pulumi-vault 7.6.0a1764657486__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +1399 -0
- pulumi_vault/_inputs.py +2701 -0
- pulumi_vault/_utilities.py +331 -0
- pulumi_vault/ad/__init__.py +12 -0
- pulumi_vault/ad/get_access_credentials.py +177 -0
- pulumi_vault/ad/secret_backend.py +1916 -0
- pulumi_vault/ad/secret_library.py +546 -0
- pulumi_vault/ad/secret_role.py +499 -0
- pulumi_vault/alicloud/__init__.py +9 -0
- pulumi_vault/alicloud/auth_backend_role.py +866 -0
- pulumi_vault/approle/__init__.py +12 -0
- pulumi_vault/approle/auth_backend_login.py +571 -0
- pulumi_vault/approle/auth_backend_role.py +1082 -0
- pulumi_vault/approle/auth_backend_role_secret_id.py +796 -0
- pulumi_vault/approle/get_auth_backend_role_id.py +169 -0
- pulumi_vault/audit.py +499 -0
- pulumi_vault/audit_request_header.py +277 -0
- pulumi_vault/auth_backend.py +565 -0
- pulumi_vault/aws/__init__.py +22 -0
- pulumi_vault/aws/auth_backend_cert.py +420 -0
- pulumi_vault/aws/auth_backend_client.py +1259 -0
- pulumi_vault/aws/auth_backend_config_identity.py +494 -0
- pulumi_vault/aws/auth_backend_identity_whitelist.py +380 -0
- pulumi_vault/aws/auth_backend_login.py +1046 -0
- pulumi_vault/aws/auth_backend_role.py +1961 -0
- pulumi_vault/aws/auth_backend_role_tag.py +638 -0
- pulumi_vault/aws/auth_backend_roletag_blacklist.py +366 -0
- pulumi_vault/aws/auth_backend_sts_role.py +414 -0
- pulumi_vault/aws/get_access_credentials.py +369 -0
- pulumi_vault/aws/get_static_access_credentials.py +137 -0
- pulumi_vault/aws/secret_backend.py +2018 -0
- pulumi_vault/aws/secret_backend_role.py +1188 -0
- pulumi_vault/aws/secret_backend_static_role.py +639 -0
- pulumi_vault/azure/__init__.py +15 -0
- pulumi_vault/azure/_inputs.py +108 -0
- pulumi_vault/azure/auth_backend_config.py +1096 -0
- pulumi_vault/azure/auth_backend_role.py +1176 -0
- pulumi_vault/azure/backend.py +1793 -0
- pulumi_vault/azure/backend_role.py +883 -0
- pulumi_vault/azure/get_access_credentials.py +400 -0
- pulumi_vault/azure/outputs.py +107 -0
- pulumi_vault/cert_auth_backend_role.py +1539 -0
- pulumi_vault/config/__init__.py +9 -0
- pulumi_vault/config/__init__.pyi +164 -0
- pulumi_vault/config/_inputs.py +73 -0
- pulumi_vault/config/outputs.py +1225 -0
- pulumi_vault/config/ui_custom_message.py +530 -0
- pulumi_vault/config/vars.py +230 -0
- pulumi_vault/consul/__init__.py +10 -0
- pulumi_vault/consul/secret_backend.py +1517 -0
- pulumi_vault/consul/secret_backend_role.py +847 -0
- pulumi_vault/database/__init__.py +14 -0
- pulumi_vault/database/_inputs.py +11907 -0
- pulumi_vault/database/outputs.py +8496 -0
- pulumi_vault/database/secret_backend_connection.py +1676 -0
- pulumi_vault/database/secret_backend_role.py +840 -0
- pulumi_vault/database/secret_backend_static_role.py +881 -0
- pulumi_vault/database/secrets_mount.py +2160 -0
- pulumi_vault/egp_policy.py +399 -0
- pulumi_vault/gcp/__init__.py +17 -0
- pulumi_vault/gcp/_inputs.py +441 -0
- pulumi_vault/gcp/auth_backend.py +1486 -0
- pulumi_vault/gcp/auth_backend_role.py +1235 -0
- pulumi_vault/gcp/get_auth_backend_role.py +514 -0
- pulumi_vault/gcp/outputs.py +302 -0
- pulumi_vault/gcp/secret_backend.py +1807 -0
- pulumi_vault/gcp/secret_impersonated_account.py +484 -0
- pulumi_vault/gcp/secret_roleset.py +554 -0
- pulumi_vault/gcp/secret_static_account.py +557 -0
- pulumi_vault/generic/__init__.py +11 -0
- pulumi_vault/generic/endpoint.py +786 -0
- pulumi_vault/generic/get_secret.py +306 -0
- pulumi_vault/generic/secret.py +486 -0
- pulumi_vault/get_auth_backend.py +226 -0
- pulumi_vault/get_auth_backends.py +170 -0
- pulumi_vault/get_namespace.py +226 -0
- pulumi_vault/get_namespaces.py +202 -0
- pulumi_vault/get_nomad_access_token.py +210 -0
- pulumi_vault/get_policy_document.py +160 -0
- pulumi_vault/get_raft_autopilot_state.py +267 -0
- pulumi_vault/github/__init__.py +13 -0
- pulumi_vault/github/_inputs.py +225 -0
- pulumi_vault/github/auth_backend.py +1194 -0
- pulumi_vault/github/outputs.py +174 -0
- pulumi_vault/github/team.py +380 -0
- pulumi_vault/github/user.py +380 -0
- pulumi_vault/identity/__init__.py +35 -0
- pulumi_vault/identity/entity.py +447 -0
- pulumi_vault/identity/entity_alias.py +398 -0
- pulumi_vault/identity/entity_policies.py +455 -0
- pulumi_vault/identity/get_entity.py +384 -0
- pulumi_vault/identity/get_group.py +467 -0
- pulumi_vault/identity/get_oidc_client_creds.py +175 -0
- pulumi_vault/identity/get_oidc_openid_config.py +334 -0
- pulumi_vault/identity/get_oidc_public_keys.py +179 -0
- pulumi_vault/identity/group.py +805 -0
- pulumi_vault/identity/group_alias.py +386 -0
- pulumi_vault/identity/group_member_entity_ids.py +444 -0
- pulumi_vault/identity/group_member_group_ids.py +467 -0
- pulumi_vault/identity/group_policies.py +471 -0
- pulumi_vault/identity/mfa_duo.py +674 -0
- pulumi_vault/identity/mfa_login_enforcement.py +566 -0
- pulumi_vault/identity/mfa_okta.py +626 -0
- pulumi_vault/identity/mfa_pingid.py +616 -0
- pulumi_vault/identity/mfa_totp.py +758 -0
- pulumi_vault/identity/oidc.py +268 -0
- pulumi_vault/identity/oidc_assignment.py +375 -0
- pulumi_vault/identity/oidc_client.py +667 -0
- pulumi_vault/identity/oidc_key.py +474 -0
- pulumi_vault/identity/oidc_key_allowed_client_id.py +298 -0
- pulumi_vault/identity/oidc_provider.py +550 -0
- pulumi_vault/identity/oidc_role.py +543 -0
- pulumi_vault/identity/oidc_scope.py +355 -0
- pulumi_vault/identity/outputs.py +137 -0
- pulumi_vault/jwt/__init__.py +12 -0
- pulumi_vault/jwt/_inputs.py +225 -0
- pulumi_vault/jwt/auth_backend.py +1347 -0
- pulumi_vault/jwt/auth_backend_role.py +1847 -0
- pulumi_vault/jwt/outputs.py +174 -0
- pulumi_vault/kmip/__init__.py +11 -0
- pulumi_vault/kmip/secret_backend.py +1591 -0
- pulumi_vault/kmip/secret_role.py +1194 -0
- pulumi_vault/kmip/secret_scope.py +372 -0
- pulumi_vault/kubernetes/__init__.py +15 -0
- pulumi_vault/kubernetes/auth_backend_config.py +654 -0
- pulumi_vault/kubernetes/auth_backend_role.py +1031 -0
- pulumi_vault/kubernetes/get_auth_backend_config.py +280 -0
- pulumi_vault/kubernetes/get_auth_backend_role.py +470 -0
- pulumi_vault/kubernetes/get_service_account_token.py +344 -0
- pulumi_vault/kubernetes/secret_backend.py +1341 -0
- pulumi_vault/kubernetes/secret_backend_role.py +1140 -0
- pulumi_vault/kv/__init__.py +18 -0
- pulumi_vault/kv/_inputs.py +124 -0
- pulumi_vault/kv/get_secret.py +240 -0
- pulumi_vault/kv/get_secret_subkeys_v2.py +275 -0
- pulumi_vault/kv/get_secret_v2.py +315 -0
- pulumi_vault/kv/get_secrets_list.py +186 -0
- pulumi_vault/kv/get_secrets_list_v2.py +243 -0
- pulumi_vault/kv/outputs.py +102 -0
- pulumi_vault/kv/secret.py +397 -0
- pulumi_vault/kv/secret_backend_v2.py +455 -0
- pulumi_vault/kv/secret_v2.py +970 -0
- pulumi_vault/ldap/__init__.py +19 -0
- pulumi_vault/ldap/_inputs.py +225 -0
- pulumi_vault/ldap/auth_backend.py +2520 -0
- pulumi_vault/ldap/auth_backend_group.py +386 -0
- pulumi_vault/ldap/auth_backend_user.py +439 -0
- pulumi_vault/ldap/get_dynamic_credentials.py +181 -0
- pulumi_vault/ldap/get_static_credentials.py +192 -0
- pulumi_vault/ldap/outputs.py +174 -0
- pulumi_vault/ldap/secret_backend.py +2207 -0
- pulumi_vault/ldap/secret_backend_dynamic_role.py +767 -0
- pulumi_vault/ldap/secret_backend_library_set.py +552 -0
- pulumi_vault/ldap/secret_backend_static_role.py +541 -0
- pulumi_vault/managed/__init__.py +11 -0
- pulumi_vault/managed/_inputs.py +944 -0
- pulumi_vault/managed/keys.py +398 -0
- pulumi_vault/managed/outputs.py +667 -0
- pulumi_vault/mfa_duo.py +589 -0
- pulumi_vault/mfa_okta.py +623 -0
- pulumi_vault/mfa_pingid.py +670 -0
- pulumi_vault/mfa_totp.py +620 -0
- pulumi_vault/mongodbatlas/__init__.py +10 -0
- pulumi_vault/mongodbatlas/secret_backend.py +388 -0
- pulumi_vault/mongodbatlas/secret_role.py +726 -0
- pulumi_vault/mount.py +1262 -0
- pulumi_vault/namespace.py +452 -0
- pulumi_vault/nomad_secret_backend.py +1559 -0
- pulumi_vault/nomad_secret_role.py +489 -0
- pulumi_vault/oci_auth_backend.py +676 -0
- pulumi_vault/oci_auth_backend_role.py +852 -0
- pulumi_vault/okta/__init__.py +13 -0
- pulumi_vault/okta/_inputs.py +320 -0
- pulumi_vault/okta/auth_backend.py +1231 -0
- pulumi_vault/okta/auth_backend_group.py +369 -0
- pulumi_vault/okta/auth_backend_user.py +416 -0
- pulumi_vault/okta/outputs.py +244 -0
- pulumi_vault/outputs.py +502 -0
- pulumi_vault/pkisecret/__init__.py +38 -0
- pulumi_vault/pkisecret/_inputs.py +270 -0
