-
def jwt_supported_algs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
217
|
+
def jwt_supported_algs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
203
218
|
pulumi.set(self, "jwt_supported_algs", value)
|
|
204
219
|
|
|
205
|
-
@property
|
|
220
|
+
@_builtins.property
|
|
206
221
|
@pulumi.getter(name="jwtValidationPubkeys")
|
|
207
|
-
def jwt_validation_pubkeys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
222
|
+
def jwt_validation_pubkeys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
208
223
|
"""
|
|
209
224
|
A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
210
225
|
"""
|
|
211
226
|
return pulumi.get(self, "jwt_validation_pubkeys")
|
|
212
227
|
|
|
213
228
|
@jwt_validation_pubkeys.setter
|
|
214
|
-
def jwt_validation_pubkeys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
229
|
+
def jwt_validation_pubkeys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
215
230
|
pulumi.set(self, "jwt_validation_pubkeys", value)
|
|
216
231
|
|
|
217
|
-
@property
|
|
232
|
+
@_builtins.property
|
|
218
233
|
@pulumi.getter
|
|
219
|
-
def local(self) -> Optional[pulumi.Input[
|
|
234
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
220
235
|
"""
|
|
221
236
|
Specifies if the auth method is local only.
|
|
222
237
|
"""
|
|
223
238
|
return pulumi.get(self, "local")
|
|
224
239
|
|
|
225
240
|
@local.setter
|
|
226
|
-
def local(self, value: Optional[pulumi.Input[
|
|
241
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
227
242
|
pulumi.set(self, "local", value)
|
|
228
243
|
|
|
229
|
-
@property
|
|
244
|
+
@_builtins.property
|
|
230
245
|
@pulumi.getter
|
|
231
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
246
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
232
247
|
"""
|
|
233
248
|
The namespace to provision the resource in.
|
|
234
249
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -238,12 +253,12 @@ class AuthBackendArgs:
|
|
|
238
253
|
return pulumi.get(self, "namespace")
|
|
239
254
|
|
|
240
255
|
@namespace.setter
|
|
241
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
256
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
242
257
|
pulumi.set(self, "namespace", value)
|
|
243
258
|
|
|
244
|
-
@property
|
|
259
|
+
@_builtins.property
|
|
245
260
|
@pulumi.getter(name="namespaceInState")
|
|
246
|
-
def namespace_in_state(self) -> Optional[pulumi.Input[
|
|
261
|
+
def namespace_in_state(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
247
262
|
"""
|
|
248
263
|
Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
249
264
|
|
|
@@ -254,106 +269,106 @@ class AuthBackendArgs:
|
|
|
254
269
|
return pulumi.get(self, "namespace_in_state")
|
|
255
270
|
|
|
256
271
|
@namespace_in_state.setter
|
|
257
|
-
def namespace_in_state(self, value: Optional[pulumi.Input[
|
|
272
|
+
def namespace_in_state(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
258
273
|
pulumi.set(self, "namespace_in_state", value)
|
|
259
274
|
|
|
260
|
-
@property
|
|
275
|
+
@_builtins.property
|
|
261
276
|
@pulumi.getter(name="oidcClientId")
|
|
262
|
-
def oidc_client_id(self) -> Optional[pulumi.Input[
|
|
277
|
+
def oidc_client_id(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
263
278
|
"""
|
|
264
279
|
Client ID used for OIDC backends
|
|
265
280
|
"""
|
|
266
281
|
return pulumi.get(self, "oidc_client_id")
|
|
267
282
|
|
|
268
283
|
@oidc_client_id.setter
|
|
269
|
-
def oidc_client_id(self, value: Optional[pulumi.Input[
|
|
284
|
+
def oidc_client_id(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
270
285
|
pulumi.set(self, "oidc_client_id", value)
|
|
271
286
|
|
|
272
|
-
@property
|
|
287
|
+
@_builtins.property
|
|
273
288
|
@pulumi.getter(name="oidcClientSecret")
|
|
274
|
-
def oidc_client_secret(self) -> Optional[pulumi.Input[
|
|
289
|
+
def oidc_client_secret(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
275
290
|
"""
|
|
276
291
|
Client Secret used for OIDC backends
|
|
277
292
|
"""
|
|
278
293
|
return pulumi.get(self, "oidc_client_secret")
|
|
279
294
|
|
|
280
295
|
@oidc_client_secret.setter
|
|
281
|
-
def oidc_client_secret(self, value: Optional[pulumi.Input[
|
|
296
|
+
def oidc_client_secret(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
282
297
|
pulumi.set(self, "oidc_client_secret", value)
|
|
283
298
|
|
|
284
|
-
@property
|
|
299
|
+
@_builtins.property
|
|
285
300
|
@pulumi.getter(name="oidcDiscoveryCaPem")
|
|
286
|
-
def oidc_discovery_ca_pem(self) -> Optional[pulumi.Input[
|
|
301
|
+
def oidc_discovery_ca_pem(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
287
302
|
"""
|
|
288
303
|
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
289
304
|
"""
|
|
290
305
|
return pulumi.get(self, "oidc_discovery_ca_pem")
|
|
291
306
|
|
|
292
307
|
@oidc_discovery_ca_pem.setter
|
|
293
|
-
def oidc_discovery_ca_pem(self, value: Optional[pulumi.Input[
|
|
308
|
+
def oidc_discovery_ca_pem(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
294
309
|
pulumi.set(self, "oidc_discovery_ca_pem", value)
|
|
295
310
|
|
|
296
|
-
@property
|
|
311
|
+
@_builtins.property
|
|
297
312
|
@pulumi.getter(name="oidcDiscoveryUrl")
|
|
298
|
-
def oidc_discovery_url(self) -> Optional[pulumi.Input[
|
|
313
|
+
def oidc_discovery_url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
299
314
|
"""
|
|
300
315
|
The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
301
316
|
"""
|
|
302
317
|
return pulumi.get(self, "oidc_discovery_url")
|
|
303
318
|
|
|
304
319
|
@oidc_discovery_url.setter
|
|
305
|
-
def oidc_discovery_url(self, value: Optional[pulumi.Input[
|
|
320
|
+
def oidc_discovery_url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
306
321
|
pulumi.set(self, "oidc_discovery_url", value)
|
|
307
322
|
|
|
308
|
-
@property
|
|
323
|
+
@_builtins.property
|
|
309
324
|
@pulumi.getter(name="oidcResponseMode")
|
|
310
|
-
def oidc_response_mode(self) -> Optional[pulumi.Input[
|
|
325
|
+
def oidc_response_mode(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
311
326
|
"""
|
|
312
327
|
The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
313
328
|
"""
|
|
314
329
|
return pulumi.get(self, "oidc_response_mode")
|
|
315
330
|
|
|
316
331
|
@oidc_response_mode.setter
|
|
317
|
-
def oidc_response_mode(self, value: Optional[pulumi.Input[
|
|
332
|
+
def oidc_response_mode(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
318
333
|
pulumi.set(self, "oidc_response_mode", value)
|
|
319
334
|
|
|
320
|
-
@property
|
|
335
|
+
@_builtins.property
|
|
321
336
|
@pulumi.getter(name="oidcResponseTypes")
|
|
322
|
-
def oidc_response_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
337
|
+
def oidc_response_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
