pulumi-vault 7.6.0a1764657486__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +1399 -0
- pulumi_vault/_inputs.py +2701 -0
- pulumi_vault/_utilities.py +331 -0
- pulumi_vault/ad/__init__.py +12 -0
- pulumi_vault/ad/get_access_credentials.py +177 -0
- pulumi_vault/ad/secret_backend.py +1916 -0
- pulumi_vault/ad/secret_library.py +546 -0
- pulumi_vault/ad/secret_role.py +499 -0
- pulumi_vault/alicloud/__init__.py +9 -0
- pulumi_vault/alicloud/auth_backend_role.py +866 -0
- pulumi_vault/approle/__init__.py +12 -0
- pulumi_vault/approle/auth_backend_login.py +571 -0
- pulumi_vault/approle/auth_backend_role.py +1082 -0
- pulumi_vault/approle/auth_backend_role_secret_id.py +796 -0
- pulumi_vault/approle/get_auth_backend_role_id.py +169 -0
- pulumi_vault/audit.py +499 -0
- pulumi_vault/audit_request_header.py +277 -0
- pulumi_vault/auth_backend.py +565 -0
- pulumi_vault/aws/__init__.py +22 -0
- pulumi_vault/aws/auth_backend_cert.py +420 -0
- pulumi_vault/aws/auth_backend_client.py +1259 -0
- pulumi_vault/aws/auth_backend_config_identity.py +494 -0
- pulumi_vault/aws/auth_backend_identity_whitelist.py +380 -0
- pulumi_vault/aws/auth_backend_login.py +1046 -0
- pulumi_vault/aws/auth_backend_role.py +1961 -0
- pulumi_vault/aws/auth_backend_role_tag.py +638 -0
- pulumi_vault/aws/auth_backend_roletag_blacklist.py +366 -0
- pulumi_vault/aws/auth_backend_sts_role.py +414 -0
- pulumi_vault/aws/get_access_credentials.py +369 -0
- pulumi_vault/aws/get_static_access_credentials.py +137 -0
- pulumi_vault/aws/secret_backend.py +2018 -0
- pulumi_vault/aws/secret_backend_role.py +1188 -0
- pulumi_vault/aws/secret_backend_static_role.py +639 -0
- pulumi_vault/azure/__init__.py +15 -0
- pulumi_vault/azure/_inputs.py +108 -0
- pulumi_vault/azure/auth_backend_config.py +1096 -0
- pulumi_vault/azure/auth_backend_role.py +1176 -0
- pulumi_vault/azure/backend.py +1793 -0
- pulumi_vault/azure/backend_role.py +883 -0
- pulumi_vault/azure/get_access_credentials.py +400 -0
- pulumi_vault/azure/outputs.py +107 -0
- pulumi_vault/cert_auth_backend_role.py +1539 -0
- pulumi_vault/config/__init__.py +9 -0
- pulumi_vault/config/__init__.pyi +164 -0
- pulumi_vault/config/_inputs.py +73 -0
- pulumi_vault/config/outputs.py +1225 -0
- pulumi_vault/config/ui_custom_message.py +530 -0
- pulumi_vault/config/vars.py +230 -0
- pulumi_vault/consul/__init__.py +10 -0
- pulumi_vault/consul/secret_backend.py +1517 -0
- pulumi_vault/consul/secret_backend_role.py +847 -0
- pulumi_vault/database/__init__.py +14 -0
- pulumi_vault/database/_inputs.py +11907 -0
- pulumi_vault/database/outputs.py +8496 -0
- pulumi_vault/database/secret_backend_connection.py +1676 -0
- pulumi_vault/database/secret_backend_role.py +840 -0
- pulumi_vault/database/secret_backend_static_role.py +881 -0
- pulumi_vault/database/secrets_mount.py +2160 -0
- pulumi_vault/egp_policy.py +399 -0
- pulumi_vault/gcp/__init__.py +17 -0
- pulumi_vault/gcp/_inputs.py +441 -0
- pulumi_vault/gcp/auth_backend.py +1486 -0
- pulumi_vault/gcp/auth_backend_role.py +1235 -0
- pulumi_vault/gcp/get_auth_backend_role.py +514 -0
- pulumi_vault/gcp/outputs.py +302 -0
- pulumi_vault/gcp/secret_backend.py +1807 -0
- pulumi_vault/gcp/secret_impersonated_account.py +484 -0
- pulumi_vault/gcp/secret_roleset.py +554 -0
- pulumi_vault/gcp/secret_static_account.py +557 -0
- pulumi_vault/generic/__init__.py +11 -0
- pulumi_vault/generic/endpoint.py +786 -0
- pulumi_vault/generic/get_secret.py +306 -0
- pulumi_vault/generic/secret.py +486 -0
- pulumi_vault/get_auth_backend.py +226 -0
- pulumi_vault/get_auth_backends.py +170 -0
- pulumi_vault/get_namespace.py +226 -0
- pulumi_vault/get_namespaces.py +202 -0
- pulumi_vault/get_nomad_access_token.py +210 -0
- pulumi_vault/get_policy_document.py +160 -0
- pulumi_vault/get_raft_autopilot_state.py +267 -0
- pulumi_vault/github/__init__.py +13 -0
- pulumi_vault/github/_inputs.py +225 -0
- pulumi_vault/github/auth_backend.py +1194 -0
- pulumi_vault/github/outputs.py +174 -0
- pulumi_vault/github/team.py +380 -0
- pulumi_vault/github/user.py +380 -0
- pulumi_vault/identity/__init__.py +35 -0
- pulumi_vault/identity/entity.py +447 -0
- pulumi_vault/identity/entity_alias.py +398 -0
- pulumi_vault/identity/entity_policies.py +455 -0
- pulumi_vault/identity/get_entity.py +384 -0
- pulumi_vault/identity/get_group.py +467 -0
- pulumi_vault/identity/get_oidc_client_creds.py +175 -0
- pulumi_vault/identity/get_oidc_openid_config.py +334 -0
- pulumi_vault/identity/get_oidc_public_keys.py +179 -0
- pulumi_vault/identity/group.py +805 -0
- pulumi_vault/identity/group_alias.py +386 -0
- pulumi_vault/identity/group_member_entity_ids.py +444 -0
- pulumi_vault/identity/group_member_group_ids.py +467 -0
- pulumi_vault/identity/group_policies.py +471 -0
- pulumi_vault/identity/mfa_duo.py +674 -0
- pulumi_vault/identity/mfa_login_enforcement.py +566 -0
- pulumi_vault/identity/mfa_okta.py +626 -0
- pulumi_vault/identity/mfa_pingid.py +616 -0
- pulumi_vault/identity/mfa_totp.py +758 -0
- pulumi_vault/identity/oidc.py +268 -0
- pulumi_vault/identity/oidc_assignment.py +375 -0
- pulumi_vault/identity/oidc_client.py +667 -0
- pulumi_vault/identity/oidc_key.py +474 -0
- pulumi_vault/identity/oidc_key_allowed_client_id.py +298 -0
- pulumi_vault/identity/oidc_provider.py +550 -0
- pulumi_vault/identity/oidc_role.py +543 -0
- pulumi_vault/identity/oidc_scope.py +355 -0
- pulumi_vault/identity/outputs.py +137 -0
- pulumi_vault/jwt/__init__.py +12 -0
- pulumi_vault/jwt/_inputs.py +225 -0
- pulumi_vault/jwt/auth_backend.py +1347 -0
- pulumi_vault/jwt/auth_backend_role.py +1847 -0
- pulumi_vault/jwt/outputs.py +174 -0
- pulumi_vault/kmip/__init__.py +11 -0
- pulumi_vault/kmip/secret_backend.py +1591 -0
- pulumi_vault/kmip/secret_role.py +1194 -0
- pulumi_vault/kmip/secret_scope.py +372 -0
- pulumi_vault/kubernetes/__init__.py +15 -0
- pulumi_vault/kubernetes/auth_backend_config.py +654 -0
- pulumi_vault/kubernetes/auth_backend_role.py +1031 -0
- pulumi_vault/kubernetes/get_auth_backend_config.py +280 -0
- pulumi_vault/kubernetes/get_auth_backend_role.py +470 -0
- pulumi_vault/kubernetes/get_service_account_token.py +344 -0
- pulumi_vault/kubernetes/secret_backend.py +1341 -0
- pulumi_vault/kubernetes/secret_backend_role.py +1140 -0
- pulumi_vault/kv/__init__.py +18 -0
- pulumi_vault/kv/_inputs.py +124 -0
- pulumi_vault/kv/get_secret.py +240 -0
- pulumi_vault/kv/get_secret_subkeys_v2.py +275 -0
- pulumi_vault/kv/get_secret_v2.py +315 -0
- pulumi_vault/kv/get_secrets_list.py +186 -0
- pulumi_vault/kv/get_secrets_list_v2.py +243 -0
- pulumi_vault/kv/outputs.py +102 -0
- pulumi_vault/kv/secret.py +397 -0
- pulumi_vault/kv/secret_backend_v2.py +455 -0
- pulumi_vault/kv/secret_v2.py +970 -0
- pulumi_vault/ldap/__init__.py +19 -0
- pulumi_vault/ldap/_inputs.py +225 -0
- pulumi_vault/ldap/auth_backend.py +2520 -0
- pulumi_vault/ldap/auth_backend_group.py +386 -0
- pulumi_vault/ldap/auth_backend_user.py +439 -0
- pulumi_vault/ldap/get_dynamic_credentials.py +181 -0
- pulumi_vault/ldap/get_static_credentials.py +192 -0
- pulumi_vault/ldap/outputs.py +174 -0
- pulumi_vault/ldap/secret_backend.py +2207 -0
- pulumi_vault/ldap/secret_backend_dynamic_role.py +767 -0
- pulumi_vault/ldap/secret_backend_library_set.py +552 -0
- pulumi_vault/ldap/secret_backend_static_role.py +541 -0
- pulumi_vault/managed/__init__.py +11 -0
- pulumi_vault/managed/_inputs.py +944 -0
- pulumi_vault/managed/keys.py +398 -0
- pulumi_vault/managed/outputs.py +667 -0
- pulumi_vault/mfa_duo.py +589 -0
- pulumi_vault/mfa_okta.py +623 -0
- pulumi_vault/mfa_pingid.py +670 -0
- pulumi_vault/mfa_totp.py +620 -0
- pulumi_vault/mongodbatlas/__init__.py +10 -0
- pulumi_vault/mongodbatlas/secret_backend.py +388 -0
- pulumi_vault/mongodbatlas/secret_role.py +726 -0
- pulumi_vault/mount.py +1262 -0
- pulumi_vault/namespace.py +452 -0
- pulumi_vault/nomad_secret_backend.py +1559 -0
- pulumi_vault/nomad_secret_role.py +489 -0
- pulumi_vault/oci_auth_backend.py +676 -0
- pulumi_vault/oci_auth_backend_role.py +852 -0
- pulumi_vault/okta/__init__.py +13 -0
- pulumi_vault/okta/_inputs.py +320 -0
- pulumi_vault/okta/auth_backend.py +1231 -0
- pulumi_vault/okta/auth_backend_group.py +369 -0
- pulumi_vault/okta/auth_backend_user.py +416 -0
- pulumi_vault/okta/outputs.py +244 -0
- pulumi_vault/outputs.py +502 -0
- pulumi_vault/pkisecret/__init__.py +38 -0
- pulumi_vault/pkisecret/_inputs.py +270 -0
- pulumi_vault/pkisecret/backend_acme_eab.py +550 -0
- pulumi_vault/pkisecret/backend_config_acme.py +690 -0
- pulumi_vault/pkisecret/backend_config_auto_tidy.py +1370 -0
- pulumi_vault/pkisecret/backend_config_cluster.py +370 -0
- pulumi_vault/pkisecret/backend_config_cmpv2.py +693 -0
- pulumi_vault/pkisecret/backend_config_est.py +756 -0
- pulumi_vault/pkisecret/backend_config_scep.py +738 -0
- pulumi_vault/pkisecret/get_backend_cert_metadata.py +277 -0
- pulumi_vault/pkisecret/get_backend_config_cmpv2.py +226 -0
- pulumi_vault/pkisecret/get_backend_config_est.py +251 -0
- pulumi_vault/pkisecret/get_backend_config_scep.py +271 -0
- pulumi_vault/pkisecret/get_backend_issuer.py +395 -0
- pulumi_vault/pkisecret/get_backend_issuers.py +192 -0
- pulumi_vault/pkisecret/get_backend_key.py +211 -0
- pulumi_vault/pkisecret/get_backend_keys.py +192 -0
- pulumi_vault/pkisecret/outputs.py +270 -0
- pulumi_vault/pkisecret/secret_backend_cert.py +1315 -0
- pulumi_vault/pkisecret/secret_backend_config_ca.py +386 -0
- pulumi_vault/pkisecret/secret_backend_config_issuers.py +392 -0
- pulumi_vault/pkisecret/secret_backend_config_urls.py +462 -0
- pulumi_vault/pkisecret/secret_backend_crl_config.py +846 -0
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +1629 -0
- pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +444 -0
- pulumi_vault/pkisecret/secret_backend_issuer.py +1089 -0
- pulumi_vault/pkisecret/secret_backend_key.py +613 -0
- pulumi_vault/pkisecret/secret_backend_role.py +2694 -0
- pulumi_vault/pkisecret/secret_backend_root_cert.py +2134 -0
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +2031 -0
- pulumi_vault/pkisecret/secret_backend_sign.py +1194 -0
- pulumi_vault/plugin.py +596 -0
- pulumi_vault/plugin_pinned_version.py +299 -0
- pulumi_vault/policy.py +279 -0
- pulumi_vault/provider.py +781 -0
- pulumi_vault/pulumi-plugin.json +5 -0
- pulumi_vault/py.typed +0 -0
- pulumi_vault/quota_lease_count.py +504 -0
- pulumi_vault/quota_rate_limit.py +751 -0
- pulumi_vault/rabbitmq/__init__.py +12 -0
- pulumi_vault/rabbitmq/_inputs.py +235 -0
- pulumi_vault/rabbitmq/outputs.py +144 -0
- pulumi_vault/rabbitmq/secret_backend.py +1437 -0
- pulumi_vault/rabbitmq/secret_backend_role.py +496 -0
- pulumi_vault/raft_autopilot.py +609 -0
- pulumi_vault/raft_snapshot_agent_config.py +1591 -0
- pulumi_vault/rgp_policy.py +349 -0
- pulumi_vault/saml/__init__.py +12 -0
- pulumi_vault/saml/_inputs.py +225 -0
- pulumi_vault/saml/auth_backend.py +811 -0
- pulumi_vault/saml/auth_backend_role.py +1068 -0
- pulumi_vault/saml/outputs.py +174 -0
- pulumi_vault/scep_auth_backend_role.py +908 -0
- pulumi_vault/secrets/__init__.py +18 -0
- pulumi_vault/secrets/_inputs.py +110 -0
- pulumi_vault/secrets/outputs.py +94 -0
- pulumi_vault/secrets/sync_association.py +450 -0
- pulumi_vault/secrets/sync_aws_destination.py +780 -0
- pulumi_vault/secrets/sync_azure_destination.py +736 -0
- pulumi_vault/secrets/sync_config.py +303 -0
- pulumi_vault/secrets/sync_gcp_destination.py +572 -0
- pulumi_vault/secrets/sync_gh_destination.py +688 -0
- pulumi_vault/secrets/sync_github_apps.py +376 -0
- pulumi_vault/secrets/sync_vercel_destination.py +603 -0
- pulumi_vault/ssh/__init__.py +13 -0
- pulumi_vault/ssh/_inputs.py +76 -0
- pulumi_vault/ssh/get_secret_backend_sign.py +294 -0
- pulumi_vault/ssh/outputs.py +51 -0
- pulumi_vault/ssh/secret_backend_ca.py +588 -0
- pulumi_vault/ssh/secret_backend_role.py +1493 -0
- pulumi_vault/terraformcloud/__init__.py +11 -0
- pulumi_vault/terraformcloud/secret_backend.py +1321 -0
- pulumi_vault/terraformcloud/secret_creds.py +445 -0
- pulumi_vault/terraformcloud/secret_role.py +563 -0
- pulumi_vault/token.py +1026 -0
- pulumi_vault/tokenauth/__init__.py +9 -0
- pulumi_vault/tokenauth/auth_backend_role.py +1135 -0
- pulumi_vault/transform/__init__.py +14 -0
- pulumi_vault/transform/alphabet.py +348 -0
- pulumi_vault/transform/get_decode.py +287 -0
- pulumi_vault/transform/get_encode.py +291 -0
- pulumi_vault/transform/role.py +350 -0
- pulumi_vault/transform/template.py +592 -0
- pulumi_vault/transform/transformation.py +608 -0
- pulumi_vault/transit/__init__.py +15 -0
- pulumi_vault/transit/get_cmac.py +256 -0
- pulumi_vault/transit/get_decrypt.py +181 -0
- pulumi_vault/transit/get_encrypt.py +174 -0
- pulumi_vault/transit/get_sign.py +328 -0
- pulumi_vault/transit/get_verify.py +373 -0
- pulumi_vault/transit/secret_backend_key.py +1202 -0
- pulumi_vault/transit/secret_cache_config.py +302 -0
- pulumi_vault-7.6.0a1764657486.dist-info/METADATA +92 -0
- pulumi_vault-7.6.0a1764657486.dist-info/RECORD +274 -0
- pulumi_vault-7.6.0a1764657486.dist-info/WHEEL +5 -0
- pulumi_vault-7.6.0a1764657486.dist-info/top_level.txt +1 -0
|
@@ -0,0 +1,2520 @@
|
|
|
1
|
+
# coding=utf-8
|
|
2
|
+
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
|
+
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
|
+
|
|
5
|
+
import builtins as _builtins
|
|
6
|
+
import warnings
|
|
7
|
+
import sys
|
|
8
|
+
import pulumi
|
|
9
|
+
import pulumi.runtime
|
|
10
|
+
from typing import Any, Mapping, Optional, Sequence, Union, overload
|
|
11
|
+
if sys.version_info >= (3, 11):
|
|
12
|
+
from typing import NotRequired, TypedDict, TypeAlias
|
|
13
|
+
else:
|
|
14
|
+
from typing_extensions import NotRequired, TypedDict, TypeAlias
|
|
15
|
+
from .. import _utilities
|
|
16
|
+
from . import outputs
|
|
17
|
+
from ._inputs import *
|
|
18
|
+
|
|
19
|
+
__all__ = ['AuthBackendArgs', 'AuthBackend']
|
|
20
|
+
|
|
21
|
+
@pulumi.input_type
|
|
22
|
+
class AuthBackendArgs:
|
|
23
|
+
def __init__(__self__, *,
|
|
24
|
+
url: pulumi.Input[_builtins.str],
|
|
25
|
+
alias_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
26
|
+
anonymous_group_search: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
27
|
+
binddn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
28
|
+
bindpass: Optional[pulumi.Input[_builtins.str]] = None,
|
|
29
|
+
case_sensitive_names: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
30
|
+
certificate: Optional[pulumi.Input[_builtins.str]] = None,
|
|
31
|
+
client_tls_cert: Optional[pulumi.Input[_builtins.str]] = None,
|
|
32
|
+
client_tls_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
33
|
+
connection_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
34
|
+
deny_null_bind: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
35
|
+
dereference_aliases: Optional[pulumi.Input[_builtins.str]] = None,
|
|
36
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
37
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
38
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
39
|
+
discoverdn: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
40
|
+
enable_samaccountname_login: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
41
|
+
groupattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
42
|
+
groupdn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
43
|
+
groupfilter: Optional[pulumi.Input[_builtins.str]] = None,
|
|
44
|
+
insecure_tls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
45
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
46
|
+
max_page_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
47
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
48
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
49
|
+
request_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
50
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
51
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
52
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
53
|
+
starttls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
54
|
+
tls_max_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
55
|
+
tls_min_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
56
|
+
token_bound_cidrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
57
|
+
token_explicit_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
58
|
+
token_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
59
|
+
token_no_default_policy: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
60
|
+
token_num_uses: Optional[pulumi.Input[_builtins.int]] = None,
|
|
61
|
+
token_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
62
|
+
token_policies: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
63
|
+
token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
64
|
+
token_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
65
|
+
tune: Optional[pulumi.Input['AuthBackendTuneArgs']] = None,
|
|
66
|
+
upndomain: Optional[pulumi.Input[_builtins.str]] = None,
|
|
67
|
+
use_token_groups: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
68
|
+
userattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
69
|
+
userdn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
70
|
+
userfilter: Optional[pulumi.Input[_builtins.str]] = None,
|
|
71
|
+
username_as_alias: Optional[pulumi.Input[_builtins.bool]] = None):
|
|
72
|
+
"""
|
|
73
|
+
The set of arguments for constructing a AuthBackend resource.