- pulumi_vault/pkisecret/backend_acme_eab.py +550 -0
- pulumi_vault/pkisecret/backend_config_acme.py +690 -0
- pulumi_vault/pkisecret/backend_config_auto_tidy.py +1370 -0
- pulumi_vault/pkisecret/backend_config_cluster.py +370 -0
- pulumi_vault/pkisecret/backend_config_cmpv2.py +693 -0
- pulumi_vault/pkisecret/backend_config_est.py +756 -0
- pulumi_vault/pkisecret/backend_config_scep.py +738 -0
- pulumi_vault/pkisecret/get_backend_cert_metadata.py +277 -0
- pulumi_vault/pkisecret/get_backend_config_cmpv2.py +226 -0
- pulumi_vault/pkisecret/get_backend_config_est.py +251 -0
- pulumi_vault/pkisecret/get_backend_config_scep.py +271 -0
- pulumi_vault/pkisecret/get_backend_issuer.py +395 -0
- pulumi_vault/pkisecret/get_backend_issuers.py +192 -0
- pulumi_vault/pkisecret/get_backend_key.py +211 -0
- pulumi_vault/pkisecret/get_backend_keys.py +192 -0
- pulumi_vault/pkisecret/outputs.py +270 -0
- pulumi_vault/pkisecret/secret_backend_cert.py +1315 -0
- pulumi_vault/pkisecret/secret_backend_config_ca.py +386 -0
- pulumi_vault/pkisecret/secret_backend_config_issuers.py +392 -0
- pulumi_vault/pkisecret/secret_backend_config_urls.py +462 -0
- pulumi_vault/pkisecret/secret_backend_crl_config.py +846 -0
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +1629 -0
- pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +444 -0
- pulumi_vault/pkisecret/secret_backend_issuer.py +1089 -0
- pulumi_vault/pkisecret/secret_backend_key.py +613 -0
- pulumi_vault/pkisecret/secret_backend_role.py +2694 -0
- pulumi_vault/pkisecret/secret_backend_root_cert.py +2134 -0
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +2031 -0
- pulumi_vault/pkisecret/secret_backend_sign.py +1194 -0
- pulumi_vault/plugin.py +596 -0
- pulumi_vault/plugin_pinned_version.py +299 -0
- pulumi_vault/policy.py +279 -0
- pulumi_vault/provider.py +781 -0
- pulumi_vault/pulumi-plugin.json +5 -0
- pulumi_vault/py.typed +0 -0
- pulumi_vault/quota_lease_count.py +504 -0
- pulumi_vault/quota_rate_limit.py +751 -0
- pulumi_vault/rabbitmq/__init__.py +12 -0
- pulumi_vault/rabbitmq/_inputs.py +235 -0
- pulumi_vault/rabbitmq/outputs.py +144 -0
- pulumi_vault/rabbitmq/secret_backend.py +1437 -0
- pulumi_vault/rabbitmq/secret_backend_role.py +496 -0
- pulumi_vault/raft_autopilot.py +609 -0
- pulumi_vault/raft_snapshot_agent_config.py +1591 -0
- pulumi_vault/rgp_policy.py +349 -0
- pulumi_vault/saml/__init__.py +12 -0
- pulumi_vault/saml/_inputs.py +225 -0
- pulumi_vault/saml/auth_backend.py +811 -0
- pulumi_vault/saml/auth_backend_role.py +1068 -0
- pulumi_vault/saml/outputs.py +174 -0
- pulumi_vault/scep_auth_backend_role.py +908 -0
- pulumi_vault/secrets/__init__.py +18 -0
- pulumi_vault/secrets/_inputs.py +110 -0
- pulumi_vault/secrets/outputs.py +94 -0
- pulumi_vault/secrets/sync_association.py +450 -0
- pulumi_vault/secrets/sync_aws_destination.py +780 -0
- pulumi_vault/secrets/sync_azure_destination.py +736 -0
- pulumi_vault/secrets/sync_config.py +303 -0
- pulumi_vault/secrets/sync_gcp_destination.py +572 -0
- pulumi_vault/secrets/sync_gh_destination.py +688 -0
- pulumi_vault/secrets/sync_github_apps.py +376 -0
- pulumi_vault/secrets/sync_vercel_destination.py +603 -0
- pulumi_vault/ssh/__init__.py +13 -0
- pulumi_vault/ssh/_inputs.py +76 -0
- pulumi_vault/ssh/get_secret_backend_sign.py +294 -0
- pulumi_vault/ssh/outputs.py +51 -0
- pulumi_vault/ssh/secret_backend_ca.py +588 -0
- pulumi_vault/ssh/secret_backend_role.py +1493 -0
- pulumi_vault/terraformcloud/__init__.py +11 -0
- pulumi_vault/terraformcloud/secret_backend.py +1321 -0
- pulumi_vault/terraformcloud/secret_creds.py +445 -0
- pulumi_vault/terraformcloud/secret_role.py +563 -0
- pulumi_vault/token.py +1026 -0
- pulumi_vault/tokenauth/__init__.py +9 -0
- pulumi_vault/tokenauth/auth_backend_role.py +1135 -0
- pulumi_vault/transform/__init__.py +14 -0
- pulumi_vault/transform/alphabet.py +348 -0
- pulumi_vault/transform/get_decode.py +287 -0
- pulumi_vault/transform/get_encode.py +291 -0
- pulumi_vault/transform/role.py +350 -0
- pulumi_vault/transform/template.py +592 -0
- pulumi_vault/transform/transformation.py +608 -0
- pulumi_vault/transit/__init__.py +15 -0
- pulumi_vault/transit/get_cmac.py +256 -0
- pulumi_vault/transit/get_decrypt.py +181 -0
- pulumi_vault/transit/get_encrypt.py +174 -0
- pulumi_vault/transit/get_sign.py +328 -0
- pulumi_vault/transit/get_verify.py +373 -0
- pulumi_vault/transit/secret_backend_key.py +1202 -0
- pulumi_vault/transit/secret_cache_config.py +302 -0
- pulumi_vault-7.6.0a1764657486.dist-info/METADATA +92 -0
- pulumi_vault-7.6.0a1764657486.dist-info/RECORD +274 -0
- pulumi_vault-7.6.0a1764657486.dist-info/WHEEL +5 -0
- pulumi_vault-7.6.0a1764657486.dist-info/top_level.txt +1 -0
|
@@ -0,0 +1,1347 @@
|
|
|
1
|
+
# coding=utf-8
|
|
2
|
+
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
|
+
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
|
+
|
|
5
|
+
import builtins as _builtins
|
|
6
|
+
import warnings
|
|
7
|
+
import sys
|
|
8
|
+
import pulumi
|
|
9
|
+
import pulumi.runtime
|
|
10
|
+
from typing import Any, Mapping, Optional, Sequence, Union, overload
|
|
11
|
+
if sys.version_info >= (3, 11):
|
|
12
|
+
from typing import NotRequired, TypedDict, TypeAlias
|
|
13
|
+
else:
|
|
14
|
+
from typing_extensions import NotRequired, TypedDict, TypeAlias
|
|
15
|
+
from .. import _utilities
|
|
16
|
+
from . import outputs
|
|
17
|
+
from ._inputs import *
|
|
18
|
+
|
|
19
|
+
__all__ = ['AuthBackendArgs', 'AuthBackend']
|
|
20
|
+
|
|
21
|
+
@pulumi.input_type
|
|
22
|
+
class AuthBackendArgs:
|
|
23
|
+
def __init__(__self__, *,
|
|
24
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
25
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
26
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
27
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
28
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
29
|
+
jwks_pairs: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]] = None,
|
|
30
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
31
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
32
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
33
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
34
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
35
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
36
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
37
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
38
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
39
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
40
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
41
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
42
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
43
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
44
|
+
tune: Optional[pulumi.Input['AuthBackendTuneArgs']] = None,
|
|
45
|
+
type: Optional[pulumi.Input[_builtins.str]] = None):
|
|
46
|
+
"""
|
|
47
|
+
The set of arguments for constructing a AuthBackend resource.
|
|
48
|
+
:param pulumi.Input[_builtins.str] bound_issuer: The value against which to match the iss claim in a JWT
|
|
49
|
+
:param pulumi.Input[_builtins.str] default_role: The default role to use if none is provided during login
|
|
50
|
+
:param pulumi.Input[_builtins.str] description: The description of the auth backend
|
|
51
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
52
|
+
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
53
|
+
:param pulumi.Input[_builtins.str] jwks_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
54
|
+
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]] jwks_pairs: List of JWKS URL and optional CA certificate pairs. Cannot be used with `jwks_url` or `jwks_ca_pem`. Requires Vault 1.16+.
|
|
55
|
+
:param pulumi.Input[_builtins.str] jwks_url: JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
56
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_supported_algs: A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
57
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_validation_pubkeys: A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
58
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
59
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
60
|
+
The value should not contain leading or trailing forward slashes.
|
|
61
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
62
|
+
*Available only for Vault Enterprise*.