323
338
|
"""
|
|
324
339
|
List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
325
340
|
"""
|
|
326
341
|
return pulumi.get(self, "oidc_response_types")
|
|
327
342
|
|
|
328
343
|
@oidc_response_types.setter
|
|
329
|
-
def oidc_response_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
344
|
+
def oidc_response_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
330
345
|
pulumi.set(self, "oidc_response_types", value)
|
|
331
346
|
|
|
332
|
-
@property
|
|
347
|
+
@_builtins.property
|
|
333
348
|
@pulumi.getter
|
|
334
|
-
def path(self) -> Optional[pulumi.Input[
|
|
349
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
335
350
|
"""
|
|
336
351
|
Path to mount the JWT/OIDC auth backend
|
|
337
352
|
"""
|
|
338
353
|
return pulumi.get(self, "path")
|
|
339
354
|
|
|
340
355
|
@path.setter
|
|
341
|
-
def path(self, value: Optional[pulumi.Input[
|
|
356
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
342
357
|
pulumi.set(self, "path", value)
|
|
343
358
|
|
|
344
|
-
@property
|
|
359
|
+
@_builtins.property
|
|
345
360
|
@pulumi.getter(name="providerConfig")
|
|
346
|
-
def provider_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
361
|
+
def provider_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
347
362
|
"""
|
|
348
363
|
Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
349
364
|
"""
|
|
350
365
|
return pulumi.get(self, "provider_config")
|
|
351
366
|
|
|
352
367
|
@provider_config.setter
|
|
353
|
-
def provider_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
368
|
+
def provider_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
354
369
|
pulumi.set(self, "provider_config", value)
|
|
355
370
|
|
|
356
|
-
@property
|
|
371
|
+
@_builtins.property
|
|
357
372
|
@pulumi.getter
|
|
358
373
|
def tune(self) -> Optional[pulumi.Input['AuthBackendTuneArgs']]:
|
|
359
374
|
return pulumi.get(self, "tune")
|
|
@@ -362,75 +377,77 @@ class AuthBackendArgs:
|
|
|
362
377
|
def tune(self, value: Optional[pulumi.Input['AuthBackendTuneArgs']]):
|
|
363
378
|
pulumi.set(self, "tune", value)
|
|
364
379
|
|
|
365
|
-
@property
|
|
380
|
+
@_builtins.property
|
|
366
381
|
@pulumi.getter
|
|
367
|
-
def type(self) -> Optional[pulumi.Input[
|
|
382
|
+
def type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
368
383
|
"""
|
|
369
384
|
Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
370
385
|
"""
|
|
371
386
|
return pulumi.get(self, "type")
|
|
372
387
|
|
|
373
388
|
@type.setter
|
|
374
|
-
def type(self, value: Optional[pulumi.Input[
|
|
389
|
+
def type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
375
390
|
pulumi.set(self, "type", value)
|
|
376
391
|
|
|
377
392
|
|
|
378
393
|
@pulumi.input_type
|
|
379
394
|
class _AuthBackendState:
|
|
380
395
|
def __init__(__self__, *,
|
|
381
|
-
accessor: Optional[pulumi.Input[
|
|
382
|
-
bound_issuer: Optional[pulumi.Input[
|
|
383
|
-
default_role: Optional[pulumi.Input[
|
|
384
|
-
description: Optional[pulumi.Input[
|
|
385
|
-
disable_remount: Optional[pulumi.Input[
|
|
386
|
-
jwks_ca_pem: Optional[pulumi.Input[
|
|
387
|
-
|
|
388
|
-
|
|
389
|
-
|
|
390
|
-
|
|
391
|
-
|
|
392
|
-
|
|
393
|
-
|
|
394
|
-
|
|
395
|
-
|
|
396
|
-
|
|
397
|
-
|
|
398
|
-
|
|
399
|
-
|
|
400
|
-
|
|
396
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
397
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
398
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
399
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
400
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
401
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
402
|
+
jwks_pairs: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]] = None,
|
|
403
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
404
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
405
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
406
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
407
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
408
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
409
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
410
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
411
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
412
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
413
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
414
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
415
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
416
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
401
417
|
tune: Optional[pulumi.Input['AuthBackendTuneArgs']] = None,
|
|
402
|
-
type: Optional[pulumi.Input[
|
|
418
|
+
type: Optional[pulumi.Input[_builtins.str]] = None):
|
|
403
419
|
"""
|
|
404
420
|
Input properties used for looking up and filtering AuthBackend resources.
|
|
405
|
-
:param pulumi.Input[
|
|
406
|
-
:param pulumi.Input[
|
|
407
|
-
:param pulumi.Input[
|
|
408
|
-
:param pulumi.Input[
|
|
409
|
-
:param pulumi.Input[
|
|
421
|
+
:param pulumi.Input[_builtins.str] accessor: The accessor for this auth method
|
|
422
|
+
:param pulumi.Input[_builtins.str] bound_issuer: The value against which to match the iss claim in a JWT
|
|
423
|
+
:param pulumi.Input[_builtins.str] default_role: The default role to use if none is provided during login
|
|
424
|
+
:param pulumi.Input[_builtins.str] description: The description of the auth backend
|
|
425
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
410
426
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
411
|
-
:param pulumi.Input[
|
|
412
|
-
:param pulumi.Input[
|
|
413
|
-
:param pulumi.Input[
|
|
414
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
415
|
-
:param pulumi.Input[
|
|
416
|
-
:param pulumi.Input[
|
|
427
|
+
:param pulumi.Input[_builtins.str] jwks_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
428
|
+
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]] jwks_pairs: List of JWKS URL and optional CA certificate pairs. Cannot be used with `jwks_url` or `jwks_ca_pem`. Requires Vault 1.16+.
|
|
429
|
+
:param pulumi.Input[_builtins.str] jwks_url: JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
430
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_supported_algs: A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
431
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_validation_pubkeys: A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
432
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
433
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
417
434
|
The value should not contain leading or trailing forward slashes.
|
|
418
435
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
419
436
|
*Available only for Vault Enterprise*.