|
|
74
|
+
:param pulumi.Input[_builtins.str] url: The URL of the LDAP server
|
|
75
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] alias_metadata: The metadata to be tied to generated entity alias.
|
|
76
|
+
This should be a list or map containing the metadata in key value pairs.
|
|
77
|
+
:param pulumi.Input[_builtins.bool] anonymous_group_search: Allows anonymous group searches.
|
|
78
|
+
:param pulumi.Input[_builtins.str] binddn: DN of object to bind when performing user search
|
|
79
|
+
:param pulumi.Input[_builtins.str] bindpass: Password to use with `binddn` when performing user search
|
|
80
|
+
:param pulumi.Input[_builtins.bool] case_sensitive_names: Control case senstivity of objects fetched from LDAP, this is used for object matching in vault
|
|
81
|
+
:param pulumi.Input[_builtins.str] certificate: Trusted CA to validate TLS certificate
|
|
82
|
+
:param pulumi.Input[_builtins.int] connection_timeout: Timeout in seconds when connecting to LDAP before attempting to connect to the next server in the URL provided in `url` (integer: 30)
|
|
83
|
+
:param pulumi.Input[_builtins.bool] deny_null_bind: Prevents users from bypassing authentication when providing an empty password.
|
|
84
|
+
:param pulumi.Input[_builtins.str] dereference_aliases: Specifies how aliases are dereferenced during LDAP searches. Valid values are 'never','searching','finding', and 'always'.
|
|
85
|
+
:param pulumi.Input[_builtins.str] description: Description for the LDAP auth backend mount
|
|
86
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
87
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
88
|
+
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
89
|
+
:param pulumi.Input[_builtins.bool] discoverdn: Use anonymous bind to discover the bind DN of a user.
|
|
90
|
+
:param pulumi.Input[_builtins.bool] enable_samaccountname_login: Enables login using the sAMAccountName attribute.
|
|
91
|
+
:param pulumi.Input[_builtins.str] groupattr: LDAP attribute to follow on objects returned by groupfilter
|
|
92
|
+
:param pulumi.Input[_builtins.str] groupdn: Base DN under which to perform group search
|
|
93
|
+
:param pulumi.Input[_builtins.str] groupfilter: Go template used to construct group membership query
|
|
94
|
+
:param pulumi.Input[_builtins.bool] insecure_tls: Control whether or TLS certificates must be validated
|
|
95
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
96
|
+
:param pulumi.Input[_builtins.int] max_page_size: Sets the max page size for LDAP lookups, by default it's set to -1.
|
|
97
|
+
*Available only for Vault 1.11.11+, 1.12.7+, and 1.13.3+*.
|
|
98
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
99
|
+
The value should not contain leading or trailing forward slashes.
|
|
100
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
101
|
+
*Available only for Vault Enterprise*.
|
|
102
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the LDAP auth backend under
|
|
103
|
+
:param pulumi.Input[_builtins.int] request_timeout: The timeout(in sec) for requests to the LDAP server.
|
|
104
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
105
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
106
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
107
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
108
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
109
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
110
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
111
|
+
:param pulumi.Input[_builtins.bool] starttls: Control use of TLS when conecting to LDAP
|
|
112
|
+
:param pulumi.Input[_builtins.str] tls_max_version: Maximum acceptable version of TLS
|
|
113
|
+
:param pulumi.Input[_builtins.str] tls_min_version: Minimum acceptable version of TLS
|
|
114
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
|
|
115
|
+
:param pulumi.Input[_builtins.int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
|
|
116
|
+
:param pulumi.Input[_builtins.int] token_max_ttl: The maximum lifetime of the generated token
|
|
117
|
+
:param pulumi.Input[_builtins.bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
|
|
118
|
+
:param pulumi.Input[_builtins.int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
|
|
119
|
+
:param pulumi.Input[_builtins.int] token_period: Generated Token's Period
|
|
120
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_policies: Generated Token's Policies
|
|
121
|
+
:param pulumi.Input[_builtins.int] token_ttl: The initial ttl of the token to generate in seconds
|
|
122
|
+
:param pulumi.Input[_builtins.str] token_type: Specifies the type of tokens that should be returned by
|
|
123
|
+
the mount. Valid values are "default-service", "default-batch", "service", "batch".
|
|
124
|
+
:param pulumi.Input['AuthBackendTuneArgs'] tune: Extra configuration block. Structure is documented below.
|
|
125
|
+
|
|
126
|
+
The `tune` block is used to tune the auth backend:
|
|
127
|
+
:param pulumi.Input[_builtins.str] upndomain: The `userPrincipalDomain` used to construct the UPN string for the authenticating user.
|
|
128
|
+
:param pulumi.Input[_builtins.bool] use_token_groups: Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships
|
|
129
|
+
:param pulumi.Input[_builtins.str] userattr: Attribute on user object matching username passed in
|
|
130
|
+
:param pulumi.Input[_builtins.str] userdn: Base DN under which to perform user search
|
|
131
|
+
:param pulumi.Input[_builtins.str] userfilter: LDAP user search filter
|
|
132
|
+
:param pulumi.Input[_builtins.bool] username_as_alias: Force the auth method to use the username passed by the user as the alias name.
|
|
133
|
+
"""
|
|
134
|
+
pulumi.set(__self__, "url", url)
|
|
135
|
+
if alias_metadata is not None:
|
|
136
|
+
pulumi.set(__self__, "alias_metadata", alias_metadata)
|
|
137
|
+
if anonymous_group_search is not None:
|
|
138
|
+
pulumi.set(__self__, "anonymous_group_search", anonymous_group_search)
|
|
139
|
+
if binddn is not None:
|
|
140
|
+
pulumi.set(__self__, "binddn", binddn)
|
|
141
|
+
if bindpass is not None:
|
|
142
|
+
pulumi.set(__self__, "bindpass", bindpass)
|
|
143
|
+
if case_sensitive_names is not None:
|
|
144
|
+
pulumi.set(__self__, "case_sensitive_names", case_sensitive_names)
|
|
145
|
+
if certificate is not None:
|
|
146
|
+
pulumi.set(__self__, "certificate", certificate)
|
|
147
|
+
if client_tls_cert is not None:
|
|
148
|
+
pulumi.set(__self__, "client_tls_cert", client_tls_cert)
|
|
149
|
+
if client_tls_key is not None:
|
|
150
|
+
pulumi.set(__self__, "client_tls_key", client_tls_key)
|
|
151
|
+
if connection_timeout is not None:
|
|
152
|
+
pulumi.set(__self__, "connection_timeout", connection_timeout)
|
|
153
|
+
if deny_null_bind is not None:
|
|
154
|
+
pulumi.set(__self__, "deny_null_bind", deny_null_bind)
|
|
155
|
+
if dereference_aliases is not None:
|
|
156
|
+
pulumi.set(__self__, "dereference_aliases", dereference_aliases)
|
|
157
|
+
if description is not None:
|
|
158
|
+
pulumi.set(__self__, "description", description)
|
|
159
|
+
if disable_automated_rotation is not None:
|
|
160
|
+
pulumi.set(__self__, "disable_automated_rotation", disable_automated_rotation)
|
|
161
|
+
if disable_remount is not None:
|
|
162
|
+
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
163
|
+
if discoverdn is not None:
|
|
164
|
+
pulumi.set(__self__, "discoverdn", discoverdn)
|
|
165
|
+
if enable_samaccountname_login is not None:
|
|
166
|
+
pulumi.set(__self__, "enable_samaccountname_login", enable_samaccountname_login)
|
|
167
|
+
if groupattr is not None:
|
|
168
|
+
pulumi.set(__self__, "groupattr", groupattr)
|
|
169
|
+
if groupdn is not None:
|
|
170
|
+
pulumi.set(__self__, "groupdn", groupdn)
|
|
171
|
+
if groupfilter is not None:
|
|
172
|
+
pulumi.set(__self__, "groupfilter", groupfilter)
|
|
173
|
+
if insecure_tls is not None:
|
|
174
|
+
pulumi.set(__self__, "insecure_tls", insecure_tls)
|
|
175
|
+
if local is not None:
|
|
176
|
+
pulumi.set(__self__, "local", local)
|
|
177
|
+
if max_page_size is not None:
|
|
178
|
+
pulumi.set(__self__, "max_page_size", max_page_size)
|
|
179
|
+
if namespace is not None:
|
|
180
|
+
pulumi.set(__self__, "namespace", namespace)
|
|
181
|
+
if path is not None:
|
|
182
|
+
pulumi.set(__self__, "path", path)
|
|
183
|
+
if request_timeout is not None:
|
|
184
|
+
pulumi.set(__self__, "request_timeout", request_timeout)
|
|
185
|
+
if rotation_period is not None:
|
|
186
|
+
pulumi.set(__self__, "rotation_period", rotation_period)
|
|
187
|
+
if rotation_schedule is not None:
|
|
188
|
+
pulumi.set(__self__, "rotation_schedule", rotation_schedule)
|
|
189
|
+
if rotation_window is not None:
|
|
190
|
+
pulumi.set(__self__, "rotation_window", rotation_window)
|
|
191
|
+
if starttls is not None:
|
|
192
|
+
pulumi.set(__self__, "starttls", starttls)
|
|
193
|
+
if tls_max_version is not None:
|
|
194
|
+
pulumi.set(__self__, "tls_max_version", tls_max_version)
|
|
195
|
+
if tls_min_version is not None:
|
|
196
|
+
pulumi.set(__self__, "tls_min_version", tls_min_version)
|
|
197
|
+
if token_bound_cidrs is not None:
|
|
198
|
+
pulumi.set(__self__, "token_bound_cidrs", token_bound_cidrs)
|
|
199
|
+
if token_explicit_max_ttl is not None:
|
|
200
|
+
pulumi.set(__self__, "token_explicit_max_ttl", token_explicit_max_ttl)
|
|
201
|
+
if token_max_ttl is not None:
|
|
202
|
+
pulumi.set(__self__, "token_max_ttl", token_max_ttl)
|
|
203
|
+
if token_no_default_policy is not None:
|
|
204
|
+
pulumi.set(__self__, "token_no_default_policy", token_no_default_policy)
|
|
205
|
+
if token_num_uses is not None:
|
|
206
|
+
pulumi.set(__self__, "token_num_uses", token_num_uses)
|
|
207
|
+
if token_period is not None:
|
|
208
|
+
pulumi.set(__self__, "token_period", token_period)
|
|
209
|
+
if token_policies is not None:
|
|
210
|
+
pulumi.set(__self__, "token_policies", token_policies)
|
|
211
|
+
if token_ttl is not None:
|
|
212
|
+
pulumi.set(__self__, "token_ttl", token_ttl)
|
|
213
|
+
if token_type is not None:
|
|
214
|
+
pulumi.set(__self__, "token_type", token_type)
|
|
215
|
+
if tune is not None:
|
|
216
|
+
pulumi.set(__self__, "tune", tune)
|
|
217
|
+
if upndomain is not None:
|
|
218
|
+
pulumi.set(__self__, "upndomain", upndomain)
|
|
219
|
+
if use_token_groups is not None:
|
|
220
|
+
pulumi.set(__self__, "use_token_groups", use_token_groups)
|
|
221
|
+
if userattr is not None:
|
|
222
|
+
pulumi.set(__self__, "userattr", userattr)
|
|
223
|
+
if userdn is not None:
|
|
224
|
+
pulumi.set(__self__, "userdn", userdn)
|
|
225
|
+
if userfilter is not None:
|
|
226
|
+
pulumi.set(__self__, "userfilter", userfilter)
|
|
227
|
+
if username_as_alias is not None:
|
|
228
|
+
pulumi.set(__self__, "username_as_alias", username_as_alias)
|
|
229
|
+
|
|
230
|
+
@_builtins.property
|
|
231
|
+
@pulumi.getter
|
|
232
|
+
def url(self) -> pulumi.Input[_builtins.str]:
|
|
233
|
+
"""
|
|
234
|
+
The URL of the LDAP server
|
|
235
|
+
"""
|
|
236
|
+
return pulumi.get(self, "url")
|
|
237
|
+
|
|
238
|
+
@url.setter
|
|
239
|
+
def url(self, value: pulumi.Input[_builtins.str]):
|
|
240
|
+
pulumi.set(self, "url", value)
|
|
241
|
+
|
|
242
|
+
@_builtins.property
|
|
243
|
+
@pulumi.getter(name="aliasMetadata")
|
|
244
|
+
def alias_metadata(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
245
|
+
"""
|
|
246
|
+
The metadata to be tied to generated entity alias.
|
|
247
|
+
This should be a list or map containing the metadata in key value pairs.
|
|
248
|
+
"""
|
|
249
|
+
return pulumi.get(self, "alias_metadata")
|
|
250
|
+
|
|
251
|
+
@alias_metadata.setter
|
|
252
|
+
def alias_metadata(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
253
|
+
pulumi.set(self, "alias_metadata", value)
|
|
254
|
+
|
|
255
|
+
@_builtins.property
|
|
256
|
+
@pulumi.getter(name="anonymousGroupSearch")
|
|
257
|
+
def anonymous_group_search(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
258
|
+
"""
|
|
259
|
+
Allows anonymous group searches.
|
|
260
|
+
"""
|
|
261
|
+
return pulumi.get(self, "anonymous_group_search")
|
|
262
|
+
|
|
263
|
+
@anonymous_group_search.setter
|
|
264
|
+
def anonymous_group_search(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
265
|
+
pulumi.set(self, "anonymous_group_search", value)
|
|
266
|
+
|
|
267
|
+
@_builtins.property
|
|
268
|
+
@pulumi.getter
|
|
269
|
+
def binddn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
270
|
+
"""
|
|
271
|
+
DN of object to bind when performing user search
|
|
272
|
+
"""
|
|
273
|
+
return pulumi.get(self, "binddn")
|
|
274
|
+
|
|
275
|
+
@binddn.setter
|
|
276
|
+
def binddn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
277
|
+
pulumi.set(self, "binddn", value)
|
|
278
|
+
|
|
279
|
+
@_builtins.property
|
|
280
|
+
@pulumi.getter
|
|
281
|
+
def bindpass(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
282
|
+
"""
|
|
283
|
+
Password to use with `binddn` when performing user search
|
|
284
|
+
"""
|
|
285
|
+
return pulumi.get(self, "bindpass")
|
|
286
|
+
|
|
287
|
+
@bindpass.setter
|
|
288
|
+
def bindpass(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
289
|
+
pulumi.set(self, "bindpass", value)
|
|
290
|
+
|
|
291
|
+
@_builtins.property
|
|
292
|
+
@pulumi.getter(name="caseSensitiveNames")
|
|
293
|
+
def case_sensitive_names(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
294
|
+
"""
|
|
295
|
+
Control case senstivity of objects fetched from LDAP, this is used for object matching in vault
|
|
296
|
+
"""
|
|
297
|
+
return pulumi.get(self, "case_sensitive_names")
|
|
298
|
+
|
|
299
|
+
@case_sensitive_names.setter
|
|
300
|
+
def case_sensitive_names(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
301
|
+
pulumi.set(self, "case_sensitive_names", value)
|
|
302
|
+
|
|
303
|
+
@_builtins.property
|
|
304
|
+
@pulumi.getter
|
|
305
|
+
def certificate(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
306
|
+
"""
|
|
307
|
+
Trusted CA to validate TLS certificate
|
|
308
|
+
"""
|
|
309
|
+
return pulumi.get(self, "certificate")
|
|
310
|
+
|
|
311
|
+
@certificate.setter
|
|
312
|
+
def certificate(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
313
|
+
pulumi.set(self, "certificate", value)
|
|
314
|
+
|
|
315
|
+
@_builtins.property
|
|
316
|
+
@pulumi.getter(name="clientTlsCert")
|
|
317
|
+
def client_tls_cert(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
318
|
+
return pulumi.get(self, "client_tls_cert")
|
|
319
|
+
|
|
320
|
+
@client_tls_cert.setter
|
|
321
|
+
def client_tls_cert(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
322
|
+
pulumi.set(self, "client_tls_cert", value)
|
|
323
|
+
|
|
324
|
+
@_builtins.property
|
|
325
|
+
@pulumi.getter(name="clientTlsKey")
|
|
326
|
+
def client_tls_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
327
|
+
return pulumi.get(self, "client_tls_key")
|
|
328
|
+
|
|
329
|
+
@client_tls_key.setter
|
|
330
|
+
def client_tls_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
331
|
+
pulumi.set(self, "client_tls_key", value)
|
|
332
|
+
|
|
333
|
+
@_builtins.property
|
|
334
|
+
@pulumi.getter(name="connectionTimeout")
|
|
335
|
+
def connection_timeout(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
336
|
+
"""
|
|
337
|
+
Timeout in seconds when connecting to LDAP before attempting to connect to the next server in the URL provided in `url` (integer: 30)
|
|
338
|
+
"""
|
|
339
|
+
return pulumi.get(self, "connection_timeout")
|
|
340
|
+
|
|
341
|
+
@connection_timeout.setter
|
|
342
|
+
def connection_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
343
|
+
pulumi.set(self, "connection_timeout", value)
|
|
344
|
+
|
|
345
|
+
@_builtins.property
|
|
346
|
+
@pulumi.getter(name="denyNullBind")
|
|
347
|
+
def deny_null_bind(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
348
|
+
"""
|
|
349
|
+
Prevents users from bypassing authentication when providing an empty password.