|
|
63
|
+
:param pulumi.Input[_builtins.bool] namespace_in_state: Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
64
|
+
|
|
65
|
+
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
66
|
+
|
|
67
|
+
The `tune` block is used to tune the auth backend:
|
|
68
|
+
:param pulumi.Input[_builtins.str] oidc_client_id: Client ID used for OIDC backends
|
|
69
|
+
:param pulumi.Input[_builtins.str] oidc_client_secret: Client Secret used for OIDC backends
|
|
70
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
71
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_url: The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
72
|
+
:param pulumi.Input[_builtins.str] oidc_response_mode: The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
73
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] oidc_response_types: List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
74
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the JWT/OIDC auth backend
|
|
75
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] provider_config: Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
76
|
+
:param pulumi.Input[_builtins.str] type: Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
77
|
+
"""
|
|
78
|
+
if bound_issuer is not None:
|
|
79
|
+
pulumi.set(__self__, "bound_issuer", bound_issuer)
|
|
80
|
+
if default_role is not None:
|
|
81
|
+
pulumi.set(__self__, "default_role", default_role)
|
|
82
|
+
if description is not None:
|
|
83
|
+
pulumi.set(__self__, "description", description)
|
|
84
|
+
if disable_remount is not None:
|
|
85
|
+
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
86
|
+
if jwks_ca_pem is not None:
|
|
87
|
+
pulumi.set(__self__, "jwks_ca_pem", jwks_ca_pem)
|
|
88
|
+
if jwks_pairs is not None:
|
|
89
|
+
pulumi.set(__self__, "jwks_pairs", jwks_pairs)
|
|
90
|
+
if jwks_url is not None:
|
|
91
|
+
pulumi.set(__self__, "jwks_url", jwks_url)
|
|
92
|
+
if jwt_supported_algs is not None:
|
|
93
|
+
pulumi.set(__self__, "jwt_supported_algs", jwt_supported_algs)
|
|
94
|
+
if jwt_validation_pubkeys is not None:
|
|
95
|
+
pulumi.set(__self__, "jwt_validation_pubkeys", jwt_validation_pubkeys)
|
|
96
|
+
if local is not None:
|
|
97
|
+
pulumi.set(__self__, "local", local)
|
|
98
|
+
if namespace is not None:
|
|
99
|
+
pulumi.set(__self__, "namespace", namespace)
|
|
100
|
+
if namespace_in_state is not None:
|
|
101
|
+
pulumi.set(__self__, "namespace_in_state", namespace_in_state)
|
|
102
|
+
if oidc_client_id is not None:
|
|
103
|
+
pulumi.set(__self__, "oidc_client_id", oidc_client_id)
|
|
104
|
+
if oidc_client_secret is not None:
|
|
105
|
+
pulumi.set(__self__, "oidc_client_secret", oidc_client_secret)
|
|
106
|
+
if oidc_discovery_ca_pem is not None:
|
|
107
|
+
pulumi.set(__self__, "oidc_discovery_ca_pem", oidc_discovery_ca_pem)
|
|
108
|
+
if oidc_discovery_url is not None:
|
|
109
|
+
pulumi.set(__self__, "oidc_discovery_url", oidc_discovery_url)
|
|
110
|
+
if oidc_response_mode is not None:
|
|
111
|
+
pulumi.set(__self__, "oidc_response_mode", oidc_response_mode)
|
|
112
|
+
if oidc_response_types is not None:
|
|
113
|
+
pulumi.set(__self__, "oidc_response_types", oidc_response_types)
|
|
114
|
+
if path is not None:
|
|
115
|
+
pulumi.set(__self__, "path", path)
|
|
116
|
+
if provider_config is not None:
|
|
117
|
+
pulumi.set(__self__, "provider_config", provider_config)
|
|
118
|
+
if tune is not None:
|
|
119
|
+
pulumi.set(__self__, "tune", tune)
|
|
120
|
+
if type is not None:
|
|
121
|
+
pulumi.set(__self__, "type", type)
|
|
122
|
+
|
|
123
|
+
@_builtins.property
|
|
124
|
+
@pulumi.getter(name="boundIssuer")
|
|
125
|
+
def bound_issuer(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
126
|
+
"""
|
|
127
|
+
The value against which to match the iss claim in a JWT
|
|
128
|
+
"""
|
|
129
|
+
return pulumi.get(self, "bound_issuer")
|
|
130
|
+
|
|
131
|
+
@bound_issuer.setter
|
|
132
|
+
def bound_issuer(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
133
|
+
pulumi.set(self, "bound_issuer", value)
|
|
134
|
+
|
|
135
|
+
@_builtins.property
|
|
136
|
+
@pulumi.getter(name="defaultRole")
|
|
137
|
+
def default_role(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
138
|
+
"""
|
|
139
|
+
The default role to use if none is provided during login
|
|
140
|
+
"""
|
|
141
|
+
return pulumi.get(self, "default_role")
|
|
142
|
+
|
|
143
|
+
@default_role.setter
|
|
144
|
+
def default_role(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
145
|
+
pulumi.set(self, "default_role", value)
|
|
146
|
+
|
|
147
|
+
@_builtins.property
|
|
148
|
+
@pulumi.getter
|
|
149
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
150
|
+
"""
|
|
151
|
+
The description of the auth backend
|
|
152
|
+
"""
|
|
153
|
+
return pulumi.get(self, "description")
|
|
154
|
+
|
|
155
|
+
@description.setter
|
|
156
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
157
|
+
pulumi.set(self, "description", value)
|
|
158
|
+
|
|
159
|
+
@_builtins.property
|
|
160
|
+
@pulumi.getter(name="disableRemount")
|
|
161
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
162
|
+
"""
|
|
163
|
+
If set, opts out of mount migration on path updates.
|
|
164
|
+
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
165
|
+
"""
|
|
166
|
+
return pulumi.get(self, "disable_remount")
|
|
167
|
+
|
|
168
|
+
@disable_remount.setter
|
|
169
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
170
|
+
pulumi.set(self, "disable_remount", value)
|
|
171
|
+
|
|
172
|
+
@_builtins.property
|
|
173
|
+
@pulumi.getter(name="jwksCaPem")
|
|
174
|
+
def jwks_ca_pem(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
175
|
+
"""
|
|
176
|
+
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
177
|
+
"""
|
|
178
|
+
return pulumi.get(self, "jwks_ca_pem")
|
|
179
|
+
|
|
180
|
+
@jwks_ca_pem.setter
|
|
181
|
+
def jwks_ca_pem(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
182
|
+
pulumi.set(self, "jwks_ca_pem", value)
|
|
183
|
+
|
|
184
|
+
@_builtins.property
|
|
185
|
+
@pulumi.getter(name="jwksPairs")
|
|
186
|
+
def jwks_pairs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]]:
|
|
187
|
+
"""
|
|
188
|
+
List of JWKS URL and optional CA certificate pairs. Cannot be used with `jwks_url` or `jwks_ca_pem`. Requires Vault 1.16+.
|
|
189
|
+
"""
|
|
190
|
+
return pulumi.get(self, "jwks_pairs")
|
|
191
|
+
|
|
192
|
+
@jwks_pairs.setter
|
|
193
|
+
def jwks_pairs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]]):
|
|
194
|
+
pulumi.set(self, "jwks_pairs", value)
|
|
195
|
+
|
|
196
|
+
@_builtins.property
|
|
197
|
+
@pulumi.getter(name="jwksUrl")
|
|
198
|
+
def jwks_url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
199
|
+
"""
|
|
200
|
+
JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
201
|
+
"""
|
|
202
|
+
return pulumi.get(self, "jwks_url")
|
|
203
|
+
|
|
204
|
+
@jwks_url.setter
|
|
205
|
+
def jwks_url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
206
|
+
pulumi.set(self, "jwks_url", value)
|
|
207
|
+
|
|
208
|
+
@_builtins.property
|
|
209
|
+
@pulumi.getter(name="jwtSupportedAlgs")
|
|
210
|
+
def jwt_supported_algs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
211
|
+
"""
|
|
212
|
+
A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
213
|
+
"""
|
|
214
|
+
return pulumi.get(self, "jwt_supported_algs")
|
|
215
|
+
|
|
216
|
+
@jwt_supported_algs.setter
|
|
217
|
+
def jwt_supported_algs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
218
|
+
pulumi.set(self, "jwt_supported_algs", value)
|
|
219
|
+
|
|
220
|
+
@_builtins.property
|
|
221
|
+
@pulumi.getter(name="jwtValidationPubkeys")
|
|
222
|
+
def jwt_validation_pubkeys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
223
|
+
"""
|
|
224
|
+
A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
225
|
+
"""
|
|
226
|
+
return pulumi.get(self, "jwt_validation_pubkeys")
|
|
227
|
+
|
|
228
|
+
@jwt_validation_pubkeys.setter
|
|
229
|
+
def jwt_validation_pubkeys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
230
|
+
pulumi.set(self, "jwt_validation_pubkeys", value)
|
|
231
|
+
|
|
232
|
+
@_builtins.property
|
|
233
|
+
@pulumi.getter
|
|
234
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
235
|
+
"""
|
|
236
|
+
Specifies if the auth method is local only.
|
|
237
|
+
"""
|
|
238
|
+
return pulumi.get(self, "local")
|
|
239
|
+
|
|
240
|
+
@local.setter
|
|
241
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
242
|
+
pulumi.set(self, "local", value)
|
|
243
|
+
|
|
244
|
+
@_builtins.property
|
|
245
|
+
@pulumi.getter
|
|
246
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
247
|
+
"""
|
|
248
|
+
The namespace to provision the resource in.
|
|
249
|
+
The value should not contain leading or trailing forward slashes.
|
|
250
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
251
|
+
*Available only for Vault Enterprise*.