|
|
420
|
-
:param pulumi.Input[
|
|
437
|
+
:param pulumi.Input[_builtins.bool] namespace_in_state: Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
421
438
|
|
|
422
439
|
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
423
440
|
|
|
424
441
|
The `tune` block is used to tune the auth backend:
|
|
425
|
-
:param pulumi.Input[
|
|
426
|
-
:param pulumi.Input[
|
|
427
|
-
:param pulumi.Input[
|
|
428
|
-
:param pulumi.Input[
|
|
429
|
-
:param pulumi.Input[
|
|
430
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
431
|
-
:param pulumi.Input[
|
|
432
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
433
|
-
:param pulumi.Input[
|
|
442
|
+
:param pulumi.Input[_builtins.str] oidc_client_id: Client ID used for OIDC backends
|
|
443
|
+
:param pulumi.Input[_builtins.str] oidc_client_secret: Client Secret used for OIDC backends
|
|
444
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
445
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_url: The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
446
|
+
:param pulumi.Input[_builtins.str] oidc_response_mode: The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
447
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] oidc_response_types: List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
448
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the JWT/OIDC auth backend
|
|
449
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] provider_config: Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
450
|
+
:param pulumi.Input[_builtins.str] type: Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
434
451
|
"""
|
|
435
452
|
if accessor is not None:
|
|
436
453
|
pulumi.set(__self__, "accessor", accessor)
|
|
@@ -444,6 +461,8 @@ class _AuthBackendState:
|
|
|
444
461
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
445
462
|
if jwks_ca_pem is not None:
|
|
446
463
|
pulumi.set(__self__, "jwks_ca_pem", jwks_ca_pem)
|
|
464
|
+
if jwks_pairs is not None:
|
|
465
|
+
pulumi.set(__self__, "jwks_pairs", jwks_pairs)
|
|
447
466
|
if jwks_url is not None:
|
|
448
467
|
pulumi.set(__self__, "jwks_url", jwks_url)
|
|
449
468
|
if jwt_supported_algs is not None:
|
|
@@ -477,57 +496,57 @@ class _AuthBackendState:
|
|
|
477
496
|
if type is not None:
|
|
478
497
|
pulumi.set(__self__, "type", type)
|
|
479
498
|
|
|
480
|
-
@property
|
|
499
|
+
@_builtins.property
|
|
481
500
|
@pulumi.getter
|
|
482
|
-
def accessor(self) -> Optional[pulumi.Input[
|
|
501
|
+
def accessor(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
483
502
|
"""
|
|
484
503
|
The accessor for this auth method
|
|
485
504
|
"""
|
|
486
505
|
return pulumi.get(self, "accessor")
|
|
487
506
|
|
|
488
507
|
@accessor.setter
|
|
489
|
-
def accessor(self, value: Optional[pulumi.Input[
|
|
508
|
+
def accessor(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
490
509
|
pulumi.set(self, "accessor", value)
|
|
491
510
|
|
|
492
|
-
@property
|
|
511
|
+
@_builtins.property
|
|
493
512
|
@pulumi.getter(name="boundIssuer")
|
|
494
|
-
def bound_issuer(self) -> Optional[pulumi.Input[
|
|
513
|
+
def bound_issuer(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
495
514
|
"""
|
|
496
515
|
The value against which to match the iss claim in a JWT
|
|
497
516
|
"""
|
|
498
517
|
return pulumi.get(self, "bound_issuer")
|
|
499
518
|
|
|
500
519
|
@bound_issuer.setter
|
|
501
|
-
def bound_issuer(self, value: Optional[pulumi.Input[
|
|
520
|
+
def bound_issuer(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
502
521
|
pulumi.set(self, "bound_issuer", value)
|
|
503
522
|
|
|
504
|
-
@property
|
|
523
|
+
@_builtins.property
|
|
505
524
|
@pulumi.getter(name="defaultRole")
|
|
506
|
-
def default_role(self) -> Optional[pulumi.Input[
|
|
525
|
+
def default_role(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
507
526
|
"""
|
|
508
527
|
The default role to use if none is provided during login
|
|
509
528
|
"""
|
|
510
529
|
return pulumi.get(self, "default_role")
|
|
511
530
|
|
|
512
531
|
@default_role.setter
|
|
513
|
-
def default_role(self, value: Optional[pulumi.Input[
|
|
532
|
+
def default_role(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
514
533
|
pulumi.set(self, "default_role", value)
|
|
515
534
|
|
|
516
|
-
@property
|
|
535
|
+
@_builtins.property
|
|
517
536
|
@pulumi.getter
|
|
518
|
-
def description(self) -> Optional[pulumi.Input[
|
|
537
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
519
538
|
"""
|
|
520
539
|
The description of the auth backend
|
|
521
540
|
"""
|
|
522
541
|
return pulumi.get(self, "description")
|
|
523
542
|
|
|
524
543
|
@description.setter
|
|
525
|
-
def description(self, value: Optional[pulumi.Input[
|
|
544
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
526
545
|
pulumi.set(self, "description", value)
|
|
527
546
|
|
|
528
|
-
@property
|
|
547
|
+
@_builtins.property
|
|
529
548
|
@pulumi.getter(name="disableRemount")
|
|
530
|
-
def disable_remount(self) -> Optional[pulumi.Input[
|
|
549
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
531
550
|
"""
|
|
532
551
|
If set, opts out of mount migration on path updates.
|
|
533
552
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
@@ -535,72 +554,84 @@ class _AuthBackendState:
|
|
|
535
554
|
return pulumi.get(self, "disable_remount")
|
|
536
555
|
|
|
537
556
|
@disable_remount.setter
|
|
538
|
-
def disable_remount(self, value: Optional[pulumi.Input[
|
|
557
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
539
558
|
pulumi.set(self, "disable_remount", value)
|
|
540
559
|
|
|
541
|
-
@property
|
|
560
|
+
@_builtins.property
|
|
542
561
|
@pulumi.getter(name="jwksCaPem")
|
|
543
|
-
def jwks_ca_pem(self) -> Optional[pulumi.Input[
|
|
562
|
+
def jwks_ca_pem(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
544
563
|
"""
|
|
545
564
|
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
546
565
|
"""
|
|
547
566
|
return pulumi.get(self, "jwks_ca_pem")
|
|
548
567
|
|
|
549
568
|
@jwks_ca_pem.setter
|
|
550
|
-
def jwks_ca_pem(self, value: Optional[pulumi.Input[
|
|
569
|
+
def jwks_ca_pem(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
551
570
|
pulumi.set(self, "jwks_ca_pem", value)
|
|
552
571
|
|
|
553
|
-
@property
|
|
572
|
+
@_builtins.property
|
|
573
|
+
@pulumi.getter(name="jwksPairs")
|
|
574
|
+
def jwks_pairs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]]:
|
|
575
|
+
"""
|
|
576
|
+
List of JWKS URL and optional CA certificate pairs. Cannot be used with `jwks_url` or `jwks_ca_pem`. Requires Vault 1.16+.