|
|
350
|
+
"""
|
|
351
|
+
return pulumi.get(self, "deny_null_bind")
|
|
352
|
+
|
|
353
|
+
@deny_null_bind.setter
|
|
354
|
+
def deny_null_bind(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
355
|
+
pulumi.set(self, "deny_null_bind", value)
|
|
356
|
+
|
|
357
|
+
@_builtins.property
|
|
358
|
+
@pulumi.getter(name="dereferenceAliases")
|
|
359
|
+
def dereference_aliases(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
360
|
+
"""
|
|
361
|
+
Specifies how aliases are dereferenced during LDAP searches. Valid values are 'never','searching','finding', and 'always'.
|
|
362
|
+
"""
|
|
363
|
+
return pulumi.get(self, "dereference_aliases")
|
|
364
|
+
|
|
365
|
+
@dereference_aliases.setter
|
|
366
|
+
def dereference_aliases(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
367
|
+
pulumi.set(self, "dereference_aliases", value)
|
|
368
|
+
|
|
369
|
+
@_builtins.property
|
|
370
|
+
@pulumi.getter
|
|
371
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
372
|
+
"""
|
|
373
|
+
Description for the LDAP auth backend mount
|
|
374
|
+
"""
|
|
375
|
+
return pulumi.get(self, "description")
|
|
376
|
+
|
|
377
|
+
@description.setter
|
|
378
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
379
|
+
pulumi.set(self, "description", value)
|
|
380
|
+
|
|
381
|
+
@_builtins.property
|
|
382
|
+
@pulumi.getter(name="disableAutomatedRotation")
|
|
383
|
+
def disable_automated_rotation(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
384
|
+
"""
|
|
385
|
+
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
386
|
+
"""
|
|
387
|
+
return pulumi.get(self, "disable_automated_rotation")
|
|
388
|
+
|
|
389
|
+
@disable_automated_rotation.setter
|
|
390
|
+
def disable_automated_rotation(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
391
|
+
pulumi.set(self, "disable_automated_rotation", value)
|
|
392
|
+
|
|
393
|
+
@_builtins.property
|
|
394
|
+
@pulumi.getter(name="disableRemount")
|
|
395
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
396
|
+
"""
|
|
397
|
+
If set, opts out of mount migration on path updates.
|
|
398
|
+
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
399
|
+
"""
|
|
400
|
+
return pulumi.get(self, "disable_remount")
|
|
401
|
+
|
|
402
|
+
@disable_remount.setter
|
|
403
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
404
|
+
pulumi.set(self, "disable_remount", value)
|
|
405
|
+
|
|
406
|
+
@_builtins.property
|
|
407
|
+
@pulumi.getter
|
|
408
|
+
def discoverdn(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
409
|
+
"""
|
|
410
|
+
Use anonymous bind to discover the bind DN of a user.
|
|
411
|
+
"""
|
|
412
|
+
return pulumi.get(self, "discoverdn")
|
|
413
|
+
|
|
414
|
+
@discoverdn.setter
|
|
415
|
+
def discoverdn(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
416
|
+
pulumi.set(self, "discoverdn", value)
|
|
417
|
+
|
|
418
|
+
@_builtins.property
|
|
419
|
+
@pulumi.getter(name="enableSamaccountnameLogin")
|
|
420
|
+
def enable_samaccountname_login(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
421
|
+
"""
|
|
422
|
+
Enables login using the sAMAccountName attribute.
|
|
423
|
+
"""
|
|
424
|
+
return pulumi.get(self, "enable_samaccountname_login")
|
|
425
|
+
|
|
426
|
+
@enable_samaccountname_login.setter
|
|
427
|
+
def enable_samaccountname_login(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
428
|
+
pulumi.set(self, "enable_samaccountname_login", value)
|
|
429
|
+
|
|
430
|
+
@_builtins.property
|
|
431
|
+
@pulumi.getter
|
|
432
|
+
def groupattr(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
433
|
+
"""
|
|
434
|
+
LDAP attribute to follow on objects returned by groupfilter
|
|
435
|
+
"""
|
|
436
|
+
return pulumi.get(self, "groupattr")
|
|
437
|
+
|
|
438
|
+
@groupattr.setter
|
|
439
|
+
def groupattr(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
440
|
+
pulumi.set(self, "groupattr", value)
|
|
441
|
+
|
|
442
|
+
@_builtins.property
|
|
443
|
+
@pulumi.getter
|
|
444
|
+
def groupdn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
445
|
+
"""
|
|
446
|
+
Base DN under which to perform group search
|
|
447
|
+
"""
|
|
448
|
+
return pulumi.get(self, "groupdn")
|
|
449
|
+
|
|
450
|
+
@groupdn.setter
|
|
451
|
+
def groupdn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
452
|
+
pulumi.set(self, "groupdn", value)
|
|
453
|
+
|
|
454
|
+
@_builtins.property
|
|
455
|
+
@pulumi.getter
|
|
456
|
+
def groupfilter(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
457
|
+
"""
|
|
458
|
+
Go template used to construct group membership query
|
|
459
|
+
"""
|
|
460
|
+
return pulumi.get(self, "groupfilter")
|
|
461
|
+
|
|
462
|
+
@groupfilter.setter
|
|
463
|
+
def groupfilter(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
464
|
+
pulumi.set(self, "groupfilter", value)
|
|
465
|
+
|
|
466
|
+
@_builtins.property
|
|
467
|
+
@pulumi.getter(name="insecureTls")
|
|
468
|
+
def insecure_tls(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
469
|
+
"""
|
|
470
|
+
Control whether or TLS certificates must be validated
|
|
471
|
+
"""
|
|
472
|
+
return pulumi.get(self, "insecure_tls")
|
|
473
|
+
|
|
474
|
+
@insecure_tls.setter
|
|
475
|
+
def insecure_tls(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
476
|
+
pulumi.set(self, "insecure_tls", value)
|
|
477
|
+
|
|
478
|
+
@_builtins.property
|
|
479
|
+
@pulumi.getter
|
|
480
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
481
|
+
"""
|
|
482
|
+
Specifies if the auth method is local only.
|
|
483
|
+
"""
|
|
484
|
+
return pulumi.get(self, "local")
|
|
485
|
+
|
|
486
|
+
@local.setter
|
|
487
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
488
|
+
pulumi.set(self, "local", value)
|
|
489
|
+
|
|
490
|
+
@_builtins.property
|
|
491
|
+
@pulumi.getter(name="maxPageSize")
|
|
492
|
+
def max_page_size(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
493
|
+
"""
|
|
494
|
+
Sets the max page size for LDAP lookups, by default it's set to -1.
|
|
495
|
+
*Available only for Vault 1.11.11+, 1.12.7+, and 1.13.3+*.
|
|
496
|
+
"""
|
|
497
|
+
return pulumi.get(self, "max_page_size")
|
|
498
|
+
|
|
499
|
+
@max_page_size.setter
|
|
500
|
+
def max_page_size(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
501
|
+
pulumi.set(self, "max_page_size", value)
|
|
502
|
+
|
|
503
|
+
@_builtins.property
|
|
504
|
+
@pulumi.getter
|
|
505
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
506
|
+
"""
|
|
507
|
+
The namespace to provision the resource in.
|
|
508
|
+
The value should not contain leading or trailing forward slashes.
|
|
509
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
510
|
+
*Available only for Vault Enterprise*.
|
|
511
|
+
"""
|
|
512
|
+
return pulumi.get(self, "namespace")
|
|
513
|
+
|
|
514
|
+
@namespace.setter
|
|
515
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
516
|
+
pulumi.set(self, "namespace", value)
|
|
517
|
+
|
|
518
|
+
@_builtins.property
|
|
519
|
+
@pulumi.getter
|
|
520
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
521
|
+
"""
|
|
522
|
+
Path to mount the LDAP auth backend under
|
|
523
|
+
"""
|
|
524
|
+
return pulumi.get(self, "path")
|
|
525
|
+
|
|
526
|
+
@path.setter
|
|
527
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
528
|
+
pulumi.set(self, "path", value)
|
|
529
|
+
|
|
530
|
+
@_builtins.property
|
|
531
|
+
@pulumi.getter(name="requestTimeout")
|
|
532
|
+
def request_timeout(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
533
|
+
"""
|
|
534
|
+
The timeout(in sec) for requests to the LDAP server.
|
|
535
|
+
"""
|
|
536
|
+
return pulumi.get(self, "request_timeout")
|
|
537
|
+
|
|
538
|
+
@request_timeout.setter
|
|
539
|
+
def request_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
540
|
+
pulumi.set(self, "request_timeout", value)
|
|
541
|
+
|
|
542
|
+
@_builtins.property
|
|
543
|
+
@pulumi.getter(name="rotationPeriod")
|
|
544
|
+
def rotation_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
545
|
+
"""
|
|
546
|
+
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
547
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
548
|
+
"""
|
|
549
|
+
return pulumi.get(self, "rotation_period")
|
|
550
|
+
|
|
551
|
+
@rotation_period.setter
|
|
552
|
+
def rotation_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
553
|
+
pulumi.set(self, "rotation_period", value)
|
|
554
|
+
|
|
555
|
+
@_builtins.property
|
|
556
|
+
@pulumi.getter(name="rotationSchedule")
|
|
557
|
+
def rotation_schedule(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
558
|
+
"""
|
|
559
|
+
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
560
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
561
|
+
"""
|
|
562
|
+
return pulumi.get(self, "rotation_schedule")
|
|
563
|
+
|
|
564
|
+
@rotation_schedule.setter
|
|
565
|
+
def rotation_schedule(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
566
|
+
pulumi.set(self, "rotation_schedule", value)
|
|
567
|
+
|
|
568
|
+
@_builtins.property
|
|
569
|
+
@pulumi.getter(name="rotationWindow")
|
|
570
|
+
def rotation_window(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
571
|
+
"""
|
|
572
|
+
The maximum amount of time in seconds allowed to complete
|
|
573
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
574
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
575
|
+
"""
|
|
576
|
+
return pulumi.get(self, "rotation_window")
|
|
577
|
+
|
|
578
|
+
@rotation_window.setter
|
|
579
|
+
def rotation_window(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
580
|
+
pulumi.set(self, "rotation_window", value)
|
|
581
|
+
|
|
582
|
+
@_builtins.property
|
|
583
|
+
@pulumi.getter
|
|
584
|
+
def starttls(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
585
|
+
"""
|
|
586
|
+
Control use of TLS when conecting to LDAP
|
|
587
|
+
"""
|
|
588
|
+
return pulumi.get(self, "starttls")
|
|
589
|
+
|
|
590
|
+
@starttls.setter
|
|
591
|
+
def starttls(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
592
|
+
pulumi.set(self, "starttls", value)
|
|
593
|
+
|
|
594
|
+
@_builtins.property
|
|
595
|
+
@pulumi.getter(name="tlsMaxVersion")
|
|
596
|
+
def tls_max_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
597
|
+
"""
|
|
598
|
+
Maximum acceptable version of TLS
|
|
599
|
+
"""
|
|
600
|
+
return pulumi.get(self, "tls_max_version")
|
|
601
|
+
|
|
602
|
+
@tls_max_version.setter
|
|
603
|
+
def tls_max_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
604
|
+
pulumi.set(self, "tls_max_version", value)
|
|
605
|
+
|
|
606
|
+
@_builtins.property
|
|
607
|
+
@pulumi.getter(name="tlsMinVersion")
|
|
608
|
+
def tls_min_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
609
|
+
"""
|
|
610
|
+
Minimum acceptable version of TLS
|
|
611
|
+
"""
|
|
612
|
+
return pulumi.get(self, "tls_min_version")
|
|
613
|
+
|
|
614
|
+
@tls_min_version.setter
|
|
615
|
+
def tls_min_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
616
|
+
pulumi.set(self, "tls_min_version", value)
|
|
617
|
+
|
|
618
|
+
@_builtins.property
|
|
619
|
+
@pulumi.getter(name="tokenBoundCidrs")
|
|
620
|
+
def token_bound_cidrs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
621
|
+
"""
|
|
622
|
+
Specifies the blocks of IP addresses which are allowed to use the generated token
|
|
623
|
+
"""
|
|
624
|
+
return pulumi.get(self, "token_bound_cidrs")
|
|
625
|
+
|
|
626
|
+
@token_bound_cidrs.setter
|
|
627
|
+
def token_bound_cidrs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
628
|
+
pulumi.set(self, "token_bound_cidrs", value)
|
|
629
|
+
|
|
630
|
+
@_builtins.property
|
|
631
|
+
@pulumi.getter(name="tokenExplicitMaxTtl")
|
|
632
|
+
def token_explicit_max_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
633
|
+
"""
|
|
634
|
+
Generated Token's Explicit Maximum TTL in seconds
|
|
635
|
+
"""
|
|
636
|
+
return pulumi.get(self, "token_explicit_max_ttl")
|
|
637
|
+
|
|
638
|
+
@token_explicit_max_ttl.setter
|
|
639
|
+
def token_explicit_max_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
640
|
+
pulumi.set(self, "token_explicit_max_ttl", value)
|
|
641
|
+
|
|
642
|
+
@_builtins.property
|
|
643
|
+
@pulumi.getter(name="tokenMaxTtl")
|
|
644
|
+
def token_max_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
645
|
+
"""
|
|
646
|
+
The maximum lifetime of the generated token
|
|
647
|
+
"""
|
|
648
|
+
return pulumi.get(self, "token_max_ttl")
|
|
649
|
+
|
|
650
|
+
@token_max_ttl.setter
|
|
651
|
+
def token_max_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
652
|
+
pulumi.set(self, "token_max_ttl", value)
|
|
653
|
+
|
|
654
|
+
@_builtins.property
|
|
655
|
+
@pulumi.getter(name="tokenNoDefaultPolicy")
|
|
656
|
+
def token_no_default_policy(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
657
|
+
"""
|
|
658
|
+
If true, the 'default' policy will not automatically be added to generated tokens
|
|
659
|
+
"""
|
|
660
|
+
return pulumi.get(self, "token_no_default_policy")
|
|
661
|
+
|
|
662
|
+
@token_no_default_policy.setter
|
|
663
|
+
def token_no_default_policy(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
664
|
+
pulumi.set(self, "token_no_default_policy", value)
|
|
665
|
+
|
|
666
|
+
@_builtins.property
|
|
667
|
+
@pulumi.getter(name="tokenNumUses")
|
|
668
|
+
def token_num_uses(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
669
|
+
"""
|
|
670
|
+
The maximum number of times a token may be used, a value of zero means unlimited
|
|
671
|
+
"""
|
|
672
|
+
return pulumi.get(self, "token_num_uses")
|
|
673
|
+
|
|
674
|
+
@token_num_uses.setter
|
|
675
|
+
def token_num_uses(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
676
|
+
pulumi.set(self, "token_num_uses", value)
|
|
677
|
+
|
|
678
|
+
@_builtins.property
|
|
679
|
+
@pulumi.getter(name="tokenPeriod")
|
|
680
|
+
def token_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
681
|
+
"""
|
|
682
|
+
Generated Token's Period
|
|
683
|
+
"""
|
|
684
|
+
return pulumi.get(self, "token_period")
|
|
685
|
+
|
|
686
|
+
@token_period.setter
|
|
687
|
+
def token_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
688
|
+
pulumi.set(self, "token_period", value)
|
|
689
|
+
|
|
690
|
+
@_builtins.property
|
|
691
|
+
@pulumi.getter(name="tokenPolicies")
|
|
692
|
+
def token_policies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
693
|
+
"""
|
|
694
|
+
Generated Token's Policies
|
|
695
|
+
"""
|
|
696
|
+
return pulumi.get(self, "token_policies")
|
|
697
|
+
|
|
698
|
+
@token_policies.setter
|
|
699
|
+
def token_policies(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
700
|
+
pulumi.set(self, "token_policies", value)
|
|
701
|
+
|
|
702
|
+
@_builtins.property
|
|
703
|
+
@pulumi.getter(name="tokenTtl")
|
|
704
|
+
def token_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
705
|
+
"""
|
|
706
|
+
The initial ttl of the token to generate in seconds
|
|
707
|
+
"""
|
|
708
|
+
return pulumi.get(self, "token_ttl")
|
|
709
|
+
|
|
710
|
+
@token_ttl.setter
|
|
711
|
+
def token_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
712
|
+
pulumi.set(self, "token_ttl", value)
|
|
713
|
+
|
|
714
|
+
@_builtins.property
|
|
715
|
+
@pulumi.getter(name="tokenType")
|
|
716
|
+
def token_type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
717
|
+
"""
|
|
718
|
+
Specifies the type of tokens that should be returned by
|
|
719
|
+
the mount. Valid values are "default-service", "default-batch", "service", "batch".
|
|
720
|
+
"""
|
|
721
|
+
return pulumi.get(self, "token_type")
|
|
722
|
+
|
|
723
|
+
@token_type.setter
|
|
724
|
+
def token_type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
725
|
+
pulumi.set(self, "token_type", value)
|
|
726
|
+
|
|
727
|
+
@_builtins.property
|
|
728
|
+
@pulumi.getter
|
|
729
|
+
def tune(self) -> Optional[pulumi.Input['AuthBackendTuneArgs']]:
|
|
730
|
+
"""
|
|
731
|
+
Extra configuration block. Structure is documented below.
|
|
732
|
+
|
|
733
|
+
The `tune` block is used to tune the auth backend:
|
|
734
|
+
"""
|
|
735
|
+
return pulumi.get(self, "tune")
|
|
736
|
+
|
|
737
|
+
@tune.setter
|
|
738
|
+
def tune(self, value: Optional[pulumi.Input['AuthBackendTuneArgs']]):
|
|
739
|
+
pulumi.set(self, "tune", value)
|
|
740
|
+
|
|
741
|
+
@_builtins.property
|
|
742
|
+
@pulumi.getter
|
|
743
|
+
def upndomain(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
744
|
+
"""
|
|
745
|
+
The `userPrincipalDomain` used to construct the UPN string for the authenticating user.
