pulumi-vault-kotlin/com.pulumi.vault.ad.kotlin/SecretBackend

SecretBackend

class SecretBackend : KotlinCustomResource

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const config = new vault.ad.SecretBackend("config", {
    backend: "ad",
    binddn: "CN=Administrator,CN=Users,DC=corp,DC=example,DC=net",
    bindpass: "SuperSecretPassw0rd",
    url: "ldaps://ad",
    insecureTls: true,
    userdn: "CN=Users,DC=corp,DC=example,DC=net",
});

import pulumi
import pulumi_vault as vault
config = vault.ad.SecretBackend("config",
    backend="ad",
    binddn="CN=Administrator,CN=Users,DC=corp,DC=example,DC=net",
    bindpass="SuperSecretPassw0rd",
    url="ldaps://ad",
    insecure_tls=True,
    userdn="CN=Users,DC=corp,DC=example,DC=net")

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
    var config = new Vault.AD.SecretBackend("config", new()
    {
        Backend = "ad",
        Binddn = "CN=Administrator,CN=Users,DC=corp,DC=example,DC=net",
        Bindpass = "SuperSecretPassw0rd",
        Url = "ldaps://ad",
        InsecureTls = true,
        Userdn = "CN=Users,DC=corp,DC=example,DC=net",
    });
});

package main
import (
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/ad"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ad.NewSecretBackend(ctx, "config", &ad.SecretBackendArgs{
			Backend:     pulumi.String("ad"),
			Binddn:      pulumi.String("CN=Administrator,CN=Users,DC=corp,DC=example,DC=net"),
			Bindpass:    pulumi.String("SuperSecretPassw0rd"),
			Url:         pulumi.String("ldaps://ad"),
			InsecureTls: pulumi.Bool(true),
			Userdn:      pulumi.String("CN=Users,DC=corp,DC=example,DC=net"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.ad.SecretBackend;
import com.pulumi.vault.ad.SecretBackendArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var config = new SecretBackend("config", SecretBackendArgs.builder()
            .backend("ad")
            .binddn("CN=Administrator,CN=Users,DC=corp,DC=example,DC=net")
            .bindpass("SuperSecretPassw0rd")
            .url("ldaps://ad")
            .insecureTls("true")
            .userdn("CN=Users,DC=corp,DC=example,DC=net")
            .build());
    }
}

resources:
  config:
    type: vault:ad:SecretBackend
    properties:
      backend: ad
      binddn: CN=Administrator,CN=Users,DC=corp,DC=example,DC=net
      bindpass: SuperSecretPassw0rd
      url: ldaps://ad
      insecureTls: 'true'
      userdn: CN=Users,DC=corp,DC=example,DC=net

Import

AD secret backend can be imported using the backend, e.g.

$ pulumi import vault:ad/secretBackend:SecretBackend ad ad

Properties

anonymousGroupSearch

val anonymousGroupSearch: Output<Boolean>?

Use anonymous binds when performing LDAP group searches (if true the initial credentials will still be used for the initial connection test).

backend

val backend: Output<String>?

The unique path this backend should be mounted at. Must not begin or end with a /. Defaults to ad.

binddn

val binddn: Output<String>

Distinguished name of object to bind when performing user and group search.

bindpass

val bindpass: Output<String>

Password to use along with binddn when performing user search.

caseSensitiveNames

val caseSensitiveNames: Output<Boolean>?

If set, user and group names assigned to policies within the backend will be case sensitive. Otherwise, names will be normalized to lower case.

certificate

val certificate: Output<String>?

CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.

clientTlsCert

val clientTlsCert: Output<String>?

Client certificate to provide to the LDAP server, must be x509 PEM encoded.

clientTlsKey

val clientTlsKey: Output<String>?

Client certificate key to provide to the LDAP server, must be x509 PEM encoded.

defaultLeaseTtlSeconds

val defaultLeaseTtlSeconds: Output<Int>

Default lease duration for secrets in seconds.

denyNullBind

val denyNullBind: Output<Boolean>?

