pulumi-gcp-kotlin/com.pulumi.gcp.iam.kotlin/WorkforcePoolProviderArgs

WorkforcePoolProviderArgs

data class WorkforcePoolProviderArgs(val attributeCondition: Output<String>? = null, val attributeMapping: Output<Map<String, String>>? = null, val description: Output<String>? = null, val disabled: Output<Boolean>? = null, val displayName: Output<String>? = null, val location: Output<String>? = null, val oidc: Output<WorkforcePoolProviderOidcArgs>? = null, val providerId: Output<String>? = null, val saml: Output<WorkforcePoolProviderSamlArgs>? = null, val workforcePoolId: Output<String>? = null) : ConvertibleToJava<WorkforcePoolProviderArgs>

A configuration for an external identity provider. To get more information about WorkforcePoolProvider, see:

Note: Ask your Google Cloud account team to request access to workforce identity federation for your billing/quota project. The account team notifies you when the project is granted access. Warning: All arguments including the following potentially sensitive values will be stored in the raw state as plain text: oidc.client_secret.value.plain_text. Read more about sensitive data in state.

Example Usage

Iam Workforce Pool Provider Saml Basic

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkforcePool;
import com.pulumi.gcp.iam.WorkforcePoolArgs;
import com.pulumi.gcp.iam.WorkforcePoolProvider;
import com.pulumi.gcp.iam.WorkforcePoolProviderArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderSamlArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var pool = new WorkforcePool("pool", WorkforcePoolArgs.builder()
            .workforcePoolId("example-pool")
            .parent("organizations/123456789")
            .location("global")
            .build());
        var example = new WorkforcePoolProvider("example", WorkforcePoolProviderArgs.builder()
            .workforcePoolId(pool.workforcePoolId())
            .location(pool.location())
            .providerId("example-prvdr")
            .attributeMapping(Map.of("google.subject", "assertion.sub"))
            .saml(WorkforcePoolProviderSamlArgs.builder()
                .idpMetadataXml("<?xml version=\"1.0\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"https://test.com\"><md:IDPSSODescriptor protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"> <md:KeyDescriptor use=\"signing\"><ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\"><ds:X509Data><ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAX7/5qPhMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCmRldi00NTg0MjExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjIwMjE2MDAxOTEyWhcNMzIwMjE2MDAyMDEyWjCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDApkZXYtNDU4NDIxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxrBl7GKz52cRpxF9xCsirnRuMxnhFBaUrsHqAQrLqWmdlpNYZTVg+T9iQ+aq/iE68L+BRZcZniKIvW58wqqS0ltXVvIkXuDSvnvnkkI5yMIVErR20K8jSOKQm1FmK+fgAJ4koshFiu9oLiqu0Ejc0DuL3/XRsb4RuxjktKTb1khgBBtb+7idEk0sFR0RPefAweXImJkDHDm7SxjDwGJUubbqpdTxasPr0W+AHI1VUzsUsTiHAoyb0XDkYqHfDzhj/ZdIEl4zHQ3bEZvlD984ztAnmX2SuFLLKfXeAAGHei8MMixJvwxYkkPeYZ/5h8WgBZPP4heS2CPjwYExt29L8QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARjJFz++a9Z5IQGFzsZMrX2EDR5ML4xxUiQkbhld1S1PljOLcYFARDmUC2YYHOueU4ee8Jid9nPGEUebV/4Jok+b+oQh+dWMgiWjSLI7h5q4OYZ3VJtdlVwgMFt2iz+/4yBKMUZ50g3Qgg36vE34us+eKitg759JgCNsibxn0qtJgSPm0sgP2L6yTaLnoEUbXBRxCwynTSkp9ZijZqEzbhN0e2dWv7Rx/nfpohpDP6vEiFImKFHpDSv3M/5de1ytQzPFrZBYt9WlzlYwE1aD9FHCxdd+rWgYMVVoRaRmndpV/Rq3QUuDuFJtaoX11bC7ExkOpg9KstZzA63i3VcfYv</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"https://test.com/sso\"/></md:IDPSSODescriptor></md:EntityDescriptor>")
                .build())
            .build());
    }
}
Content copied to clipboard