|
|
746
|
+
"""
|
|
747
|
+
return pulumi.get(self, "upndomain")
|
|
748
|
+
|
|
749
|
+
@upndomain.setter
|
|
750
|
+
def upndomain(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
751
|
+
pulumi.set(self, "upndomain", value)
|
|
752
|
+
|
|
753
|
+
@_builtins.property
|
|
754
|
+
@pulumi.getter(name="useTokenGroups")
|
|
755
|
+
def use_token_groups(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
756
|
+
"""
|
|
757
|
+
Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships
|
|
758
|
+
"""
|
|
759
|
+
return pulumi.get(self, "use_token_groups")
|
|
760
|
+
|
|
761
|
+
@use_token_groups.setter
|
|
762
|
+
def use_token_groups(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
763
|
+
pulumi.set(self, "use_token_groups", value)
|
|
764
|
+
|
|
765
|
+
@_builtins.property
|
|
766
|
+
@pulumi.getter
|
|
767
|
+
def userattr(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
768
|
+
"""
|
|
769
|
+
Attribute on user object matching username passed in
|
|
770
|
+
"""
|
|
771
|
+
return pulumi.get(self, "userattr")
|
|
772
|
+
|
|
773
|
+
@userattr.setter
|
|
774
|
+
def userattr(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
775
|
+
pulumi.set(self, "userattr", value)
|
|
776
|
+
|
|
777
|
+
@_builtins.property
|
|
778
|
+
@pulumi.getter
|
|
779
|
+
def userdn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
780
|
+
"""
|
|
781
|
+
Base DN under which to perform user search
|
|
782
|
+
"""
|
|
783
|
+
return pulumi.get(self, "userdn")
|
|
784
|
+
|
|
785
|
+
@userdn.setter
|
|
786
|
+
def userdn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
787
|
+
pulumi.set(self, "userdn", value)
|
|
788
|
+
|
|
789
|
+
@_builtins.property
|
|
790
|
+
@pulumi.getter
|
|
791
|
+
def userfilter(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
792
|
+
"""
|
|
793
|
+
LDAP user search filter
|
|
794
|
+
"""
|
|
795
|
+
return pulumi.get(self, "userfilter")
|
|
796
|
+
|
|
797
|
+
@userfilter.setter
|
|
798
|
+
def userfilter(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
799
|
+
pulumi.set(self, "userfilter", value)
|
|
800
|
+
|
|
801
|
+
@_builtins.property
|
|
802
|
+
@pulumi.getter(name="usernameAsAlias")
|
|
803
|
+
def username_as_alias(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
804
|
+
"""
|
|
805
|
+
Force the auth method to use the username passed by the user as the alias name.
|
|
806
|
+
"""
|
|
807
|
+
return pulumi.get(self, "username_as_alias")
|
|
808
|
+
|
|
809
|
+
@username_as_alias.setter
|
|
810
|
+
def username_as_alias(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
811
|
+
pulumi.set(self, "username_as_alias", value)
|
|
812
|
+
|
|
813
|
+
|
|
814
|
+
@pulumi.input_type
|
|
815
|
+
class _AuthBackendState:
|
|
816
|
+
def __init__(__self__, *,
|
|
817
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
818
|
+
alias_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
819
|
+
anonymous_group_search: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
820
|
+
binddn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
821
|
+
bindpass: Optional[pulumi.Input[_builtins.str]] = None,
|
|
822
|
+
case_sensitive_names: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
823
|
+
certificate: Optional[pulumi.Input[_builtins.str]] = None,
|
|
824
|
+
client_tls_cert: Optional[pulumi.Input[_builtins.str]] = None,
|
|
825
|
+
client_tls_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
826
|
+
connection_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
827
|
+
deny_null_bind: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
828
|
+
dereference_aliases: Optional[pulumi.Input[_builtins.str]] = None,
|
|
829
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
830
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
831
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
832
|
+
discoverdn: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
833
|
+
enable_samaccountname_login: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
834
|
+
groupattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
835
|
+
groupdn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
836
|
+
groupfilter: Optional[pulumi.Input[_builtins.str]] = None,
|
|
837
|
+
insecure_tls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
838
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
839
|
+
max_page_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
840
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
841
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
842
|
+
request_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
843
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
844
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
845
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
846
|
+
starttls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
847
|
+
tls_max_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
848
|
+
tls_min_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
849
|
+
token_bound_cidrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
850
|
+
token_explicit_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
851
|
+
token_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
852
|
+
token_no_default_policy: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
853
|
+
token_num_uses: Optional[pulumi.Input[_builtins.int]] = None,
|
|
854
|
+
token_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
855
|
+
token_policies: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
856
|
+
token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
857
|
+
token_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
858
|
+
tune: Optional[pulumi.Input['AuthBackendTuneArgs']] = None,
|
|
859
|
+
upndomain: Optional[pulumi.Input[_builtins.str]] = None,
|
|
860
|
+
url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
861
|
+
use_token_groups: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
862
|
+
userattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
863
|
+
userdn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
864
|
+
userfilter: Optional[pulumi.Input[_builtins.str]] = None,
|
|
865
|
+
username_as_alias: Optional[pulumi.Input[_builtins.bool]] = None):
|
|
866
|
+
"""
|
|
867
|
+
Input properties used for looking up and filtering AuthBackend resources.
|
|
868
|
+
:param pulumi.Input[_builtins.str] accessor: The accessor for this auth mount.
|
|
869
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] alias_metadata: The metadata to be tied to generated entity alias.
|
|
870
|
+
This should be a list or map containing the metadata in key value pairs.
|
|
871
|
+
:param pulumi.Input[_builtins.bool] anonymous_group_search: Allows anonymous group searches.
|
|
872
|
+
:param pulumi.Input[_builtins.str] binddn: DN of object to bind when performing user search
|
|
873
|
+
:param pulumi.Input[_builtins.str] bindpass: Password to use with `binddn` when performing user search
|
|
874
|
+
:param pulumi.Input[_builtins.bool] case_sensitive_names: Control case senstivity of objects fetched from LDAP, this is used for object matching in vault
|
|
875
|
+
:param pulumi.Input[_builtins.str] certificate: Trusted CA to validate TLS certificate
|
|
876
|
+
:param pulumi.Input[_builtins.int] connection_timeout: Timeout in seconds when connecting to LDAP before attempting to connect to the next server in the URL provided in `url` (integer: 30)
|
|
877
|
+
:param pulumi.Input[_builtins.bool] deny_null_bind: Prevents users from bypassing authentication when providing an empty password.
|
|
878
|
+
:param pulumi.Input[_builtins.str] dereference_aliases: Specifies how aliases are dereferenced during LDAP searches. Valid values are 'never','searching','finding', and 'always'.
|
|
879
|
+
:param pulumi.Input[_builtins.str] description: Description for the LDAP auth backend mount
|
|
880
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
881
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
882
|
+
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
883
|
+
:param pulumi.Input[_builtins.bool] discoverdn: Use anonymous bind to discover the bind DN of a user.
|
|
884
|
+
:param pulumi.Input[_builtins.bool] enable_samaccountname_login: Enables login using the sAMAccountName attribute.
|
|
885
|
+
:param pulumi.Input[_builtins.str] groupattr: LDAP attribute to follow on objects returned by groupfilter
|
|
886
|
+
:param pulumi.Input[_builtins.str] groupdn: Base DN under which to perform group search
|
|
887
|
+
:param pulumi.Input[_builtins.str] groupfilter: Go template used to construct group membership query
|
|
888
|
+
:param pulumi.Input[_builtins.bool] insecure_tls: Control whether or TLS certificates must be validated
|
|
889
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
890
|
+
:param pulumi.Input[_builtins.int] max_page_size: Sets the max page size for LDAP lookups, by default it's set to -1.
|
|
891
|
+
*Available only for Vault 1.11.11+, 1.12.7+, and 1.13.3+*.
|
|
892
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
893
|
+
The value should not contain leading or trailing forward slashes.
|
|
894
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
895
|
+
*Available only for Vault Enterprise*.
|
|
896
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the LDAP auth backend under
|
|
897
|
+
:param pulumi.Input[_builtins.int] request_timeout: The timeout(in sec) for requests to the LDAP server.
|
|
898
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
899
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
900
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
901
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
902
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
903
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
904
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
905
|
+
:param pulumi.Input[_builtins.bool] starttls: Control use of TLS when conecting to LDAP
|
|
906
|
+
:param pulumi.Input[_builtins.str] tls_max_version: Maximum acceptable version of TLS
|
|
907
|
+
:param pulumi.Input[_builtins.str] tls_min_version: Minimum acceptable version of TLS
|
|
908
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
|
|
909
|
+
:param pulumi.Input[_builtins.int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
|
|
910
|
+
:param pulumi.Input[_builtins.int] token_max_ttl: The maximum lifetime of the generated token
|
|
911
|
+
:param pulumi.Input[_builtins.bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
|
|
912
|
+
:param pulumi.Input[_builtins.int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
|
|
913
|
+
:param pulumi.Input[_builtins.int] token_period: Generated Token's Period
|
|
914
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_policies: Generated Token's Policies
|
|
915
|
+
:param pulumi.Input[_builtins.int] token_ttl: The initial ttl of the token to generate in seconds
|
|
916
|
+
:param pulumi.Input[_builtins.str] token_type: Specifies the type of tokens that should be returned by
|
|
917
|
+
the mount. Valid values are "default-service", "default-batch", "service", "batch".
|
|
918
|
+
:param pulumi.Input['AuthBackendTuneArgs'] tune: Extra configuration block. Structure is documented below.
|
|
919
|
+
|
|
920
|
+
The `tune` block is used to tune the auth backend:
|
|
921
|
+
:param pulumi.Input[_builtins.str] upndomain: The `userPrincipalDomain` used to construct the UPN string for the authenticating user.
|
|
922
|
+
:param pulumi.Input[_builtins.str] url: The URL of the LDAP server
|
|
923
|
+
:param pulumi.Input[_builtins.bool] use_token_groups: Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships
|
|
924
|
+
:param pulumi.Input[_builtins.str] userattr: Attribute on user object matching username passed in
|
|
925
|
+
:param pulumi.Input[_builtins.str] userdn: Base DN under which to perform user search
|
|
926
|
+
:param pulumi.Input[_builtins.str] userfilter: LDAP user search filter
|
|
927
|
+
:param pulumi.Input[_builtins.bool] username_as_alias: Force the auth method to use the username passed by the user as the alias name.
|
|
928
|
+
"""
|
|
929
|
+
if accessor is not None:
|
|
930
|
+
pulumi.set(__self__, "accessor", accessor)
|
|
931
|
+
if alias_metadata is not None:
|
|
932
|
+
pulumi.set(__self__, "alias_metadata", alias_metadata)
|
|
933
|
+
if anonymous_group_search is not None:
|
|
934
|
+
pulumi.set(__self__, "anonymous_group_search", anonymous_group_search)
|
|
935
|
+
if binddn is not None:
|
|
936
|
+
pulumi.set(__self__, "binddn", binddn)
|
|
937
|
+
if bindpass is not None:
|
|
938
|
+
pulumi.set(__self__, "bindpass", bindpass)
|
|
939
|
+
if case_sensitive_names is not None:
|
|
940
|
+
pulumi.set(__self__, "case_sensitive_names", case_sensitive_names)
|
|
941
|
+
if certificate is not None:
|
|
942
|
+
pulumi.set(__self__, "certificate", certificate)
|
|
943
|
+
if client_tls_cert is not None:
|
|
944
|
+
pulumi.set(__self__, "client_tls_cert", client_tls_cert)
|
|
945
|
+
if client_tls_key is not None:
|
|
946
|
+
pulumi.set(__self__, "client_tls_key", client_tls_key)
|
|
947
|
+
if connection_timeout is not None:
|
|
948
|
+
pulumi.set(__self__, "connection_timeout", connection_timeout)
|
|
949
|
+
if deny_null_bind is not None:
|
|
950
|
+
pulumi.set(__self__, "deny_null_bind", deny_null_bind)
|
|
951
|
+
if dereference_aliases is not None:
|
|
952
|
+
pulumi.set(__self__, "dereference_aliases", dereference_aliases)
|
|
953
|
+
if description is not None:
|
|
954
|
+
pulumi.set(__self__, "description", description)
|
|
955
|
+
if disable_automated_rotation is not None:
|
|
956
|
+
pulumi.set(__self__, "disable_automated_rotation", disable_automated_rotation)
|
|
957
|
+
if disable_remount is not None:
|
|
958
|
+
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
959
|
+
if discoverdn is not None:
|
|
960
|
+
pulumi.set(__self__, "discoverdn", discoverdn)
|
|
961
|
+
if enable_samaccountname_login is not None:
|
|
962
|
+
pulumi.set(__self__, "enable_samaccountname_login", enable_samaccountname_login)
|
|
963
|
+
if groupattr is not None:
|
|
964
|
+
pulumi.set(__self__, "groupattr", groupattr)
|
|
965
|
+
if groupdn is not None:
|
|
966
|
+
pulumi.set(__self__, "groupdn", groupdn)
|
|
967
|
+
if groupfilter is not None:
|
|
968
|
+
pulumi.set(__self__, "groupfilter", groupfilter)
|
|
969
|
+
if insecure_tls is not None:
|
|
970
|
+
pulumi.set(__self__, "insecure_tls", insecure_tls)
|
|
971
|
+
if local is not None:
|
|
972
|
+
pulumi.set(__self__, "local", local)
|
|
973
|
+
if max_page_size is not None:
|
|
974
|
+
pulumi.set(__self__, "max_page_size", max_page_size)
|
|
975
|
+
if namespace is not None:
|
|
976
|
+
pulumi.set(__self__, "namespace", namespace)
|
|
977
|
+
if path is not None:
|
|
978
|
+
pulumi.set(__self__, "path", path)
|
|
979
|
+
if request_timeout is not None:
|
|
980
|
+
pulumi.set(__self__, "request_timeout", request_timeout)
|
|
981
|
+
if rotation_period is not None:
|
|
982
|
+
pulumi.set(__self__, "rotation_period", rotation_period)
|
|
983
|
+
if rotation_schedule is not None:
|
|
984
|
+
pulumi.set(__self__, "rotation_schedule", rotation_schedule)
|
|
985
|
+
if rotation_window is not None:
|
|
986
|
+
pulumi.set(__self__, "rotation_window", rotation_window)
|
|
987
|
+
if starttls is not None:
|
|
988
|
+
pulumi.set(__self__, "starttls", starttls)
|
|
989
|
+
if tls_max_version is not None:
|
|
990
|
+
pulumi.set(__self__, "tls_max_version", tls_max_version)
|
|
991
|
+
if tls_min_version is not None:
|
|
992
|
+
pulumi.set(__self__, "tls_min_version", tls_min_version)
|
|
993
|
+
if token_bound_cidrs is not None:
|
|
994
|
+
pulumi.set(__self__, "token_bound_cidrs", token_bound_cidrs)
|
|
995
|
+
if token_explicit_max_ttl is not None:
|
|
996
|
+
pulumi.set(__self__, "token_explicit_max_ttl", token_explicit_max_ttl)
|
|
997
|
+
if token_max_ttl is not None:
|
|
998
|
+
pulumi.set(__self__, "token_max_ttl", token_max_ttl)
|
|
999
|
+
if token_no_default_policy is not None:
|
|
1000
|
+
pulumi.set(__self__, "token_no_default_policy", token_no_default_policy)
|
|
1001
|
+
if token_num_uses is not None:
|
|
1002
|
+
pulumi.set(__self__, "token_num_uses", token_num_uses)
|
|
1003
|
+
if token_period is not None:
|
|
1004
|
+
pulumi.set(__self__, "token_period", token_period)
|
|
1005
|
+
if token_policies is not None:
|
|
1006
|
+
pulumi.set(__self__, "token_policies", token_policies)
|
|
1007
|
+
if token_ttl is not None:
|
|
1008
|
+
pulumi.set(__self__, "token_ttl", token_ttl)
|
|
1009
|
+
if token_type is not None:
|
|
1010
|
+
pulumi.set(__self__, "token_type", token_type)
|
|
1011
|
+
if tune is not None:
|
|
1012
|
+
pulumi.set(__self__, "tune", tune)
|
|
1013
|
+
if upndomain is not None:
|
|
1014
|
+
pulumi.set(__self__, "upndomain", upndomain)
|
|
1015
|
+
if url is not None:
|
|
1016
|
+
pulumi.set(__self__, "url", url)
|
|
1017
|
+
if use_token_groups is not None:
|
|
1018
|
+
pulumi.set(__self__, "use_token_groups", use_token_groups)
|
|
1019
|
+
if userattr is not None:
|
|
1020
|
+
pulumi.set(__self__, "userattr", userattr)
|
|
1021
|
+
if userdn is not None:
|
|
1022
|
+
pulumi.set(__self__, "userdn", userdn)
|
|
1023
|
+
if userfilter is not None:
|
|
1024
|
+
pulumi.set(__self__, "userfilter", userfilter)
|
|
1025
|
+
if username_as_alias is not None:
|
|
1026
|
+
pulumi.set(__self__, "username_as_alias", username_as_alias)
|
|
1027
|
+
|
|
1028
|
+
@_builtins.property
|
|
1029
|
+
@pulumi.getter
|
|
1030
|
+
def accessor(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1031
|
+
"""
|
|
1032
|
+
The accessor for this auth mount.
|
|
1033
|
+
"""
|
|
1034
|
+
return pulumi.get(self, "accessor")
|
|
1035
|
+
|
|
1036
|
+
@accessor.setter
|
|
1037
|
+
def accessor(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1038
|
+
pulumi.set(self, "accessor", value)
|
|
1039
|
+
|
|
1040
|
+
@_builtins.property
|
|
1041
|
+
@pulumi.getter(name="aliasMetadata")
|
|
1042
|
+
def alias_metadata(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
1043
|
+
"""
|
|
1044
|
+
The metadata to be tied to generated entity alias.
|
|
1045
|
+
This should be a list or map containing the metadata in key value pairs.
|
|
1046
|
+
"""
|
|
1047
|
+
return pulumi.get(self, "alias_metadata")
|
|
1048
|
+
|
|
1049
|
+
@alias_metadata.setter
|
|
1050
|
+
def alias_metadata(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
1051
|
+
pulumi.set(self, "alias_metadata", value)
|
|
1052
|
+
|
|
1053
|
+
@_builtins.property
|
|
1054
|
+
@pulumi.getter(name="anonymousGroupSearch")
|
|
1055
|
+
def anonymous_group_search(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1056
|
+
"""
|
|
1057
|
+
Allows anonymous group searches.
