pulumi-vault 7.2.0a1752907825__py3-none-any.whl → 7.2.0a1753398491__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +1 -1
- pulumi_vault/_inputs.py +672 -673
- pulumi_vault/ad/__init__.py +1 -1
- pulumi_vault/ad/get_access_credentials.py +27 -28
- pulumi_vault/ad/secret_backend.py +579 -580
- pulumi_vault/ad/secret_library.py +120 -121
- pulumi_vault/ad/secret_role.py +104 -105
- pulumi_vault/alicloud/__init__.py +1 -1
- pulumi_vault/alicloud/auth_backend_role.py +222 -223
- pulumi_vault/approle/__init__.py +1 -1
- pulumi_vault/approle/auth_backend_login.py +138 -139
- pulumi_vault/approle/auth_backend_role.py +292 -293
- pulumi_vault/approle/auth_backend_role_secret_id.py +202 -203
- pulumi_vault/approle/get_auth_backend_role_id.py +23 -24
- pulumi_vault/audit.py +103 -104
- pulumi_vault/audit_request_header.py +52 -53
- pulumi_vault/auth_backend.py +132 -133
- pulumi_vault/aws/__init__.py +1 -1
- pulumi_vault/aws/auth_backend_cert.py +86 -87
- pulumi_vault/aws/auth_backend_client.py +307 -308
- pulumi_vault/aws/auth_backend_config_identity.py +103 -104
- pulumi_vault/aws/auth_backend_identity_whitelist.py +69 -70
- pulumi_vault/aws/auth_backend_login.py +258 -259
- pulumi_vault/aws/auth_backend_role.py +486 -487
- pulumi_vault/aws/auth_backend_role_tag.py +155 -156
- pulumi_vault/aws/auth_backend_roletag_blacklist.py +69 -70
- pulumi_vault/aws/auth_backend_sts_role.py +86 -87
- pulumi_vault/aws/get_access_credentials.py +59 -60
- pulumi_vault/aws/get_static_access_credentials.py +19 -20
- pulumi_vault/aws/secret_backend.py +409 -410
- pulumi_vault/aws/secret_backend_role.py +256 -257
- pulumi_vault/aws/secret_backend_static_role.py +137 -138
- pulumi_vault/azure/__init__.py +1 -1
- pulumi_vault/azure/_inputs.py +26 -27
- pulumi_vault/azure/auth_backend_config.py +222 -223
- pulumi_vault/azure/auth_backend_role.py +307 -308
- pulumi_vault/azure/backend.py +273 -274
- pulumi_vault/azure/backend_role.py +194 -195
- pulumi_vault/azure/get_access_credentials.py +75 -76
- pulumi_vault/azure/outputs.py +16 -17
- pulumi_vault/cert_auth_backend_role.py +443 -444
- pulumi_vault/config/__init__.py +1 -1
- pulumi_vault/config/__init__.pyi +1 -2
- pulumi_vault/config/_inputs.py +13 -14
- pulumi_vault/config/outputs.py +380 -381
- pulumi_vault/config/ui_custom_message.py +140 -141
- pulumi_vault/config/vars.py +31 -32
- pulumi_vault/consul/__init__.py +1 -1
- pulumi_vault/consul/secret_backend.py +239 -240
- pulumi_vault/consul/secret_backend_role.py +222 -223
- pulumi_vault/database/__init__.py +1 -1
- pulumi_vault/database/_inputs.py +3167 -3168
- pulumi_vault/database/outputs.py +2123 -2124
- pulumi_vault/database/secret_backend_connection.py +259 -260
- pulumi_vault/database/secret_backend_role.py +205 -206
- pulumi_vault/database/secret_backend_static_role.py +218 -219
- pulumi_vault/database/secrets_mount.py +379 -380
- pulumi_vault/egp_policy.py +86 -87
- pulumi_vault/gcp/__init__.py +1 -1
- pulumi_vault/gcp/_inputs.py +98 -99
- pulumi_vault/gcp/auth_backend.py +322 -323
- pulumi_vault/gcp/auth_backend_role.py +347 -348
- pulumi_vault/gcp/get_auth_backend_role.py +91 -92
- pulumi_vault/gcp/outputs.py +66 -67
- pulumi_vault/gcp/secret_backend.py +299 -300
- pulumi_vault/gcp/secret_impersonated_account.py +112 -113
- pulumi_vault/gcp/secret_roleset.py +115 -116
- pulumi_vault/gcp/secret_static_account.py +115 -116
- pulumi_vault/generic/__init__.py +1 -1
- pulumi_vault/generic/endpoint.py +138 -139
- pulumi_vault/generic/get_secret.py +39 -40
- pulumi_vault/generic/secret.py +95 -96
- pulumi_vault/get_auth_backend.py +29 -30
- pulumi_vault/get_auth_backends.py +19 -20
- pulumi_vault/get_namespace.py +21 -22
- pulumi_vault/get_namespaces.py +19 -20
- pulumi_vault/get_nomad_access_token.py +25 -26
- pulumi_vault/get_policy_document.py +10 -11
- pulumi_vault/get_raft_autopilot_state.py +31 -32
- pulumi_vault/github/__init__.py +1 -1
- pulumi_vault/github/_inputs.py +50 -51
- pulumi_vault/github/auth_backend.py +285 -286
- pulumi_vault/github/outputs.py +34 -35
- pulumi_vault/github/team.py +69 -70
- pulumi_vault/github/user.py +69 -70
- pulumi_vault/identity/__init__.py +1 -1
- pulumi_vault/identity/entity.py +103 -104
- pulumi_vault/identity/entity_alias.py +86 -87
- pulumi_vault/identity/entity_policies.py +78 -79
- pulumi_vault/identity/get_entity.py +62 -63
- pulumi_vault/identity/get_group.py +75 -76
- pulumi_vault/identity/get_oidc_client_creds.py +19 -20
- pulumi_vault/identity/get_oidc_openid_config.py +39 -40
- pulumi_vault/identity/get_oidc_public_keys.py +17 -18
- pulumi_vault/identity/group.py +171 -172
- pulumi_vault/identity/group_alias.py +69 -70
- pulumi_vault/identity/group_member_entity_ids.py +69 -70
- pulumi_vault/identity/group_member_group_ids.py +69 -70
- pulumi_vault/identity/group_policies.py +78 -79
- pulumi_vault/identity/mfa_duo.py +183 -184
- pulumi_vault/identity/mfa_login_enforcement.py +147 -148
- pulumi_vault/identity/mfa_okta.py +166 -167
- pulumi_vault/identity/mfa_pingid.py +160 -161
- pulumi_vault/identity/mfa_totp.py +217 -218
- pulumi_vault/identity/oidc.py +35 -36
- pulumi_vault/identity/oidc_assignment.py +69 -70
- pulumi_vault/identity/oidc_client.py +155 -156
- pulumi_vault/identity/oidc_key.py +103 -104
- pulumi_vault/identity/oidc_key_allowed_client_id.py +52 -53
- pulumi_vault/identity/oidc_provider.py +112 -113
- pulumi_vault/identity/oidc_role.py +103 -104
- pulumi_vault/identity/oidc_scope.py +69 -70
- pulumi_vault/identity/outputs.py +42 -43
- pulumi_vault/jwt/__init__.py +1 -1
- pulumi_vault/jwt/_inputs.py +50 -51
- pulumi_vault/jwt/auth_backend.py +353 -354
- pulumi_vault/jwt/auth_backend_role.py +494 -495
- pulumi_vault/jwt/outputs.py +34 -35
- pulumi_vault/kmip/__init__.py +1 -1
- pulumi_vault/kmip/secret_backend.py +222 -223
- pulumi_vault/kmip/secret_role.py +358 -359
- pulumi_vault/kmip/secret_scope.py +69 -70
- pulumi_vault/kubernetes/__init__.py +1 -1
- pulumi_vault/kubernetes/auth_backend_config.py +171 -172
- pulumi_vault/kubernetes/auth_backend_role.py +273 -274
- pulumi_vault/kubernetes/get_auth_backend_config.py +57 -58
- pulumi_vault/kubernetes/get_auth_backend_role.py +87 -88
- pulumi_vault/kubernetes/get_service_account_token.py +51 -52
- pulumi_vault/kubernetes/secret_backend.py +384 -385
- pulumi_vault/kubernetes/secret_backend_role.py +239 -240
- pulumi_vault/kv/__init__.py +1 -1
- pulumi_vault/kv/_inputs.py +25 -26
- pulumi_vault/kv/get_secret.py +25 -26
- pulumi_vault/kv/get_secret_subkeys_v2.py +39 -40
- pulumi_vault/kv/get_secret_v2.py +41 -42
- pulumi_vault/kv/get_secrets_list.py +17 -18
- pulumi_vault/kv/get_secrets_list_v2.py +25 -26
- pulumi_vault/kv/outputs.py +17 -18
- pulumi_vault/kv/secret.py +61 -62
- pulumi_vault/kv/secret_backend_v2.py +86 -87
- pulumi_vault/kv/secret_v2.py +184 -185
- pulumi_vault/ldap/__init__.py +1 -1
- pulumi_vault/ldap/auth_backend.py +716 -717
- pulumi_vault/ldap/auth_backend_group.py +69 -70
- pulumi_vault/ldap/auth_backend_user.py +86 -87
- pulumi_vault/ldap/get_dynamic_credentials.py +27 -28
- pulumi_vault/ldap/get_static_credentials.py +29 -30
- pulumi_vault/ldap/secret_backend.py +673 -674
- pulumi_vault/ldap/secret_backend_dynamic_role.py +154 -155
- pulumi_vault/ldap/secret_backend_library_set.py +120 -121
- pulumi_vault/ldap/secret_backend_static_role.py +120 -121
- pulumi_vault/managed/__init__.py +1 -1
- pulumi_vault/managed/_inputs.py +274 -275
- pulumi_vault/managed/keys.py +27 -28
- pulumi_vault/managed/outputs.py +184 -185
- pulumi_vault/mfa_duo.py +137 -138
- pulumi_vault/mfa_okta.py +137 -138
- pulumi_vault/mfa_pingid.py +149 -150
- pulumi_vault/mfa_totp.py +154 -155
- pulumi_vault/mongodbatlas/__init__.py +1 -1
- pulumi_vault/mongodbatlas/secret_backend.py +78 -79
- pulumi_vault/mongodbatlas/secret_role.py +188 -189
- pulumi_vault/mount.py +333 -334
- pulumi_vault/namespace.py +78 -79
- pulumi_vault/nomad_secret_backend.py +256 -257
- pulumi_vault/nomad_secret_role.py +103 -104
- pulumi_vault/okta/__init__.py +1 -1
