pulumi-vault-kotlin/com.pulumi.vault.jwt.kotlin/AuthBackendArgs

AuthBackendArgs

data class AuthBackendArgs(val boundIssuer: Output<String>? = null, val defaultRole: Output<String>? = null, val description: Output<String>? = null, val disableRemount: Output<Boolean>? = null, val jwksCaPem: Output<String>? = null, val jwksUrl: Output<String>? = null, val jwtSupportedAlgs: Output<List<String>>? = null, val jwtValidationPubkeys: Output<List<String>>? = null, val local: Output<Boolean>? = null, val namespace: Output<String>? = null, val namespaceInState: Output<Boolean>? = null, val oidcClientId: Output<String>? = null, val oidcClientSecret: Output<String>? = null, val oidcDiscoveryCaPem: Output<String>? = null, val oidcDiscoveryUrl: Output<String>? = null, val oidcResponseMode: Output<String>? = null, val oidcResponseTypes: Output<List<String>>? = null, val path: Output<String>? = null, val providerConfig: Output<Map<String, String>>? = null, val tune: Output<AuthBackendTuneArgs>? = null, val type: Output<String>? = null) : ConvertibleToJava<AuthBackendArgs>

Provides a resource for managing an JWT auth backend within Vault.

Example Usage

Manage JWT auth backend:

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const example = new vault.jwt.AuthBackend("example", {
    description: "Demonstration of the Terraform JWT auth backend",
    path: "jwt",
    oidcDiscoveryUrl: "https://myco.auth0.com/",
    boundIssuer: "https://myco.auth0.com/",
});

import pulumi
import pulumi_vault as vault
example = vault.jwt.AuthBackend("example",
    description="Demonstration of the Terraform JWT auth backend",
    path="jwt",
    oidc_discovery_url="https://myco.auth0.com/",
    bound_issuer="https://myco.auth0.com/")

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
    var example = new Vault.Jwt.AuthBackend("example", new()
    {
        Description = "Demonstration of the Terraform JWT auth backend",
        Path = "jwt",
        OidcDiscoveryUrl = "https://myco.auth0.com/",
        BoundIssuer = "https://myco.auth0.com/",
    });
});

package main
import (
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/jwt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := jwt.NewAuthBackend(ctx, "example", &jwt.AuthBackendArgs{
			Description:      pulumi.String("Demonstration of the Terraform JWT auth backend"),
			Path:             pulumi.String("jwt"),
			OidcDiscoveryUrl: pulumi.String("https://myco.auth0.com/"),
			BoundIssuer:      pulumi.String("https://myco.auth0.com/"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.jwt.AuthBackend;
import com.pulumi.vault.jwt.AuthBackendArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var example = new AuthBackend("example", AuthBackendArgs.builder()
            .description("Demonstration of the Terraform JWT auth backend")
            .path("jwt")
            .oidcDiscoveryUrl("https://myco.auth0.com/")
            .boundIssuer("https://myco.auth0.com/")
            .build());
    }
}

resources:
  example:
    type: vault:jwt:AuthBackend
    properties:
      description: Demonstration of the Terraform JWT auth backend
      path: jwt
      oidcDiscoveryUrl: https://myco.auth0.com/
      boundIssuer: https://myco.auth0.com/

Manage OIDC auth backend:

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const example = new vault.jwt.AuthBackend("example", {
    description: "Demonstration of the Terraform JWT auth backend",
    path: "oidc",
    type: "oidc",
    oidcDiscoveryUrl: "https://myco.auth0.com/",
    oidcClientId: "1234567890",
    oidcClientSecret: "secret123456",
    boundIssuer: "https://myco.auth0.com/",
    tune: {
        listingVisibility: "unauth",
    },
});

import pulumi
import pulumi_vault as vault
example = vault.jwt.AuthBackend("example",
    description="Demonstration of the Terraform JWT auth backend",
    path="oidc",
    type="oidc",
    oidc_discovery_url="https://myco.auth0.com/",
    oidc_client_id="1234567890",
    oidc_client_secret="secret123456",
    bound_issuer="https://myco.auth0.com/",
    tune={
        "listing_visibility": "unauth",
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
    var example = new Vault.Jwt.AuthBackend("example", new()
    {
        Description = "Demonstration of the Terraform JWT auth backend",
        Path = "oidc",
        Type = "oidc",
        OidcDiscoveryUrl = "https://myco.auth0.com/",
        OidcClientId = "1234567890",
        OidcClientSecret = "secret123456",
        BoundIssuer = "https://myco.auth0.com/",
        Tune = new Vault.Jwt.Inputs.AuthBackendTuneArgs
        {
            ListingVisibility = "unauth",
        },
    });
});