|
|
1058
|
+
"""
|
|
1059
|
+
return pulumi.get(self, "anonymous_group_search")
|
|
1060
|
+
|
|
1061
|
+
@anonymous_group_search.setter
|
|
1062
|
+
def anonymous_group_search(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1063
|
+
pulumi.set(self, "anonymous_group_search", value)
|
|
1064
|
+
|
|
1065
|
+
@_builtins.property
|
|
1066
|
+
@pulumi.getter
|
|
1067
|
+
def binddn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1068
|
+
"""
|
|
1069
|
+
DN of object to bind when performing user search
|
|
1070
|
+
"""
|
|
1071
|
+
return pulumi.get(self, "binddn")
|
|
1072
|
+
|
|
1073
|
+
@binddn.setter
|
|
1074
|
+
def binddn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1075
|
+
pulumi.set(self, "binddn", value)
|
|
1076
|
+
|
|
1077
|
+
@_builtins.property
|
|
1078
|
+
@pulumi.getter
|
|
1079
|
+
def bindpass(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1080
|
+
"""
|
|
1081
|
+
Password to use with `binddn` when performing user search
|
|
1082
|
+
"""
|
|
1083
|
+
return pulumi.get(self, "bindpass")
|
|
1084
|
+
|
|
1085
|
+
@bindpass.setter
|
|
1086
|
+
def bindpass(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1087
|
+
pulumi.set(self, "bindpass", value)
|
|
1088
|
+
|
|
1089
|
+
@_builtins.property
|
|
1090
|
+
@pulumi.getter(name="caseSensitiveNames")
|
|
1091
|
+
def case_sensitive_names(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1092
|
+
"""
|
|
1093
|
+
Control case senstivity of objects fetched from LDAP, this is used for object matching in vault
|
|
1094
|
+
"""
|
|
1095
|
+
return pulumi.get(self, "case_sensitive_names")
|
|
1096
|
+
|
|
1097
|
+
@case_sensitive_names.setter
|
|
1098
|
+
def case_sensitive_names(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1099
|
+
pulumi.set(self, "case_sensitive_names", value)
|
|
1100
|
+
|
|
1101
|
+
@_builtins.property
|
|
1102
|
+
@pulumi.getter
|
|
1103
|
+
def certificate(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1104
|
+
"""
|
|
1105
|
+
Trusted CA to validate TLS certificate
|
|
1106
|
+
"""
|
|
1107
|
+
return pulumi.get(self, "certificate")
|
|
1108
|
+
|
|
1109
|
+
@certificate.setter
|
|
1110
|
+
def certificate(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1111
|
+
pulumi.set(self, "certificate", value)
|
|
1112
|
+
|
|
1113
|
+
@_builtins.property
|
|
1114
|
+
@pulumi.getter(name="clientTlsCert")
|
|
1115
|
+
def client_tls_cert(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1116
|
+
return pulumi.get(self, "client_tls_cert")
|
|
1117
|
+
|
|
1118
|
+
@client_tls_cert.setter
|
|
1119
|
+
def client_tls_cert(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1120
|
+
pulumi.set(self, "client_tls_cert", value)
|
|
1121
|
+
|
|
1122
|
+
@_builtins.property
|
|
1123
|
+
@pulumi.getter(name="clientTlsKey")
|
|
1124
|
+
def client_tls_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1125
|
+
return pulumi.get(self, "client_tls_key")
|
|
1126
|
+
|
|
1127
|
+
@client_tls_key.setter
|
|
1128
|
+
def client_tls_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1129
|
+
pulumi.set(self, "client_tls_key", value)
|
|
1130
|
+
|
|
1131
|
+
@_builtins.property
|
|
1132
|
+
@pulumi.getter(name="connectionTimeout")
|
|
1133
|
+
def connection_timeout(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1134
|
+
"""
|
|
1135
|
+
Timeout in seconds when connecting to LDAP before attempting to connect to the next server in the URL provided in `url` (integer: 30)
|
|
1136
|
+
"""
|
|
1137
|
+
return pulumi.get(self, "connection_timeout")
|
|
1138
|
+
|
|
1139
|
+
@connection_timeout.setter
|
|
1140
|
+
def connection_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1141
|
+
pulumi.set(self, "connection_timeout", value)
|
|
1142
|
+
|
|
1143
|
+
@_builtins.property
|
|
1144
|
+
@pulumi.getter(name="denyNullBind")
|
|
1145
|
+
def deny_null_bind(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1146
|
+
"""
|
|
1147
|
+
Prevents users from bypassing authentication when providing an empty password.
|
|
1148
|
+
"""
|
|
1149
|
+
return pulumi.get(self, "deny_null_bind")
|
|
1150
|
+
|
|
1151
|
+
@deny_null_bind.setter
|
|
1152
|
+
def deny_null_bind(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1153
|
+
pulumi.set(self, "deny_null_bind", value)
|
|
1154
|
+
|
|
1155
|
+
@_builtins.property
|
|
1156
|
+
@pulumi.getter(name="dereferenceAliases")
|
|
1157
|
+
def dereference_aliases(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1158
|
+
"""
|
|
1159
|
+
Specifies how aliases are dereferenced during LDAP searches. Valid values are 'never','searching','finding', and 'always'.
|
|
1160
|
+
"""
|
|
1161
|
+
return pulumi.get(self, "dereference_aliases")
|
|
1162
|
+
|
|
1163
|
+
@dereference_aliases.setter
|
|
1164
|
+
def dereference_aliases(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1165
|
+
pulumi.set(self, "dereference_aliases", value)
|
|
1166
|
+
|
|
1167
|
+
@_builtins.property
|
|
1168
|
+
@pulumi.getter
|
|
1169
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1170
|
+
"""
|
|
1171
|
+
Description for the LDAP auth backend mount
|
|
1172
|
+
"""
|
|
1173
|
+
return pulumi.get(self, "description")
|
|
1174
|
+
|
|
1175
|
+
@description.setter
|
|
1176
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1177
|
+
pulumi.set(self, "description", value)
|
|
1178
|
+
|
|
1179
|
+
@_builtins.property
|
|
1180
|
+
@pulumi.getter(name="disableAutomatedRotation")
|
|
1181
|
+
def disable_automated_rotation(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1182
|
+
"""
|
|
1183
|
+
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
1184
|
+
"""
|
|
1185
|
+
return pulumi.get(self, "disable_automated_rotation")
|
|
1186
|
+
|
|
1187
|
+
@disable_automated_rotation.setter
|
|
1188
|
+
def disable_automated_rotation(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1189
|
+
pulumi.set(self, "disable_automated_rotation", value)
|
|
1190
|
+
|
|
1191
|
+
@_builtins.property
|
|
1192
|
+
@pulumi.getter(name="disableRemount")
|
|
1193
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1194
|
+
"""
|
|
1195
|
+
If set, opts out of mount migration on path updates.
|
|
1196
|
+
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1197
|
+
"""
|
|
1198
|
+
return pulumi.get(self, "disable_remount")
|
|
1199
|
+
|
|
1200
|
+
@disable_remount.setter
|
|
1201
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1202
|
+
pulumi.set(self, "disable_remount", value)
|
|
1203
|
+
|
|
1204
|
+
@_builtins.property
|
|
1205
|
+
@pulumi.getter
|
|
1206
|
+
def discoverdn(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1207
|
+
"""
|
|
1208
|
+
Use anonymous bind to discover the bind DN of a user.
|
|
1209
|
+
"""
|
|
1210
|
+
return pulumi.get(self, "discoverdn")
|
|
1211
|
+
|
|
1212
|
+
@discoverdn.setter
|
|
1213
|
+
def discoverdn(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1214
|
+
pulumi.set(self, "discoverdn", value)
|
|
1215
|
+
|
|
1216
|
+
@_builtins.property
|
|
1217
|
+
@pulumi.getter(name="enableSamaccountnameLogin")
|
|
1218
|
+
def enable_samaccountname_login(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1219
|
+
"""
|
|
1220
|
+
Enables login using the sAMAccountName attribute.
|
|
1221
|
+
"""
|
|
1222
|
+
return pulumi.get(self, "enable_samaccountname_login")
|
|
1223
|
+
|
|
1224
|
+
@enable_samaccountname_login.setter
|
|
1225
|
+
def enable_samaccountname_login(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1226
|
+
pulumi.set(self, "enable_samaccountname_login", value)
|
|
1227
|
+
|
|
1228
|
+
@_builtins.property
|
|
1229
|
+
@pulumi.getter
|
|
1230
|
+
def groupattr(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1231
|
+
"""
|
|
1232
|
+
LDAP attribute to follow on objects returned by groupfilter
|
|
1233
|
+
"""
|
|
1234
|
+
return pulumi.get(self, "groupattr")
|
|
1235
|
+
|
|
1236
|
+
@groupattr.setter
|
|
1237
|
+
def groupattr(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1238
|
+
pulumi.set(self, "groupattr", value)
|
|
1239
|
+
|
|
1240
|
+
@_builtins.property
|
|
1241
|
+
@pulumi.getter
|
|
1242
|
+
def groupdn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1243
|
+
"""
|
|
1244
|
+
Base DN under which to perform group search
|
|
1245
|
+
"""
|
|
1246
|
+
return pulumi.get(self, "groupdn")
|
|
1247
|
+
|
|
1248
|
+
@groupdn.setter
|
|
1249
|
+
def groupdn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1250
|
+
pulumi.set(self, "groupdn", value)
|
|
1251
|
+
|
|
1252
|
+
@_builtins.property
|
|
1253
|
+
@pulumi.getter
|
|
1254
|
+
def groupfilter(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1255
|
+
"""
|
|
1256
|
+
Go template used to construct group membership query
|
|
1257
|
+
"""
|
|
1258
|
+
return pulumi.get(self, "groupfilter")
|
|
1259
|
+
|
|
1260
|
+
@groupfilter.setter
|
|
1261
|
+
def groupfilter(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1262
|
+
pulumi.set(self, "groupfilter", value)
|
|
1263
|
+
|
|
1264
|
+
@_builtins.property
|
|
1265
|
+
@pulumi.getter(name="insecureTls")
|
|
1266
|
+
def insecure_tls(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1267
|
+
"""
|
|
1268
|
+
Control whether or TLS certificates must be validated
|
|
1269
|
+
"""
|
|
1270
|
+
return pulumi.get(self, "insecure_tls")
|
|
1271
|
+
|
|
1272
|
+
@insecure_tls.setter
|
|
1273
|
+
def insecure_tls(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1274
|
+
pulumi.set(self, "insecure_tls", value)
|
|
1275
|
+
|
|
1276
|
+
@_builtins.property
|
|
1277
|
+
@pulumi.getter
|
|
1278
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1279
|
+
"""
|
|
1280
|
+
Specifies if the auth method is local only.
|
|
1281
|
+
"""
|
|
1282
|
+
return pulumi.get(self, "local")
|
|
1283
|
+
|
|
1284
|
+
@local.setter
|
|
1285
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1286
|
+
pulumi.set(self, "local", value)
|
|
1287
|
+
|
|
1288
|
+
@_builtins.property
|
|
1289
|
+
@pulumi.getter(name="maxPageSize")
|
|
1290
|
+
def max_page_size(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1291
|
+
"""
|
|
1292
|
+
Sets the max page size for LDAP lookups, by default it's set to -1.
|
|
1293
|
+
*Available only for Vault 1.11.11+, 1.12.7+, and 1.13.3+*.
|
|
1294
|
+
"""
|
|
1295
|
+
return pulumi.get(self, "max_page_size")
|
|
1296
|
+
|
|
1297
|
+
@max_page_size.setter
|
|
1298
|
+
def max_page_size(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1299
|
+
pulumi.set(self, "max_page_size", value)
|
|
1300
|
+
|
|
1301
|
+
@_builtins.property
|
|
1302
|
+
@pulumi.getter
|
|
1303
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1304
|
+
"""
|
|
1305
|
+
The namespace to provision the resource in.
|
|
1306
|
+
The value should not contain leading or trailing forward slashes.
|
|
1307
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
1308
|
+
*Available only for Vault Enterprise*.
|
|
1309
|
+
"""
|
|
1310
|
+
return pulumi.get(self, "namespace")
|
|
1311
|
+
|
|
1312
|
+
@namespace.setter
|
|
1313
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1314
|
+
pulumi.set(self, "namespace", value)
|
|
1315
|
+
|
|
1316
|
+
@_builtins.property
|
|
1317
|
+
@pulumi.getter
|
|
1318
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1319
|
+
"""
|
|
1320
|
+
Path to mount the LDAP auth backend under
|
|
1321
|
+
"""
|
|
1322
|
+
return pulumi.get(self, "path")
|
|
1323
|
+
|
|
1324
|
+
@path.setter
|
|
1325
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1326
|
+
pulumi.set(self, "path", value)
|
|
1327
|
+
|
|
1328
|
+
@_builtins.property
|
|
1329
|
+
@pulumi.getter(name="requestTimeout")
|
|
1330
|
+
def request_timeout(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1331
|
+
"""
|
|
1332
|
+
The timeout(in sec) for requests to the LDAP server.
|
|
1333
|
+
"""
|
|
1334
|
+
return pulumi.get(self, "request_timeout")
|
|
1335
|
+
|
|
1336
|
+
@request_timeout.setter
|
|
1337
|
+
def request_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1338
|
+
pulumi.set(self, "request_timeout", value)
|
|
1339
|
+
|
|
1340
|
+
@_builtins.property
|
|
1341
|
+
@pulumi.getter(name="rotationPeriod")
|
|
1342
|
+
def rotation_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1343
|
+
"""
|
|
1344
|
+
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
1345
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
1346
|
+
"""
|
|
1347
|
+
return pulumi.get(self, "rotation_period")
|
|
1348
|
+
|
|
1349
|
+
@rotation_period.setter
|
|
1350
|
+
def rotation_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1351
|
+
pulumi.set(self, "rotation_period", value)
|
|
1352
|
+
|
|
1353
|
+
@_builtins.property
|
|
1354
|
+
@pulumi.getter(name="rotationSchedule")
|
|
1355
|
+
def rotation_schedule(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1356
|
+
"""
|
|
1357
|
+
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
1358
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
1359
|
+
"""
|
|
1360
|
+
return pulumi.get(self, "rotation_schedule")
|
|
1361
|
+
|
|
1362
|
+
@rotation_schedule.setter
|
|
1363
|
+
def rotation_schedule(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1364
|
+
pulumi.set(self, "rotation_schedule", value)
|
|
1365
|
+
|
|
1366
|
+
@_builtins.property
|
|
1367
|
+
@pulumi.getter(name="rotationWindow")
|
|
1368
|
+
def rotation_window(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1369
|
+
"""
|
|
1370
|
+
The maximum amount of time in seconds allowed to complete
|
|
1371
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
1372
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
1373
|
+
"""
|
|
1374
|
+
return pulumi.get(self, "rotation_window")
|
|
1375
|
+
|
|
1376
|
+
@rotation_window.setter
|
|
1377
|
+
def rotation_window(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1378
|
+
pulumi.set(self, "rotation_window", value)
|
|
1379
|
+
|
|
1380
|
+
@_builtins.property
|
|
1381
|
+
@pulumi.getter
|
|
1382
|
+
def starttls(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1383
|
+
"""
|
|
1384
|
+
Control use of TLS when conecting to LDAP
|
|
1385
|
+
"""
|
|
1386
|
+
return pulumi.get(self, "starttls")
|
|
1387
|
+
|
|
1388
|
+
@starttls.setter
|
|
1389
|
+
def starttls(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1390
|
+
pulumi.set(self, "starttls", value)
|
|
1391
|
+
|
|
1392
|
+
@_builtins.property
|
|
1393
|
+
@pulumi.getter(name="tlsMaxVersion")
|
|
1394
|
+
def tls_max_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1395
|
+
"""
|
|
1396
|
+
Maximum acceptable version of TLS
|
|
1397
|
+
"""
|
|
1398
|
+
return pulumi.get(self, "tls_max_version")
|
|
1399
|
+
|
|
1400
|
+
@tls_max_version.setter
|
|
1401
|
+
def tls_max_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1402
|
+
pulumi.set(self, "tls_max_version", value)
|
|
1403
|
+
|
|
1404
|
+
@_builtins.property
|
|
1405
|
+
@pulumi.getter(name="tlsMinVersion")
|
|
1406
|
+
def tls_min_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1407
|
+
"""
|
|
1408
|
+
Minimum acceptable version of TLS
|
|
1409
|
+
"""
|
|
1410
|
+
return pulumi.get(self, "tls_min_version")
|
|
1411
|
+
|
|
1412
|
+
@tls_min_version.setter
|
|
1413
|
+
def tls_min_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1414
|
+
pulumi.set(self, "tls_min_version", value)
|
|
1415
|
+
|
|
1416
|
+
@_builtins.property
|
|
1417
|
+
@pulumi.getter(name="tokenBoundCidrs")
|
|
1418
|
+
def token_bound_cidrs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
1419
|
+
"""
|
|
1420
|
+
Specifies the blocks of IP addresses which are allowed to use the generated token
|
|
1421
|
+
"""
|
|
1422
|
+
return pulumi.get(self, "token_bound_cidrs")
|
|
1423
|
+
|
|
1424
|
+
@token_bound_cidrs.setter
|
|
1425
|
+
def token_bound_cidrs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
1426
|
+
pulumi.set(self, "token_bound_cidrs", value)
|
|
1427
|
+
|
|
1428
|
+
@_builtins.property
|
|
1429
|
+
@pulumi.getter(name="tokenExplicitMaxTtl")
|
|
1430
|
+
def token_explicit_max_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1431
|
+
"""
|
|
1432
|
+
Generated Token's Explicit Maximum TTL in seconds
|
|
1433
|
+
"""
|
|
1434
|
+
return pulumi.get(self, "token_explicit_max_ttl")
|
|
1435
|
+
|
|
1436
|
+
@token_explicit_max_ttl.setter
|
|
1437
|
+
def token_explicit_max_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1438
|
+
pulumi.set(self, "token_explicit_max_ttl", value)
|
|
1439
|
+
|
|
1440
|
+
@_builtins.property
|
|
1441
|
+
@pulumi.getter(name="tokenMaxTtl")
|
|
1442
|
+
def token_max_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1443
|
+
"""
|
|
1444
|
+
The maximum lifetime of the generated token
|
|
1445
|
+
"""
|
|
1446
|
+
return pulumi.get(self, "token_max_ttl")
|
|
1447
|
+
|
|
1448
|
+
@token_max_ttl.setter
|
|
1449
|
+
def token_max_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1450
|
+
pulumi.set(self, "token_max_ttl", value)
|
|
1451
|
+
|
|
1452
|
+
@_builtins.property
|
|
1453
|
+
@pulumi.getter(name="tokenNoDefaultPolicy")
|
|
1454
|
+
def token_no_default_policy(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1455
|
+
"""
|
|
1456
|
+
If true, the 'default' policy will not automatically be added to generated tokens
|
|
1457
|
+
"""
|
|
1458
|
+
return pulumi.get(self, "token_no_default_policy")
|
|
1459
|
+
|
|
1460
|
+
@token_no_default_policy.setter
|
|
1461
|
+
def token_no_default_policy(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1462
|
+
pulumi.set(self, "token_no_default_policy", value)
|
|
1463
|
+
|
|
1464
|
+
@_builtins.property
|
|
1465
|
+
@pulumi.getter(name="tokenNumUses")
|
|
1466
|
+
def token_num_uses(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1467
|
+
"""
|
|
1468
|
+
The maximum number of times a token may be used, a value of zero means unlimited
|
|
1469
|
+
"""
|
|
1470
|
+
return pulumi.get(self, "token_num_uses")
|
|
1471
|
+
|
|
1472
|
+
@token_num_uses.setter
|
|
1473
|
+
def token_num_uses(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1474
|
+
pulumi.set(self, "token_num_uses", value)
|
|
1475
|
+
|
|
1476
|
+
@_builtins.property
|
|
1477
|
+
@pulumi.getter(name="tokenPeriod")
|
|
1478
|
+
def token_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1479
|
+
"""
|
|
1480
|
+
Generated Token's Period
|
|
1481
|
+
"""
|
|
1482
|
+
return pulumi.get(self, "token_period")
|
|
1483
|
+
|
|
1484
|
+
@token_period.setter
|
|
1485
|
+
def token_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1486
|
+
pulumi.set(self, "token_period", value)
|
|
1487
|
+
|
|
1488
|
+
@_builtins.property
|
|
1489
|
+
@pulumi.getter(name="tokenPolicies")
|
|
1490
|
+
def token_policies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
1491
|
+
"""
|
|
1492
|
+
Generated Token's Policies
|
|
1493
|
+
"""
|
|
1494
|
+
return pulumi.get(self, "token_policies")
|
|
1495
|
+
|
|
1496
|
+
@token_policies.setter
|
|
1497
|
+
def token_policies(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
1498
|
+
pulumi.set(self, "token_policies", value)
|
|
1499
|
+
|
|
1500
|
+
@_builtins.property
|
|
1501
|
+
@pulumi.getter(name="tokenTtl")
|
|
1502
|
+
def token_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
1503
|
+
"""
|
|
1504
|
+
The initial ttl of the token to generate in seconds
|
|
1505
|
+
"""
|
|
1506
|
+
return pulumi.get(self, "token_ttl")
|
|
1507
|
+
|
|
1508
|
+
@token_ttl.setter
|
|
1509
|
+
def token_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
1510
|
+
pulumi.set(self, "token_ttl", value)
|
|
1511
|
+
|
|
1512
|
+
@_builtins.property
|
|
1513
|
+
@pulumi.getter(name="tokenType")
|
|
1514
|
+
def token_type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1515
|
+
"""
|
|
1516
|
+
Specifies the type of tokens that should be returned by
|
|
1517
|
+
the mount. Valid values are "default-service", "default-batch", "service", "batch".