|
|
252
|
+
"""
|
|
253
|
+
return pulumi.get(self, "namespace")
|
|
254
|
+
|
|
255
|
+
@namespace.setter
|
|
256
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
257
|
+
pulumi.set(self, "namespace", value)
|
|
258
|
+
|
|
259
|
+
@_builtins.property
|
|
260
|
+
@pulumi.getter(name="namespaceInState")
|
|
261
|
+
def namespace_in_state(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
262
|
+
"""
|
|
263
|
+
Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
264
|
+
|
|
265
|
+
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
266
|
+
|
|
267
|
+
The `tune` block is used to tune the auth backend:
|
|
268
|
+
"""
|
|
269
|
+
return pulumi.get(self, "namespace_in_state")
|
|
270
|
+
|
|
271
|
+
@namespace_in_state.setter
|
|
272
|
+
def namespace_in_state(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
273
|
+
pulumi.set(self, "namespace_in_state", value)
|
|
274
|
+
|
|
275
|
+
@_builtins.property
|
|
276
|
+
@pulumi.getter(name="oidcClientId")
|
|
277
|
+
def oidc_client_id(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
278
|
+
"""
|
|
279
|
+
Client ID used for OIDC backends
|
|
280
|
+
"""
|
|
281
|
+
return pulumi.get(self, "oidc_client_id")
|
|
282
|
+
|
|
283
|
+
@oidc_client_id.setter
|
|
284
|
+
def oidc_client_id(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
285
|
+
pulumi.set(self, "oidc_client_id", value)
|
|
286
|
+
|
|
287
|
+
@_builtins.property
|
|
288
|
+
@pulumi.getter(name="oidcClientSecret")
|
|
289
|
+
def oidc_client_secret(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
290
|
+
"""
|
|
291
|
+
Client Secret used for OIDC backends
|
|
292
|
+
"""
|
|
293
|
+
return pulumi.get(self, "oidc_client_secret")
|
|
294
|
+
|
|
295
|
+
@oidc_client_secret.setter
|
|
296
|
+
def oidc_client_secret(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
297
|
+
pulumi.set(self, "oidc_client_secret", value)
|
|
298
|
+
|
|
299
|
+
@_builtins.property
|
|
300
|
+
@pulumi.getter(name="oidcDiscoveryCaPem")
|
|
301
|
+
def oidc_discovery_ca_pem(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
302
|
+
"""
|
|
303
|
+
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
304
|
+
"""
|
|
305
|
+
return pulumi.get(self, "oidc_discovery_ca_pem")
|
|
306
|
+
|
|
307
|
+
@oidc_discovery_ca_pem.setter
|
|
308
|
+
def oidc_discovery_ca_pem(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
309
|
+
pulumi.set(self, "oidc_discovery_ca_pem", value)
|
|
310
|
+
|
|
311
|
+
@_builtins.property
|
|
312
|
+
@pulumi.getter(name="oidcDiscoveryUrl")
|
|
313
|
+
def oidc_discovery_url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
314
|
+
"""
|
|
315
|
+
The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
316
|
+
"""
|
|
317
|
+
return pulumi.get(self, "oidc_discovery_url")
|
|
318
|
+
|
|
319
|
+
@oidc_discovery_url.setter
|
|
320
|
+
def oidc_discovery_url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
321
|
+
pulumi.set(self, "oidc_discovery_url", value)
|
|
322
|
+
|
|
323
|
+
@_builtins.property
|
|
324
|
+
@pulumi.getter(name="oidcResponseMode")
|
|
325
|
+
def oidc_response_mode(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
326
|
+
"""
|
|
327
|
+
The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
328
|
+
"""
|
|
329
|
+
return pulumi.get(self, "oidc_response_mode")
|
|
330
|
+
|
|
331
|
+
@oidc_response_mode.setter
|
|
332
|
+
def oidc_response_mode(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
333
|
+
pulumi.set(self, "oidc_response_mode", value)
|
|
334
|
+
|
|
335
|
+
@_builtins.property
|
|
336
|
+
@pulumi.getter(name="oidcResponseTypes")
|
|
337
|
+
def oidc_response_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
338
|
+
"""
|
|
339
|
+
List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
340
|
+
"""
|
|
341
|
+
return pulumi.get(self, "oidc_response_types")
|
|
342
|
+
|
|
343
|
+
@oidc_response_types.setter
|
|
344
|
+
def oidc_response_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
345
|
+
pulumi.set(self, "oidc_response_types", value)
|
|
346
|
+
|
|
347
|
+
@_builtins.property
|
|
348
|
+
@pulumi.getter
|
|
349
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
350
|
+
"""
|
|
351
|
+
Path to mount the JWT/OIDC auth backend
|
|
352
|
+
"""
|
|
353
|
+
return pulumi.get(self, "path")
|
|
354
|
+
|
|
355
|
+
@path.setter
|
|
356
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
357
|
+
pulumi.set(self, "path", value)
|
|
358
|
+
|
|
359
|
+
@_builtins.property
|
|
360
|
+
@pulumi.getter(name="providerConfig")
|
|
361
|
+
def provider_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
362
|
+
"""
|
|
363
|
+
Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
364
|
+
"""
|
|
365
|
+
return pulumi.get(self, "provider_config")
|
|
366
|
+
|
|
367
|
+
@provider_config.setter
|
|
368
|
+
def provider_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
369
|
+
pulumi.set(self, "provider_config", value)
|
|
370
|
+
|
|
371
|
+
@_builtins.property
|
|
372
|
+
@pulumi.getter
|
|
373
|
+
def tune(self) -> Optional[pulumi.Input['AuthBackendTuneArgs']]:
|
|
374
|
+
return pulumi.get(self, "tune")
|
|
375
|
+
|
|
376
|
+
@tune.setter
|
|
377
|
+
def tune(self, value: Optional[pulumi.Input['AuthBackendTuneArgs']]):
|
|
378
|
+
pulumi.set(self, "tune", value)
|
|
379
|
+
|
|
380
|
+
@_builtins.property
|
|
381
|
+
@pulumi.getter
|
|
382
|
+
def type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
383
|
+
"""
|
|
384
|
+
Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
385
|
+
"""
|
|
386
|
+
return pulumi.get(self, "type")
|
|
387
|
+
|
|
388
|
+
@type.setter
|
|
389
|
+
def type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
390
|
+
pulumi.set(self, "type", value)
|
|
391
|
+
|
|
392
|
+
|
|
393
|
+
@pulumi.input_type
|
|
394
|
+
class _AuthBackendState:
|
|
395
|
+
def __init__(__self__, *,
|
|
396
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
397
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
398
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
399
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
400
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
401
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
402
|
+
jwks_pairs: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]] = None,
|
|
403
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
404
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
405
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
406
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
407
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
408
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
409
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
410
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
411
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
412
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
413
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
414
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
415
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
416
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
417
|
+
tune: Optional[pulumi.Input['AuthBackendTuneArgs']] = None,
|
|
418
|
+
type: Optional[pulumi.Input[_builtins.str]] = None):
|
|
419
|
+
"""
|
|
420
|
+
Input properties used for looking up and filtering AuthBackend resources.
|
|
421
|
+
:param pulumi.Input[_builtins.str] accessor: The accessor for this auth method
|
|
422
|
+
:param pulumi.Input[_builtins.str] bound_issuer: The value against which to match the iss claim in a JWT
|
|
423
|
+
:param pulumi.Input[_builtins.str] default_role: The default role to use if none is provided during login
|
|
424
|
+
:param pulumi.Input[_builtins.str] description: The description of the auth backend
|
|
425
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
426
|
+
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
427
|
+
:param pulumi.Input[_builtins.str] jwks_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
428
|
+
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]] jwks_pairs: List of JWKS URL and optional CA certificate pairs. Cannot be used with `jwks_url` or `jwks_ca_pem`. Requires Vault 1.16+.
|
|
429
|
+
:param pulumi.Input[_builtins.str] jwks_url: JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
430
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_supported_algs: A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
431
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_validation_pubkeys: A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
432
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
433
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
434
|
+
The value should not contain leading or trailing forward slashes.
|
|
435
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
436
|
+
*Available only for Vault Enterprise*.
|
|
437
|
+
:param pulumi.Input[_builtins.bool] namespace_in_state: Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
438
|
+
|
|
439
|
+
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
440
|
+
|
|
441
|
+
The `tune` block is used to tune the auth backend:
|
|
442
|
+
:param pulumi.Input[_builtins.str] oidc_client_id: Client ID used for OIDC backends
|
|
443
|
+
:param pulumi.Input[_builtins.str] oidc_client_secret: Client Secret used for OIDC backends
|
|
444
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
445
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_url: The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
446
|
+
:param pulumi.Input[_builtins.str] oidc_response_mode: The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
447
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] oidc_response_types: List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
448
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the JWT/OIDC auth backend
|
|
449
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] provider_config: Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
450
|
+
:param pulumi.Input[_builtins.str] type: Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
451
|
+
"""
|
|
452
|
+
if accessor is not None:
|
|
453
|
+
pulumi.set(__self__, "accessor", accessor)
|
|
454
|
+
if bound_issuer is not None:
|
|
455
|
+
pulumi.set(__self__, "bound_issuer", bound_issuer)
|
|
456
|
+
if default_role is not None:
|
|
457
|
+
pulumi.set(__self__, "default_role", default_role)
|
|
458
|
+
if description is not None:
|
|
459
|
+
pulumi.set(__self__, "description", description)
|
|
460
|
+
if disable_remount is not None:
|
|
461
|
+
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
462
|
+
if jwks_ca_pem is not None:
|
|
463
|
+
pulumi.set(__self__, "jwks_ca_pem", jwks_ca_pem)
|
|
464
|
+
if jwks_pairs is not None:
|
|
465
|
+
pulumi.set(__self__, "jwks_pairs", jwks_pairs)
|
|
466
|
+
if jwks_url is not None:
|
|
467
|
+
pulumi.set(__self__, "jwks_url", jwks_url)
|
|
468
|
+
if jwt_supported_algs is not None:
|
|
469
|
+
pulumi.set(__self__, "jwt_supported_algs", jwt_supported_algs)
|
|
470
|
+
if jwt_validation_pubkeys is not None:
|
|
471
|
+
pulumi.set(__self__, "jwt_validation_pubkeys", jwt_validation_pubkeys)
|
|
472
|
+
if local is not None:
|
|
473
|
+
pulumi.set(__self__, "local", local)
|
|
474
|
+
if namespace is not None:
|
|
475
|
+
pulumi.set(__self__, "namespace", namespace)
|
|
476
|
+
if namespace_in_state is not None:
|
|
477
|
+
pulumi.set(__self__, "namespace_in_state", namespace_in_state)
|
|
478
|
+
if oidc_client_id is not None:
|
|
479
|
+
pulumi.set(__self__, "oidc_client_id", oidc_client_id)
|
|
480
|
+
if oidc_client_secret is not None:
|
|
481
|
+
pulumi.set(__self__, "oidc_client_secret", oidc_client_secret)
|
|
482
|
+
if oidc_discovery_ca_pem is not None:
|
|
483
|
+
pulumi.set(__self__, "oidc_discovery_ca_pem", oidc_discovery_ca_pem)
|
|
484
|
+
if oidc_discovery_url is not None:
|
|
485
|
+
pulumi.set(__self__, "oidc_discovery_url", oidc_discovery_url)
|
|
486
|
+
if oidc_response_mode is not None:
|
|
487
|
+
pulumi.set(__self__, "oidc_response_mode", oidc_response_mode)
|
|
488
|
+
if oidc_response_types is not None:
|
|
489
|
+
pulumi.set(__self__, "oidc_response_types", oidc_response_types)
|
|
490
|
+
if path is not None:
|
|
491
|
+
pulumi.set(__self__, "path", path)
|
|
492
|
+
if provider_config is not None:
|
|
493
|
+
pulumi.set(__self__, "provider_config", provider_config)
|
|
494
|
+
if tune is not None:
|
|
495
|
+
pulumi.set(__self__, "tune", tune)
|
|
496
|
+
if type is not None:
|
|
497
|
+
pulumi.set(__self__, "type", type)
|
|
498
|
+
|
|
499
|
+
@_builtins.property
|
|
500
|
+
@pulumi.getter
|
|
501
|
+
def accessor(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
502
|
+
"""
|
|
503
|
+
The accessor for this auth method
|
|
504
|
+
"""
|
|
505
|
+
return pulumi.get(self, "accessor")
|
|
506
|
+
|
|
507
|
+
@accessor.setter
|
|
508
|
+
def accessor(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
509
|
+
pulumi.set(self, "accessor", value)
|
|
510
|
+
|
|
511
|
+
@_builtins.property
|
|
512
|
+
@pulumi.getter(name="boundIssuer")
|
|
513
|
+
def bound_issuer(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
514
|
+
"""
|
|
515
|
+
The value against which to match the iss claim in a JWT
|
|
516
|
+
"""
|
|
517
|
+
return pulumi.get(self, "bound_issuer")
|
|
518
|
+
|
|
519
|
+
@bound_issuer.setter
|
|
520
|
+
def bound_issuer(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
521
|
+
pulumi.set(self, "bound_issuer", value)
|
|
522
|
+
|
|
523
|
+
@_builtins.property
|
|
524
|
+
@pulumi.getter(name="defaultRole")
|
|
525
|
+
def default_role(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
526
|
+
"""
|
|
527
|
+
The default role to use if none is provided during login
|
|
528
|
+
"""
|
|
529
|
+
return pulumi.get(self, "default_role")
|
|
530
|
+
|
|
531
|
+
@default_role.setter
|
|
532
|
+
def default_role(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
533
|
+
pulumi.set(self, "default_role", value)
|
|
534
|
+
|
|
535
|
+
@_builtins.property
|
|
536
|
+
@pulumi.getter
|
|
537
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
538
|
+
"""
|
|
539
|
+
The description of the auth backend
|
|
540
|
+
"""
|
|
541
|
+
return pulumi.get(self, "description")
|
|
542
|
+
|
|
543
|
+
@description.setter
|
|
544
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
545
|
+
pulumi.set(self, "description", value)
|
|
546
|
+
|
|
547
|
+
@_builtins.property
|
|
548
|
+
@pulumi.getter(name="disableRemount")
|
|
549
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
550
|
+
"""
|
|
551
|
+
If set, opts out of mount migration on path updates.