- pulumi_vault/okta/_inputs.py +31 -32
- pulumi_vault/okta/auth_backend.py +305 -306
- pulumi_vault/okta/auth_backend_group.py +69 -70
- pulumi_vault/okta/auth_backend_user.py +86 -87
- pulumi_vault/okta/outputs.py +21 -22
- pulumi_vault/outputs.py +81 -82
- pulumi_vault/pkisecret/__init__.py +1 -1
- pulumi_vault/pkisecret/_inputs.py +55 -56
- pulumi_vault/pkisecret/backend_acme_eab.py +116 -117
- pulumi_vault/pkisecret/backend_config_acme.py +175 -176
- pulumi_vault/pkisecret/backend_config_auto_tidy.py +394 -395
- pulumi_vault/pkisecret/backend_config_cluster.py +71 -72
- pulumi_vault/pkisecret/backend_config_cmpv2.py +132 -133
- pulumi_vault/pkisecret/backend_config_est.py +149 -150
- pulumi_vault/pkisecret/backend_config_scep.py +137 -138
- pulumi_vault/pkisecret/get_backend_cert_metadata.py +37 -38
- pulumi_vault/pkisecret/get_backend_config_cmpv2.py +32 -33
- pulumi_vault/pkisecret/get_backend_config_est.py +30 -31
- pulumi_vault/pkisecret/get_backend_config_scep.py +29 -30
- pulumi_vault/pkisecret/get_backend_issuer.py +63 -64
- pulumi_vault/pkisecret/get_backend_issuers.py +23 -24
- pulumi_vault/pkisecret/get_backend_key.py +29 -30
- pulumi_vault/pkisecret/get_backend_keys.py +23 -24
- pulumi_vault/pkisecret/outputs.py +61 -62
- pulumi_vault/pkisecret/secret_backend_cert.py +415 -416
- pulumi_vault/pkisecret/secret_backend_config_ca.py +54 -55
- pulumi_vault/pkisecret/secret_backend_config_issuers.py +75 -76
- pulumi_vault/pkisecret/secret_backend_config_urls.py +105 -106
- pulumi_vault/pkisecret/secret_backend_crl_config.py +241 -242
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +515 -516
- pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +78 -79
- pulumi_vault/pkisecret/secret_backend_issuer.py +286 -287
- pulumi_vault/pkisecret/secret_backend_key.py +146 -147
- pulumi_vault/pkisecret/secret_backend_role.py +873 -874
- pulumi_vault/pkisecret/secret_backend_root_cert.py +677 -678
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +660 -661
- pulumi_vault/pkisecret/secret_backend_sign.py +346 -347
- pulumi_vault/plugin.py +154 -155
- pulumi_vault/plugin_pinned_version.py +52 -53
- pulumi_vault/policy.py +52 -53
- pulumi_vault/provider.py +160 -161
- pulumi_vault/pulumi-plugin.json +1 -1
- pulumi_vault/quota_lease_count.py +103 -104
- pulumi_vault/quota_rate_limit.py +171 -172
- pulumi_vault/rabbitmq/__init__.py +1 -1
- pulumi_vault/rabbitmq/_inputs.py +50 -51
- pulumi_vault/rabbitmq/outputs.py +34 -35
- pulumi_vault/rabbitmq/secret_backend.py +207 -208
- pulumi_vault/rabbitmq/secret_backend_role.py +79 -80
- pulumi_vault/raft_autopilot.py +137 -138
- pulumi_vault/raft_snapshot_agent_config.py +477 -478
- pulumi_vault/rgp_policy.py +69 -70
- pulumi_vault/saml/__init__.py +1 -1
- pulumi_vault/saml/auth_backend.py +188 -189
- pulumi_vault/saml/auth_backend_role.py +290 -291
- pulumi_vault/scep_auth_backend_role.py +252 -253
- pulumi_vault/secrets/__init__.py +1 -1
- pulumi_vault/secrets/_inputs.py +19 -20
- pulumi_vault/secrets/outputs.py +13 -14
- pulumi_vault/secrets/sync_association.py +88 -89
- pulumi_vault/secrets/sync_aws_destination.py +180 -181
- pulumi_vault/secrets/sync_azure_destination.py +180 -181
- pulumi_vault/secrets/sync_config.py +52 -53
- pulumi_vault/secrets/sync_gcp_destination.py +129 -130
- pulumi_vault/secrets/sync_gh_destination.py +163 -164
- pulumi_vault/secrets/sync_github_apps.py +78 -79
- pulumi_vault/secrets/sync_vercel_destination.py +146 -147
- pulumi_vault/ssh/__init__.py +1 -1
- pulumi_vault/ssh/_inputs.py +13 -14
- pulumi_vault/ssh/get_secret_backend_sign.py +65 -66
- pulumi_vault/ssh/outputs.py +9 -10
- pulumi_vault/ssh/secret_backend_ca.py +120 -121
- pulumi_vault/ssh/secret_backend_role.py +446 -447
- pulumi_vault/terraformcloud/__init__.py +1 -1
- pulumi_vault/terraformcloud/secret_backend.py +138 -139
- pulumi_vault/terraformcloud/secret_creds.py +93 -94
- pulumi_vault/terraformcloud/secret_role.py +117 -118
- pulumi_vault/token.py +301 -302
- pulumi_vault/tokenauth/__init__.py +1 -1
- pulumi_vault/tokenauth/auth_backend_role.py +324 -325
- pulumi_vault/transform/__init__.py +1 -1
- pulumi_vault/transform/alphabet.py +69 -70
- pulumi_vault/transform/get_decode.py +57 -58
- pulumi_vault/transform/get_encode.py +57 -58
- pulumi_vault/transform/role.py +69 -70
- pulumi_vault/transform/template.py +137 -138
- pulumi_vault/transform/transformation.py +171 -172
- pulumi_vault/transit/__init__.py +1 -1
- pulumi_vault/transit/get_cmac.py +47 -48
- pulumi_vault/transit/get_decrypt.py +25 -26
- pulumi_vault/transit/get_encrypt.py +29 -30
- pulumi_vault/transit/get_sign.py +71 -72
- pulumi_vault/transit/get_verify.py +83 -84
- pulumi_vault/transit/secret_backend_key.py +336 -337
- pulumi_vault/transit/secret_cache_config.py +52 -53
- {pulumi_vault-7.2.0a1752907825.dist-info → pulumi_vault-7.2.0a1753398491.dist-info}/METADATA +1 -1
- pulumi_vault-7.2.0a1753398491.dist-info/RECORD +268 -0
- pulumi_vault-7.2.0a1752907825.dist-info/RECORD +0 -268
- {pulumi_vault-7.2.0a1752907825.dist-info → pulumi_vault-7.2.0a1753398491.dist-info}/WHEEL +0 -0
- {pulumi_vault-7.2.0a1752907825.dist-info → pulumi_vault-7.2.0a1753398491.dist-info}/top_level.txt +0 -0
pulumi_vault/jwt/auth_backend.py
CHANGED
|
@@ -2,8 +2,7 @@
|
|
|
2
2
|
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
4
|
|
|
5
|
-
import builtins
|
|
6
|
-
import copy
|
|
5
|
+
import builtins as _builtins
|
|
7
6
|
import warnings
|
|
8
7
|
import sys
|
|
9
8
|
import pulumi
|
|
@@ -22,57 +21,57 @@ __all__ = ['AuthBackendArgs', 'AuthBackend']
|
|
|
22
21
|
@pulumi.input_type
|
|
23
22
|
class AuthBackendArgs:
|
|
24
23
|
def __init__(__self__, *,
|
|
25
|
-
bound_issuer: Optional[pulumi.Input[
|
|
26
|
-
default_role: Optional[pulumi.Input[
|
|
27
|
-
description: Optional[pulumi.Input[
|
|
28
|
-
disable_remount: Optional[pulumi.Input[
|
|
29
|
-
jwks_ca_pem: Optional[pulumi.Input[
|
|
30
|
-
jwks_url: Optional[pulumi.Input[
|
|
31
|
-
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
32
|
-
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
33
|
-
local: Optional[pulumi.Input[
|
|
34
|
-
namespace: Optional[pulumi.Input[
|
|
35
|
-
namespace_in_state: Optional[pulumi.Input[
|
|
36
|
-
oidc_client_id: Optional[pulumi.Input[
|
|
37
|
-
oidc_client_secret: Optional[pulumi.Input[
|
|
38
|
-
oidc_discovery_ca_pem: Optional[pulumi.Input[
|
|
39
|
-
oidc_discovery_url: Optional[pulumi.Input[
|
|
40
|
-
oidc_response_mode: Optional[pulumi.Input[
|
|
41
|
-
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
42
|
-
path: Optional[pulumi.Input[
|
|
43
|
-
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
24
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
25
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
26
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
27
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
28
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
29
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
30
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
31
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
32
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
33
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
34
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
35
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
36
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
37
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
38
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
39
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
40
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
41
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
42
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
44
43
|
tune: Optional[pulumi.Input['AuthBackendTuneArgs']] = None,
|
|
45
|
-
type: Optional[pulumi.Input[
|
|
44
|
+
type: Optional[pulumi.Input[_builtins.str]] = None):
|
|
46
45
|
"""
|
|
47
46
|
The set of arguments for constructing a AuthBackend resource.