|
|
577
|
+
"""
|
|
578
|
+
return pulumi.get(self, "jwks_pairs")
|
|
579
|
+
|
|
580
|
+
@jwks_pairs.setter
|
|
581
|
+
def jwks_pairs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]]):
|
|
582
|
+
pulumi.set(self, "jwks_pairs", value)
|
|
583
|
+
|
|
584
|
+
@_builtins.property
|
|
554
585
|
@pulumi.getter(name="jwksUrl")
|
|
555
|
-
def jwks_url(self) -> Optional[pulumi.Input[
|
|
586
|
+
def jwks_url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
556
587
|
"""
|
|
557
588
|
JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
558
589
|
"""
|
|
559
590
|
return pulumi.get(self, "jwks_url")
|
|
560
591
|
|
|
561
592
|
@jwks_url.setter
|
|
562
|
-
def jwks_url(self, value: Optional[pulumi.Input[
|
|
593
|
+
def jwks_url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
563
594
|
pulumi.set(self, "jwks_url", value)
|
|
564
595
|
|
|
565
|
-
@property
|
|
596
|
+
@_builtins.property
|
|
566
597
|
@pulumi.getter(name="jwtSupportedAlgs")
|
|
567
|
-
def jwt_supported_algs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
598
|
+
def jwt_supported_algs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
568
599
|
"""
|
|
569
600
|
A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
570
601
|
"""
|
|
571
602
|
return pulumi.get(self, "jwt_supported_algs")
|
|
572
603
|
|
|
573
604
|
@jwt_supported_algs.setter
|
|
574
|
-
def jwt_supported_algs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
605
|
+
def jwt_supported_algs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
575
606
|
pulumi.set(self, "jwt_supported_algs", value)
|
|
576
607
|
|
|
577
|
-
@property
|
|
608
|
+
@_builtins.property
|
|
578
609
|
@pulumi.getter(name="jwtValidationPubkeys")
|
|
579
|
-
def jwt_validation_pubkeys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
610
|
+
def jwt_validation_pubkeys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
580
611
|
"""
|
|
581
612
|
A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
582
613
|
"""
|
|
583
614
|
return pulumi.get(self, "jwt_validation_pubkeys")
|
|
584
615
|
|
|
585
616
|
@jwt_validation_pubkeys.setter
|
|
586
|
-
def jwt_validation_pubkeys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
617
|
+
def jwt_validation_pubkeys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
587
618
|
pulumi.set(self, "jwt_validation_pubkeys", value)
|
|
588
619
|
|
|
589
|
-
@property
|
|
620
|
+
@_builtins.property
|
|
590
621
|
@pulumi.getter
|
|
591
|
-
def local(self) -> Optional[pulumi.Input[
|
|
622
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
592
623
|
"""
|
|
593
624
|
Specifies if the auth method is local only.
|
|
594
625
|
"""
|
|
595
626
|
return pulumi.get(self, "local")
|
|
596
627
|
|
|
597
628
|
@local.setter
|
|
598
|
-
def local(self, value: Optional[pulumi.Input[
|
|
629
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
599
630
|
pulumi.set(self, "local", value)
|
|
600
631
|
|
|
601
|
-
@property
|
|
632
|
+
@_builtins.property
|
|
602
633
|
@pulumi.getter
|
|
603
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
634
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
604
635
|
"""
|
|
605
636
|
The namespace to provision the resource in.
|
|
606
637
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -610,12 +641,12 @@ class _AuthBackendState:
|
|
|
610
641
|
return pulumi.get(self, "namespace")
|
|
611
642
|
|
|
612
643
|
@namespace.setter
|
|
613
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
644
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
614
645
|
pulumi.set(self, "namespace", value)
|
|
615
646
|
|
|
616
|
-
@property
|
|
647
|
+
@_builtins.property
|
|
617
648
|
@pulumi.getter(name="namespaceInState")
|
|
618
|
-
def namespace_in_state(self) -> Optional[pulumi.Input[
|
|
649
|
+
def namespace_in_state(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
619
650
|
"""
|
|
620
651
|
Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
621
652
|
|
|
@@ -626,106 +657,106 @@ class _AuthBackendState:
|
|
|
626
657
|
return pulumi.get(self, "namespace_in_state")
|
|
627
658
|
|
|
628
659
|
@namespace_in_state.setter
|
|
629
|
-
def namespace_in_state(self, value: Optional[pulumi.Input[
|
|
660
|
+
def namespace_in_state(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
630
661
|
pulumi.set(self, "namespace_in_state", value)
|
|
631
662
|
|
|
632
|
-
@property
|
|
663
|
+
@_builtins.property
|
|
633
664
|
@pulumi.getter(name="oidcClientId")
|
|
634
|
-
def oidc_client_id(self) -> Optional[pulumi.Input[
|
|
665
|
+
def oidc_client_id(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
635
666
|
"""
|
|
636
667
|
Client ID used for OIDC backends
|
|
637
668
|
"""
|
|
638
669
|
return pulumi.get(self, "oidc_client_id")
|
|
639
670
|
|
|
640
671
|
@oidc_client_id.setter
|
|
641
|
-
def oidc_client_id(self, value: Optional[pulumi.Input[
|
|
672
|
+
def oidc_client_id(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
642
673
|
pulumi.set(self, "oidc_client_id", value)
|
|
643
674
|
|
|
644
|
-
@property
|
|
675
|
+
@_builtins.property
|
|
645
676
|
@pulumi.getter(name="oidcClientSecret")
|
|
646
|
-
def oidc_client_secret(self) -> Optional[pulumi.Input[
|
|
677
|
+
def oidc_client_secret(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
647
678
|
"""
|
|
648
679
|
Client Secret used for OIDC backends
|
|
649
680
|
"""
|
|
650
681
|
return pulumi.get(self, "oidc_client_secret")
|
|
651
682
|
|
|
652
683
|
@oidc_client_secret.setter
|
|
653
|
-
def oidc_client_secret(self, value: Optional[pulumi.Input[
|
|
684
|
+
def oidc_client_secret(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
654
685
|
pulumi.set(self, "oidc_client_secret", value)
|
|
655
686
|
|
|
656
|
-
@property
|
|
687
|
+
@_builtins.property
|
|
657
688
|
@pulumi.getter(name="oidcDiscoveryCaPem")
|
|
658
|
-
def oidc_discovery_ca_pem(self) -> Optional[pulumi.Input[
|
|
689
|
+
def oidc_discovery_ca_pem(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
659
690
|
"""
|
|
660
691
|
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
661
692
|
"""
|
|
662
693
|
return pulumi.get(self, "oidc_discovery_ca_pem")
|
|
663
694
|
|
|
664
695
|
@oidc_discovery_ca_pem.setter
|
|
665
|
-
def oidc_discovery_ca_pem(self, value: Optional[pulumi.Input[
|
|
696
|
+
def oidc_discovery_ca_pem(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
666
697
|
pulumi.set(self, "oidc_discovery_ca_pem", value)
|
|
667
698
|
|
|
668
|
-
@property
|
|
699
|
+
@_builtins.property
|
|
669
700
|
@pulumi.getter(name="oidcDiscoveryUrl")
|
|
670
|
-
def oidc_discovery_url(self) -> Optional[pulumi.Input[
|
|
701
|
+
def oidc_discovery_url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
671
702
|
"""
|
|
672
703
|
The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
673
704
|
"""
|
|
674
705
|
return pulumi.get(self, "oidc_discovery_url")
|
|
675
706
|
|
|
676
707
|
@oidc_discovery_url.setter
|
|
677
|
-
def oidc_discovery_url(self, value: Optional[pulumi.Input[
|
|
708
|
+
def oidc_discovery_url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
678
709
|
pulumi.set(self, "oidc_discovery_url", value)
|
|
679
710
|
|
|
680
|
-
@property
|
|
711
|
+
@_builtins.property
|
|
681
712
|
@pulumi.getter(name="oidcResponseMode")
|
|
682
|
-
def oidc_response_mode(self) -> Optional[pulumi.Input[
|
|
713
|
+
def oidc_response_mode(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
683
714
|
"""
|
|
684
715
|
The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