|
|
552
|
+
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
553
|
+
"""
|
|
554
|
+
return pulumi.get(self, "disable_remount")
|
|
555
|
+
|
|
556
|
+
@disable_remount.setter
|
|
557
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
558
|
+
pulumi.set(self, "disable_remount", value)
|
|
559
|
+
|
|
560
|
+
@_builtins.property
|
|
561
|
+
@pulumi.getter(name="jwksCaPem")
|
|
562
|
+
def jwks_ca_pem(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
563
|
+
"""
|
|
564
|
+
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
565
|
+
"""
|
|
566
|
+
return pulumi.get(self, "jwks_ca_pem")
|
|
567
|
+
|
|
568
|
+
@jwks_ca_pem.setter
|
|
569
|
+
def jwks_ca_pem(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
570
|
+
pulumi.set(self, "jwks_ca_pem", value)
|
|
571
|
+
|
|
572
|
+
@_builtins.property
|
|
573
|
+
@pulumi.getter(name="jwksPairs")
|
|
574
|
+
def jwks_pairs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]]:
|
|
575
|
+
"""
|
|
576
|
+
List of JWKS URL and optional CA certificate pairs. Cannot be used with `jwks_url` or `jwks_ca_pem`. Requires Vault 1.16+.
|
|
577
|
+
"""
|
|
578
|
+
return pulumi.get(self, "jwks_pairs")
|
|
579
|
+
|
|
580
|
+
@jwks_pairs.setter
|
|
581
|
+
def jwks_pairs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]]):
|
|
582
|
+
pulumi.set(self, "jwks_pairs", value)
|
|
583
|
+
|
|
584
|
+
@_builtins.property
|
|
585
|
+
@pulumi.getter(name="jwksUrl")
|
|
586
|
+
def jwks_url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
587
|
+
"""
|
|
588
|
+
JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
589
|
+
"""
|
|
590
|
+
return pulumi.get(self, "jwks_url")
|
|
591
|
+
|
|
592
|
+
@jwks_url.setter
|
|
593
|
+
def jwks_url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
594
|
+
pulumi.set(self, "jwks_url", value)
|
|
595
|
+
|
|
596
|
+
@_builtins.property
|
|
597
|
+
@pulumi.getter(name="jwtSupportedAlgs")
|
|
598
|
+
def jwt_supported_algs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
599
|
+
"""
|
|
600
|
+
A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
601
|
+
"""
|
|
602
|
+
return pulumi.get(self, "jwt_supported_algs")
|
|
603
|
+
|
|
604
|
+
@jwt_supported_algs.setter
|
|
605
|
+
def jwt_supported_algs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
606
|
+
pulumi.set(self, "jwt_supported_algs", value)
|
|
607
|
+
|
|
608
|
+
@_builtins.property
|
|
609
|
+
@pulumi.getter(name="jwtValidationPubkeys")
|
|
610
|
+
def jwt_validation_pubkeys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
611
|
+
"""
|
|
612
|
+
A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
613
|
+
"""
|
|
614
|
+
return pulumi.get(self, "jwt_validation_pubkeys")
|
|
615
|
+
|
|
616
|
+
@jwt_validation_pubkeys.setter
|
|
617
|
+
def jwt_validation_pubkeys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
618
|
+
pulumi.set(self, "jwt_validation_pubkeys", value)
|
|
619
|
+
|
|
620
|
+
@_builtins.property
|
|
621
|
+
@pulumi.getter
|
|
622
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
623
|
+
"""
|
|
624
|
+
Specifies if the auth method is local only.
|
|
625
|
+
"""
|
|
626
|
+
return pulumi.get(self, "local")
|
|
627
|
+
|
|
628
|
+
@local.setter
|
|
629
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
630
|
+
pulumi.set(self, "local", value)
|
|
631
|
+
|
|
632
|
+
@_builtins.property
|
|
633
|
+
@pulumi.getter
|
|
634
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
635
|
+
"""
|
|
636
|
+
The namespace to provision the resource in.
|
|
637
|
+
The value should not contain leading or trailing forward slashes.
|
|
638
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
639
|
+
*Available only for Vault Enterprise*.
|
|
640
|
+
"""
|
|
641
|
+
return pulumi.get(self, "namespace")
|
|
642
|
+
|
|
643
|
+
@namespace.setter
|
|
644
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
645
|
+
pulumi.set(self, "namespace", value)
|
|
646
|
+
|
|
647
|
+
@_builtins.property
|
|
648
|
+
@pulumi.getter(name="namespaceInState")
|
|
649
|
+
def namespace_in_state(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
650
|
+
"""
|
|
651
|
+
Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
652
|
+
|
|
653
|
+
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
654
|
+
|
|
655
|
+
The `tune` block is used to tune the auth backend:
|
|
656
|
+
"""
|
|
657
|
+
return pulumi.get(self, "namespace_in_state")
|
|
658
|
+
|
|
659
|
+
@namespace_in_state.setter
|
|
660
|
+
def namespace_in_state(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
661
|
+
pulumi.set(self, "namespace_in_state", value)
|
|
662
|
+
|
|
663
|
+
@_builtins.property
|
|
664
|
+
@pulumi.getter(name="oidcClientId")
|
|
665
|
+
def oidc_client_id(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
666
|
+
"""
|
|
667
|
+
Client ID used for OIDC backends
|
|
668
|
+
"""
|
|
669
|
+
return pulumi.get(self, "oidc_client_id")
|
|
670
|
+
|
|
671
|
+
@oidc_client_id.setter
|
|
672
|
+
def oidc_client_id(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
673
|
+
pulumi.set(self, "oidc_client_id", value)
|
|
674
|
+
|
|
675
|
+
@_builtins.property
|
|
676
|
+
@pulumi.getter(name="oidcClientSecret")
|
|
677
|
+
def oidc_client_secret(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
678
|
+
"""
|
|
679
|
+
Client Secret used for OIDC backends
|
|
680
|
+
"""
|
|
681
|
+
return pulumi.get(self, "oidc_client_secret")
|
|
682
|
+
|
|
683
|
+
@oidc_client_secret.setter
|
|
684
|
+
def oidc_client_secret(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
685
|
+
pulumi.set(self, "oidc_client_secret", value)
|
|
686
|
+
|
|
687
|
+
@_builtins.property
|
|
688
|
+
@pulumi.getter(name="oidcDiscoveryCaPem")
|
|
689
|
+
def oidc_discovery_ca_pem(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
690
|
+
"""
|
|
691
|
+
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
692
|
+
"""
|
|
693
|
+
return pulumi.get(self, "oidc_discovery_ca_pem")
|
|
694
|
+
|
|
695
|
+
@oidc_discovery_ca_pem.setter
|
|
696
|
+
def oidc_discovery_ca_pem(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
697
|
+
pulumi.set(self, "oidc_discovery_ca_pem", value)
|
|
698
|
+
|
|
699
|
+
@_builtins.property
|
|
700
|
+
@pulumi.getter(name="oidcDiscoveryUrl")
|
|
701
|
+
def oidc_discovery_url(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
702
|
+
"""
|
|
703
|
+
The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
704
|
+
"""
|
|
705
|
+
return pulumi.get(self, "oidc_discovery_url")
|
|
706
|
+
|
|
707
|
+
@oidc_discovery_url.setter
|
|
708
|
+
def oidc_discovery_url(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
709
|
+
pulumi.set(self, "oidc_discovery_url", value)
|
|
710
|
+
|
|
711
|
+
@_builtins.property
|
|
712
|
+
@pulumi.getter(name="oidcResponseMode")
|
|
713
|
+
def oidc_response_mode(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
714
|
+
"""
|
|
715
|
+
The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
716
|
+
"""
|
|
717
|
+
return pulumi.get(self, "oidc_response_mode")
|
|
718
|
+
|
|
719
|
+
@oidc_response_mode.setter
|
|
720
|
+
def oidc_response_mode(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
721
|
+
pulumi.set(self, "oidc_response_mode", value)
|
|
722
|
+
|
|
723
|
+
@_builtins.property
|
|
724
|
+
@pulumi.getter(name="oidcResponseTypes")
|
|
725
|
+
def oidc_response_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
726
|
+
"""
|
|
727
|
+
List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
728
|
+
"""
|
|
729
|
+
return pulumi.get(self, "oidc_response_types")
|
|
730
|
+
|
|
731
|
+
@oidc_response_types.setter
|
|
732
|
+
def oidc_response_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
733
|
+
pulumi.set(self, "oidc_response_types", value)
|
|
734
|
+
|
|
735
|
+
@_builtins.property
|
|
736
|
+
@pulumi.getter
|
|
737
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
738
|
+
"""
|
|
739
|
+
Path to mount the JWT/OIDC auth backend
|
|
740
|
+
"""
|
|
741
|
+
return pulumi.get(self, "path")
|
|
742
|
+
|
|
743
|
+
@path.setter
|
|
744
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
745
|
+
pulumi.set(self, "path", value)
|
|
746
|
+
|
|
747
|
+
@_builtins.property
|
|
748
|
+
@pulumi.getter(name="providerConfig")
|
|
749
|
+
def provider_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
750
|
+
"""
|
|
751
|
+
Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
752
|
+
"""
|
|
753
|
+
return pulumi.get(self, "provider_config")
|
|
754
|
+
|
|
755
|
+
@provider_config.setter
|
|
756
|
+
def provider_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
757
|
+
pulumi.set(self, "provider_config", value)
|
|
758
|
+
|
|
759
|
+
@_builtins.property
|
|
760
|
+
@pulumi.getter
|
|
761
|
+
def tune(self) -> Optional[pulumi.Input['AuthBackendTuneArgs']]:
|
|
762
|
+
return pulumi.get(self, "tune")
|
|
763
|
+
|
|
764
|
+
@tune.setter
|
|
765
|
+
def tune(self, value: Optional[pulumi.Input['AuthBackendTuneArgs']]):
|
|
766
|
+
pulumi.set(self, "tune", value)
|
|
767
|
+
|
|
768
|
+
@_builtins.property
|
|
769
|
+
@pulumi.getter
|
|
770
|
+
def type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
771
|
+
"""
|
|
772
|
+
Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