|
|
48
|
-
:param pulumi.Input[
|
|
49
|
-
:param pulumi.Input[
|
|
50
|
-
:param pulumi.Input[
|
|
51
|
-
:param pulumi.Input[
|
|
47
|
+
:param pulumi.Input[_builtins.str] bound_issuer: The value against which to match the iss claim in a JWT
|
|
48
|
+
:param pulumi.Input[_builtins.str] default_role: The default role to use if none is provided during login
|
|
49
|
+
:param pulumi.Input[_builtins.str] description: The description of the auth backend
|
|
50
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
52
51
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
53
|
-
:param pulumi.Input[
|
|
54
|
-
:param pulumi.Input[
|
|
55
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
56
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
57
|
-
:param pulumi.Input[
|
|
58
|
-
:param pulumi.Input[
|
|
52
|
+
:param pulumi.Input[_builtins.str] jwks_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
53
|
+
:param pulumi.Input[_builtins.str] jwks_url: JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
54
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_supported_algs: A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
55
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_validation_pubkeys: A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
56
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
57
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
59
58
|
The value should not contain leading or trailing forward slashes.
|
|
60
59
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
61
60
|
*Available only for Vault Enterprise*.
|
|
62
|
-
:param pulumi.Input[
|
|
61
|
+
:param pulumi.Input[_builtins.bool] namespace_in_state: Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
63
62
|
|
|
64
63
|
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
65
64
|
|
|
66
65
|
The `tune` block is used to tune the auth backend:
|
|
67
|
-
:param pulumi.Input[
|
|
68
|
-
:param pulumi.Input[
|
|
69
|
-
:param pulumi.Input[
|
|
70
|
-
:param pulumi.Input[
|
|
71
|
-
:param pulumi.Input[
|
|
72
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
73
|
-
:param pulumi.Input[
|
|
74
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
75
|
-
:param pulumi.Input[
|
|
66
|
+
:param pulumi.Input[_builtins.str] oidc_client_id: Client ID used for OIDC backends
|
|
67
|
+
:param pulumi.Input[_builtins.str] oidc_client_secret: Client Secret used for OIDC backends
|
|
68
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
69
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_url: The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
70
|
+
:param pulumi.Input[_builtins.str] oidc_response_mode: The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
71
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] oidc_response_types: List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
72
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the JWT/OIDC auth backend
|
|
73
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] provider_config: Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
74
|
+
:param pulumi.Input[_builtins.str] type: Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
76
75
|
"""
|
|
77
76
|
if bound_issuer is not None:
|
|
78
77
|
pulumi.set(__self__, "bound_issuer", bound_issuer)
|
|
@@ -117,45 +116,45 @@ class AuthBackendArgs:
|
|
|
117
116
|
if type is not None:
|
|
118
117
|
pulumi.set(__self__, "type", type)
|
|
119
118
|
|
|
120
|
-
@property
|
|
119
|
+
@_builtins.property
|
|
121
120
|
@pulumi.getter(name="boundIssuer")
|
|
122
|
-
def bound_issuer(self) -> Optional[pulumi.Input[
|
|
121
|
+
def bound_issuer(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
123
122
|
"""
|
|
124
123
|
The value against which to match the iss claim in a JWT
|
|
125
124
|
"""
|
|
126
125
|
return pulumi.get(self, "bound_issuer")
|
|
127
126
|
|
|
128
127
|
@bound_issuer.setter
|
|
129
|
-
def bound_issuer(self, value: Optional[pulumi.Input[
|
|
128
|
+
def bound_issuer(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
130
129
|
pulumi.set(self, "bound_issuer", value)
|
|
131
130
|
|
|
132
|
-
@property
|
|
131
|
+
@_builtins.property
|
|
133
132
|
@pulumi.getter(name="defaultRole")
|
|
134
|
-
def default_role(self) -> Optional[pulumi.Input[
|
|
133
|
+
def default_role(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
135
134
|
"""
|
|
136
135
|
The default role to use if none is provided during login
|
|
137
136
|
"""
|
|
138
137
|
return pulumi.get(self, "default_role")
|
|
139
138
|
|
|
140
139
|
@default_role.setter
|
|
141
|
-
def default_role(self, value: Optional[pulumi.Input[
|
|
140
|
+
def default_role(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
142
141
|
pulumi.set(self, "default_role", value)
|
|
143
142
|
|
|
144
|
-
@property
|
|
143
|
+
@_builtins.property
|
|
145
144
|
@pulumi.getter
|
|
146
|
-
def description(self) -> Optional[pulumi.Input[
|
|
145
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
147
146
|
"""
|
|
148
147
|
The description of the auth backend
|
|
149
148
|
"""
|
|
150
149
|
return pulumi.get(self, "description")
|
|
151
150
|
|
|
152
151
|
@description.setter
|
|
153
|
-
def description(self, value: Optional[pulumi.Input[
|
|
152
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
154
153
|
pulumi.set(self, "description", value)
|
|
155
154
|
|
|
156
|
-
@property
|
|
155
|
+
@_builtins.property
|
|
157
156
|
@pulumi.getter(name="disableRemount")
|
|
158
|
-
def disable_remount(self) -> Optional[pulumi.Input[
|
|
157
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
159
158
|
"""
|
|
160
159
|
If set, opts out of mount migration on path updates.
|
|
161
160
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
@@ -163,72 +162,72 @@ class AuthBackendArgs:
|
|
|
163
162
|
return pulumi.get(self, "disable_remount")
|
|
164
163
|
|
|
165
164
|
@disable_remount.setter
|
|
166
|
-
def disable_remount(self, value: Optional[pulumi.Input[
|
|
165
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
167
166
|
pulumi.set(self, "disable_remount", value)
|
|
168
167
|
|
|
169
|
-
@property
|
|
168
|
+
@_builtins.property
|
|
170
169
|
@pulumi.getter(name="jwksCaPem")
|
|
171
|
-
def jwks_ca_pem(self) -> Optional[pulumi.Input[
|
|
170
|
+
def jwks_ca_pem(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
172
171
|
"""
|
|
173
172
|
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
174
173
|
"""
|
|
175
174
|
return pulumi.get(self, "jwks_ca_pem")
|
|
176
175
|
|
|
177
176
|
@jwks_ca_pem.setter
|
|
178
|
-
def jwks_ca_pem(self, value: Optional[pulumi.Input[
|
|
177
|
+
def jwks_ca_pem(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
179
178
|
pulumi.set(self, "jwks_ca_pem", value)
|
|
180
179
|
|
|
181
|
-
@property
|
|
180
|
+
@_builtins.property
|
|
182
181
|
@pulumi.getter(name="jwksUrl")
|
|
183
|
-
def jwks_url(self) -> Optional[pulumi.Input[
|
|
182
|
+
def jwks_url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
184
183
|
"""
|
|
185
184
|
JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
186
185
|
"""
|
|
187
186
|
return pulumi.get(self, "jwks_url")
|
|
188
187
|
|
|
189
188
|
@jwks_url.setter
|
|
190
|
-
def jwks_url(self, value: Optional[pulumi.Input[
|
|
189
|
+
def jwks_url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
191
190
|
pulumi.set(self, "jwks_url", value)
|
|
192
191
|
|
|
193
|
-
@property
|
|
192
|
+
@_builtins.property
|
|
194
193
|
@pulumi.getter(name="jwtSupportedAlgs")
|
|
195
|
-
def jwt_supported_algs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
194
|
+
def jwt_supported_algs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
196
195
|
"""
|
|
197
196
|
A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
198
197
|
"""
|
|
199
198
|
return pulumi.get(self, "jwt_supported_algs")
|
|
200
199
|
|
|
201
200
|
@jwt_supported_algs.setter
|
|
202
|
-
def jwt_supported_algs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
201
|
+
def jwt_supported_algs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
203
202
|
pulumi.set(self, "jwt_supported_algs", value)
|
|
204
203
|
|
|
205
|
-
@property
|
|
204
|
+
@_builtins.property
|
|
206
205
|
@pulumi.getter(name="jwtValidationPubkeys")
|
|
207
|
-
def jwt_validation_pubkeys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
206
|
+
def jwt_validation_pubkeys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
208
207
|
"""
|
|
209
208
|
A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
210
209
|
"""
|
|
211
210
|
return pulumi.get(self, "jwt_validation_pubkeys")
|
|
212
211
|
|
|
213
212
|
@jwt_validation_pubkeys.setter
|
|
214
|
-
def jwt_validation_pubkeys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
213
|
+
def jwt_validation_pubkeys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
215
214
|
pulumi.set(self, "jwt_validation_pubkeys", value)
|
|
216
215
|
|
|
217
|
-
@property
|
|
216
|
+
@_builtins.property
|
|
218
217
|
@pulumi.getter
|
|
219
|
-
def local(self) -> Optional[pulumi.Input[
|
|
218
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
220
219
|
"""
|
|
221
220
|
Specifies if the auth method is local only.
|
|
222
221
|
"""
|
|
223
222
|
return pulumi.get(self, "local")
|
|
224
223
|
|
|
225
224
|
@local.setter
|
|
226
|
-
def local(self, value: Optional[pulumi.Input[
|
|
225
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
227
226
|
pulumi.set(self, "local", value)
|
|
228
227
|
|
|
229
|
-
@property
|
|
228
|
+
@_builtins.property
|
|
230
229
|
@pulumi.getter
|
|
231
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
230
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
232
231
|
"""
|
|
233
232
|
The namespace to provision the resource in.