Iam Workforce Pool Provider Saml Full

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkforcePool;
import com.pulumi.gcp.iam.WorkforcePoolArgs;
import com.pulumi.gcp.iam.WorkforcePoolProvider;
import com.pulumi.gcp.iam.WorkforcePoolProviderArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderSamlArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var pool = new WorkforcePool("pool", WorkforcePoolArgs.builder()
            .workforcePoolId("example-pool")
            .parent("organizations/123456789")
            .location("global")
            .build());
        var example = new WorkforcePoolProvider("example", WorkforcePoolProviderArgs.builder()
            .workforcePoolId(pool.workforcePoolId())
            .location(pool.location())
            .providerId("example-prvdr")
            .attributeMapping(Map.of("google.subject", "assertion.sub"))
            .saml(WorkforcePoolProviderSamlArgs.builder()
                .idpMetadataXml("<?xml version=\"1.0\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"https://test.com\"><md:IDPSSODescriptor protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"> <md:KeyDescriptor use=\"signing\"><ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\"><ds:X509Data><ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAX7/5qPhMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCmRldi00NTg0MjExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjIwMjE2MDAxOTEyWhcNMzIwMjE2MDAyMDEyWjCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDApkZXYtNDU4NDIxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxrBl7GKz52cRpxF9xCsirnRuMxnhFBaUrsHqAQrLqWmdlpNYZTVg+T9iQ+aq/iE68L+BRZcZniKIvW58wqqS0ltXVvIkXuDSvnvnkkI5yMIVErR20K8jSOKQm1FmK+fgAJ4koshFiu9oLiqu0Ejc0DuL3/XRsb4RuxjktKTb1khgBBtb+7idEk0sFR0RPefAweXImJkDHDm7SxjDwGJUubbqpdTxasPr0W+AHI1VUzsUsTiHAoyb0XDkYqHfDzhj/ZdIEl4zHQ3bEZvlD984ztAnmX2SuFLLKfXeAAGHei8MMixJvwxYkkPeYZ/5h8WgBZPP4heS2CPjwYExt29L8QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARjJFz++a9Z5IQGFzsZMrX2EDR5ML4xxUiQkbhld1S1PljOLcYFARDmUC2YYHOueU4ee8Jid9nPGEUebV/4Jok+b+oQh+dWMgiWjSLI7h5q4OYZ3VJtdlVwgMFt2iz+/4yBKMUZ50g3Qgg36vE34us+eKitg759JgCNsibxn0qtJgSPm0sgP2L6yTaLnoEUbXBRxCwynTSkp9ZijZqEzbhN0e2dWv7Rx/nfpohpDP6vEiFImKFHpDSv3M/5de1ytQzPFrZBYt9WlzlYwE1aD9FHCxdd+rWgYMVVoRaRmndpV/Rq3QUuDuFJtaoX11bC7ExkOpg9KstZzA63i3VcfYv</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"https://test.com/sso\"/></md:IDPSSODescriptor></md:EntityDescriptor>")
                .build())
            .displayName("Display name")
            .description("A sample SAML workforce pool provider.")
            .disabled(false)
            .attributeCondition("true")
            .build());
    }
}
Content copied to clipboard

Iam Workforce Pool Provider Oidc Basic

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkforcePool;
import com.pulumi.gcp.iam.WorkforcePoolArgs;
import com.pulumi.gcp.iam.WorkforcePoolProvider;
import com.pulumi.gcp.iam.WorkforcePoolProviderArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcClientSecretArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcClientSecretValueArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcWebSsoConfigArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var pool = new WorkforcePool("pool", WorkforcePoolArgs.builder()
            .workforcePoolId("example-pool")
            .parent("organizations/123456789")
            .location("global")
            .build());
        var example = new WorkforcePoolProvider("example", WorkforcePoolProviderArgs.builder()
            .workforcePoolId(pool.workforcePoolId())
            .location(pool.location())
            .providerId("example-prvdr")
            .attributeMapping(Map.of("google.subject", "assertion.sub"))
            .oidc(WorkforcePoolProviderOidcArgs.builder()
                .issuerUri("https://accounts.thirdparty.com")
                .clientId("client-id")
                .clientSecret(WorkforcePoolProviderOidcClientSecretArgs.builder()
                    .value(WorkforcePoolProviderOidcClientSecretValueArgs.builder()
                        .plainText("client-secret")
                        .build())
                    .build())
                .webSsoConfig(WorkforcePoolProviderOidcWebSsoConfigArgs.builder()
                    .responseType("CODE")
                    .assertionClaimsBehavior("MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS")
                    .build())
                .build())
            .build());
    }
}
Content copied to clipboard