773
|
+
"""
|
|
774
|
+
return pulumi.get(self, "type")
|
|
775
|
+
|
|
776
|
+
@type.setter
|
|
777
|
+
def type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
778
|
+
pulumi.set(self, "type", value)
|
|
779
|
+
|
|
780
|
+
|
|
781
|
+
@pulumi.type_token("vault:jwt/authBackend:AuthBackend")
|
|
782
|
+
class AuthBackend(pulumi.CustomResource):
|
|
783
|
+
@overload
|
|
784
|
+
def __init__(__self__,
|
|
785
|
+
resource_name: str,
|
|
786
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
787
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
788
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
789
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
790
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
791
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
792
|
+
jwks_pairs: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]] = None,
|
|
793
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
794
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
795
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
796
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
797
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
798
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
799
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
800
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
801
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
802
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
803
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
804
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
805
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
806
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
807
|
+
tune: Optional[pulumi.Input[Union['AuthBackendTuneArgs', 'AuthBackendTuneArgsDict']]] = None,
|
|
808
|
+
type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
809
|
+
__props__=None):
|
|
810
|
+
"""
|
|
811
|
+
Provides a resource for managing an
|
|
812
|
+
[JWT auth backend within Vault](https://www.vaultproject.io/docs/auth/jwt.html).
|
|
813
|
+
|
|
814
|
+
## Example Usage
|
|
815
|
+
|
|
816
|
+
Manage JWT auth backend:
|
|
817
|
+
|
|
818
|
+
```python
|
|
819
|
+
import pulumi
|
|
820
|
+
import pulumi_vault as vault
|
|
821
|
+
|
|
822
|
+
example = vault.jwt.AuthBackend("example",
|
|
823
|
+
description="Demonstration of the Terraform JWT auth backend",
|
|
824
|
+
path="jwt",
|
|
825
|
+
oidc_discovery_url="https://myco.auth0.com/",
|
|
826
|
+
bound_issuer="https://myco.auth0.com/")
|
|
827
|
+
```
|
|
828
|
+
|
|
829
|
+
Manage OIDC auth backend:
|
|
830
|
+
|
|
831
|
+
```python
|
|
832
|
+
import pulumi
|
|
833
|
+
import pulumi_vault as vault
|
|
834
|
+
|
|
835
|
+
example = vault.jwt.AuthBackend("example",
|
|
836
|
+
description="Demonstration of the Terraform JWT auth backend",
|
|
837
|
+
path="oidc",
|
|
838
|
+
type="oidc",
|
|
839
|
+
oidc_discovery_url="https://myco.auth0.com/",
|
|
840
|
+
oidc_client_id="1234567890",
|
|
841
|
+
oidc_client_secret="secret123456",
|
|
842
|
+
bound_issuer="https://myco.auth0.com/",
|
|
843
|
+
tune={
|
|
844
|
+
"listing_visibility": "unauth",
|
|
845
|
+
})
|
|
846
|
+
```
|
|
847
|
+
|
|
848
|
+
Configuring the auth backend with a `provider_config:
|
|
849
|
+
|
|
850
|
+
```python
|
|
851
|
+
import pulumi
|
|
852
|
+
import pulumi_vault as vault
|
|
853
|
+
|
|
854
|
+
gsuite = vault.jwt.AuthBackend("gsuite",
|
|
855
|
+
description="OIDC backend",
|
|
856
|
+
oidc_discovery_url="https://accounts.google.com",
|
|
857
|
+
path="oidc",
|
|
858
|
+
type="oidc",
|
|
859
|
+
provider_config={
|
|
860
|
+
"provider": "gsuite",
|
|
861
|
+
"fetch_groups": "true",
|
|
862
|
+
"fetch_user_info": "true",
|
|
863
|
+
"groups_recurse_max_depth": "1",
|
|
864
|
+
})
|
|
865
|
+
```
|
|
866
|
+
|
|
867
|
+
## Import
|
|
868
|
+
|
|
869
|
+
JWT auth backend can be imported using the `path`, e.g.
|
|
870
|
+
|
|
871
|
+
```sh
|
|
872
|
+
$ pulumi import vault:jwt/authBackend:AuthBackend oidc oidc
|
|
873
|
+
```
|
|
874
|
+
or
|
|
875
|
+
|
|
876
|
+
```sh
|
|
877
|
+
$ pulumi import vault:jwt/authBackend:AuthBackend jwt jwt
|
|
878
|
+
```
|
|
879
|
+
|
|
880
|
+
:param str resource_name: The name of the resource.
|
|
881
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
882
|
+
:param pulumi.Input[_builtins.str] bound_issuer: The value against which to match the iss claim in a JWT
|
|
883
|
+
:param pulumi.Input[_builtins.str] default_role: The default role to use if none is provided during login
|
|
884
|
+
:param pulumi.Input[_builtins.str] description: The description of the auth backend
|
|
885
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
886
|
+
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
887
|
+
:param pulumi.Input[_builtins.str] jwks_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
888
|
+
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]] jwks_pairs: List of JWKS URL and optional CA certificate pairs. Cannot be used with `jwks_url` or `jwks_ca_pem`. Requires Vault 1.16+.
|
|
889
|
+
:param pulumi.Input[_builtins.str] jwks_url: JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
890
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_supported_algs: A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
891
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_validation_pubkeys: A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
892
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
893
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
894
|
+
The value should not contain leading or trailing forward slashes.
|
|
895
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
896
|
+
*Available only for Vault Enterprise*.
|
|
897
|
+
:param pulumi.Input[_builtins.bool] namespace_in_state: Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
898
|
+
|
|
899
|
+
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
900
|
+
|
|
901
|
+
The `tune` block is used to tune the auth backend:
|
|
902
|
+
:param pulumi.Input[_builtins.str] oidc_client_id: Client ID used for OIDC backends
|
|
903
|
+
:param pulumi.Input[_builtins.str] oidc_client_secret: Client Secret used for OIDC backends
|
|
904
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
905
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_url: The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
906
|
+
:param pulumi.Input[_builtins.str] oidc_response_mode: The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
907
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] oidc_response_types: List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
908
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the JWT/OIDC auth backend
|
|
909
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] provider_config: Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
910
|
+
:param pulumi.Input[_builtins.str] type: Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
911
|
+
"""
|
|
912
|
+
...
|
|
913
|
+
@overload
|
|
914
|
+
def __init__(__self__,
|
|
915
|
+
resource_name: str,
|
|
916
|
+
args: Optional[AuthBackendArgs] = None,
|
|
917
|
+
opts: Optional[pulumi.ResourceOptions] = None):
|
|
918
|
+
"""
|
|
919
|
+
Provides a resource for managing an
|
|
920
|
+
[JWT auth backend within Vault](https://www.vaultproject.io/docs/auth/jwt.html).
|
|
921
|
+
|
|
922
|
+
## Example Usage
|
|
923
|
+
|
|
924
|
+
Manage JWT auth backend:
|
|
925
|
+
|
|
926
|
+
```python
|
|
927
|
+
import pulumi
|
|
928
|
+
import pulumi_vault as vault
|
|
929
|
+
|
|
930
|
+
example = vault.jwt.AuthBackend("example",
|
|
931
|
+
description="Demonstration of the Terraform JWT auth backend",
|
|
932
|
+
path="jwt",
|
|
933
|
+
oidc_discovery_url="https://myco.auth0.com/",
|
|
934
|
+
bound_issuer="https://myco.auth0.com/")
|
|
935
|
+
```
|
|
936
|
+
|
|
937
|
+
Manage OIDC auth backend:
|
|
938
|
+
|
|
939
|
+
```python
|
|
940
|
+
import pulumi
|
|
941
|
+
import pulumi_vault as vault
|
|
942
|
+
|
|
943
|
+
example = vault.jwt.AuthBackend("example",
|
|
944
|
+
description="Demonstration of the Terraform JWT auth backend",
|
|
945
|
+
path="oidc",
|
|
946
|
+
type="oidc",
|
|
947
|
+
oidc_discovery_url="https://myco.auth0.com/",
|
|
948
|
+
oidc_client_id="1234567890",
|
|
949
|
+
oidc_client_secret="secret123456",
|
|
950
|
+
bound_issuer="https://myco.auth0.com/",
|
|
951
|
+
tune={
|
|
952
|
+
"listing_visibility": "unauth",
|
|
953
|
+
})
|
|
954
|
+
```
|
|
955
|
+
|
|
956
|
+
Configuring the auth backend with a `provider_config:
|
|
957
|
+
|
|
958
|
+
```python
|
|
959
|
+
import pulumi
|
|
960
|
+
import pulumi_vault as vault
|
|
961
|
+
|
|
962
|
+
gsuite = vault.jwt.AuthBackend("gsuite",
|
|
963
|
+
description="OIDC backend",
|
|
964
|
+
oidc_discovery_url="https://accounts.google.com",
|
|
965
|
+
path="oidc",
|
|
966
|
+
type="oidc",
|
|
967
|
+
provider_config={
|
|
968
|
+
"provider": "gsuite",
|
|
969
|
+
"fetch_groups": "true",
|
|
970
|
+
"fetch_user_info": "true",
|
|
971
|
+
"groups_recurse_max_depth": "1",
|
|
972
|
+
})
|
|
973
|
+
```
|
|
974
|
+
|
|
975
|
+
## Import
|
|
976
|
+
|
|
977
|
+
JWT auth backend can be imported using the `path`, e.g.