|
|
234
233
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -238,12 +237,12 @@ class AuthBackendArgs:
|
|
|
238
237
|
return pulumi.get(self, "namespace")
|
|
239
238
|
|
|
240
239
|
@namespace.setter
|
|
241
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
240
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
242
241
|
pulumi.set(self, "namespace", value)
|
|
243
242
|
|
|
244
|
-
@property
|
|
243
|
+
@_builtins.property
|
|
245
244
|
@pulumi.getter(name="namespaceInState")
|
|
246
|
-
def namespace_in_state(self) -> Optional[pulumi.Input[
|
|
245
|
+
def namespace_in_state(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
247
246
|
"""
|
|
248
247
|
Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
249
248
|
|
|
@@ -254,106 +253,106 @@ class AuthBackendArgs:
|
|
|
254
253
|
return pulumi.get(self, "namespace_in_state")
|
|
255
254
|
|
|
256
255
|
@namespace_in_state.setter
|
|
257
|
-
def namespace_in_state(self, value: Optional[pulumi.Input[
|
|
256
|
+
def namespace_in_state(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
258
257
|
pulumi.set(self, "namespace_in_state", value)
|
|
259
258
|
|
|
260
|
-
@property
|
|
259
|
+
@_builtins.property
|
|
261
260
|
@pulumi.getter(name="oidcClientId")
|
|
262
|
-
def oidc_client_id(self) -> Optional[pulumi.Input[
|
|
261
|
+
def oidc_client_id(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
263
262
|
"""
|
|
264
263
|
Client ID used for OIDC backends
|
|
265
264
|
"""
|
|
266
265
|
return pulumi.get(self, "oidc_client_id")
|
|
267
266
|
|
|
268
267
|
@oidc_client_id.setter
|
|
269
|
-
def oidc_client_id(self, value: Optional[pulumi.Input[
|
|
268
|
+
def oidc_client_id(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
270
269
|
pulumi.set(self, "oidc_client_id", value)
|
|
271
270
|
|
|
272
|
-
@property
|
|
271
|
+
@_builtins.property
|
|
273
272
|
@pulumi.getter(name="oidcClientSecret")
|
|
274
|
-
def oidc_client_secret(self) -> Optional[pulumi.Input[
|
|
273
|
+
def oidc_client_secret(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
275
274
|
"""
|
|
276
275
|
Client Secret used for OIDC backends
|
|
277
276
|
"""
|
|
278
277
|
return pulumi.get(self, "oidc_client_secret")
|
|
279
278
|
|
|
280
279
|
@oidc_client_secret.setter
|
|
281
|
-
def oidc_client_secret(self, value: Optional[pulumi.Input[
|
|
280
|
+
def oidc_client_secret(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
282
281
|
pulumi.set(self, "oidc_client_secret", value)
|
|
283
282
|
|
|
284
|
-
@property
|
|
283
|
+
@_builtins.property
|
|
285
284
|
@pulumi.getter(name="oidcDiscoveryCaPem")
|
|
286
|
-
def oidc_discovery_ca_pem(self) -> Optional[pulumi.Input[
|
|
285
|
+
def oidc_discovery_ca_pem(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
287
286
|
"""
|
|
288
287
|
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
289
288
|
"""
|
|
290
289
|
return pulumi.get(self, "oidc_discovery_ca_pem")
|
|
291
290
|
|
|
292
291
|
@oidc_discovery_ca_pem.setter
|
|
293
|
-
def oidc_discovery_ca_pem(self, value: Optional[pulumi.Input[
|
|
292
|
+
def oidc_discovery_ca_pem(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
294
293
|
pulumi.set(self, "oidc_discovery_ca_pem", value)
|
|
295
294
|
|
|
296
|
-
@property
|
|
295
|
+
@_builtins.property
|
|
297
296
|
@pulumi.getter(name="oidcDiscoveryUrl")
|
|
298
|
-
def oidc_discovery_url(self) -> Optional[pulumi.Input[
|
|
297
|
+
def oidc_discovery_url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
299
298
|
"""
|
|
300
299
|
The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
301
300
|
"""
|
|
302
301
|
return pulumi.get(self, "oidc_discovery_url")
|
|
303
302
|
|
|
304
303
|
@oidc_discovery_url.setter
|
|
305
|
-
def oidc_discovery_url(self, value: Optional[pulumi.Input[
|
|
304
|
+
def oidc_discovery_url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
306
305
|
pulumi.set(self, "oidc_discovery_url", value)
|
|
307
306
|
|
|
308
|
-
@property
|
|
307
|
+
@_builtins.property
|
|
309
308
|
@pulumi.getter(name="oidcResponseMode")
|
|
310
|
-
def oidc_response_mode(self) -> Optional[pulumi.Input[
|
|
309
|
+
def oidc_response_mode(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
311
310
|
"""
|
|
312
311
|
The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
313
312
|
"""
|
|
314
313
|
return pulumi.get(self, "oidc_response_mode")
|
|
315
314
|
|
|
316
315
|
@oidc_response_mode.setter
|
|
317
|
-
def oidc_response_mode(self, value: Optional[pulumi.Input[
|
|
316
|
+
def oidc_response_mode(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
318
317
|
pulumi.set(self, "oidc_response_mode", value)
|
|
319
318
|
|
|
320
|
-
@property
|
|
319
|
+
@_builtins.property
|
|
321
320
|
@pulumi.getter(name="oidcResponseTypes")
|
|
322
|
-
def oidc_response_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
321
|
+
def oidc_response_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
323
322
|
"""
|
|
324
323
|
List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
325
324
|
"""
|
|
326
325
|
return pulumi.get(self, "oidc_response_types")
|
|
327
326
|
|
|
328
327
|
@oidc_response_types.setter
|
|
329
|
-
def oidc_response_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
328
|
+
def oidc_response_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
330
329
|
pulumi.set(self, "oidc_response_types", value)
|
|
331
330
|
|
|
332
|
-
@property
|
|
331
|
+
@_builtins.property
|
|
333
332
|
@pulumi.getter
|
|
334
|
-
def path(self) -> Optional[pulumi.Input[
|
|
333
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
335
334
|
"""
|
|
336
335
|
Path to mount the JWT/OIDC auth backend
|
|
337
336
|
"""
|
|
338
337
|
return pulumi.get(self, "path")
|
|
339
338
|
|
|
340
339
|
@path.setter
|
|
341
|
-
def path(self, value: Optional[pulumi.Input[
|
|
340
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
342
341
|
pulumi.set(self, "path", value)
|
|
343
342
|
|
|
344
|
-
@property
|
|
343
|
+
@_builtins.property
|
|
345
344
|
@pulumi.getter(name="providerConfig")
|
|
346
|
-
def provider_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
345
|
+
def provider_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
347
346
|
"""
|
|
348
347
|
Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
349
348
|
"""
|
|
350
349
|
return pulumi.get(self, "provider_config")
|
|
351
350
|
|
|
352
351
|
@provider_config.setter
|
|
353
|
-
def provider_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
352
|
+
def provider_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
354
353
|
pulumi.set(self, "provider_config", value)
|
|
355
354
|
|
|
356
|
-
@property
|
|
355
|
+
@_builtins.property
|
|
357
356
|
@pulumi.getter
|
|
358
357
|
def tune(self) -> Optional[pulumi.Input['AuthBackendTuneArgs']]:
|
|
359
358
|
return pulumi.get(self, "tune")
|
|
@@ -362,75 +361,75 @@ class AuthBackendArgs:
|
|
|
362
361
|
def tune(self, value: Optional[pulumi.Input['AuthBackendTuneArgs']]):
|
|
363
362
|
pulumi.set(self, "tune", value)
|
|
364
363
|
|
|
365
|
-
@property
|
|
364
|
+
@_builtins.property
|
|
366
365
|
@pulumi.getter
|
|
367
|
-
def type(self) -> Optional[pulumi.Input[
|
|
366
|
+
def type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
368
367
|
"""
|
|
369
368
|
Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
370
369
|
"""
|
|
371
370
|
return pulumi.get(self, "type")
|
|
372
371
|
|
|
373
372
|
@type.setter
|
|
374
|
-
def type(self, value: Optional[pulumi.Input[
|
|
373
|
+
def type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
375
374
|
pulumi.set(self, "type", value)
|
|
376
375
|
|
|
377
376
|
|
|
378
377
|
@pulumi.input_type
|
|
379
378
|
class _AuthBackendState:
|
|
380
379
|
def __init__(__self__, *,
|
|
381
|
-
accessor: Optional[pulumi.Input[
|
|
382
|
-
bound_issuer: Optional[pulumi.Input[
|
|
383
|
-
default_role: Optional[pulumi.Input[
|
|
384
|
-
description: Optional[pulumi.Input[
|
|
385
|
-
disable_remount: Optional[pulumi.Input[
|
|
386
|
-
jwks_ca_pem: Optional[pulumi.Input[
|
|
387
|
-
jwks_url: Optional[pulumi.Input[
|
|
388
|
-
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
389
|
-
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
390
|
-
local: Optional[pulumi.Input[
|
|
391
|
-
namespace: Optional[pulumi.Input[
|
|
392
|
-
namespace_in_state: Optional[pulumi.Input[
|
|
393
|
-
oidc_client_id: Optional[pulumi.Input[
|
|
394
|
-
oidc_client_secret: Optional[pulumi.Input[
|
|
395
|
-
oidc_discovery_ca_pem: Optional[pulumi.Input[
|
|
396
|
-
oidc_discovery_url: Optional[pulumi.Input[
|
|
397
|
-
oidc_response_mode: Optional[pulumi.Input[
|
|
398
|
-
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
399
|
-
path: Optional[pulumi.Input[
|
|
400
|
-
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
380
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
381
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
382
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
383
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
384
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
385
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
386
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
387
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
388
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
389
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
390
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
391
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
392
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
393
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
394
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
395
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
396
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
397
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
398
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
399
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
401
400
|
tune: Optional[pulumi.Input['AuthBackendTuneArgs']] = None,
|
|
402
|
-
type: Optional[pulumi.Input[
|
|
401
|
+
type: Optional[pulumi.Input[_builtins.str]] = None):
|
|
403
402
|
"""
|
|
404
403
|
Input properties used for looking up and filtering AuthBackend resources.
|
|
405
|
-
:param pulumi.Input[
|
|
406
|
-
:param pulumi.Input[
|
|
407
|
-
:param pulumi.Input[
|
|
408
|
-
:param pulumi.Input[
|
|
409
|
-
:param pulumi.Input[
|
|
404
|
+
:param pulumi.Input[_builtins.str] accessor: The accessor for this auth method
|
|
405
|
+
:param pulumi.Input[_builtins.str] bound_issuer: The value against which to match the iss claim in a JWT
|
|
406
|
+
:param pulumi.Input[_builtins.str] default_role: The default role to use if none is provided during login
|
|
407
|
+
:param pulumi.Input[_builtins.str] description: The description of the auth backend
|
|
408
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
410
409
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
411
|
-
:param pulumi.Input[
|
|
412
|
-
:param pulumi.Input[
|
|
413
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
414
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
415
|
-
:param pulumi.Input[
|
|
416
|
-
:param pulumi.Input[
|
|
410
|
+
:param pulumi.Input[_builtins.str] jwks_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
411
|
+
:param pulumi.Input[_builtins.str] jwks_url: JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
412
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_supported_algs: A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
413
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_validation_pubkeys: A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
414
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
415
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
417
416
|
The value should not contain leading or trailing forward slashes.