package main
import (
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/jwt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := jwt.NewAuthBackend(ctx, "example", &jwt.AuthBackendArgs{
			Description:      pulumi.String("Demonstration of the Terraform JWT auth backend"),
			Path:             pulumi.String("oidc"),
			Type:             pulumi.String("oidc"),
			OidcDiscoveryUrl: pulumi.String("https://myco.auth0.com/"),
			OidcClientId:     pulumi.String("1234567890"),
			OidcClientSecret: pulumi.String("secret123456"),
			BoundIssuer:      pulumi.String("https://myco.auth0.com/"),
			Tune: &jwt.AuthBackendTuneArgs{
				ListingVisibility: pulumi.String("unauth"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.jwt.AuthBackend;
import com.pulumi.vault.jwt.AuthBackendArgs;
import com.pulumi.vault.jwt.inputs.AuthBackendTuneArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var example = new AuthBackend("example", AuthBackendArgs.builder()
            .description("Demonstration of the Terraform JWT auth backend")
            .path("oidc")
            .type("oidc")
            .oidcDiscoveryUrl("https://myco.auth0.com/")
            .oidcClientId("1234567890")
            .oidcClientSecret("secret123456")
            .boundIssuer("https://myco.auth0.com/")
            .tune(AuthBackendTuneArgs.builder()
                .listingVisibility("unauth")
                .build())
            .build());
    }
}

resources:
  example:
    type: vault:jwt:AuthBackend
    properties:
      description: Demonstration of the Terraform JWT auth backend
      path: oidc
      type: oidc
      oidcDiscoveryUrl: https://myco.auth0.com/
      oidcClientId: '1234567890'
      oidcClientSecret: secret123456
      boundIssuer: https://myco.auth0.com/
      tune:
        listingVisibility: unauth

Configuring the auth backend with a `provider_config:

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const gsuite = new vault.jwt.AuthBackend("gsuite", {
    description: "OIDC backend",
    oidcDiscoveryUrl: "https://accounts.google.com",
    path: "oidc",
    type: "oidc",
    providerConfig: {
        provider: "gsuite",
        fetch_groups: "true",
        fetch_user_info: "true",
        groups_recurse_max_depth: "1",
    },
});

import pulumi
import pulumi_vault as vault
gsuite = vault.jwt.AuthBackend("gsuite",
    description="OIDC backend",
    oidc_discovery_url="https://accounts.google.com",
    path="oidc",
    type="oidc",
    provider_config={
        "provider": "gsuite",
        "fetch_groups": "true",
        "fetch_user_info": "true",
        "groups_recurse_max_depth": "1",
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
    var gsuite = new Vault.Jwt.AuthBackend("gsuite", new()
    {
        Description = "OIDC backend",
        OidcDiscoveryUrl = "https://accounts.google.com",
        Path = "oidc",
        Type = "oidc",
        ProviderConfig =
        {
            { "provider", "gsuite" },
            { "fetch_groups", "true" },
            { "fetch_user_info", "true" },
            { "groups_recurse_max_depth", "1" },
        },
    });
});

package main
import (
	"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/jwt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := jwt.NewAuthBackend(ctx, "gsuite", &jwt.AuthBackendArgs{
			Description:      pulumi.String("OIDC backend"),
			OidcDiscoveryUrl: pulumi.String("https://accounts.google.com"),
			Path:             pulumi.String("oidc"),
			Type:             pulumi.String("oidc"),
			ProviderConfig: pulumi.StringMap{
				"provider":                 pulumi.String("gsuite"),
				"fetch_groups":             pulumi.String("true"),
				"fetch_user_info":          pulumi.String("true"),
				"groups_recurse_max_depth": pulumi.String("1"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.jwt.AuthBackend;
import com.pulumi.vault.jwt.AuthBackendArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var gsuite = new AuthBackend("gsuite", AuthBackendArgs.builder()
            .description("OIDC backend")
            .oidcDiscoveryUrl("https://accounts.google.com")
            .path("oidc")
            .type("oidc")
            .providerConfig(Map.ofEntries(
                Map.entry("provider", "gsuite"),
                Map.entry("fetch_groups", true),
                Map.entry("fetch_user_info", true),
                Map.entry("groups_recurse_max_depth", 1)
            ))
            .build());
    }
}