Denies an unauthenticated LDAP bind request if the user's password is empty; defaults to true.

description

val description: Output<String>?

Human-friendly description of the mount for the Active Directory backend.

disableRemount

val disableRemount: Output<Boolean>?

If set, opts out of mount migration on path updates. See here for more info on Mount Migration

discoverdn

val discoverdn: Output<Boolean>?

Use anonymous bind to discover the bind Distinguished Name of a user.

groupattr

val groupattr: Output<String>?

LDAP attribute to follow on objects returned by in order to enumerate user group membership. Examples: cn or memberOf, etc. Defaults to cn.

groupdn

val groupdn: Output<String>?

LDAP search base to use for group membership search (eg: ou=Groups,dc=example,dc=org).

groupfilter

val groupfilter: Output<String>?

Go template for querying group membership of user (optional) The template can access the following context variables: UserDN, Username. Defaults to (|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))

val id: Output<String>

insecureTls

val insecureTls: Output<Boolean>?

Skip LDAP server SSL Certificate verification. This is not recommended for production. Defaults to false.

lastRotationTolerance

val lastRotationTolerance: Output<Int>

The number of seconds after a Vault rotation where, if Active Directory shows a later rotation, it should be considered out-of-band

local

val local: Output<Boolean>?

Mark the secrets engine as local-only. Local engines are not replicated or removed by replication.Tolerance duration to use when checking the last rotation time.

maxLeaseTtlSeconds

val maxLeaseTtlSeconds: Output<Int>

Maximum possible lease duration for secrets in seconds.

maxTtl

val maxTtl: Output<Int>

In seconds, the maximum password time-to-live.

namespace

val namespace: Output<String>?

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

passwordPolicy

val passwordPolicy: Output<String>?

Name of the password policy to use to generate passwords.

pulumiChildResources

val pulumiChildResources: Set<KotlinResource>

pulumiResourceName

val pulumiResourceName: String

pulumiResourceType

val pulumiResourceType: String

requestTimeout

val requestTimeout: Output<Int>?

Timeout, in seconds, for the connection when making requests against the server before returning back an error.

starttls

val starttls: Output<Boolean>

Issue a StartTLS command after establishing unencrypted connection.

tlsMaxVersion

val tlsMaxVersion: Output<String>

Maximum TLS version to use. Accepted values are tls10, tls11, tls12 or tls13. Defaults to tls12.

tlsMinVersion

val tlsMinVersion: Output<String>

Minimum TLS version to use. Accepted values are tls10, tls11, tls12 or tls13. Defaults to tls12.

ttl

val ttl: Output<Int>

In seconds, the default password time-to-live.

upndomain

val upndomain: Output<String>

Enables userPrincipalDomain login with username@UPNDomain.

url

val url: Output<String>?

LDAP URL to connect to. Multiple URLs can be specified by concatenating them with commas; they will be tried in-order. Defaults to ldap://127.0.0.1.

urn

val urn: Output<String>

usePre111GroupCnBehavior

val usePre111GroupCnBehavior: Output<Boolean>

In Vault 1.1.1 a fix for handling group CN values of different cases unfortunately introduced a regression that could cause previously defined groups to not be found due to a change in the resulting name. If set true, the pre-1.1.1 behavior for matching group CNs will be used. This is only needed in some upgrade scenarios for backwards compatibility. It is enabled by default if the config is upgraded but disabled by default on new configurations.

userattr

val userattr: Output<String>?

Attribute used when searching users. Defaults to cn.

userdn

val userdn: Output<String>?

LDAP domain to use for users (eg: ou=People,dc=example,dc=org)`.

useTokenGroups

val useTokenGroups: Output<Boolean>?

If true, use the Active Directory tokenGroups constructed attribute of the user to find the group memberships. This will find all security groups including nested ones.