|
|
418
417
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
419
418
|
*Available only for Vault Enterprise*.
|
|
420
|
-
:param pulumi.Input[
|
|
419
|
+
:param pulumi.Input[_builtins.bool] namespace_in_state: Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
421
420
|
|
|
422
421
|
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
423
422
|
|
|
424
423
|
The `tune` block is used to tune the auth backend:
|
|
425
|
-
:param pulumi.Input[
|
|
426
|
-
:param pulumi.Input[
|
|
427
|
-
:param pulumi.Input[
|
|
428
|
-
:param pulumi.Input[
|
|
429
|
-
:param pulumi.Input[
|
|
430
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
431
|
-
:param pulumi.Input[
|
|
432
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
433
|
-
:param pulumi.Input[
|
|
424
|
+
:param pulumi.Input[_builtins.str] oidc_client_id: Client ID used for OIDC backends
|
|
425
|
+
:param pulumi.Input[_builtins.str] oidc_client_secret: Client Secret used for OIDC backends
|
|
426
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
427
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_url: The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
428
|
+
:param pulumi.Input[_builtins.str] oidc_response_mode: The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
429
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] oidc_response_types: List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
430
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the JWT/OIDC auth backend
|
|
431
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] provider_config: Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
432
|
+
:param pulumi.Input[_builtins.str] type: Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
434
433
|
"""
|
|
435
434
|
if accessor is not None:
|
|
436
435
|
pulumi.set(__self__, "accessor", accessor)
|
|
@@ -477,57 +476,57 @@ class _AuthBackendState:
|
|
|
477
476
|
if type is not None:
|
|
478
477
|
pulumi.set(__self__, "type", type)
|
|
479
478
|
|
|
480
|
-
@property
|
|
479
|
+
@_builtins.property
|
|
481
480
|
@pulumi.getter
|
|
482
|
-
def accessor(self) -> Optional[pulumi.Input[
|
|
481
|
+
def accessor(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
483
482
|
"""
|
|
484
483
|
The accessor for this auth method
|
|
485
484
|
"""
|
|
486
485
|
return pulumi.get(self, "accessor")
|
|
487
486
|
|
|
488
487
|
@accessor.setter
|
|
489
|
-
def accessor(self, value: Optional[pulumi.Input[
|
|
488
|
+
def accessor(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
490
489
|
pulumi.set(self, "accessor", value)
|
|
491
490
|
|
|
492
|
-
@property
|
|
491
|
+
@_builtins.property
|
|
493
492
|
@pulumi.getter(name="boundIssuer")
|
|
494
|
-
def bound_issuer(self) -> Optional[pulumi.Input[
|
|
493
|
+
def bound_issuer(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
495
494
|
"""
|
|
496
495
|
The value against which to match the iss claim in a JWT
|
|
497
496
|
"""
|
|
498
497
|
return pulumi.get(self, "bound_issuer")
|
|
499
498
|
|
|
500
499
|
@bound_issuer.setter
|
|
501
|
-
def bound_issuer(self, value: Optional[pulumi.Input[
|
|
500
|
+
def bound_issuer(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
502
501
|
pulumi.set(self, "bound_issuer", value)
|
|
503
502
|
|
|
504
|
-
@property
|
|
503
|
+
@_builtins.property
|
|
505
504
|
@pulumi.getter(name="defaultRole")
|
|
506
|
-
def default_role(self) -> Optional[pulumi.Input[
|
|
505
|
+
def default_role(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
507
506
|
"""
|
|
508
507
|
The default role to use if none is provided during login
|
|
509
508
|
"""
|
|
510
509
|
return pulumi.get(self, "default_role")
|
|
511
510
|
|
|
512
511
|
@default_role.setter
|
|
513
|
-
def default_role(self, value: Optional[pulumi.Input[
|
|
512
|
+
def default_role(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
514
513
|
pulumi.set(self, "default_role", value)
|
|
515
514
|
|
|
516
|
-
@property
|
|
515
|
+
@_builtins.property
|
|
517
516
|
@pulumi.getter
|
|
518
|
-
def description(self) -> Optional[pulumi.Input[
|
|
517
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
519
518
|
"""
|
|
520
519
|
The description of the auth backend
|
|
521
520
|
"""
|
|
522
521
|
return pulumi.get(self, "description")
|
|
523
522
|
|
|
524
523
|
@description.setter
|
|
525
|
-
def description(self, value: Optional[pulumi.Input[
|
|
524
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
526
525
|
pulumi.set(self, "description", value)
|
|
527
526
|
|
|
528
|
-
@property
|
|
527
|
+
@_builtins.property
|
|
529
528
|
@pulumi.getter(name="disableRemount")
|
|
530
|
-
def disable_remount(self) -> Optional[pulumi.Input[
|
|
529
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
531
530
|
"""
|
|
532
531
|
If set, opts out of mount migration on path updates.
|
|
533
532
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
@@ -535,72 +534,72 @@ class _AuthBackendState:
|
|
|
535
534
|
return pulumi.get(self, "disable_remount")
|
|
536
535
|
|
|
537
536
|
@disable_remount.setter
|
|
538
|
-
def disable_remount(self, value: Optional[pulumi.Input[
|
|
537
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
539
538
|
pulumi.set(self, "disable_remount", value)
|
|
540
539
|
|
|
541
|
-
@property
|
|
540
|
+
@_builtins.property
|
|
542
541
|
@pulumi.getter(name="jwksCaPem")
|
|
543
|
-
def jwks_ca_pem(self) -> Optional[pulumi.Input[
|
|
542
|
+
def jwks_ca_pem(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
544
543
|
"""
|
|
545
544
|
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
546
545
|
"""
|
|
547
546
|
return pulumi.get(self, "jwks_ca_pem")
|
|
548
547
|
|
|
549
548
|
@jwks_ca_pem.setter
|
|
550
|
-
def jwks_ca_pem(self, value: Optional[pulumi.Input[
|
|
549
|
+
def jwks_ca_pem(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
551
550
|
pulumi.set(self, "jwks_ca_pem", value)
|
|
552
551
|
|
|
553
|
-
@property
|
|
552
|
+
@_builtins.property
|
|
554
553
|
@pulumi.getter(name="jwksUrl")
|
|
555
|
-
def jwks_url(self) -> Optional[pulumi.Input[
|
|
554
|
+
def jwks_url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
556
555
|
"""
|
|
557
556
|
JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
558
557
|
"""
|
|
559
558
|
return pulumi.get(self, "jwks_url")
|
|
560
559
|
|
|
561
560
|
@jwks_url.setter
|
|
562
|
-
def jwks_url(self, value: Optional[pulumi.Input[
|
|
561
|
+
def jwks_url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
563
562
|
pulumi.set(self, "jwks_url", value)
|
|
564
563
|
|
|
565
|
-
@property
|
|
564
|
+
@_builtins.property
|
|
566
565
|
@pulumi.getter(name="jwtSupportedAlgs")
|
|
567
|
-
def jwt_supported_algs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
566
|
+
def jwt_supported_algs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
568
567
|
"""
|
|
569
568
|
A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
570
569
|
"""
|
|
571
570
|
return pulumi.get(self, "jwt_supported_algs")
|
|
572
571
|
|
|
573
572
|
@jwt_supported_algs.setter
|
|
574
|
-
def jwt_supported_algs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
573
|
+
def jwt_supported_algs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
575
574
|
pulumi.set(self, "jwt_supported_algs", value)
|
|
576
575
|
|
|
577
|
-
@property
|
|
576
|
+
@_builtins.property
|
|
578
577
|
@pulumi.getter(name="jwtValidationPubkeys")
|
|
579
|
-
def jwt_validation_pubkeys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
578
|
+
def jwt_validation_pubkeys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
580
579
|
"""
|
|
581
580
|
A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
582
581
|
"""
|
|
583
582
|
return pulumi.get(self, "jwt_validation_pubkeys")
|
|
584
583
|
|
|
585
584
|
@jwt_validation_pubkeys.setter
|
|
586
|
-
def jwt_validation_pubkeys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
585
|
+
def jwt_validation_pubkeys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
587
586
|
pulumi.set(self, "jwt_validation_pubkeys", value)
|
|
588
587
|
|
|
589
|
-
@property
|
|
588
|
+
@_builtins.property
|
|
590
589
|
@pulumi.getter
|
|
591
|
-
def local(self) -> Optional[pulumi.Input[
|
|
590
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
592
591
|
"""
|
|
593
592
|
Specifies if the auth method is local only.
|
|
594
593
|
"""
|
|
595
594
|
return pulumi.get(self, "local")
|
|
596
595
|
|
|
597
596
|
@local.setter
|
|
598
|
-
def local(self, value: Optional[pulumi.Input[
|
|
597
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
599
598
|
pulumi.set(self, "local", value)
|
|
600
599
|
|
|
601
|
-
@property
|
|
600
|
+
@_builtins.property
|
|
602
601
|
@pulumi.getter
|
|
603
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
602
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
604
603
|
"""
|
|
605
604
|
The namespace to provision the resource in.