685
716
|
"""
|
|
686
717
|
return pulumi.get(self, "oidc_response_mode")
|
|
687
718
|
|
|
688
719
|
@oidc_response_mode.setter
|
|
689
|
-
def oidc_response_mode(self, value: Optional[pulumi.Input[
|
|
720
|
+
def oidc_response_mode(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
690
721
|
pulumi.set(self, "oidc_response_mode", value)
|
|
691
722
|
|
|
692
|
-
@property
|
|
723
|
+
@_builtins.property
|
|
693
724
|
@pulumi.getter(name="oidcResponseTypes")
|
|
694
|
-
def oidc_response_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
725
|
+
def oidc_response_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
695
726
|
"""
|
|
696
727
|
List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
697
728
|
"""
|
|
698
729
|
return pulumi.get(self, "oidc_response_types")
|
|
699
730
|
|
|
700
731
|
@oidc_response_types.setter
|
|
701
|
-
def oidc_response_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
732
|
+
def oidc_response_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
702
733
|
pulumi.set(self, "oidc_response_types", value)
|
|
703
734
|
|
|
704
|
-
@property
|
|
735
|
+
@_builtins.property
|
|
705
736
|
@pulumi.getter
|
|
706
|
-
def path(self) -> Optional[pulumi.Input[
|
|
737
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
707
738
|
"""
|
|
708
739
|
Path to mount the JWT/OIDC auth backend
|
|
709
740
|
"""
|
|
710
741
|
return pulumi.get(self, "path")
|
|
711
742
|
|
|
712
743
|
@path.setter
|
|
713
|
-
def path(self, value: Optional[pulumi.Input[
|
|
744
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
714
745
|
pulumi.set(self, "path", value)
|
|
715
746
|
|
|
716
|
-
@property
|
|
747
|
+
@_builtins.property
|
|
717
748
|
@pulumi.getter(name="providerConfig")
|
|
718
|
-
def provider_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
749
|
+
def provider_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
719
750
|
"""
|
|
720
751
|
Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
721
752
|
"""
|
|
722
753
|
return pulumi.get(self, "provider_config")
|
|
723
754
|
|
|
724
755
|
@provider_config.setter
|
|
725
|
-
def provider_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
756
|
+
def provider_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
726
757
|
pulumi.set(self, "provider_config", value)
|
|
727
758
|
|
|
728
|
-
@property
|
|
759
|
+
@_builtins.property
|
|
729
760
|
@pulumi.getter
|
|
730
761
|
def tune(self) -> Optional[pulumi.Input['AuthBackendTuneArgs']]:
|
|
731
762
|
return pulumi.get(self, "tune")
|
|
@@ -734,16 +765,16 @@ class _AuthBackendState:
|
|
|
734
765
|
def tune(self, value: Optional[pulumi.Input['AuthBackendTuneArgs']]):
|
|
735
766
|
pulumi.set(self, "tune", value)
|
|
736
767
|
|
|
737
|
-
@property
|
|
768
|
+
@_builtins.property
|
|
738
769
|
@pulumi.getter
|
|
739
|
-
def type(self) -> Optional[pulumi.Input[
|
|
770
|
+
def type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
740
771
|
"""
|
|
741
772
|
Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
742
773
|
"""
|
|
743
774
|
return pulumi.get(self, "type")
|
|
744
775
|
|
|
745
776
|
@type.setter
|
|
746
|
-
def type(self, value: Optional[pulumi.Input[
|
|
777
|
+
def type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
747
778
|
pulumi.set(self, "type", value)
|
|
748
779
|
|
|
749
780
|
|
|
@@ -753,27 +784,28 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
753
784
|
def __init__(__self__,
|
|
754
785
|
resource_name: str,
|
|
755
786
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
756
|
-
bound_issuer: Optional[pulumi.Input[
|
|
757
|
-
default_role: Optional[pulumi.Input[
|
|
758
|
-
description: Optional[pulumi.Input[
|
|
759
|
-
disable_remount: Optional[pulumi.Input[
|
|
760
|
-
jwks_ca_pem: Optional[pulumi.Input[
|
|
761
|
-
|
|
762
|
-
|
|
763
|
-
|
|
764
|
-
|
|
765
|
-
|
|
766
|
-
|
|
767
|
-
|
|
768
|
-
|
|
769
|
-
|
|
770
|
-
|
|
771
|
-
|
|
772
|
-
|
|
773
|
-
|
|
774
|
-
|
|
787
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
788
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
789
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
790
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
791
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
792
|
+
jwks_pairs: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]] = None,
|
|
793
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
794
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
795
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
796
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
797
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
798
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
799
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
800
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
801
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
802
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
803
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
804
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
805
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
806
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
775
807
|
tune: Optional[pulumi.Input[Union['AuthBackendTuneArgs', 'AuthBackendTuneArgsDict']]] = None,
|
|
776
|
-
type: Optional[pulumi.Input[
|
|
808
|
+
type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
777
809
|
__props__=None):
|
|
778
810
|
"""
|
|
779
811
|
Provides a resource for managing an
|
|
@@ -847,34 +879,35 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
847
879
|
|
|
848
880
|
:param str resource_name: The name of the resource.
|
|
849
881
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
850
|
-
:param pulumi.Input[
|
|
851
|
-
:param pulumi.Input[
|
|
852
|
-
:param pulumi.Input[
|
|
853
|
-
:param pulumi.Input[
|
|
882
|
+
:param pulumi.Input[_builtins.str] bound_issuer: The value against which to match the iss claim in a JWT
|
|
883
|
+
:param pulumi.Input[_builtins.str] default_role: The default role to use if none is provided during login
|
|
884
|
+
:param pulumi.Input[_builtins.str] description: The description of the auth backend
|
|
885
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
854
886
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
855
|
-
:param pulumi.Input[
|
|
856
|
-
:param pulumi.Input[
|
|
857
|
-
:param pulumi.Input[
|
|
858
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
859
|
-
:param pulumi.Input[
|
|
860
|
-
:param pulumi.Input[
|
|
887
|
+
:param pulumi.Input[_builtins.str] jwks_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
888
|
+
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]] jwks_pairs: List of JWKS URL and optional CA certificate pairs. Cannot be used with `jwks_url` or `jwks_ca_pem`. Requires Vault 1.16+.
|
|
889
|
+
:param pulumi.Input[_builtins.str] jwks_url: JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
890
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_supported_algs: A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
891
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_validation_pubkeys: A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
892
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
893
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
861
894
|
The value should not contain leading or trailing forward slashes.
|
|
862
895
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
863
896
|
*Available only for Vault Enterprise*.