Iam Workforce Pool Provider Oidc Full

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkforcePool;
import com.pulumi.gcp.iam.WorkforcePoolArgs;
import com.pulumi.gcp.iam.WorkforcePoolProvider;
import com.pulumi.gcp.iam.WorkforcePoolProviderArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcClientSecretArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcClientSecretValueArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcWebSsoConfigArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var pool = new WorkforcePool("pool", WorkforcePoolArgs.builder()
            .workforcePoolId("example-pool")
            .parent("organizations/123456789")
            .location("global")
            .build());
        var example = new WorkforcePoolProvider("example", WorkforcePoolProviderArgs.builder()
            .workforcePoolId(pool.workforcePoolId())
            .location(pool.location())
            .providerId("example-prvdr")
            .attributeMapping(Map.of("google.subject", "assertion.sub"))
            .oidc(WorkforcePoolProviderOidcArgs.builder()
                .issuerUri("https://accounts.thirdparty.com")
                .clientId("client-id")
                .clientSecret(WorkforcePoolProviderOidcClientSecretArgs.builder()
                    .value(WorkforcePoolProviderOidcClientSecretValueArgs.builder()
                        .plainText("client-secret")
                        .build())
                    .build())
                .webSsoConfig(WorkforcePoolProviderOidcWebSsoConfigArgs.builder()
                    .responseType("CODE")
                    .assertionClaimsBehavior("MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS")
                    .additionalScopes(
                        "groups",
                        "roles")
                    .build())
                .build())
            .displayName("Display name")
            .description("A sample OIDC workforce pool provider.")
            .disabled(false)
            .attributeCondition("true")
            .build());
    }
}
Content copied to clipboard

Import

WorkforcePoolProvider can be imported using any of these accepted formats

$ pulumi import gcp:iam/workforcePoolProvider:WorkforcePoolProvider default locations/{{location}}/workforcePools/{{workforce_pool_id}}/providers/{{provider_id}}
Content copied to clipboard
$ pulumi import gcp:iam/workforcePoolProvider:WorkforcePoolProvider default {{location}}/{{workforce_pool_id}}/{{provider_id}}
Content copied to clipboard

Constructors

Link copied to clipboard
fun WorkforcePoolProviderArgs(attributeCondition: Output<String>? = null, attributeMapping: Output<Map<String, String>>? = null, description: Output<String>? = null, disabled: Output<Boolean>? = null, displayName: Output<String>? = null, location: Output<String>? = null, oidc: Output<WorkforcePoolProviderOidcArgs>? = null, providerId: Output<String>? = null, saml: Output<WorkforcePoolProviderSamlArgs>? = null, workforcePoolId: Output<String>? = null)

Functions

Link copied to clipboard
open override fun toJava(): WorkforcePoolProviderArgs

Properties

Link copied to clipboard
val attributeCondition: Output<String>? = null

A Common Expression Language expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted. The expression must output a boolean representing whether to allow the federation. The following keywords may be referenced in the expressions:

Link copied to clipboard
val attributeMapping: Output<Map<String, String>>? = null

Maps attributes from the authentication credentials issued by an external identity provider to Google Cloud attributes, such as subject and segment. Each key must be a string specifying the Google Cloud IAM attribute to map to. The following keys are supported:

Link copied to clipboard
val description: Output<String>? = null

A user-specified description of the provider. Cannot exceed 256 characters.

Link copied to clipboard
val disabled: Output<Boolean>? = null

Whether the provider is disabled. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access.

Link copied to clipboard
val displayName: Output<String>? = null

A user-specified display name for the provider. Cannot exceed 32 characters.

Link copied to clipboard
val location: Output<String>? = null

The location for the resource.

Link copied to clipboard
val oidc: Output<WorkforcePoolProviderOidcArgs>? = null

Represents an OpenId Connect 1.0 identity provider. Structure is documented below.

Link copied to clipboard
val providerId: Output<String>? = null

The ID for the provider, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters a-z0-9-. The prefix gcp- is reserved for use by Google, and may not be specified.

Link copied to clipboard
val saml: Output<WorkforcePoolProviderSamlArgs>? = null

Represents a SAML identity provider. Structure is documented below.

Link copied to clipboard
val workforcePoolId: Output<String>? = null

The ID to use for the pool, which becomes the final component of the resource name. The IDs must be a globally unique string of 6 to 63 lowercase letters, digits, or hyphens. It must start with a letter, and cannot have a trailing hyphen. The prefix gcp- is reserved for use by Google, and may not be specified.