|
|
606
605
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -610,12 +609,12 @@ class _AuthBackendState:
|
|
|
610
609
|
return pulumi.get(self, "namespace")
|
|
611
610
|
|
|
612
611
|
@namespace.setter
|
|
613
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
612
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
614
613
|
pulumi.set(self, "namespace", value)
|
|
615
614
|
|
|
616
|
-
@property
|
|
615
|
+
@_builtins.property
|
|
617
616
|
@pulumi.getter(name="namespaceInState")
|
|
618
|
-
def namespace_in_state(self) -> Optional[pulumi.Input[
|
|
617
|
+
def namespace_in_state(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
619
618
|
"""
|
|
620
619
|
Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
621
620
|
|
|
@@ -626,106 +625,106 @@ class _AuthBackendState:
|
|
|
626
625
|
return pulumi.get(self, "namespace_in_state")
|
|
627
626
|
|
|
628
627
|
@namespace_in_state.setter
|
|
629
|
-
def namespace_in_state(self, value: Optional[pulumi.Input[
|
|
628
|
+
def namespace_in_state(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
630
629
|
pulumi.set(self, "namespace_in_state", value)
|
|
631
630
|
|
|
632
|
-
@property
|
|
631
|
+
@_builtins.property
|
|
633
632
|
@pulumi.getter(name="oidcClientId")
|
|
634
|
-
def oidc_client_id(self) -> Optional[pulumi.Input[
|
|
633
|
+
def oidc_client_id(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
635
634
|
"""
|
|
636
635
|
Client ID used for OIDC backends
|
|
637
636
|
"""
|
|
638
637
|
return pulumi.get(self, "oidc_client_id")
|
|
639
638
|
|
|
640
639
|
@oidc_client_id.setter
|
|
641
|
-
def oidc_client_id(self, value: Optional[pulumi.Input[
|
|
640
|
+
def oidc_client_id(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
642
641
|
pulumi.set(self, "oidc_client_id", value)
|
|
643
642
|
|
|
644
|
-
@property
|
|
643
|
+
@_builtins.property
|
|
645
644
|
@pulumi.getter(name="oidcClientSecret")
|
|
646
|
-
def oidc_client_secret(self) -> Optional[pulumi.Input[
|
|
645
|
+
def oidc_client_secret(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
647
646
|
"""
|
|
648
647
|
Client Secret used for OIDC backends
|
|
649
648
|
"""
|
|
650
649
|
return pulumi.get(self, "oidc_client_secret")
|
|
651
650
|
|
|
652
651
|
@oidc_client_secret.setter
|
|
653
|
-
def oidc_client_secret(self, value: Optional[pulumi.Input[
|
|
652
|
+
def oidc_client_secret(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
654
653
|
pulumi.set(self, "oidc_client_secret", value)
|
|
655
654
|
|
|
656
|
-
@property
|
|
655
|
+
@_builtins.property
|
|
657
656
|
@pulumi.getter(name="oidcDiscoveryCaPem")
|
|
658
|
-
def oidc_discovery_ca_pem(self) -> Optional[pulumi.Input[
|
|
657
|
+
def oidc_discovery_ca_pem(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
659
658
|
"""
|
|
660
659
|
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
661
660
|
"""
|
|
662
661
|
return pulumi.get(self, "oidc_discovery_ca_pem")
|
|
663
662
|
|
|
664
663
|
@oidc_discovery_ca_pem.setter
|
|
665
|
-
def oidc_discovery_ca_pem(self, value: Optional[pulumi.Input[
|
|
664
|
+
def oidc_discovery_ca_pem(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
666
665
|
pulumi.set(self, "oidc_discovery_ca_pem", value)
|
|
667
666
|
|
|
668
|
-
@property
|
|
667
|
+
@_builtins.property
|
|
669
668
|
@pulumi.getter(name="oidcDiscoveryUrl")
|
|
670
|
-
def oidc_discovery_url(self) -> Optional[pulumi.Input[
|
|
669
|
+
def oidc_discovery_url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
671
670
|
"""
|
|
672
671
|
The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
673
672
|
"""
|
|
674
673
|
return pulumi.get(self, "oidc_discovery_url")
|
|
675
674
|
|
|
676
675
|
@oidc_discovery_url.setter
|
|
677
|
-
def oidc_discovery_url(self, value: Optional[pulumi.Input[
|
|
676
|
+
def oidc_discovery_url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
678
677
|
pulumi.set(self, "oidc_discovery_url", value)
|
|
679
678
|
|
|
680
|
-
@property
|
|
679
|
+
@_builtins.property
|
|
681
680
|
@pulumi.getter(name="oidcResponseMode")
|
|
682
|
-
def oidc_response_mode(self) -> Optional[pulumi.Input[
|
|
681
|
+
def oidc_response_mode(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
683
682
|
"""
|
|
684
683
|
The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
685
684
|
"""
|
|
686
685
|
return pulumi.get(self, "oidc_response_mode")
|
|
687
686
|
|
|
688
687
|
@oidc_response_mode.setter
|
|
689
|
-
def oidc_response_mode(self, value: Optional[pulumi.Input[
|
|
688
|
+
def oidc_response_mode(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
690
689
|
pulumi.set(self, "oidc_response_mode", value)
|
|
691
690
|
|
|
692
|
-
@property
|
|
691
|
+
@_builtins.property
|
|
693
692
|
@pulumi.getter(name="oidcResponseTypes")
|
|
694
|
-
def oidc_response_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
693
|
+
def oidc_response_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
695
694
|
"""
|
|
696
695
|
List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
697
696
|
"""
|
|
698
697
|
return pulumi.get(self, "oidc_response_types")
|
|
699
698
|
|
|
700
699
|
@oidc_response_types.setter
|
|
701
|
-
def oidc_response_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
700
|
+
def oidc_response_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
702
701
|
pulumi.set(self, "oidc_response_types", value)
|
|
703
702
|
|
|
704
|
-
@property
|
|
703
|
+
@_builtins.property
|
|
705
704
|
@pulumi.getter
|
|
706
|
-
def path(self) -> Optional[pulumi.Input[
|
|
705
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
707
706
|
"""
|
|
708
707
|
Path to mount the JWT/OIDC auth backend
|
|
709
708
|
"""
|
|
710
709
|
return pulumi.get(self, "path")
|
|
711
710
|
|
|
712
711
|
@path.setter
|
|
713
|
-
def path(self, value: Optional[pulumi.Input[
|
|
712
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
714
713
|
pulumi.set(self, "path", value)
|
|
715
714
|
|
|
716
|
-
@property
|
|
715
|
+
@_builtins.property
|
|
717
716
|
@pulumi.getter(name="providerConfig")
|
|
718
|
-
def provider_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
717
|
+
def provider_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
719
718
|
"""
|
|
720
719
|
Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
721
720
|
"""
|
|
722
721
|
return pulumi.get(self, "provider_config")
|
|
723
722
|
|
|
724
723
|
@provider_config.setter
|
|
725
|
-
def provider_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
724
|
+
def provider_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
726
725
|
pulumi.set(self, "provider_config", value)
|
|
727
726
|
|
|
728
|
-
@property
|
|
727
|
+
@_builtins.property
|
|
729
728
|
@pulumi.getter
|
|
730
729
|
def tune(self) -> Optional[pulumi.Input['AuthBackendTuneArgs']]:
|
|
731
730
|
return pulumi.get(self, "tune")
|
|
@@ -734,16 +733,16 @@ class _AuthBackendState:
|
|
|
734
733
|
def tune(self, value: Optional[pulumi.Input['AuthBackendTuneArgs']]):
|
|
735
734
|
pulumi.set(self, "tune", value)
|
|
736
735
|
|
|
737
|
-
@property
|
|
736
|
+
@_builtins.property
|
|
738
737
|
@pulumi.getter
|
|
739
|
-
def type(self) -> Optional[pulumi.Input[
|
|
738
|
+
def type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
740
739
|
"""
|
|
741
740
|
Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
742
741
|
"""
|
|
743
742
|
return pulumi.get(self, "type")
|
|
744
743
|
|
|
745
744
|
@type.setter
|
|
746
|
-
def type(self, value: Optional[pulumi.Input[
|
|
745
|
+
def type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
747
746
|
pulumi.set(self, "type", value)
|
|
748
747
|
|
|
749
748
|
|
|
@@ -753,27 +752,27 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
753
752
|
def __init__(__self__,
|
|
754
753
|
resource_name: str,
|
|
755
754
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
756
|
-
bound_issuer: Optional[pulumi.Input[
|
|
757
|
-
default_role: Optional[pulumi.Input[
|
|
758
|
-
description: Optional[pulumi.Input[
|
|
759
|
-
disable_remount: Optional[pulumi.Input[
|
|
760
|
-
jwks_ca_pem: Optional[pulumi.Input[
|
|
761
|
-
jwks_url: Optional[pulumi.Input[
|
|
762
|
-
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
763
|
-
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
764
|
-
local: Optional[pulumi.Input[
|
|
765
|
-
namespace: Optional[pulumi.Input[
|
|
766
|
-
namespace_in_state: Optional[pulumi.Input[
|
|
767
|
-
oidc_client_id: Optional[pulumi.Input[
|
|
768
|
-
oidc_client_secret: Optional[pulumi.Input[
|
|
769
|
-
oidc_discovery_ca_pem: Optional[pulumi.Input[
|
|
770
|
-
oidc_discovery_url: Optional[pulumi.Input[
|
|
771
|
-
oidc_response_mode: Optional[pulumi.Input[
|
|
772
|
-
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
773
|
-
path: Optional[pulumi.Input[
|
|
774
|
-
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
755
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
756
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
757
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
758
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
759
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
760
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
761
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
762
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
763
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
764
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
765
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
766
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
767
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
768
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
769
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
770
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
771
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
772
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
773
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
775
774
|
tune: Optional[pulumi.Input[Union['AuthBackendTuneArgs', 'AuthBackendTuneArgsDict']]] = None,
|
|
776
|
-
type: Optional[pulumi.Input[
|
|
775
|
+
type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
777
776
|
__props__=None):
|
|
778
777
|
"""
|
|
779
778
|
Provides a resource for managing an
|
|
@@ -847,34 +846,34 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
847
846
|
|
|
848
847
|
:param str resource_name: The name of the resource.
|
|
849
848
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
850
|
-
:param pulumi.Input[
|
|
851
|
-
:param pulumi.Input[
|
|
852
|
-
:param pulumi.Input[
|
|
853
|
-
:param pulumi.Input[
|
|
849
|
+
:param pulumi.Input[_builtins.str] bound_issuer: The value against which to match the iss claim in a JWT
|
|
850
|
+
:param pulumi.Input[_builtins.str] default_role: The default role to use if none is provided during login
|
|
851
|
+
:param pulumi.Input[_builtins.str] description: The description of the auth backend
|
|
852
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
854
853
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
855
|
-
:param pulumi.Input[
|
|
856
|
-
:param pulumi.Input[
|
|
857
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
858
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
859
|
-
:param pulumi.Input[
|
|
860
|
-
:param pulumi.Input[
|
|
854
|
+
:param pulumi.Input[_builtins.str] jwks_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
855
|
+
:param pulumi.Input[_builtins.str] jwks_url: JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
856
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_supported_algs: A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
857
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_validation_pubkeys: A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
858
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
859
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
861
860
|
The value should not contain leading or trailing forward slashes.