|
|
864
|
-
:param pulumi.Input[
|
|
897
|
+
:param pulumi.Input[_builtins.bool] namespace_in_state: Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
865
898
|
|
|
866
899
|
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
867
900
|
|
|
868
901
|
The `tune` block is used to tune the auth backend:
|
|
869
|
-
:param pulumi.Input[
|
|
870
|
-
:param pulumi.Input[
|
|
871
|
-
:param pulumi.Input[
|
|
872
|
-
:param pulumi.Input[
|
|
873
|
-
:param pulumi.Input[
|
|
874
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
875
|
-
:param pulumi.Input[
|
|
876
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
877
|
-
:param pulumi.Input[
|
|
902
|
+
:param pulumi.Input[_builtins.str] oidc_client_id: Client ID used for OIDC backends
|
|
903
|
+
:param pulumi.Input[_builtins.str] oidc_client_secret: Client Secret used for OIDC backends
|
|
904
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
905
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_url: The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
906
|
+
:param pulumi.Input[_builtins.str] oidc_response_mode: The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
907
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] oidc_response_types: List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
908
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the JWT/OIDC auth backend
|
|
909
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] provider_config: Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
910
|
+
:param pulumi.Input[_builtins.str] type: Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
878
911
|
"""
|
|
879
912
|
...
|
|
880
913
|
@overload
|
|
@@ -967,27 +1000,28 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
967
1000
|
def _internal_init(__self__,
|
|
968
1001
|
resource_name: str,
|
|
969
1002
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
970
|
-
bound_issuer: Optional[pulumi.Input[
|
|
971
|
-
default_role: Optional[pulumi.Input[
|
|
972
|
-
description: Optional[pulumi.Input[
|
|
973
|
-
disable_remount: Optional[pulumi.Input[
|
|
974
|
-
jwks_ca_pem: Optional[pulumi.Input[
|
|
975
|
-
|
|
976
|
-
|
|
977
|
-
|
|
978
|
-
|
|
979
|
-
|
|
980
|
-
|
|
981
|
-
|
|
982
|
-
|
|
983
|
-
|
|
984
|
-
|
|
985
|
-
|
|
986
|
-
|
|
987
|
-
|
|
988
|
-
|
|
1003
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1004
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1005
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1006
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1007
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1008
|
+
jwks_pairs: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]] = None,
|
|
1009
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1010
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1011
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1012
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1013
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1014
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1015
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1016
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1017
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1018
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1019
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1020
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1021
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1022
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
989
1023
|
tune: Optional[pulumi.Input[Union['AuthBackendTuneArgs', 'AuthBackendTuneArgsDict']]] = None,
|
|
990
|
-
type: Optional[pulumi.Input[
|
|
1024
|
+
type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
991
1025
|
__props__=None):
|
|
992
1026
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
993
1027
|
if not isinstance(opts, pulumi.ResourceOptions):
|
|
@@ -1002,6 +1036,7 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
1002
1036
|
__props__.__dict__["description"] = description
|
|
1003
1037
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
1004
1038
|
__props__.__dict__["jwks_ca_pem"] = jwks_ca_pem
|
|
1039
|
+
__props__.__dict__["jwks_pairs"] = jwks_pairs
|
|
1005
1040
|
__props__.__dict__["jwks_url"] = jwks_url
|
|
1006
1041
|
__props__.__dict__["jwt_supported_algs"] = jwt_supported_algs
|
|
1007
1042
|
__props__.__dict__["jwt_validation_pubkeys"] = jwt_validation_pubkeys
|
|
@@ -1031,28 +1066,29 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
1031
1066
|
def get(resource_name: str,
|
|
1032
1067
|
id: pulumi.Input[str],
|
|
1033
1068
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1034
|
-
accessor: Optional[pulumi.Input[
|
|
1035
|
-
bound_issuer: Optional[pulumi.Input[
|
|
1036
|
-
default_role: Optional[pulumi.Input[
|
|
1037
|
-
description: Optional[pulumi.Input[
|
|
1038
|
-
disable_remount: Optional[pulumi.Input[
|
|
1039
|
-
jwks_ca_pem: Optional[pulumi.Input[
|
|
1040
|
-
|
|
1041
|
-
|
|
1042
|
-
|
|
1043
|
-
|
|
1044
|
-
|
|
1045
|
-
|
|
1046
|
-
|
|
1047
|
-
|
|
1048
|
-
|
|
1049
|
-
|
|
1050
|
-
|
|
1051
|
-
|
|
1052
|
-
|
|
1053
|
-
|
|
1069
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1070
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1071
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1072
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1073
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1074
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1075
|
+
jwks_pairs: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]] = None,
|
|
1076
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1077
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1078
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1079
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1080
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1081
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1082
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1083
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1084
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1085
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1086
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1087
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1088
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1089
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1054
1090
|
tune: Optional[pulumi.Input[Union['AuthBackendTuneArgs', 'AuthBackendTuneArgsDict']]] = None,
|
|
1055
|
-
type: Optional[pulumi.Input[
|
|
1091
|
+
type: Optional[pulumi.Input[_builtins.str]] = None) -> 'AuthBackend':
|
|
1056
1092
|
"""
|
|
1057
1093
|
Get an existing AuthBackend resource's state with the given name, id, and optional extra
|
|
1058
1094
|
properties used to qualify the lookup.
|
|
@@ -1060,35 +1096,36 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
1060
1096
|
:param str resource_name: The unique name of the resulting resource.
|
|
1061
1097
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
1062
1098
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1063
|
-
:param pulumi.Input[
|
|
1064
|
-
:param pulumi.Input[
|
|
1065
|
-
:param pulumi.Input[
|
|
1066
|
-
:param pulumi.Input[
|
|
1067
|
-
:param pulumi.Input[
|
|
1099
|
+
:param pulumi.Input[_builtins.str] accessor: The accessor for this auth method
|
|
1100
|
+
:param pulumi.Input[_builtins.str] bound_issuer: The value against which to match the iss claim in a JWT
|
|
1101
|
+
:param pulumi.Input[_builtins.str] default_role: The default role to use if none is provided during login
|
|
1102
|
+
:param pulumi.Input[_builtins.str] description: The description of the auth backend
|
|
1103
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
1068
1104
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1069
|
-
:param pulumi.Input[
|
|
1070
|
-
:param pulumi.Input[
|
|
1071
|
-
:param pulumi.Input[
|
|
1072
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
1073
|
-
:param pulumi.Input[
|
|
1074
|
-
:param pulumi.Input[
|
|
1105
|
+
:param pulumi.Input[_builtins.str] jwks_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
1106
|
+
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]] jwks_pairs: List of JWKS URL and optional CA certificate pairs. Cannot be used with `jwks_url` or `jwks_ca_pem`. Requires Vault 1.16+.
|
|
1107
|
+
:param pulumi.Input[_builtins.str] jwks_url: JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
1108
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_supported_algs: A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
1109
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_validation_pubkeys: A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
1110
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
1111
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
1075
1112
|
The value should not contain leading or trailing forward slashes.
|
|
1076
1113
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
1077
1114
|
*Available only for Vault Enterprise*.