|
|
978
|
+
|
|
979
|
+
```sh
|
|
980
|
+
$ pulumi import vault:jwt/authBackend:AuthBackend oidc oidc
|
|
981
|
+
```
|
|
982
|
+
or
|
|
983
|
+
|
|
984
|
+
```sh
|
|
985
|
+
$ pulumi import vault:jwt/authBackend:AuthBackend jwt jwt
|
|
986
|
+
```
|
|
987
|
+
|
|
988
|
+
:param str resource_name: The name of the resource.
|
|
989
|
+
:param AuthBackendArgs args: The arguments to use to populate this resource's properties.
|
|
990
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
991
|
+
"""
|
|
992
|
+
...
|
|
993
|
+
def __init__(__self__, resource_name: str, *args, **kwargs):
|
|
994
|
+
resource_args, opts = _utilities.get_resource_args_opts(AuthBackendArgs, pulumi.ResourceOptions, *args, **kwargs)
|
|
995
|
+
if resource_args is not None:
|
|
996
|
+
__self__._internal_init(resource_name, opts, **resource_args.__dict__)
|
|
997
|
+
else:
|
|
998
|
+
__self__._internal_init(resource_name, *args, **kwargs)
|
|
999
|
+
|
|
1000
|
+
def _internal_init(__self__,
|
|
1001
|
+
resource_name: str,
|
|
1002
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1003
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1004
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1005
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1006
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1007
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1008
|
+
jwks_pairs: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]] = None,
|
|
1009
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1010
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1011
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1012
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1013
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1014
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1015
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1016
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1017
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1018
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1019
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1020
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1021
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1022
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1023
|
+
tune: Optional[pulumi.Input[Union['AuthBackendTuneArgs', 'AuthBackendTuneArgsDict']]] = None,
|
|
1024
|
+
type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1025
|
+
__props__=None):
|
|
1026
|
+
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
1027
|
+
if not isinstance(opts, pulumi.ResourceOptions):
|
|
1028
|
+
raise TypeError('Expected resource options to be a ResourceOptions instance')
|
|
1029
|
+
if opts.id is None:
|
|
1030
|
+
if __props__ is not None:
|
|
1031
|
+
raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
|
|
1032
|
+
__props__ = AuthBackendArgs.__new__(AuthBackendArgs)
|
|
1033
|
+
|
|
1034
|
+
__props__.__dict__["bound_issuer"] = bound_issuer
|
|
1035
|
+
__props__.__dict__["default_role"] = default_role
|
|
1036
|
+
__props__.__dict__["description"] = description
|
|
1037
|
+
__props__.__dict__["disable_remount"] = disable_remount
|
|
1038
|
+
__props__.__dict__["jwks_ca_pem"] = jwks_ca_pem
|
|
1039
|
+
__props__.__dict__["jwks_pairs"] = jwks_pairs
|
|
1040
|
+
__props__.__dict__["jwks_url"] = jwks_url
|
|
1041
|
+
__props__.__dict__["jwt_supported_algs"] = jwt_supported_algs
|
|
1042
|
+
__props__.__dict__["jwt_validation_pubkeys"] = jwt_validation_pubkeys
|
|
1043
|
+
__props__.__dict__["local"] = local
|
|
1044
|
+
__props__.__dict__["namespace"] = namespace
|
|
1045
|
+
__props__.__dict__["namespace_in_state"] = namespace_in_state
|
|
1046
|
+
__props__.__dict__["oidc_client_id"] = oidc_client_id
|
|
1047
|
+
__props__.__dict__["oidc_client_secret"] = None if oidc_client_secret is None else pulumi.Output.secret(oidc_client_secret)
|
|
1048
|
+
__props__.__dict__["oidc_discovery_ca_pem"] = oidc_discovery_ca_pem
|
|
1049
|
+
__props__.__dict__["oidc_discovery_url"] = oidc_discovery_url
|
|
1050
|
+
__props__.__dict__["oidc_response_mode"] = oidc_response_mode
|
|
1051
|
+
__props__.__dict__["oidc_response_types"] = oidc_response_types
|
|
1052
|
+
__props__.__dict__["path"] = path
|
|
1053
|
+
__props__.__dict__["provider_config"] = provider_config
|
|
1054
|
+
__props__.__dict__["tune"] = tune
|
|
1055
|
+
__props__.__dict__["type"] = type
|
|
1056
|
+
__props__.__dict__["accessor"] = None
|
|
1057
|
+
secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["oidcClientSecret"])
|
|
1058
|
+
opts = pulumi.ResourceOptions.merge(opts, secret_opts)
|
|
1059
|
+
super(AuthBackend, __self__).__init__(
|
|
1060
|
+
'vault:jwt/authBackend:AuthBackend',
|
|
1061
|
+
resource_name,
|
|
1062
|
+
__props__,
|
|
1063
|
+
opts)
|
|
1064
|
+
|
|
1065
|
+
@staticmethod
|
|
1066
|
+
def get(resource_name: str,
|
|
1067
|
+
id: pulumi.Input[str],
|
|
1068
|
+
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1069
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1070
|
+
bound_issuer: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1071
|
+
default_role: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1072
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1073
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1074
|
+
jwks_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1075
|
+
jwks_pairs: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]]] = None,
|
|
1076
|
+
jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1077
|
+
jwt_supported_algs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1078
|
+
jwt_validation_pubkeys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1079
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1080
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1081
|
+
namespace_in_state: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1082
|
+
oidc_client_id: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1083
|
+
oidc_client_secret: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1084
|
+
oidc_discovery_ca_pem: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1085
|
+
oidc_discovery_url: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1086
|
+
oidc_response_mode: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1087
|
+
oidc_response_types: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1088
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1089
|
+
provider_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1090
|
+
tune: Optional[pulumi.Input[Union['AuthBackendTuneArgs', 'AuthBackendTuneArgsDict']]] = None,
|
|
1091
|
+
type: Optional[pulumi.Input[_builtins.str]] = None) -> 'AuthBackend':
|
|
1092
|
+
"""
|
|
1093
|
+
Get an existing AuthBackend resource's state with the given name, id, and optional extra
|
|
1094
|
+
properties used to qualify the lookup.
|
|
1095
|
+
|
|
1096
|
+
:param str resource_name: The unique name of the resulting resource.
|
|
1097
|
+
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
1098
|
+
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1099
|
+
:param pulumi.Input[_builtins.str] accessor: The accessor for this auth method
|
|
1100
|
+
:param pulumi.Input[_builtins.str] bound_issuer: The value against which to match the iss claim in a JWT
|
|
1101
|
+
:param pulumi.Input[_builtins.str] default_role: The default role to use if none is provided during login
|
|
1102
|
+
:param pulumi.Input[_builtins.str] description: The description of the auth backend
|
|
1103
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
1104
|
+
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1105
|
+
:param pulumi.Input[_builtins.str] jwks_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
1106
|
+
:param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]] jwks_pairs: List of JWKS URL and optional CA certificate pairs. Cannot be used with `jwks_url` or `jwks_ca_pem`. Requires Vault 1.16+.
|
|
1107
|
+
:param pulumi.Input[_builtins.str] jwks_url: JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
1108
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_supported_algs: A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
1109
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] jwt_validation_pubkeys: A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
1110
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the auth method is local only.
|
|
1111
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
1112
|
+
The value should not contain leading or trailing forward slashes.
|
|
1113
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
1114
|
+
*Available only for Vault Enterprise*.