|
|
862
861
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
863
862
|
*Available only for Vault Enterprise*.
|
|
864
|
-
:param pulumi.Input[
|
|
863
|
+
:param pulumi.Input[_builtins.bool] namespace_in_state: Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
865
864
|
|
|
866
865
|
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
867
866
|
|
|
868
867
|
The `tune` block is used to tune the auth backend:
|
|
869
|
-
:param pulumi.Input[
|
|
870
|
-
:param pulumi.Input[
|
|
871
|
-
:param pulumi.Input[
|
|
872
|
-
:param pulumi.Input[
|
|
873
|
-
:param pulumi.Input[
|
|
874
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
875
|
-
:param pulumi.Input[
|
|
876
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
877
|
-
:param pulumi.Input[
|
|
868
|
+
:param pulumi.Input[_builtins.str] oidc_client_id: Client ID used for OIDC backends
|
|
869
|
+
:param pulumi.Input[_builtins.str] oidc_client_secret: Client Secret used for OIDC backends
|
|
870
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
871
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_url: The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
872
|
+
:param pulumi.Input[_builtins.str] oidc_response_mode: The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
873
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] oidc_response_types: List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
874
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the JWT/OIDC auth backend
|
|
875
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] provider_config: Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
876
|
+
:param pulumi.Input[_builtins.str] type: Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
878
877
|
"""
|
|
879
878
|
...
|
|
880
879
|
@overload
|
|
@@ -967,27 +966,27 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
967
966
|
def _internal_init(__self__,
|
|
968
967
|
resource_name: str,
|
|
969
968
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
970
|
-
bound_issuer: Optional[pulumi.Input[
|
|
971
|
-
default_role: Optional[pulumi.Input[
|
|
972
|
-
description: Optional[pulumi.Input[
|
|
973
|
-
disable_remount: Optional[pulumi.Input[
|
|
974
|
-
jwks_ca_pem: Optional[pulumi.Input[
|
|
975
|
-
jwks_url: Optional[pulumi.Input[
|
|
976
|
-
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
977
|
-
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
978
|
-
local: Optional[pulumi.Input[
|
|
979
|
-
namespace: Optional[pulumi.Input[
|
|
980
|
-
namespace_in_state: Optional[pulumi.Input[
|
|
981
|
-
oidc_client_id: Optional[pulumi.Input[
|
|
982
|
-
oidc_client_secret: Optional[pulumi.Input[
|
|
983
|
-
oidc_discovery_ca_pem: Optional[pulumi.Input[
|
|
984
|
-
oidc_discovery_url: Optional[pulumi.Input[
|
|
985
|
-
oidc_response_mode: Optional[pulumi.Input[
|
|
986
|
-
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
987
|
-
path: Optional[pulumi.Input[
|
|
988
|
-
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
969
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
970
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
971
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
972
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
973
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
974
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
975
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
976
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
977
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
978
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
979
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
980
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
981
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
982
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
983
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
984
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
985
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
986
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
987
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
989
988
|
tune: Optional[pulumi.Input[Union['AuthBackendTuneArgs', 'AuthBackendTuneArgsDict']]] = None,
|
|
990
|
-
type: Optional[pulumi.Input[
|
|
989
|
+
type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
991
990
|
__props__=None):
|
|
992
991
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
993
992
|
if not isinstance(opts, pulumi.ResourceOptions):
|
|
@@ -1031,28 +1030,28 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
1031
1030
|
def get(resource_name: str,
|
|
1032
1031
|
id: pulumi.Input[str],
|
|
1033
1032
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1034
|
-
accessor: Optional[pulumi.Input[
|
|
1035
|
-
bound_issuer: Optional[pulumi.Input[
|
|
1036
|
-
default_role: Optional[pulumi.Input[
|
|
1037
|
-
description: Optional[pulumi.Input[
|
|
1038
|
-
disable_remount: Optional[pulumi.Input[
|
|
1039
|
-
jwks_ca_pem: Optional[pulumi.Input[
|
|
1040
|
-
jwks_url: Optional[pulumi.Input[
|
|
1041
|
-
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
1042
|
-
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
1043
|
-
local: Optional[pulumi.Input[
|
|
1044
|
-
namespace: Optional[pulumi.Input[
|
|
1045
|
-
namespace_in_state: Optional[pulumi.Input[
|
|
1046
|
-
oidc_client_id: Optional[pulumi.Input[
|
|
1047
|
-
oidc_client_secret: Optional[pulumi.Input[
|
|
1048
|
-
oidc_discovery_ca_pem: Optional[pulumi.Input[
|
|
1049
|
-
oidc_discovery_url: Optional[pulumi.Input[
|
|
1050
|
-
oidc_response_mode: Optional[pulumi.Input[
|
|
1051
|
-
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
1052
|
-
path: Optional[pulumi.Input[
|
|
1053
|
-
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[
|
|
1033
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1034
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1035
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1036
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1037
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1038
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1039
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1040
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1041
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1042
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1043
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1044
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1045
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1046
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1047
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1048
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1049
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1050
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1051
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1052
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1054
1053
|
tune: Optional[pulumi.Input[Union['AuthBackendTuneArgs', 'AuthBackendTuneArgsDict']]] = None,
|
|
1055
|
-
type: Optional[pulumi.Input[
|
|
1054
|
+
type: Optional[pulumi.Input[_builtins.str]] = None) -> 'AuthBackend':
|
|
1056
1055
|
"""
|
|
1057
1056
|
Get an existing AuthBackend resource's state with the given name, id, and optional extra
|
|
1058
1057
|
properties used to qualify the lookup.
|
|
@@ -1060,35 +1059,35 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
1060
1059
|
:param str resource_name: The unique name of the resulting resource.
|
|
1061
1060
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
1062
1061
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1063
|
-
:param pulumi.Input[
|
|
1064
|
-
:param pulumi.Input[
|
|
1065
|
-
:param pulumi.Input[
|
|
1066
|
-
:param pulumi.Input[
|
|
1067
|
-
:param pulumi.Input[
|
|
1062
|
+
:param pulumi.Input[_builtins.str] accessor: The accessor for this auth method
|
|
1063
|
+
:param pulumi.Input[_builtins.str] bound_issuer: The value against which to match the iss claim in a JWT
|
|
1064
|
+
:param pulumi.Input[_builtins.str] default_role: The default role to use if none is provided during login
|
|
1065
|
+
:param pulumi.Input[_builtins.str] description: The description of the auth backend
|
|
1066
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
1068
1067
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1069
|
-
:param pulumi.Input[
|
|
1070
|
-
:param pulumi.Input[
|
|
1071
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
1072
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
1073
|
-
:param pulumi.Input[
|
|
1074
|
-
:param pulumi.Input[
|
|
1068
|
+
:param pulumi.Input[_builtins.str] jwks_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
1069
|
+
:param pulumi.Input[_builtins.str] jwks_url: JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
1070
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_supported_algs: A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
1071
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_validation_pubkeys: A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
1072
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
1073
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
1075
1074
|
The value should not contain leading or trailing forward slashes.
|
|
1076
1075
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
1077
1076
|
*Available only for Vault Enterprise*.
|
|
1078
|
-
:param pulumi.Input[
|
|
1077
|
+
:param pulumi.Input[_builtins.bool] namespace_in_state: Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
1079
1078
|
|
|
1080
1079
|
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
1081
1080
|
|
|
1082
1081
|
The `tune` block is used to tune the auth backend:
|
|
1083
|
-
:param pulumi.Input[
|
|
1084
|
-
:param pulumi.Input[
|
|
1085
|
-
:param pulumi.Input[
|
|
1086
|
-
:param pulumi.Input[
|
|
1087
|
-
:param pulumi.Input[
|
|
1088
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
1089
|
-
:param pulumi.Input[
|
|
1090
|
-
:param pulumi.Input[Mapping[str, pulumi.Input[
|
|
1091
|
-
:param pulumi.Input[
|
|
1082
|
+
:param pulumi.Input[_builtins.str] oidc_client_id: Client ID used for OIDC backends
|
|
1083
|
+
:param pulumi.Input[_builtins.str] oidc_client_secret: Client Secret used for OIDC backends
|
|
1084
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
1085
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_url: The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
1086
|
+
:param pulumi.Input[_builtins.str] oidc_response_mode: The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
1087
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] oidc_response_types: List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
1088
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the JWT/OIDC auth backend
|
|
1089
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] provider_config: Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
1090
|
+
:param pulumi.Input[_builtins.str] type: Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
1092
1091
|
"""
|
|
1093
1092
|
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
1094
1093
|
|
|
@@ -1118,90 +1117,90 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
1118
1117
|
__props__.__dict__["type"] = type
|
|
1119
1118
|
return AuthBackend(resource_name, opts=opts, __props__=__props__)
|
|
1120
1119
|
|
|
1121
|
-
@property
|
|
1120
|
+
@_builtins.property
|
|
1122
1121
|
@pulumi.getter
|
|
1123
|
-
def accessor(self) -> pulumi.Output[
|
|
1122
|
+
def accessor(self) -> pulumi.Output[_builtins.str]:
|
|
1124
1123
|
"""
|
|
1125
1124
|
The accessor for this auth method
|
|
1126
1125
|
"""
|
|
1127
1126
|
return pulumi.get(self, "accessor")
|
|
1128
1127
|
|
|
1129
|
-
@property
|
|
1128
|
+
@_builtins.property
|
|
1130
1129
|
@pulumi.getter(name="boundIssuer")
|
|
1131
|
-
def bound_issuer(self) -> pulumi.Output[Optional[
|
|
1130
|
+
def bound_issuer(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1132
1131
|
"""
|
|
1133
1132
|
The value against which to match the iss claim in a JWT
|
|
1134
1133
|
"""
|
|
1135
1134
|
return pulumi.get(self, "bound_issuer")
|
|
1136
1135
|
|
|
1137
|
-
@property
|
|
1136
|
+
@_builtins.property
|
|
1138
1137
|
@pulumi.getter(name="defaultRole")
|
|
1139
|
-
def default_role(self) -> pulumi.Output[Optional[
|
|
1138
|
+
def default_role(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1140
1139
|
"""
|
|
1141
1140
|
The default role to use if none is provided during login
|
|
1142
1141
|
"""
|
|
1143
1142
|
return pulumi.get(self, "default_role")
|
|
1144
1143
|
|
|
1145
|
-
@property
|
|
1144
|
+
@_builtins.property
|
|
1146
1145
|
@pulumi.getter
|
|
1147
|
-
def description(self) -> pulumi.Output[Optional[
|
|
1146
|
+
def description(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1148
1147
|
"""
|
|
1149
1148
|
The description of the auth backend
|
|
1150
1149
|
"""
|
|
1151
1150
|
return pulumi.get(self, "description")
|
|
1152
1151
|
|
|
1153
|
-
@property
|
|
1152
|
+
@_builtins.property
|
|
1154
1153
|
@pulumi.getter(name="disableRemount")
|
|
1155
|
-
def disable_remount(self) -> pulumi.Output[Optional[
|
|
1154
|
+
def disable_remount(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1156
1155
|
"""
|
|
1157
1156
|
If set, opts out of mount migration on path updates.