|
|
1518
|
+
"""
|
|
1519
|
+
return pulumi.get(self, "token_type")
|
|
1520
|
+
|
|
1521
|
+
@token_type.setter
|
|
1522
|
+
def token_type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1523
|
+
pulumi.set(self, "token_type", value)
|
|
1524
|
+
|
|
1525
|
+
@_builtins.property
|
|
1526
|
+
@pulumi.getter
|
|
1527
|
+
def tune(self) -> Optional[pulumi.Input['AuthBackendTuneArgs']]:
|
|
1528
|
+
"""
|
|
1529
|
+
Extra configuration block. Structure is documented below.
|
|
1530
|
+
|
|
1531
|
+
The `tune` block is used to tune the auth backend:
|
|
1532
|
+
"""
|
|
1533
|
+
return pulumi.get(self, "tune")
|
|
1534
|
+
|
|
1535
|
+
@tune.setter
|
|
1536
|
+
def tune(self, value: Optional[pulumi.Input['AuthBackendTuneArgs']]):
|
|
1537
|
+
pulumi.set(self, "tune", value)
|
|
1538
|
+
|
|
1539
|
+
@_builtins.property
|
|
1540
|
+
@pulumi.getter
|
|
1541
|
+
def upndomain(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1542
|
+
"""
|
|
1543
|
+
The `userPrincipalDomain` used to construct the UPN string for the authenticating user.
|
|
1544
|
+
"""
|
|
1545
|
+
return pulumi.get(self, "upndomain")
|
|
1546
|
+
|
|
1547
|
+
@upndomain.setter
|
|
1548
|
+
def upndomain(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1549
|
+
pulumi.set(self, "upndomain", value)
|
|
1550
|
+
|
|
1551
|
+
@_builtins.property
|
|
1552
|
+
@pulumi.getter
|
|
1553
|
+
def url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1554
|
+
"""
|
|
1555
|
+
The URL of the LDAP server
|
|
1556
|
+
"""
|
|
1557
|
+
return pulumi.get(self, "url")
|
|
1558
|
+
|
|
1559
|
+
@url.setter
|
|
1560
|
+
def url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1561
|
+
pulumi.set(self, "url", value)
|
|
1562
|
+
|
|
1563
|
+
@_builtins.property
|
|
1564
|
+
@pulumi.getter(name="useTokenGroups")
|
|
1565
|
+
def use_token_groups(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1566
|
+
"""
|
|
1567
|
+
Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships
|
|
1568
|
+
"""
|
|
1569
|
+
return pulumi.get(self, "use_token_groups")
|
|
1570
|
+
|
|
1571
|
+
@use_token_groups.setter
|
|
1572
|
+
def use_token_groups(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1573
|
+
pulumi.set(self, "use_token_groups", value)
|
|
1574
|
+
|
|
1575
|
+
@_builtins.property
|
|
1576
|
+
@pulumi.getter
|
|
1577
|
+
def userattr(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1578
|
+
"""
|
|
1579
|
+
Attribute on user object matching username passed in
|
|
1580
|
+
"""
|
|
1581
|
+
return pulumi.get(self, "userattr")
|
|
1582
|
+
|
|
1583
|
+
@userattr.setter
|
|
1584
|
+
def userattr(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1585
|
+
pulumi.set(self, "userattr", value)
|
|
1586
|
+
|
|
1587
|
+
@_builtins.property
|
|
1588
|
+
@pulumi.getter
|
|
1589
|
+
def userdn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1590
|
+
"""
|
|
1591
|
+
Base DN under which to perform user search
|
|
1592
|
+
"""
|
|
1593
|
+
return pulumi.get(self, "userdn")
|
|
1594
|
+
|
|
1595
|
+
@userdn.setter
|
|
1596
|
+
def userdn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1597
|
+
pulumi.set(self, "userdn", value)
|
|
1598
|
+
|
|
1599
|
+
@_builtins.property
|
|
1600
|
+
@pulumi.getter
|
|
1601
|
+
def userfilter(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1602
|
+
"""
|
|
1603
|
+
LDAP user search filter
|
|
1604
|
+
"""
|
|
1605
|
+
return pulumi.get(self, "userfilter")
|
|
1606
|
+
|
|
1607
|
+
@userfilter.setter
|
|
1608
|
+
def userfilter(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1609
|
+
pulumi.set(self, "userfilter", value)
|
|
1610
|
+
|
|
1611
|
+
@_builtins.property
|
|
1612
|
+
@pulumi.getter(name="usernameAsAlias")
|
|
1613
|
+
def username_as_alias(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1614
|
+
"""
|
|
1615
|
+
Force the auth method to use the username passed by the user as the alias name.
|
|
1616
|
+
"""
|
|
1617
|
+
return pulumi.get(self, "username_as_alias")
|
|
1618
|
+
|
|
1619
|
+
@username_as_alias.setter
|
|
1620
|
+
def username_as_alias(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1621
|
+
pulumi.set(self, "username_as_alias", value)
|
|
1622
|
+
|
|
1623
|
+
|
|
1624
|
+
@pulumi.type_token("vault:ldap/authBackend:AuthBackend")
|
|
1625
|
+
class AuthBackend(pulumi.CustomResource):
|
|
1626
|
+
@overload
|
|
1627
|
+
def __init__(__self__,
|
|
1628
|
+
resource_name: str,
|
|
1629
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1630
|
+
alias_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1631
|
+
anonymous_group_search: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1632
|
+
binddn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1633
|
+
bindpass: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1634
|
+
case_sensitive_names: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1635
|
+
certificate: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1636
|
+
client_tls_cert: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1637
|
+
client_tls_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1638
|
+
connection_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1639
|
+
deny_null_bind: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1640
|
+
dereference_aliases: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1641
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1642
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1643
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1644
|
+
discoverdn: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1645
|
+
enable_samaccountname_login: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1646
|
+
groupattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1647
|
+
groupdn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1648
|
+
groupfilter: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1649
|
+
insecure_tls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1650
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1651
|
+
max_page_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1652
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1653
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1654
|
+
request_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1655
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1656
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1657
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1658
|
+
starttls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1659
|
+
tls_max_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1660
|
+
tls_min_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1661
|
+
token_bound_cidrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1662
|
+
token_explicit_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1663
|
+
token_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1664
|
+
token_no_default_policy: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1665
|
+
token_num_uses: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1666
|
+
token_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1667
|
+
token_policies: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1668
|
+
token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1669
|
+
token_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1670
|
+
tune: Optional[pulumi.Input[Union['AuthBackendTuneArgs', 'AuthBackendTuneArgsDict']]] = None,
|
|
1671
|
+
upndomain: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1672
|
+
url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1673
|
+
use_token_groups: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1674
|
+
userattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1675
|
+
userdn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1676
|
+
userfilter: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1677
|
+
username_as_alias: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1678
|
+
__props__=None):
|
|
1679
|
+
"""
|
|
1680
|
+
Provides a resource for managing an [LDAP auth backend within Vault](https://www.vaultproject.io/docs/auth/ldap.html).
|
|
1681
|
+
|
|
1682
|
+
## Example Usage
|
|
1683
|
+
|
|
1684
|
+
```python
|
|
1685
|
+
import pulumi
|
|
1686
|
+
import pulumi_vault as vault
|
|
1687
|
+
|
|
1688
|
+
ldap = vault.ldap.AuthBackend("ldap",
|
|
1689
|
+
path="ldap",
|
|
1690
|
+
url="ldaps://dc-01.example.org",
|
|
1691
|
+
userdn="OU=Users,OU=Accounts,DC=example,DC=org",
|
|
1692
|
+
userattr="sAMAccountName",
|
|
1693
|
+
upndomain="EXAMPLE.ORG",
|
|
1694
|
+
discoverdn=False,
|
|
1695
|
+
groupdn="OU=Groups,DC=example,DC=org",
|
|
1696
|
+
groupfilter="(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))",
|
|
1697
|
+
rotation_schedule="0 * * * SAT",
|
|
1698
|
+
rotation_window=3600,
|
|
1699
|
+
request_timeout=30,
|
|
1700
|
+
dereference_aliases="always",
|
|
1701
|
+
enable_samaccountname_login=False,
|
|
1702
|
+
anonymous_group_search=False)
|
|
1703
|
+
```
|
|
1704
|
+
|
|
1705
|
+
## Import
|
|
1706
|
+
|
|
1707
|
+
LDAP authentication backends can be imported using the `path`, e.g.
|
|
1708
|
+
|
|
1709
|
+
```sh
|
|
1710
|
+
$ pulumi import vault:ldap/authBackend:AuthBackend ldap ldap
|
|
1711
|
+
```
|
|
1712
|
+
|
|
1713
|
+
:param str resource_name: The name of the resource.
|
|
1714
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1715
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] alias_metadata: The metadata to be tied to generated entity alias.
|
|
1716
|
+
This should be a list or map containing the metadata in key value pairs.
|
|
1717
|
+
:param pulumi.Input[_builtins.bool] anonymous_group_search: Allows anonymous group searches.
|
|
1718
|
+
:param pulumi.Input[_builtins.str] binddn: DN of object to bind when performing user search
|
|
1719
|
+
:param pulumi.Input[_builtins.str] bindpass: Password to use with `binddn` when performing user search
|
|
1720
|
+
:param pulumi.Input[_builtins.bool] case_sensitive_names: Control case senstivity of objects fetched from LDAP, this is used for object matching in vault
|
|
1721
|
+
:param pulumi.Input[_builtins.str] certificate: Trusted CA to validate TLS certificate
|
|
1722
|
+
:param pulumi.Input[_builtins.int] connection_timeout: Timeout in seconds when connecting to LDAP before attempting to connect to the next server in the URL provided in `url` (integer: 30)
|
|
1723
|
+
:param pulumi.Input[_builtins.bool] deny_null_bind: Prevents users from bypassing authentication when providing an empty password.
|
|
1724
|
+
:param pulumi.Input[_builtins.str] dereference_aliases: Specifies how aliases are dereferenced during LDAP searches. Valid values are 'never','searching','finding', and 'always'.
|
|
1725
|
+
:param pulumi.Input[_builtins.str] description: Description for the LDAP auth backend mount
|
|
1726
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
1727
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
1728
|
+
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1729
|
+
:param pulumi.Input[_builtins.bool] discoverdn: Use anonymous bind to discover the bind DN of a user.
|
|
1730
|
+
:param pulumi.Input[_builtins.bool] enable_samaccountname_login: Enables login using the sAMAccountName attribute.
|
|
1731
|
+
:param pulumi.Input[_builtins.str] groupattr: LDAP attribute to follow on objects returned by groupfilter
|
|
1732
|
+
:param pulumi.Input[_builtins.str] groupdn: Base DN under which to perform group search
|
|
1733
|
+
:param pulumi.Input[_builtins.str] groupfilter: Go template used to construct group membership query
|
|
1734
|
+
:param pulumi.Input[_builtins.bool] insecure_tls: Control whether or TLS certificates must be validated
|
|
1735
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
1736
|
+
:param pulumi.Input[_builtins.int] max_page_size: Sets the max page size for LDAP lookups, by default it's set to -1.
|
|
1737
|
+
*Available only for Vault 1.11.11+, 1.12.7+, and 1.13.3+*.
|
|
1738
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
1739
|
+
The value should not contain leading or trailing forward slashes.
|
|
1740
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
1741
|
+
*Available only for Vault Enterprise*.
|
|
1742
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the LDAP auth backend under
|
|
1743
|
+
:param pulumi.Input[_builtins.int] request_timeout: The timeout(in sec) for requests to the LDAP server.
|
|
1744
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
1745
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
1746
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
1747
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
1748
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
1749
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
1750
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
1751
|
+
:param pulumi.Input[_builtins.bool] starttls: Control use of TLS when conecting to LDAP
|
|
1752
|
+
:param pulumi.Input[_builtins.str] tls_max_version: Maximum acceptable version of TLS
|
|
1753
|
+
:param pulumi.Input[_builtins.str] tls_min_version: Minimum acceptable version of TLS
|
|
1754
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
|
|
1755
|
+
:param pulumi.Input[_builtins.int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
|
|
1756
|
+
:param pulumi.Input[_builtins.int] token_max_ttl: The maximum lifetime of the generated token
|
|
1757
|
+
:param pulumi.Input[_builtins.bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
|
|
1758
|
+
:param pulumi.Input[_builtins.int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
|
|
1759
|
+
:param pulumi.Input[_builtins.int] token_period: Generated Token's Period
|
|
1760
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_policies: Generated Token's Policies
|
|
1761
|
+
:param pulumi.Input[_builtins.int] token_ttl: The initial ttl of the token to generate in seconds
|
|
1762
|
+
:param pulumi.Input[_builtins.str] token_type: Specifies the type of tokens that should be returned by
|
|
1763
|
+
the mount. Valid values are "default-service", "default-batch", "service", "batch".
|
|
1764
|
+
:param pulumi.Input[Union['AuthBackendTuneArgs', 'AuthBackendTuneArgsDict']] tune: Extra configuration block. Structure is documented below.
|
|
1765
|
+
|
|
1766
|
+
The `tune` block is used to tune the auth backend:
|
|
1767
|
+
:param pulumi.Input[_builtins.str] upndomain: The `userPrincipalDomain` used to construct the UPN string for the authenticating user.
|
|
1768
|
+
:param pulumi.Input[_builtins.str] url: The URL of the LDAP server
|
|
1769
|
+
:param pulumi.Input[_builtins.bool] use_token_groups: Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships
|
|
1770
|
+
:param pulumi.Input[_builtins.str] userattr: Attribute on user object matching username passed in
|
|
1771
|
+
:param pulumi.Input[_builtins.str] userdn: Base DN under which to perform user search
|
|
1772
|
+
:param pulumi.Input[_builtins.str] userfilter: LDAP user search filter
|
|
1773
|
+
:param pulumi.Input[_builtins.bool] username_as_alias: Force the auth method to use the username passed by the user as the alias name.
|
|
1774
|
+
"""
|
|
1775
|
+
...
|
|
1776
|
+
@overload
|
|
1777
|
+
def __init__(__self__,
|
|
1778
|
+
resource_name: str,
|
|
1779
|
+
args: AuthBackendArgs,
|
|
1780
|
+
opts: Optional[pulumi.ResourceOptions] = None):
|
|
1781
|
+
"""
|
|
1782
|
+
Provides a resource for managing an [LDAP auth backend within Vault](https://www.vaultproject.io/docs/auth/ldap.html).
|
|
1783
|
+
|
|
1784
|
+
## Example Usage
|
|
1785
|
+
|
|
1786
|
+
```python
|
|
1787
|
+
import pulumi
|
|
1788
|
+
import pulumi_vault as vault
|
|
1789
|
+
|
|
1790
|
+
ldap = vault.ldap.AuthBackend("ldap",
|
|
1791
|
+
path="ldap",
|
|
1792
|
+
url="ldaps://dc-01.example.org",
|
|
1793
|
+
userdn="OU=Users,OU=Accounts,DC=example,DC=org",
|
|
1794
|
+
userattr="sAMAccountName",
|
|
1795
|
+
upndomain="EXAMPLE.ORG",
|
|
1796
|
+
discoverdn=False,
|
|
1797
|
+
groupdn="OU=Groups,DC=example,DC=org",
|
|
1798
|
+
groupfilter="(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))",
|
|
1799
|
+
rotation_schedule="0 * * * SAT",
|
|
1800
|
+
rotation_window=3600,
|
|
1801
|
+
request_timeout=30,
|
|
1802
|
+
dereference_aliases="always",
|
|
1803
|
+
enable_samaccountname_login=False,
|
|
1804
|
+
anonymous_group_search=False)
|
|
1805
|
+
```
|
|
1806
|
+
|
|
1807
|
+
## Import
|
|
1808
|
+
|
|
1809
|
+
LDAP authentication backends can be imported using the `path`, e.g.
|
|
1810
|
+
|
|
1811
|
+
```sh
|
|
1812
|
+
$ pulumi import vault:ldap/authBackend:AuthBackend ldap ldap
|
|
1813
|
+
```
|
|
1814
|
+
|
|
1815
|
+
:param str resource_name: The name of the resource.
|
|
1816
|
+
:param AuthBackendArgs args: The arguments to use to populate this resource's properties.
|
|
1817
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1818
|
+
"""
|
|
1819
|
+
...