|
|
1078
|
-
:param pulumi.Input[
|
|
1115
|
+
:param pulumi.Input[_builtins.bool] namespace_in_state: Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
1079
1116
|
|
|
1080
1117
|
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
1081
1118
|
|
|
1082
1119
|
The `tune` block is used to tune the auth backend:
|
|
1083
|
-
:param pulumi.Input[
|
|
1084
|
-
:param pulumi.Input[
|
|
1085
|
-
:param pulumi.Input[
|
|
1086
|
-
:param pulumi.Input[
|
|
1087
|
-
:param pulumi.Input[
|
|
1088
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
1089
|
-
:param pulumi.Input[
|
|
1090
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
1091
|
-
:param pulumi.Input[
|
|
1120
|
+
:param pulumi.Input[_builtins.str] oidc_client_id: Client ID used for OIDC backends
|
|
1121
|
+
:param pulumi.Input[_builtins.str] oidc_client_secret: Client Secret used for OIDC backends
|
|
1122
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
1123
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_url: The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
1124
|
+
:param pulumi.Input[_builtins.str] oidc_response_mode: The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
1125
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] oidc_response_types: List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
1126
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the JWT/OIDC auth backend
|
|
1127
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] provider_config: Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
1128
|
+
:param pulumi.Input[_builtins.str] type: Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
1092
1129
|
"""
|
|
1093
1130
|
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
1094
1131
|
|
|
@@ -1100,6 +1137,7 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
1100
1137
|
__props__.__dict__["description"] = description
|
|
1101
1138
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
1102
1139
|
__props__.__dict__["jwks_ca_pem"] = jwks_ca_pem
|
|
1140
|
+
__props__.__dict__["jwks_pairs"] = jwks_pairs
|
|
1103
1141
|
__props__.__dict__["jwks_url"] = jwks_url
|
|
1104
1142
|
__props__.__dict__["jwt_supported_algs"] = jwt_supported_algs
|
|
1105
1143
|
__props__.__dict__["jwt_validation_pubkeys"] = jwt_validation_pubkeys
|
|
@@ -1118,90 +1156,98 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
1118
1156
|
__props__.__dict__["type"] = type
|
|
1119
1157
|
return AuthBackend(resource_name, opts=opts, __props__=__props__)
|
|
1120
1158
|
|
|
1121
|
-
@property
|
|
1159
|
+
@_builtins.property
|
|
1122
1160
|
@pulumi.getter
|
|
1123
|
-
def accessor(self) -> pulumi.Output[
|
|
1161
|
+
def accessor(self) -> pulumi.Output[_builtins.str]:
|
|
1124
1162
|
"""
|
|
1125
1163
|
The accessor for this auth method
|
|
1126
1164
|
"""
|
|
1127
1165
|
return pulumi.get(self, "accessor")
|
|
1128
1166
|
|
|
1129
|
-
@property
|
|
1167
|
+
@_builtins.property
|
|
1130
1168
|
@pulumi.getter(name="boundIssuer")
|
|
1131
|
-
def bound_issuer(self) -> pulumi.Output[Optional[
|
|
1169
|
+
def bound_issuer(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1132
1170
|
"""
|
|
1133
1171
|
The value against which to match the iss claim in a JWT
|
|
1134
1172
|
"""
|
|
1135
1173
|
return pulumi.get(self, "bound_issuer")
|
|
1136
1174
|
|
|
1137
|
-
@property
|
|
1175
|
+
@_builtins.property
|
|
1138
1176
|
@pulumi.getter(name="defaultRole")
|
|
1139
|
-
def default_role(self) -> pulumi.Output[Optional[
|
|
1177
|
+
def default_role(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1140
1178
|
"""
|
|
1141
1179
|
The default role to use if none is provided during login
|
|
1142
1180
|
"""
|
|
1143
1181
|
return pulumi.get(self, "default_role")
|
|
1144
1182
|
|
|
1145
|
-
@property
|
|
1183
|
+
@_builtins.property
|
|
1146
1184
|
@pulumi.getter
|
|
1147
|
-
def description(self) -> pulumi.Output[Optional[
|
|
1185
|
+
def description(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1148
1186
|
"""
|
|
1149
1187
|
The description of the auth backend
|
|
1150
1188
|
"""
|
|
1151
1189
|
return pulumi.get(self, "description")
|
|
1152
1190
|
|
|
1153
|
-
@property
|
|
1191
|
+
@_builtins.property
|
|
1154
1192
|
@pulumi.getter(name="disableRemount")
|
|
1155
|
-
def disable_remount(self) -> pulumi.Output[Optional[
|
|
1193
|
+
def disable_remount(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1156
1194
|
"""
|
|
1157
1195
|
If set, opts out of mount migration on path updates.
|
|
1158
1196
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1159
1197
|
"""
|
|
1160
1198
|
return pulumi.get(self, "disable_remount")
|
|
1161
1199
|
|
|
1162
|
-
@property
|
|
1200
|
+
@_builtins.property
|
|
1163
1201
|
@pulumi.getter(name="jwksCaPem")
|
|
1164
|
-
def jwks_ca_pem(self) -> pulumi.Output[Optional[
|
|
1202
|
+
def jwks_ca_pem(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1165
1203
|
"""
|
|
1166
1204
|
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
1167
1205
|
"""
|
|
1168
1206
|
return pulumi.get(self, "jwks_ca_pem")
|
|
1169
1207
|
|
|
1170
|
-
@property
|
|
1208
|
+
@_builtins.property
|
|
1209
|
+
@pulumi.getter(name="jwksPairs")
|
|
1210
|
+
def jwks_pairs(self) -> pulumi.Output[Optional[Sequence[Mapping[str, _builtins.str]]]]:
|
|
1211
|
+
"""
|
|
1212
|
+
List of JWKS URL and optional CA certificate pairs. Cannot be used with `jwks_url` or `jwks_ca_pem`. Requires Vault 1.16+.
|
|
1213
|
+
"""
|
|
1214
|
+
return pulumi.get(self, "jwks_pairs")
|
|
1215
|
+
|
|
1216
|
+
@_builtins.property
|
|
1171
1217
|
@pulumi.getter(name="jwksUrl")
|
|
1172
|
-
def jwks_url(self) -> pulumi.Output[Optional[
|
|
1218
|
+
def jwks_url(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1173
1219
|
"""
|
|
1174
1220
|
JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
1175
1221
|
"""
|
|
1176
1222
|
return pulumi.get(self, "jwks_url")
|
|
1177
1223
|
|
|
1178
|
-
@property
|
|
1224
|
+
@_builtins.property
|
|
1179
1225
|
@pulumi.getter(name="jwtSupportedAlgs")
|
|
1180
|
-
def jwt_supported_algs(self) -> pulumi.Output[Optional[Sequence[
|
|
1226
|
+
def jwt_supported_algs(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1181
1227
|
"""
|
|
1182
1228
|
A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
1183
1229
|
"""
|
|
1184
1230
|
return pulumi.get(self, "jwt_supported_algs")
|
|
1185
1231
|
|
|
1186
|
-
@property
|
|
1232
|
+
@_builtins.property
|
|
1187
1233
|
@pulumi.getter(name="jwtValidationPubkeys")
|
|
1188
|
-
def jwt_validation_pubkeys(self) -> pulumi.Output[Optional[Sequence[
|
|
1234
|
+
def jwt_validation_pubkeys(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1189
1235
|
"""
|
|
1190
1236
|
A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
1191
1237
|
"""
|
|
1192
1238
|
return pulumi.get(self, "jwt_validation_pubkeys")
|
|
1193
1239
|
|
|
1194
|
-
@property
|
|
1240
|
+
@_builtins.property
|
|
1195
1241
|
@pulumi.getter
|
|
1196
|
-
def local(self) -> pulumi.Output[Optional[
|
|
1242
|
+
def local(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1197
1243
|
"""
|
|
1198
1244
|
Specifies if the auth method is local only.