|
|
1158
1157
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1159
1158
|
"""
|
|
1160
1159
|
return pulumi.get(self, "disable_remount")
|
|
1161
1160
|
|
|
1162
|
-
@property
|
|
1161
|
+
@_builtins.property
|
|
1163
1162
|
@pulumi.getter(name="jwksCaPem")
|
|
1164
|
-
def jwks_ca_pem(self) -> pulumi.Output[Optional[
|
|
1163
|
+
def jwks_ca_pem(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1165
1164
|
"""
|
|
1166
1165
|
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
1167
1166
|
"""
|
|
1168
1167
|
return pulumi.get(self, "jwks_ca_pem")
|
|
1169
1168
|
|
|
1170
|
-
@property
|
|
1169
|
+
@_builtins.property
|
|
1171
1170
|
@pulumi.getter(name="jwksUrl")
|
|
1172
|
-
def jwks_url(self) -> pulumi.Output[Optional[
|
|
1171
|
+
def jwks_url(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1173
1172
|
"""
|
|
1174
1173
|
JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
1175
1174
|
"""
|
|
1176
1175
|
return pulumi.get(self, "jwks_url")
|
|
1177
1176
|
|
|
1178
|
-
@property
|
|
1177
|
+
@_builtins.property
|
|
1179
1178
|
@pulumi.getter(name="jwtSupportedAlgs")
|
|
1180
|
-
def jwt_supported_algs(self) -> pulumi.Output[Optional[Sequence[
|
|
1179
|
+
def jwt_supported_algs(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1181
1180
|
"""
|
|
1182
1181
|
A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
1183
1182
|
"""
|
|
1184
1183
|
return pulumi.get(self, "jwt_supported_algs")
|
|
1185
1184
|
|
|
1186
|
-
@property
|
|
1185
|
+
@_builtins.property
|
|
1187
1186
|
@pulumi.getter(name="jwtValidationPubkeys")
|
|
1188
|
-
def jwt_validation_pubkeys(self) -> pulumi.Output[Optional[Sequence[
|
|
1187
|
+
def jwt_validation_pubkeys(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1189
1188
|
"""
|
|
1190
1189
|
A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
1191
1190
|
"""
|
|
1192
1191
|
return pulumi.get(self, "jwt_validation_pubkeys")
|
|
1193
1192
|
|
|
1194
|
-
@property
|
|
1193
|
+
@_builtins.property
|
|
1195
1194
|
@pulumi.getter
|
|
1196
|
-
def local(self) -> pulumi.Output[Optional[
|
|
1195
|
+
def local(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1197
1196
|
"""
|
|
1198
1197
|
Specifies if the auth method is local only.
|
|
1199
1198
|
"""
|
|
1200
1199
|
return pulumi.get(self, "local")
|
|
1201
1200
|
|
|
1202
|
-
@property
|
|
1201
|
+
@_builtins.property
|
|
1203
1202
|
@pulumi.getter
|
|
1204
|
-
def namespace(self) -> pulumi.Output[Optional[
|
|
1203
|
+
def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1205
1204
|
"""
|
|
1206
1205
|
The namespace to provision the resource in.
|
|
1207
1206
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -1210,9 +1209,9 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
1210
1209
|
"""
|
|
1211
1210
|
return pulumi.get(self, "namespace")
|
|
1212
1211
|
|
|
1213
|
-
@property
|
|
1212
|
+
@_builtins.property
|
|
1214
1213
|
@pulumi.getter(name="namespaceInState")
|
|
1215
|
-
def namespace_in_state(self) -> pulumi.Output[Optional[
|
|
1214
|
+
def namespace_in_state(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1216
1215
|
"""
|
|
1217
1216
|
Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
1218
1217
|
|
|
@@ -1222,78 +1221,78 @@ class AuthBackend(pulumi.CustomResource):
|
|
|
1222
1221
|
"""
|
|
1223
1222
|
return pulumi.get(self, "namespace_in_state")
|
|
1224
1223
|
|
|
1225
|
-
@property
|
|
1224
|
+
@_builtins.property
|
|
1226
1225
|
@pulumi.getter(name="oidcClientId")
|
|
1227
|
-
def oidc_client_id(self) -> pulumi.Output[Optional[
|
|
1226
|
+
def oidc_client_id(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1228
1227
|
"""
|
|
1229
1228
|
Client ID used for OIDC backends
|
|
1230
1229
|
"""
|
|
1231
1230
|
return pulumi.get(self, "oidc_client_id")
|
|
1232
1231
|
|
|
1233
|
-
@property
|
|
1232
|
+
@_builtins.property
|
|
1234
1233
|
@pulumi.getter(name="oidcClientSecret")
|
|
1235
|
-
def oidc_client_secret(self) -> pulumi.Output[Optional[
|
|
1234
|
+
def oidc_client_secret(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1236
1235
|
"""
|
|
1237
1236
|
Client Secret used for OIDC backends
|
|
1238
1237
|
"""
|
|
1239
1238
|
return pulumi.get(self, "oidc_client_secret")
|
|
1240
1239
|
|
|
1241
|
-
@property
|
|
1240
|
+
@_builtins.property
|
|
1242
1241
|
@pulumi.getter(name="oidcDiscoveryCaPem")
|
|
1243
|
-
def oidc_discovery_ca_pem(self) -> pulumi.Output[Optional[
|
|
1242
|
+
def oidc_discovery_ca_pem(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1244
1243
|
"""
|
|
1245
1244
|
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
1246
1245
|
"""
|
|
1247
1246
|
return pulumi.get(self, "oidc_discovery_ca_pem")
|
|
1248
1247
|
|
|
1249
|
-
@property
|
|
1248
|
+
@_builtins.property
|
|
1250
1249
|
@pulumi.getter(name="oidcDiscoveryUrl")
|
|
1251
|
-
def oidc_discovery_url(self) -> pulumi.Output[Optional[
|
|
1250
|
+
def oidc_discovery_url(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1252
1251
|
"""
|
|
1253
1252
|
The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
1254
1253
|
"""
|
|
1255
1254
|
return pulumi.get(self, "oidc_discovery_url")
|
|
1256
1255
|
|
|
1257
|
-
@property
|
|
1256
|
+
@_builtins.property
|
|
1258
1257
|
@pulumi.getter(name="oidcResponseMode")
|
|
1259
|
-
def oidc_response_mode(self) -> pulumi.Output[Optional[
|
|
1258
|
+
def oidc_response_mode(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1260
1259
|
"""
|
|
1261
1260
|
The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
1262
1261
|
"""
|
|
1263
1262
|
return pulumi.get(self, "oidc_response_mode")
|
|
1264
1263
|
|
|
1265
|
-
@property
|
|
1264
|
+
@_builtins.property
|
|
1266
1265
|
@pulumi.getter(name="oidcResponseTypes")
|
|
1267
|
-
def oidc_response_types(self) -> pulumi.Output[Optional[Sequence[
|
|
1266
|
+
def oidc_response_types(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1268
1267
|
"""
|
|
1269
1268
|
List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
1270
1269
|
"""
|
|
1271
1270
|
return pulumi.get(self, "oidc_response_types")
|
|
1272
1271
|
|
|
1273
|
-
@property
|
|
1272
|
+
@_builtins.property
|
|
1274
1273
|
@pulumi.getter
|
|
1275
|
-
def path(self) -> pulumi.Output[Optional[
|
|
1274
|
+
def path(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1276
1275
|
"""
|
|
1277
1276
|
Path to mount the JWT/OIDC auth backend
|
|
1278
1277
|
"""
|
|
1279
1278
|
return pulumi.get(self, "path")
|
|
1280
1279
|
|
|
1281
|
-
@property
|
|
1280
|
+
@_builtins.property
|
|
1282
1281
|
@pulumi.getter(name="providerConfig")
|
|
1283
|
-
def provider_config(self) -> pulumi.Output[Optional[Mapping[str,
|
|
1282
|
+
def provider_config(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
|
|
1284
1283
|
"""
|
|
1285
1284
|
Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
1286
1285
|
"""
|
|
1287
1286
|
return pulumi.get(self, "provider_config")
|
|
1288
1287
|
|
|
1289
|
-
@property
|
|
1288
|
+
@_builtins.property
|
|
1290
1289
|
@pulumi.getter
|
|
1291
1290
|
def tune(self) -> pulumi.Output['outputs.AuthBackendTune']:
|
|
1292
1291
|
return pulumi.get(self, "tune")
|
|
1293
1292
|
|
|
1294
|
-
@property
|
|
1293
|
+
@_builtins.property
|
|
1295
1294
|
@pulumi.getter
|
|
1296
|
-
def type(self) -> pulumi.Output[Optional[
|
|
1295
|
+
def type(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1297
1296
|
"""
|
|
1298
1297
|
Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
1299
1298
|
"""
|