resources:
  gsuite:
    type: vault:jwt:AuthBackend
    properties:
      description: OIDC backend
      oidcDiscoveryUrl: https://accounts.google.com
      path: oidc
      type: oidc
      providerConfig:
        provider: gsuite
        fetch_groups: true
        fetch_user_info: true
        groups_recurse_max_depth: 1

Import

JWT auth backend can be imported using the path, e.g.

$ pulumi import vault:jwt/authBackend:AuthBackend oidc oidc

$ pulumi import vault:jwt/authBackend:AuthBackend jwt jwt

Constructors

AuthBackendArgs

constructor(boundIssuer: Output<String>? = null, defaultRole: Output<String>? = null, description: Output<String>? = null, disableRemount: Output<Boolean>? = null, jwksCaPem: Output<String>? = null, jwksUrl: Output<String>? = null, jwtSupportedAlgs: Output<List<String>>? = null, jwtValidationPubkeys: Output<List<String>>? = null, local: Output<Boolean>? = null, namespace: Output<String>? = null, namespaceInState: Output<Boolean>? = null, oidcClientId: Output<String>? = null, oidcClientSecret: Output<String>? = null, oidcDiscoveryCaPem: Output<String>? = null, oidcDiscoveryUrl: Output<String>? = null, oidcResponseMode: Output<String>? = null, oidcResponseTypes: Output<List<String>>? = null, path: Output<String>? = null, providerConfig: Output<Map<String, String>>? = null, tune: Output<AuthBackendTuneArgs>? = null, type: Output<String>? = null)

Properties

boundIssuer

val boundIssuer: Output<String>? = null

The value against which to match the iss claim in a JWT

defaultRole

val defaultRole: Output<String>? = null

The default role to use if none is provided during login

description

val description: Output<String>? = null

The description of the auth backend

disableRemount

val disableRemount: Output<Boolean>? = null

If set, opts out of mount migration on path updates. See here for more info on Mount Migration

jwksCaPem

val jwksCaPem: Output<String>? = null

The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.

jwksUrl

val jwksUrl: Output<String>? = null

JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".

jwtSupportedAlgs

val jwtSupportedAlgs: Output<List<String>>? = null

A list of supported signing algorithms. Vault 1.1.0 defaults to RS256 but future or past versions of Vault may differ

jwtValidationPubkeys

val jwtValidationPubkeys: Output<List<String>>? = null

A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with oidc_discovery_url

local

val local: Output<Boolean>? = null

Specifies if the auth method is local only.

namespace

val namespace: Output<String>? = null

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

namespaceInState

val namespaceInState: Output<Boolean>? = null

Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs

oidcClientId

val oidcClientId: Output<String>? = null

Client ID used for OIDC backends

oidcClientSecret

val oidcClientSecret: Output<String>? = null

Client Secret used for OIDC backends

oidcDiscoveryCaPem

val oidcDiscoveryCaPem: Output<String>? = null

The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used

oidcDiscoveryUrl

val oidcDiscoveryUrl: Output<String>? = null

The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with jwt_validation_pubkeys

oidcResponseMode

val oidcResponseMode: Output<String>? = null

The response mode to be used in the OAuth2 request. Allowed values are query and form_post. Defaults to query. If using Vault namespaces, and oidc_response_mode is form_post, then namespace_in_state should be set to false.

oidcResponseTypes

val oidcResponseTypes: Output<List<String>>? = null

List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to ["code"]. Note: id_token may only be used if oidc_response_mode is set to form_post.

path

val path: Output<String>? = null

Path to mount the JWT/OIDC auth backend

providerConfig

val providerConfig: Output<Map<String, String>>? = null

Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.

tune

val tune: Output<AuthBackendTuneArgs>? = null

type

val type: Output<String>? = null

Type of auth backend. Should be one of jwt or oidc. Default - jwt

Functions

toJava

open override fun toJava(): AuthBackendArgs