|
|
1115
|
+
:param pulumi.Input[_builtins.bool] namespace_in_state: Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
1116
|
+
|
|
1117
|
+
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
1118
|
+
|
|
1119
|
+
The `tune` block is used to tune the auth backend:
|
|
1120
|
+
:param pulumi.Input[_builtins.str] oidc_client_id: Client ID used for OIDC backends
|
|
1121
|
+
:param pulumi.Input[_builtins.str] oidc_client_secret: Client Secret used for OIDC backends
|
|
1122
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_ca_pem: The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
1123
|
+
:param pulumi.Input[_builtins.str] oidc_discovery_url: The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
1124
|
+
:param pulumi.Input[_builtins.str] oidc_response_mode: The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
1125
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] oidc_response_types: List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
1126
|
+
:param pulumi.Input[_builtins.str] path: Path to mount the JWT/OIDC auth backend
|
|
1127
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] provider_config: Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
1128
|
+
:param pulumi.Input[_builtins.str] type: Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
1129
|
+
"""
|
|
1130
|
+
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
1131
|
+
|
|
1132
|
+
__props__ = _AuthBackendState.__new__(_AuthBackendState)
|
|
1133
|
+
|
|
1134
|
+
__props__.__dict__["accessor"] = accessor
|
|
1135
|
+
__props__.__dict__["bound_issuer"] = bound_issuer
|
|
1136
|
+
__props__.__dict__["default_role"] = default_role
|
|
1137
|
+
__props__.__dict__["description"] = description
|
|
1138
|
+
__props__.__dict__["disable_remount"] = disable_remount
|
|
1139
|
+
__props__.__dict__["jwks_ca_pem"] = jwks_ca_pem
|
|
1140
|
+
__props__.__dict__["jwks_pairs"] = jwks_pairs
|
|
1141
|
+
__props__.__dict__["jwks_url"] = jwks_url
|
|
1142
|
+
__props__.__dict__["jwt_supported_algs"] = jwt_supported_algs
|
|
1143
|
+
__props__.__dict__["jwt_validation_pubkeys"] = jwt_validation_pubkeys
|
|
1144
|
+
__props__.__dict__["local"] = local
|
|
1145
|
+
__props__.__dict__["namespace"] = namespace
|
|
1146
|
+
__props__.__dict__["namespace_in_state"] = namespace_in_state
|
|
1147
|
+
__props__.__dict__["oidc_client_id"] = oidc_client_id
|
|
1148
|
+
__props__.__dict__["oidc_client_secret"] = oidc_client_secret
|
|
1149
|
+
__props__.__dict__["oidc_discovery_ca_pem"] = oidc_discovery_ca_pem
|
|
1150
|
+
__props__.__dict__["oidc_discovery_url"] = oidc_discovery_url
|
|
1151
|
+
__props__.__dict__["oidc_response_mode"] = oidc_response_mode
|
|
1152
|
+
__props__.__dict__["oidc_response_types"] = oidc_response_types
|
|
1153
|
+
__props__.__dict__["path"] = path
|
|
1154
|
+
__props__.__dict__["provider_config"] = provider_config
|
|
1155
|
+
__props__.__dict__["tune"] = tune
|
|
1156
|
+
__props__.__dict__["type"] = type
|
|
1157
|
+
return AuthBackend(resource_name, opts=opts, __props__=__props__)
|
|
1158
|
+
|
|
1159
|
+
@_builtins.property
|
|
1160
|
+
@pulumi.getter
|
|
1161
|
+
def accessor(self) -> pulumi.Output[_builtins.str]:
|
|
1162
|
+
"""
|
|
1163
|
+
The accessor for this auth method
|
|
1164
|
+
"""
|
|
1165
|
+
return pulumi.get(self, "accessor")
|
|
1166
|
+
|
|
1167
|
+
@_builtins.property
|
|
1168
|
+
@pulumi.getter(name="boundIssuer")
|
|
1169
|
+
def bound_issuer(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1170
|
+
"""
|
|
1171
|
+
The value against which to match the iss claim in a JWT
|
|
1172
|
+
"""
|
|
1173
|
+
return pulumi.get(self, "bound_issuer")
|
|
1174
|
+
|
|
1175
|
+
@_builtins.property
|
|
1176
|
+
@pulumi.getter(name="defaultRole")
|
|
1177
|
+
def default_role(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1178
|
+
"""
|
|
1179
|
+
The default role to use if none is provided during login
|
|
1180
|
+
"""
|
|
1181
|
+
return pulumi.get(self, "default_role")
|
|
1182
|
+
|
|
1183
|
+
@_builtins.property
|
|
1184
|
+
@pulumi.getter
|
|
1185
|
+
def description(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1186
|
+
"""
|
|
1187
|
+
The description of the auth backend
|
|
1188
|
+
"""
|
|
1189
|
+
return pulumi.get(self, "description")
|
|
1190
|
+
|
|
1191
|
+
@_builtins.property
|
|
1192
|
+
@pulumi.getter(name="disableRemount")
|
|
1193
|
+
def disable_remount(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1194
|
+
"""
|
|
1195
|
+
If set, opts out of mount migration on path updates.
|
|
1196
|
+
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1197
|
+
"""
|
|
1198
|
+
return pulumi.get(self, "disable_remount")
|
|
1199
|
+
|
|
1200
|
+
@_builtins.property
|
|
1201
|
+
@pulumi.getter(name="jwksCaPem")
|
|
1202
|
+
def jwks_ca_pem(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1203
|
+
"""
|
|
1204
|
+
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
|
|
1205
|
+
"""
|
|
1206
|
+
return pulumi.get(self, "jwks_ca_pem")
|
|
1207
|
+
|
|
1208
|
+
@_builtins.property
|
|
1209
|
+
@pulumi.getter(name="jwksPairs")
|
|
1210
|
+
def jwks_pairs(self) -> pulumi.Output[Optional[Sequence[Mapping[str, _builtins.str]]]]:
|
|
1211
|
+
"""
|
|
1212
|
+
List of JWKS URL and optional CA certificate pairs. Cannot be used with `jwks_url` or `jwks_ca_pem`. Requires Vault 1.16+.
|
|
1213
|
+
"""
|
|
1214
|
+
return pulumi.get(self, "jwks_pairs")
|
|
1215
|
+
|
|
1216
|
+
@_builtins.property
|
|
1217
|
+
@pulumi.getter(name="jwksUrl")
|
|
1218
|
+
def jwks_url(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1219
|
+
"""
|
|
1220
|
+
JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
|
|
1221
|
+
"""
|
|
1222
|
+
return pulumi.get(self, "jwks_url")
|
|
1223
|
+
|
|
1224
|
+
@_builtins.property
|
|
1225
|
+
@pulumi.getter(name="jwtSupportedAlgs")
|
|
1226
|
+
def jwt_supported_algs(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1227
|
+
"""
|
|
1228
|
+
A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ
|
|
1229
|
+
"""
|
|
1230
|
+
return pulumi.get(self, "jwt_supported_algs")
|
|
1231
|
+
|
|
1232
|
+
@_builtins.property
|
|
1233
|
+
@pulumi.getter(name="jwtValidationPubkeys")
|
|
1234
|
+
def jwt_validation_pubkeys(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1235
|
+
"""
|
|
1236
|
+
A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with `oidc_discovery_url`
|
|
1237
|
+
"""
|
|
1238
|
+
return pulumi.get(self, "jwt_validation_pubkeys")
|
|
1239
|
+
|
|
1240
|
+
@_builtins.property
|
|
1241
|
+
@pulumi.getter
|
|
1242
|
+
def local(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1243
|
+
"""
|
|
1244
|
+
Specifies if the auth method is local only.
|
|
1245
|
+
"""
|
|
1246
|
+
return pulumi.get(self, "local")
|
|
1247
|
+
|
|
1248
|
+
@_builtins.property
|
|
1249
|
+
@pulumi.getter
|
|
1250
|
+
def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1251
|
+
"""
|
|
1252
|
+
The namespace to provision the resource in.
|
|
1253
|
+
The value should not contain leading or trailing forward slashes.
|
|
1254
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
1255
|
+
*Available only for Vault Enterprise*.
|
|
1256
|
+
"""
|
|
1257
|
+
return pulumi.get(self, "namespace")
|
|
1258
|
+
|
|
1259
|
+
@_builtins.property
|
|
1260
|
+
@pulumi.getter(name="namespaceInState")
|
|
1261
|
+
def namespace_in_state(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1262
|
+
"""
|
|
1263
|
+
Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs
|
|
1264
|
+
|
|
1265
|
+
* tune - (Optional) Extra configuration block. Structure is documented below.
|
|
1266
|
+
|
|
1267
|
+
The `tune` block is used to tune the auth backend:
|
|
1268
|
+
"""
|
|
1269
|
+
return pulumi.get(self, "namespace_in_state")
|
|
1270
|
+
|
|
1271
|
+
@_builtins.property
|
|
1272
|
+
@pulumi.getter(name="oidcClientId")
|
|
1273
|
+
def oidc_client_id(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1274
|
+
"""
|
|
1275
|
+
Client ID used for OIDC backends
|
|
1276
|
+
"""
|
|
1277
|
+
return pulumi.get(self, "oidc_client_id")
|
|
1278
|
+
|
|
1279
|
+
@_builtins.property
|
|
1280
|
+
@pulumi.getter(name="oidcClientSecret")
|
|
1281
|
+
def oidc_client_secret(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1282
|
+
"""
|
|
1283
|
+
Client Secret used for OIDC backends
|
|
1284
|
+
"""
|
|
1285
|
+
return pulumi.get(self, "oidc_client_secret")
|
|
1286
|
+
|
|
1287
|
+
@_builtins.property
|
|
1288
|
+
@pulumi.getter(name="oidcDiscoveryCaPem")
|
|
1289
|
+
def oidc_discovery_ca_pem(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1290
|
+
"""
|
|
1291
|
+
The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used
|
|
1292
|
+
"""
|
|
1293
|
+
return pulumi.get(self, "oidc_discovery_ca_pem")
|
|
1294
|
+
|
|
1295
|
+
@_builtins.property
|
|
1296
|
+
@pulumi.getter(name="oidcDiscoveryUrl")
|
|
1297
|
+
def oidc_discovery_url(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1298
|
+
"""
|
|
1299
|
+
The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with `jwt_validation_pubkeys`
|
|
1300
|
+
"""
|
|
1301
|
+
return pulumi.get(self, "oidc_discovery_url")
|
|
1302
|
+
|
|
1303
|
+
@_builtins.property
|
|
1304
|
+
@pulumi.getter(name="oidcResponseMode")
|
|
1305
|
+
def oidc_response_mode(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1306
|
+
"""
|
|
1307
|
+
The response mode to be used in the OAuth2 request. Allowed values are `query` and `form_post`. Defaults to `query`. If using Vault namespaces, and `oidc_response_mode` is `form_post`, then `namespace_in_state` should be set to `false`.
|
|
1308
|
+
"""
|
|
1309
|
+
return pulumi.get(self, "oidc_response_mode")
|
|
1310
|
+
|
|
1311
|
+
@_builtins.property
|
|
1312
|
+
@pulumi.getter(name="oidcResponseTypes")
|
|
1313
|
+
def oidc_response_types(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1314
|
+
"""
|
|
1315
|
+
List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `["code"]`. Note: `id_token` may only be used if `oidc_response_mode` is set to `form_post`.
|
|
1316
|
+
"""
|
|
1317
|
+
return pulumi.get(self, "oidc_response_types")
|
|
1318
|
+
|
|
1319
|
+
@_builtins.property
|
|
1320
|
+
@pulumi.getter
|
|
1321
|
+
def path(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1322
|
+
"""
|
|
1323
|
+
Path to mount the JWT/OIDC auth backend
|
|
1324
|
+
"""
|
|
1325
|
+
return pulumi.get(self, "path")
|
|
1326
|
+
|
|
1327
|
+
@_builtins.property
|
|
1328
|
+
@pulumi.getter(name="providerConfig")
|
|
1329
|
+
def provider_config(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
|
|
1330
|
+
"""
|
|
1331
|
+
Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.
|
|
1332
|
+
"""
|
|
1333
|
+
return pulumi.get(self, "provider_config")
|
|
1334
|
+
|
|
1335
|
+
@_builtins.property
|
|
1336
|
+
@pulumi.getter
|
|
1337
|
+
def tune(self) -> pulumi.Output['outputs.AuthBackendTune']:
|
|
1338
|
+
return pulumi.get(self, "tune")
|
|
1339
|
+
|
|
1340
|
+
@_builtins.property
|
|
1341
|
+
@pulumi.getter
|
|
1342
|
+
def type(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1343
|
+
"""
|
|
1344
|
+
Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt`
|
|
1345
|
+
"""
|
|
1346
|
+
return pulumi.get(self, "type")
|
|
1347
|
+
|