|
|
1820
|
+
def __init__(__self__, resource_name: str, *args, **kwargs):
|
|
1821
|
+
resource_args, opts = _utilities.get_resource_args_opts(AuthBackendArgs, pulumi.ResourceOptions, *args, **kwargs)
|
|
1822
|
+
if resource_args is not None:
|
|
1823
|
+
__self__._internal_init(resource_name, opts, **resource_args.__dict__)
|
|
1824
|
+
else:
|
|
1825
|
+
__self__._internal_init(resource_name, *args, **kwargs)
|
|
1826
|
+
|
|
1827
|
+
def _internal_init(__self__,
|
|
1828
|
+
resource_name: str,
|
|
1829
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1830
|
+
alias_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1831
|
+
anonymous_group_search: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1832
|
+
binddn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1833
|
+
bindpass: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1834
|
+
case_sensitive_names: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1835
|
+
certificate: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1836
|
+
client_tls_cert: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1837
|
+
client_tls_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1838
|
+
connection_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1839
|
+
deny_null_bind: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1840
|
+
dereference_aliases: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1841
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1842
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1843
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1844
|
+
discoverdn: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1845
|
+
enable_samaccountname_login: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1846
|
+
groupattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1847
|
+
groupdn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1848
|
+
groupfilter: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1849
|
+
insecure_tls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1850
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1851
|
+
max_page_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1852
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1853
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1854
|
+
request_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1855
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1856
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1857
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1858
|
+
starttls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1859
|
+
tls_max_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1860
|
+
tls_min_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1861
|
+
token_bound_cidrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1862
|
+
token_explicit_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1863
|
+
token_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1864
|
+
token_no_default_policy: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1865
|
+
token_num_uses: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1866
|
+
token_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1867
|
+
token_policies: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1868
|
+
token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1869
|
+
token_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1870
|
+
tune: Optional[pulumi.Input[Union['AuthBackendTuneArgs', 'AuthBackendTuneArgsDict']]] = None,
|
|
1871
|
+
upndomain: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1872
|
+
url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1873
|
+
use_token_groups: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1874
|
+
userattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1875
|
+
userdn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1876
|
+
userfilter: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1877
|
+
username_as_alias: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1878
|
+
__props__=None):
|
|
1879
|
+
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
1880
|
+
if not isinstance(opts, pulumi.ResourceOptions):
|
|
1881
|
+
raise TypeError('Expected resource options to be a ResourceOptions instance')
|
|
1882
|
+
if opts.id is None:
|
|
1883
|
+
if __props__ is not None:
|
|
1884
|
+
raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
|
|
1885
|
+
__props__ = AuthBackendArgs.__new__(AuthBackendArgs)
|
|
1886
|
+
|
|
1887
|
+
__props__.__dict__["alias_metadata"] = alias_metadata
|
|
1888
|
+
__props__.__dict__["anonymous_group_search"] = anonymous_group_search
|
|
1889
|
+
__props__.__dict__["binddn"] = binddn
|
|
1890
|
+
__props__.__dict__["bindpass"] = None if bindpass is None else pulumi.Output.secret(bindpass)
|
|
1891
|
+
__props__.__dict__["case_sensitive_names"] = case_sensitive_names
|
|
1892
|
+
__props__.__dict__["certificate"] = certificate
|
|
1893
|
+
__props__.__dict__["client_tls_cert"] = client_tls_cert
|
|
1894
|
+
__props__.__dict__["client_tls_key"] = None if client_tls_key is None else pulumi.Output.secret(client_tls_key)
|
|
1895
|
+
__props__.__dict__["connection_timeout"] = connection_timeout
|
|
1896
|
+
__props__.__dict__["deny_null_bind"] = deny_null_bind
|
|
1897
|
+
__props__.__dict__["dereference_aliases"] = dereference_aliases
|
|
1898
|
+
__props__.__dict__["description"] = description
|
|
1899
|
+
__props__.__dict__["disable_automated_rotation"] = disable_automated_rotation
|
|
1900
|
+
__props__.__dict__["disable_remount"] = disable_remount
|
|
1901
|
+
__props__.__dict__["discoverdn"] = discoverdn
|
|
1902
|
+
__props__.__dict__["enable_samaccountname_login"] = enable_samaccountname_login
|
|
1903
|
+
__props__.__dict__["groupattr"] = groupattr
|
|
1904
|
+
__props__.__dict__["groupdn"] = groupdn
|
|
1905
|
+
__props__.__dict__["groupfilter"] = groupfilter
|
|
1906
|
+
__props__.__dict__["insecure_tls"] = insecure_tls
|
|
1907
|
+
__props__.__dict__["local"] = local
|
|
1908
|
+
__props__.__dict__["max_page_size"] = max_page_size
|
|
1909
|
+
__props__.__dict__["namespace"] = namespace
|
|
1910
|
+
__props__.__dict__["path"] = path
|
|
1911
|
+
__props__.__dict__["request_timeout"] = request_timeout
|
|
1912
|
+
__props__.__dict__["rotation_period"] = rotation_period
|
|
1913
|
+
__props__.__dict__["rotation_schedule"] = rotation_schedule
|
|
1914
|
+
__props__.__dict__["rotation_window"] = rotation_window
|
|
1915
|
+
__props__.__dict__["starttls"] = starttls
|
|
1916
|
+
__props__.__dict__["tls_max_version"] = tls_max_version
|
|
1917
|
+
__props__.__dict__["tls_min_version"] = tls_min_version
|
|
1918
|
+
__props__.__dict__["token_bound_cidrs"] = token_bound_cidrs
|
|
1919
|
+
__props__.__dict__["token_explicit_max_ttl"] = token_explicit_max_ttl
|
|
1920
|
+
__props__.__dict__["token_max_ttl"] = token_max_ttl
|
|
1921
|
+
__props__.__dict__["token_no_default_policy"] = token_no_default_policy
|
|
1922
|
+
__props__.__dict__["token_num_uses"] = token_num_uses
|
|
1923
|
+
__props__.__dict__["token_period"] = token_period
|
|
1924
|
+
__props__.__dict__["token_policies"] = token_policies
|
|
1925
|
+
__props__.__dict__["token_ttl"] = token_ttl
|
|
1926
|
+
__props__.__dict__["token_type"] = token_type
|
|
1927
|
+
__props__.__dict__["tune"] = tune
|
|
1928
|
+
__props__.__dict__["upndomain"] = upndomain
|
|
1929
|
+
if url is None and not opts.urn:
|
|
1930
|
+
raise TypeError("Missing required property 'url'")
|
|
1931
|
+
__props__.__dict__["url"] = url
|
|
1932
|
+
__props__.__dict__["use_token_groups"] = use_token_groups
|
|
1933
|
+
__props__.__dict__["userattr"] = userattr
|
|
1934
|
+
__props__.__dict__["userdn"] = userdn
|
|
1935
|
+
__props__.__dict__["userfilter"] = userfilter
|
|
1936
|
+
__props__.__dict__["username_as_alias"] = username_as_alias
|
|
1937
|
+
__props__.__dict__["accessor"] = None
|
|
1938
|
+
secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["bindpass", "clientTlsKey"])
|
|
1939
|
+
opts = pulumi.ResourceOptions.merge(opts, secret_opts)
|
|
1940
|
+
super(AuthBackend, __self__).__init__(
|
|
1941
|
+
'vault:ldap/authBackend:AuthBackend',
|
|
1942
|
+
resource_name,
|
|
1943
|
+
__props__,
|
|
1944
|
+
opts)
|
|
1945
|
+
|
|
1946
|
+
@staticmethod
|
|
1947
|
+
def get(resource_name: str,
|
|
1948
|
+
id: pulumi.Input[str],
|
|
1949
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1950
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1951
|
+
alias_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1952
|
+
anonymous_group_search: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1953
|
+
binddn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1954
|
+
bindpass: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1955
|
+
case_sensitive_names: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1956
|
+
certificate: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1957
|
+
client_tls_cert: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1958
|
+
client_tls_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1959
|
+
connection_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1960
|
+
deny_null_bind: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1961
|
+
dereference_aliases: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1962
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1963
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1964
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1965
|
+
discoverdn: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1966
|
+
enable_samaccountname_login: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1967
|
+
groupattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1968
|
+
groupdn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1969
|
+
groupfilter: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1970
|
+
insecure_tls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1971
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1972
|
+
max_page_size: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1973
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1974
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1975
|
+
request_timeout: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1976
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1977
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1978
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1979
|
+
starttls: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1980
|
+
tls_max_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1981
|
+
tls_min_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1982
|
+
token_bound_cidrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1983
|
+
token_explicit_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1984
|
+
token_max_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1985
|
+
token_no_default_policy: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1986
|
+
token_num_uses: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1987
|
+
token_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1988
|
+
token_policies: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1989
|
+
token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1990
|
+
token_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1991
|
+
tune: Optional[pulumi.Input[Union['AuthBackendTuneArgs', 'AuthBackendTuneArgsDict']]] = None,
|
|
1992
|
+
upndomain: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1993
|
+
url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1994
|
+
use_token_groups: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1995
|
+
userattr: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1996
|
+
userdn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1997
|
+
userfilter: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1998
|
+
username_as_alias: Optional[pulumi.Input[_builtins.bool]] = None) -> 'AuthBackend':
|
|
1999
|
+
"""
|
|
2000
|
+
Get an existing AuthBackend resource's state with the given name, id, and optional extra
|
|
2001
|
+
properties used to qualify the lookup.
|
|
2002
|
+
|
|
2003
|
+
:param str resource_name: The unique name of the resulting resource.
|
|
2004
|
+
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
2005
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
2006
|
+
:param pulumi.Input[_builtins.str] accessor: The accessor for this auth mount.
|
|
2007
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] alias_metadata: The metadata to be tied to generated entity alias.
|
|
2008
|
+
This should be a list or map containing the metadata in key value pairs.
|
|
2009
|
+
:param pulumi.Input[_builtins.bool] anonymous_group_search: Allows anonymous group searches.
|
|
2010
|
+
:param pulumi.Input[_builtins.str] binddn: DN of object to bind when performing user search
|
|
2011
|
+
:param pulumi.Input[_builtins.str] bindpass: Password to use with `binddn` when performing user search
|
|
2012
|
+
:param pulumi.Input[_builtins.bool] case_sensitive_names: Control case senstivity of objects fetched from LDAP, this is used for object matching in vault
|
|
2013
|
+
:param pulumi.Input[_builtins.str] certificate: Trusted CA to validate TLS certificate
|
|
2014
|
+
:param pulumi.Input[_builtins.int] connection_timeout: Timeout in seconds when connecting to LDAP before attempting to connect to the next server in the URL provided in `url` (integer: 30)
|
|
2015
|
+
:param pulumi.Input[_builtins.bool] deny_null_bind: Prevents users from bypassing authentication when providing an empty password.
|
|
2016
|
+
:param pulumi.Input[_builtins.str] dereference_aliases: Specifies how aliases are dereferenced during LDAP searches. Valid values are 'never','searching','finding', and 'always'.
|
|
2017
|
+
:param pulumi.Input[_builtins.str] description: Description for the LDAP auth backend mount
|
|
2018
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
2019
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
2020
|
+
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
2021
|
+
:param pulumi.Input[_builtins.bool] discoverdn: Use anonymous bind to discover the bind DN of a user.
|
|
2022
|
+
:param pulumi.Input[_builtins.bool] enable_samaccountname_login: Enables login using the sAMAccountName attribute.
|
|
2023
|
+
:param pulumi.Input[_builtins.str] groupattr: LDAP attribute to follow on objects returned by groupfilter
|
|
2024
|
+
:param pulumi.Input[_builtins.str] groupdn: Base DN under which to perform group search
|
|
2025
|
+
:param pulumi.Input[_builtins.str] groupfilter: Go template used to construct group membership query
|
|
2026
|
+
:param pulumi.Input[_builtins.bool] insecure_tls: Control whether or TLS certificates must be validated
|
|
2027
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
2028
|
+
:param pulumi.Input[_builtins.int] max_page_size: Sets the max page size for LDAP lookups, by default it's set to -1.
|
|
2029
|
+
*Available only for Vault 1.11.11+, 1.12.7+, and 1.13.3+*.
|
|
2030
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
2031
|
+
The value should not contain leading or trailing forward slashes.
|
|
2032
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
2033
|
+
*Available only for Vault Enterprise*.
|
|
2034
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the LDAP auth backend under
|
|
2035
|
+
:param pulumi.Input[_builtins.int] request_timeout: The timeout(in sec) for requests to the LDAP server.
|
|
2036
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
2037
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
2038
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
2039
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
2040
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
2041
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
2042
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
2043
|
+
:param pulumi.Input[_builtins.bool] starttls: Control use of TLS when conecting to LDAP
|
|
2044
|
+
:param pulumi.Input[_builtins.str] tls_max_version: Maximum acceptable version of TLS
|
|
2045
|
+
:param pulumi.Input[_builtins.str] tls_min_version: Minimum acceptable version of TLS
|
|
2046
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
|
|
2047
|
+
:param pulumi.Input[_builtins.int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
|
|
2048
|
+
:param pulumi.Input[_builtins.int] token_max_ttl: The maximum lifetime of the generated token
|
|
2049
|
+
:param pulumi.Input[_builtins.bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
|
|
2050
|
+
:param pulumi.Input[_builtins.int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
|
|
2051
|
+
:param pulumi.Input[_builtins.int] token_period: Generated Token's Period
|
|
2052
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] token_policies: Generated Token's Policies
|
|
2053
|
+
:param pulumi.Input[_builtins.int] token_ttl: The initial ttl of the token to generate in seconds
|
|
2054
|
+
:param pulumi.Input[_builtins.str] token_type: Specifies the type of tokens that should be returned by
|
|
2055
|
+
the mount. Valid values are "default-service", "default-batch", "service", "batch".
|
|
2056
|
+
:param pulumi.Input[Union['AuthBackendTuneArgs', 'AuthBackendTuneArgsDict']] tune: Extra configuration block. Structure is documented below.
|
|
2057
|
+
|
|
2058
|
+
The `tune` block is used to tune the auth backend:
|
|
2059
|
+
:param pulumi.Input[_builtins.str] upndomain: The `userPrincipalDomain` used to construct the UPN string for the authenticating user.
|
|
2060
|
+
:param pulumi.Input[_builtins.str] url: The URL of the LDAP server
|
|
2061
|
+
:param pulumi.Input[_builtins.bool] use_token_groups: Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships
|
|
2062
|
+
:param pulumi.Input[_builtins.str] userattr: Attribute on user object matching username passed in
|
|
2063
|
+
:param pulumi.Input[_builtins.str] userdn: Base DN under which to perform user search
|
|
2064
|
+
:param pulumi.Input[_builtins.str] userfilter: LDAP user search filter
|
|
2065
|
+
:param pulumi.Input[_builtins.bool] username_as_alias: Force the auth method to use the username passed by the user as the alias name.
|
|
2066
|
+
"""
|
|
2067
|
+
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
2068
|
+
|
|
2069
|
+
__props__ = _AuthBackendState.__new__(_AuthBackendState)
|
|
2070
|
+
|
|
2071
|
+
__props__.__dict__["accessor"] = accessor
|
|
2072
|
+
__props__.__dict__["alias_metadata"] = alias_metadata
|
|
2073
|
+
__props__.__dict__["anonymous_group_search"] = anonymous_group_search
|
|
2074
|
+
__props__.__dict__["binddn"] = binddn
|
|
2075
|
+
__props__.__dict__["bindpass"] = bindpass
|
|
2076
|
+
__props__.__dict__["case_sensitive_names"] = case_sensitive_names
|
|
2077
|
+
__props__.__dict__["certificate"] = certificate
|
|
2078
|
+
__props__.__dict__["client_tls_cert"] = client_tls_cert
|
|
2079
|
+
__props__.__dict__["client_tls_key"] = client_tls_key
|
|
2080
|
+
__props__.__dict__["connection_timeout"] = connection_timeout
|
|
2081
|
+
__props__.__dict__["deny_null_bind"] = deny_null_bind
|
|
2082
|
+
__props__.__dict__["dereference_aliases"] = dereference_aliases
|
|
2083
|
+
__props__.__dict__["description"] = description
|
|
2084
|
+
__props__.__dict__["disable_automated_rotation"] = disable_automated_rotation
|
|
2085
|
+
__props__.__dict__["disable_remount"] = disable_remount
|
|
2086
|
+
__props__.__dict__["discoverdn"] = discoverdn
|
|
2087
|
+
__props__.__dict__["enable_samaccountname_login"] = enable_samaccountname_login
|
|
2088
|
+
__props__.__dict__["groupattr"] = groupattr
|
|
2089
|
+
__props__.__dict__["groupdn"] = groupdn
|
|
2090
|
+
__props__.__dict__["groupfilter"] = groupfilter
|
|
2091
|
+
__props__.__dict__["insecure_tls"] = insecure_tls
|
|
2092
|
+
__props__.__dict__["local"] = local
|
|
2093
|
+
__props__.__dict__["max_page_size"] = max_page_size
|
|
2094
|
+
__props__.__dict__["namespace"] = namespace
|
|
2095
|
+
__props__.__dict__["path"] = path
|
|
2096
|
+
__props__.__dict__["request_timeout"] = request_timeout
|
|
2097
|
+
__props__.__dict__["rotation_period"] = rotation_period
|
|
2098
|
+
__props__.__dict__["rotation_schedule"] = rotation_schedule
|
|
2099
|
+
__props__.__dict__["rotation_window"] = rotation_window
|
|
2100
|
+
__props__.__dict__["starttls"] = starttls
|
|
2101
|
+
__props__.__dict__["tls_max_version"] = tls_max_version
|
|
2102
|
+
__props__.__dict__["tls_min_version"] = tls_min_version
|
|
2103
|
+
__props__.__dict__["token_bound_cidrs"] = token_bound_cidrs
|
|
2104
|
+
__props__.__dict__["token_explicit_max_ttl"] = token_explicit_max_ttl
|
|
2105
|
+
__props__.__dict__["token_max_ttl"] = token_max_ttl
|
|
2106
|
+
__props__.__dict__["token_no_default_policy"] = token_no_default_policy
|
|
2107
|
+
__props__.__dict__["token_num_uses"] = token_num_uses
|
|
2108
|
+
__props__.__dict__["token_period"] = token_period
|
|
2109
|
+
__props__.__dict__["token_policies"] = token_policies
|
|
2110
|
+
__props__.__dict__["token_ttl"] = token_ttl
|
|
2111
|
+
__props__.__dict__["token_type"] = token_type
|
|
2112
|
+
__props__.__dict__["tune"] = tune
|
|
2113
|
+
__props__.__dict__["upndomain"] = upndomain
|
|
2114
|
+
__props__.__dict__["url"] = url
|
|
2115
|
+
__props__.__dict__["use_token_groups"] = use_token_groups
|
|
2116
|
+
__props__.__dict__["userattr"] = userattr
|
|
2117
|
+
__props__.__dict__["userdn"] = userdn
|
|
2118
|
+
__props__.__dict__["userfilter"] = userfilter
|
|
2119
|
+
__props__.__dict__["username_as_alias"] = username_as_alias
|
|
2120
|
+
return AuthBackend(resource_name, opts=opts, __props__=__props__)
|
|
2121
|
+
|
|
2122
|
+
@_builtins.property
|
|
2123
|
+
@pulumi.getter
|
|
2124
|
+
def accessor(self) -> pulumi.Output[_builtins.str]:
|
|
2125
|
+
"""
|
|
2126
|
+
The accessor for this auth mount.
|
|
2127
|
+
"""
|
|
2128
|
+
return pulumi.get(self, "accessor")
|
|
2129
|
+
|
|
2130
|
+
@_builtins.property
|
|
2131
|
+
@pulumi.getter(name="aliasMetadata")
|
|
2132
|
+
def alias_metadata(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
|
|
2133
|
+
"""
|
|
2134
|
+
The metadata to be tied to generated entity alias.
|
|
2135
|
+
This should be a list or map containing the metadata in key value pairs.
|
|
2136
|
+
"""
|
|
2137
|
+
return pulumi.get(self, "alias_metadata")
|
|
2138
|
+
|
|
2139
|
+
@_builtins.property
|
|
2140
|
+
@pulumi.getter(name="anonymousGroupSearch")
|
|
2141
|
+
def anonymous_group_search(self) -> pulumi.Output[_builtins.bool]:
|
|
2142
|
+
"""
|
|
2143
|
+
Allows anonymous group searches.