|
|
1199
1245
|
"""
|
|
1200
1246
|
return pulumi.get(self, "local")
|
|
1201
1247
|
|
|
1202
|
-
@property
|
|
1248
|
+
@_builtins.property
|
|
1203
1249
|
@pulumi.getter
|
|
1204
|
-
def namespace(self) -> pulumi.Output[Optional[
|
|
1250
|
+
def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1205
1251
|
"""
|
|
1206
1252
|
The namespace to provision the resource in.
|
|
1207
1253
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -1210,9 +1256,9 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
1210
1256
|
"""
|
|
1211
1257
|
return pulumi.get(self, "namespace")
|
|
1212
1258
|
|
|
1213
|
-
@property
|
|
1259
|
+
@_builtins.property
|
|
1214
1260
|
@pulumi.getter(name="namespaceInState")
|
|
1215
|
-
def namespace_in_state(self) -> pulumi.Output[Optional[
|
|
1261
|
+
def namespace_in_state(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1216
1262
|
"""
|
|
1217
1263
|
Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
1218
1264
|
|
|
@@ -1222,78 +1268,78 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
1222
1268
|
"""
|
|
1223
1269
|
return pulumi.get(self, "namespace_in_state")
|
|
1224
1270
|
|
|
1225
|
-
@property
|
|
1271
|
+
@_builtins.property
|
|
1226
1272
|
@pulumi.getter(name="oidcClientId")
|
|
1227
|
-
def oidc_client_id(self) -> pulumi.Output[Optional[
|
|
1273
|
+
def oidc_client_id(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1228
1274
|
"""
|
|
1229
1275
|
Client ID used for OIDC backends
|
|
1230
1276
|
"""
|
|
1231
1277
|
return pulumi.get(self, "oidc_client_id")
|
|
1232
1278
|
|
|
1233
|
-
@property
|
|
1279
|
+
@_builtins.property
|
|
1234
1280
|
@pulumi.getter(name="oidcClientSecret")
|
|
1235
|
-
def oidc_client_secret(self) -> pulumi.Output[Optional[
|
|
1281
|
+
def oidc_client_secret(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1236
1282
|
"""
|
|
1237
1283
|
Client Secret used for OIDC backends
|
|
1238
1284
|
"""
|
|
1239
1285
|
return pulumi.get(self, "oidc_client_secret")
|
|
1240
1286
|
|
|
1241
|
-
@property
|
|
1287
|
+
@_builtins.property
|
|
1242
1288
|
@pulumi.getter(name="oidcDiscoveryCaPem")
|
|
1243
|
-
def oidc_discovery_ca_pem(self) -> pulumi.Output[Optional[
|
|
1289
|
+
def oidc_discovery_ca_pem(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1244
1290
|
"""
|
|
1245
1291
|
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
1246
1292
|
"""
|
|
1247
1293
|
return pulumi.get(self, "oidc_discovery_ca_pem")
|
|
1248
1294
|
|
|
1249
|
-
@property
|
|
1295
|
+
@_builtins.property
|
|
1250
1296
|
@pulumi.getter(name="oidcDiscoveryUrl")
|
|
1251
|
-
def oidc_discovery_url(self) -> pulumi.Output[Optional[
|
|
1297
|
+
def oidc_discovery_url(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1252
1298
|
"""
|
|
1253
1299
|
The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
1254
1300
|
"""
|
|
1255
1301
|
return pulumi.get(self, "oidc_discovery_url")
|
|
1256
1302
|
|
|
1257
|
-
@property
|
|
1303
|
+
@_builtins.property
|
|
1258
1304
|
@pulumi.getter(name="oidcResponseMode")
|
|
1259
|
-
def oidc_response_mode(self) -> pulumi.Output[Optional[
|
|
1305
|
+
def oidc_response_mode(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1260
1306
|
"""
|
|
1261
1307
|
The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
1262
1308
|
"""
|
|
1263
1309
|
return pulumi.get(self, "oidc_response_mode")
|
|
1264
1310
|
|
|
1265
|
-
@property
|
|
1311
|
+
@_builtins.property
|
|
1266
1312
|
@pulumi.getter(name="oidcResponseTypes")
|
|
1267
|
-
def oidc_response_types(self) -> pulumi.Output[Optional[Sequence[
|
|
1313
|
+
def oidc_response_types(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1268
1314
|
"""
|
|
1269
1315
|
List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
1270
1316
|
"""
|
|
1271
1317
|
return pulumi.get(self, "oidc_response_types")
|
|
1272
1318
|
|
|
1273
|
-
@property
|
|
1319
|
+
@_builtins.property
|
|
1274
1320
|
@pulumi.getter
|
|
1275
|
-
def path(self) -> pulumi.Output[Optional[
|
|
1321
|
+
def path(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1276
1322
|
"""
|
|
1277
1323
|
Path to mount the JWT/OIDC auth backend
|
|
1278
1324
|
"""
|
|
1279
1325
|
return pulumi.get(self, "path")
|
|
1280
1326
|
|
|
1281
|
-
@property
|
|
1327
|
+
@_builtins.property
|
|
1282
1328
|
@pulumi.getter(name="providerConfig")
|
|
1283
|
-
def provider_config(self) -> pulumi.Output[Optional[Mapping[str,
|
|
1329
|
+
def provider_config(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
|
|
1284
1330
|
"""
|
|
1285
1331
|
Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
1286
1332
|
"""
|
|
1287
1333
|
return pulumi.get(self, "provider_config")
|
|
1288
1334
|
|
|
1289
|
-
@property
|
|
1335
|
+
@_builtins.property
|
|
1290
1336
|
@pulumi.getter
|
|
1291
1337
|
def tune(self) -> pulumi.Output['outputs.AuthBackendTune']:
|
|
1292
1338
|
return pulumi.get(self, "tune")
|
|
1293
1339
|
|
|
1294
|
-
@property
|
|
1340
|
+
@_builtins.property
|
|
1295
1341
|
@pulumi.getter
|
|
1296
|
-
def type(self) -> pulumi.Output[Optional[
|
|
1342
|
+
def type(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1297
1343
|
"""
|
|
1298
1344
|
Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
1299
1345
|
"""
|