|
|
2144
|
+
"""
|
|
2145
|
+
return pulumi.get(self, "anonymous_group_search")
|
|
2146
|
+
|
|
2147
|
+
@_builtins.property
|
|
2148
|
+
@pulumi.getter
|
|
2149
|
+
def binddn(self) -> pulumi.Output[_builtins.str]:
|
|
2150
|
+
"""
|
|
2151
|
+
DN of object to bind when performing user search
|
|
2152
|
+
"""
|
|
2153
|
+
return pulumi.get(self, "binddn")
|
|
2154
|
+
|
|
2155
|
+
@_builtins.property
|
|
2156
|
+
@pulumi.getter
|
|
2157
|
+
def bindpass(self) -> pulumi.Output[_builtins.str]:
|
|
2158
|
+
"""
|
|
2159
|
+
Password to use with `binddn` when performing user search
|
|
2160
|
+
"""
|
|
2161
|
+
return pulumi.get(self, "bindpass")
|
|
2162
|
+
|
|
2163
|
+
@_builtins.property
|
|
2164
|
+
@pulumi.getter(name="caseSensitiveNames")
|
|
2165
|
+
def case_sensitive_names(self) -> pulumi.Output[_builtins.bool]:
|
|
2166
|
+
"""
|
|
2167
|
+
Control case senstivity of objects fetched from LDAP, this is used for object matching in vault
|
|
2168
|
+
"""
|
|
2169
|
+
return pulumi.get(self, "case_sensitive_names")
|
|
2170
|
+
|
|
2171
|
+
@_builtins.property
|
|
2172
|
+
@pulumi.getter
|
|
2173
|
+
def certificate(self) -> pulumi.Output[_builtins.str]:
|
|
2174
|
+
"""
|
|
2175
|
+
Trusted CA to validate TLS certificate
|
|
2176
|
+
"""
|
|
2177
|
+
return pulumi.get(self, "certificate")
|
|
2178
|
+
|
|
2179
|
+
@_builtins.property
|
|
2180
|
+
@pulumi.getter(name="clientTlsCert")
|
|
2181
|
+
def client_tls_cert(self) -> pulumi.Output[_builtins.str]:
|
|
2182
|
+
return pulumi.get(self, "client_tls_cert")
|
|
2183
|
+
|
|
2184
|
+
@_builtins.property
|
|
2185
|
+
@pulumi.getter(name="clientTlsKey")
|
|
2186
|
+
def client_tls_key(self) -> pulumi.Output[_builtins.str]:
|
|
2187
|
+
return pulumi.get(self, "client_tls_key")
|
|
2188
|
+
|
|
2189
|
+
@_builtins.property
|
|
2190
|
+
@pulumi.getter(name="connectionTimeout")
|
|
2191
|
+
def connection_timeout(self) -> pulumi.Output[_builtins.int]:
|
|
2192
|
+
"""
|
|
2193
|
+
Timeout in seconds when connecting to LDAP before attempting to connect to the next server in the URL provided in `url` (integer: 30)
|
|
2194
|
+
"""
|
|
2195
|
+
return pulumi.get(self, "connection_timeout")
|
|
2196
|
+
|
|
2197
|
+
@_builtins.property
|
|
2198
|
+
@pulumi.getter(name="denyNullBind")
|
|
2199
|
+
def deny_null_bind(self) -> pulumi.Output[_builtins.bool]:
|
|
2200
|
+
"""
|
|
2201
|
+
Prevents users from bypassing authentication when providing an empty password.
|
|
2202
|
+
"""
|
|
2203
|
+
return pulumi.get(self, "deny_null_bind")
|
|
2204
|
+
|
|
2205
|
+
@_builtins.property
|
|
2206
|
+
@pulumi.getter(name="dereferenceAliases")
|
|
2207
|
+
def dereference_aliases(self) -> pulumi.Output[_builtins.str]:
|
|
2208
|
+
"""
|
|
2209
|
+
Specifies how aliases are dereferenced during LDAP searches. Valid values are 'never','searching','finding', and 'always'.
|
|
2210
|
+
"""
|
|
2211
|
+
return pulumi.get(self, "dereference_aliases")
|
|
2212
|
+
|
|
2213
|
+
@_builtins.property
|
|
2214
|
+
@pulumi.getter
|
|
2215
|
+
def description(self) -> pulumi.Output[_builtins.str]:
|
|
2216
|
+
"""
|
|
2217
|
+
Description for the LDAP auth backend mount
|
|
2218
|
+
"""
|
|
2219
|
+
return pulumi.get(self, "description")
|
|
2220
|
+
|
|
2221
|
+
@_builtins.property
|
|
2222
|
+
@pulumi.getter(name="disableAutomatedRotation")
|
|
2223
|
+
def disable_automated_rotation(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
2224
|
+
"""
|
|
2225
|
+
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
2226
|
+
"""
|
|
2227
|
+
return pulumi.get(self, "disable_automated_rotation")
|
|
2228
|
+
|
|
2229
|
+
@_builtins.property
|
|
2230
|
+
@pulumi.getter(name="disableRemount")
|
|
2231
|
+
def disable_remount(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
2232
|
+
"""
|
|
2233
|
+
If set, opts out of mount migration on path updates.
|
|
2234
|
+
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
2235
|
+
"""
|
|
2236
|
+
return pulumi.get(self, "disable_remount")
|
|
2237
|
+
|
|
2238
|
+
@_builtins.property
|
|
2239
|
+
@pulumi.getter
|
|
2240
|
+
def discoverdn(self) -> pulumi.Output[_builtins.bool]:
|
|
2241
|
+
"""
|
|
2242
|
+
Use anonymous bind to discover the bind DN of a user.
|
|
2243
|
+
"""
|
|
2244
|
+
return pulumi.get(self, "discoverdn")
|
|
2245
|
+
|
|
2246
|
+
@_builtins.property
|
|
2247
|
+
@pulumi.getter(name="enableSamaccountnameLogin")
|
|
2248
|
+
def enable_samaccountname_login(self) -> pulumi.Output[_builtins.bool]:
|
|
2249
|
+
"""
|
|
2250
|
+
Enables login using the sAMAccountName attribute.
|
|
2251
|
+
"""
|
|
2252
|
+
return pulumi.get(self, "enable_samaccountname_login")
|
|
2253
|
+
|
|
2254
|
+
@_builtins.property
|
|
2255
|
+
@pulumi.getter
|
|
2256
|
+
def groupattr(self) -> pulumi.Output[_builtins.str]:
|
|
2257
|
+
"""
|
|
2258
|
+
LDAP attribute to follow on objects returned by groupfilter
|
|
2259
|
+
"""
|
|
2260
|
+
return pulumi.get(self, "groupattr")
|
|
2261
|
+
|
|
2262
|
+
@_builtins.property
|
|
2263
|
+
@pulumi.getter
|
|
2264
|
+
def groupdn(self) -> pulumi.Output[_builtins.str]:
|
|
2265
|
+
"""
|
|
2266
|
+
Base DN under which to perform group search
|
|
2267
|
+
"""
|
|
2268
|
+
return pulumi.get(self, "groupdn")
|
|
2269
|
+
|
|
2270
|
+
@_builtins.property
|
|
2271
|
+
@pulumi.getter
|
|
2272
|
+
def groupfilter(self) -> pulumi.Output[_builtins.str]:
|
|
2273
|
+
"""
|
|
2274
|
+
Go template used to construct group membership query
|
|
2275
|
+
"""
|
|
2276
|
+
return pulumi.get(self, "groupfilter")
|
|
2277
|
+
|
|
2278
|
+
@_builtins.property
|
|
2279
|
+
@pulumi.getter(name="insecureTls")
|
|
2280
|
+
def insecure_tls(self) -> pulumi.Output[_builtins.bool]:
|
|
2281
|
+
"""
|
|
2282
|
+
Control whether or TLS certificates must be validated
|
|
2283
|
+
"""
|
|
2284
|
+
return pulumi.get(self, "insecure_tls")
|
|
2285
|
+
|
|
2286
|
+
@_builtins.property
|
|
2287
|
+
@pulumi.getter
|
|
2288
|
+
def local(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
2289
|
+
"""
|
|
2290
|
+
Specifies if the auth method is local only.
|
|
2291
|
+
"""
|
|
2292
|
+
return pulumi.get(self, "local")
|
|
2293
|
+
|
|
2294
|
+
@_builtins.property
|
|
2295
|
+
@pulumi.getter(name="maxPageSize")
|
|
2296
|
+
def max_page_size(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
2297
|
+
"""
|
|
2298
|
+
Sets the max page size for LDAP lookups, by default it's set to -1.
|
|
2299
|
+
*Available only for Vault 1.11.11+, 1.12.7+, and 1.13.3+*.
|
|
2300
|
+
"""
|
|
2301
|
+
return pulumi.get(self, "max_page_size")
|
|
2302
|
+
|
|
2303
|
+
@_builtins.property
|
|
2304
|
+
@pulumi.getter
|
|
2305
|
+
def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
2306
|
+
"""
|
|
2307
|
+
The namespace to provision the resource in.
|
|
2308
|
+
The value should not contain leading or trailing forward slashes.
|
|
2309
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
2310
|
+
*Available only for Vault Enterprise*.
|
|
2311
|
+
"""
|
|
2312
|
+
return pulumi.get(self, "namespace")
|
|
2313
|
+
|
|
2314
|
+
@_builtins.property
|
|
2315
|
+
@pulumi.getter
|
|
2316
|
+
def path(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
2317
|
+
"""
|
|
2318
|
+
Path to mount the LDAP auth backend under
|
|
2319
|
+
"""
|
|
2320
|
+
return pulumi.get(self, "path")
|
|
2321
|
+
|
|
2322
|
+
@_builtins.property
|
|
2323
|
+
@pulumi.getter(name="requestTimeout")
|
|
2324
|
+
def request_timeout(self) -> pulumi.Output[_builtins.int]:
|
|
2325
|
+
"""
|
|
2326
|
+
The timeout(in sec) for requests to the LDAP server.
|
|
2327
|
+
"""
|
|
2328
|
+
return pulumi.get(self, "request_timeout")
|
|
2329
|
+
|
|
2330
|
+
@_builtins.property
|
|
2331
|
+
@pulumi.getter(name="rotationPeriod")
|
|
2332
|
+
def rotation_period(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
2333
|
+
"""
|
|
2334
|
+
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
2335
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
2336
|
+
"""
|
|
2337
|
+
return pulumi.get(self, "rotation_period")
|
|
2338
|
+
|
|
2339
|
+
@_builtins.property
|
|
2340
|
+
@pulumi.getter(name="rotationSchedule")
|
|
2341
|
+
def rotation_schedule(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
2342
|
+
"""
|
|
2343
|
+
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
2344
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
2345
|
+
"""
|
|
2346
|
+
return pulumi.get(self, "rotation_schedule")
|
|
2347
|
+
|
|
2348
|
+
@_builtins.property
|
|
2349
|
+
@pulumi.getter(name="rotationWindow")
|
|
2350
|
+
def rotation_window(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
2351
|
+
"""
|
|
2352
|
+
The maximum amount of time in seconds allowed to complete
|
|
2353
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
2354
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
2355
|
+
"""
|
|
2356
|
+
return pulumi.get(self, "rotation_window")
|
|
2357
|
+
|
|
2358
|
+
@_builtins.property
|
|
2359
|
+
@pulumi.getter
|
|
2360
|
+
def starttls(self) -> pulumi.Output[_builtins.bool]:
|
|
2361
|
+
"""
|
|
2362
|
+
Control use of TLS when conecting to LDAP
|
|
2363
|
+
"""
|
|
2364
|
+
return pulumi.get(self, "starttls")
|
|
2365
|
+
|
|
2366
|
+
@_builtins.property
|
|
2367
|
+
@pulumi.getter(name="tlsMaxVersion")
|
|
2368
|
+
def tls_max_version(self) -> pulumi.Output[_builtins.str]:
|
|
2369
|
+
"""
|
|
2370
|
+
Maximum acceptable version of TLS
|
|
2371
|
+
"""
|
|
2372
|
+
return pulumi.get(self, "tls_max_version")
|
|
2373
|
+
|
|
2374
|
+
@_builtins.property
|
|
2375
|
+
@pulumi.getter(name="tlsMinVersion")
|
|
2376
|
+
def tls_min_version(self) -> pulumi.Output[_builtins.str]:
|
|
2377
|
+
"""
|
|
2378
|
+
Minimum acceptable version of TLS
|
|
2379
|
+
"""
|
|
2380
|
+
return pulumi.get(self, "tls_min_version")
|
|
2381
|
+
|
|
2382
|
+
@_builtins.property
|
|
2383
|
+
@pulumi.getter(name="tokenBoundCidrs")
|
|
2384
|
+
def token_bound_cidrs(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
2385
|
+
"""
|
|
2386
|
+
Specifies the blocks of IP addresses which are allowed to use the generated token
|
|
2387
|
+
"""
|
|
2388
|
+
return pulumi.get(self, "token_bound_cidrs")
|
|
2389
|
+
|
|
2390
|
+
@_builtins.property
|
|
2391
|
+
@pulumi.getter(name="tokenExplicitMaxTtl")
|
|
2392
|
+
def token_explicit_max_ttl(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
2393
|
+
"""
|
|
2394
|
+
Generated Token's Explicit Maximum TTL in seconds
|
|
2395
|
+
"""
|
|
2396
|
+
return pulumi.get(self, "token_explicit_max_ttl")
|
|
2397
|
+
|
|
2398
|
+
@_builtins.property
|
|
2399
|
+
@pulumi.getter(name="tokenMaxTtl")
|
|
2400
|
+
def token_max_ttl(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
2401
|
+
"""
|
|
2402
|
+
The maximum lifetime of the generated token
|
|
2403
|
+
"""
|
|
2404
|
+
return pulumi.get(self, "token_max_ttl")
|
|
2405
|
+
|
|
2406
|
+
@_builtins.property
|
|
2407
|
+
@pulumi.getter(name="tokenNoDefaultPolicy")
|
|
2408
|
+
def token_no_default_policy(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
2409
|
+
"""
|
|
2410
|
+
If true, the 'default' policy will not automatically be added to generated tokens
|
|
2411
|
+
"""
|
|
2412
|
+
return pulumi.get(self, "token_no_default_policy")
|
|
2413
|
+
|
|
2414
|
+
@_builtins.property
|
|
2415
|
+
@pulumi.getter(name="tokenNumUses")
|
|
2416
|
+
def token_num_uses(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
2417
|
+
"""
|
|
2418
|
+
The maximum number of times a token may be used, a value of zero means unlimited
|
|
2419
|
+
"""
|
|
2420
|
+
return pulumi.get(self, "token_num_uses")
|
|
2421
|
+
|
|
2422
|
+
@_builtins.property
|
|
2423
|
+
@pulumi.getter(name="tokenPeriod")
|
|
2424
|
+
def token_period(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
2425
|
+
"""
|
|
2426
|
+
Generated Token's Period
|
|
2427
|
+
"""
|
|
2428
|
+
return pulumi.get(self, "token_period")
|
|
2429
|
+
|
|
2430
|
+
@_builtins.property
|
|
2431
|
+
@pulumi.getter(name="tokenPolicies")
|
|
2432
|
+
def token_policies(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
2433
|
+
"""
|
|
2434
|
+
Generated Token's Policies
|
|
2435
|
+
"""
|
|
2436
|
+
return pulumi.get(self, "token_policies")
|
|
2437
|
+
|
|
2438
|
+
@_builtins.property
|
|
2439
|
+
@pulumi.getter(name="tokenTtl")
|
|
2440
|
+
def token_ttl(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
2441
|
+
"""
|
|
2442
|
+
The initial ttl of the token to generate in seconds
|
|
2443
|
+
"""
|
|
2444
|
+
return pulumi.get(self, "token_ttl")
|
|
2445
|
+
|
|
2446
|
+
@_builtins.property
|
|
2447
|
+
@pulumi.getter(name="tokenType")
|
|
2448
|
+
def token_type(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
2449
|
+
"""
|
|
2450
|
+
Specifies the type of tokens that should be returned by
|
|
2451
|
+
the mount. Valid values are "default-service", "default-batch", "service", "batch".
|
|
2452
|
+
"""
|
|
2453
|
+
return pulumi.get(self, "token_type")
|
|
2454
|
+
|
|
2455
|
+
@_builtins.property
|
|
2456
|
+
@pulumi.getter
|
|
2457
|
+
def tune(self) -> pulumi.Output['outputs.AuthBackendTune']:
|
|
2458
|
+
"""
|
|
2459
|
+
Extra configuration block. Structure is documented below.
|
|
2460
|
+
|
|
2461
|
+
The `tune` block is used to tune the auth backend:
|
|
2462
|
+
"""
|
|
2463
|
+
return pulumi.get(self, "tune")
|
|
2464
|
+
|
|
2465
|
+
@_builtins.property
|
|
2466
|
+
@pulumi.getter
|
|
2467
|
+
def upndomain(self) -> pulumi.Output[_builtins.str]:
|
|
2468
|
+
"""
|
|
2469
|
+
The `userPrincipalDomain` used to construct the UPN string for the authenticating user.
|
|
2470
|
+
"""
|
|
2471
|
+
return pulumi.get(self, "upndomain")
|
|
2472
|
+
|
|
2473
|
+
@_builtins.property
|
|
2474
|
+
@pulumi.getter
|
|
2475
|
+
def url(self) -> pulumi.Output[_builtins.str]:
|
|
2476
|
+
"""
|
|
2477
|
+
The URL of the LDAP server
|
|
2478
|
+
"""
|
|
2479
|
+
return pulumi.get(self, "url")
|
|
2480
|
+
|
|
2481
|
+
@_builtins.property
|
|
2482
|
+
@pulumi.getter(name="useTokenGroups")
|
|
2483
|
+
def use_token_groups(self) -> pulumi.Output[_builtins.bool]:
|
|
2484
|
+
"""
|
|
2485
|
+
Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships
|
|
2486
|
+
"""
|
|
2487
|
+
return pulumi.get(self, "use_token_groups")
|
|
2488
|
+
|
|
2489
|
+
@_builtins.property
|
|
2490
|
+
@pulumi.getter
|
|
2491
|
+
def userattr(self) -> pulumi.Output[_builtins.str]:
|
|
2492
|
+
"""
|
|
2493
|
+
Attribute on user object matching username passed in
|
|
2494
|
+
"""
|
|
2495
|
+
return pulumi.get(self, "userattr")
|
|
2496
|
+
|
|
2497
|
+
@_builtins.property
|
|
2498
|
+
@pulumi.getter
|
|
2499
|
+
def userdn(self) -> pulumi.Output[_builtins.str]:
|
|
2500
|
+
"""
|
|
2501
|
+
Base DN under which to perform user search
|
|
2502
|
+
"""
|
|
2503
|
+
return pulumi.get(self, "userdn")
|
|
2504
|
+
|
|
2505
|
+
@_builtins.property
|
|
2506
|
+
@pulumi.getter
|
|
2507
|
+
def userfilter(self) -> pulumi.Output[_builtins.str]:
|
|
2508
|
+
"""
|
|
2509
|
+
LDAP user search filter
|
|
2510
|
+
"""
|
|
2511
|
+
return pulumi.get(self, "userfilter")
|
|
2512
|
+
|
|
2513
|
+
@_builtins.property
|
|
2514
|
+
@pulumi.getter(name="usernameAsAlias")
|
|
2515
|
+
def username_as_alias(self) -> pulumi.Output[_builtins.bool]:
|
|
2516
|
+
"""
|
|
2517
|
+
Force the auth method to use the username passed by the user as the alias name.
|
|
2518
|
+
"""
|
|
2519
|
+
return pulumi.get(self, "username_as_alias")
|
|
2520
|
+
|