pulumi-fusionauth
Version:
A Pulumi package for managing FusionAuth instances.
309 lines (308 loc) • 18.2 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "./types/input";
import * as outputs from "./types/output";
/**
* ## # External JWT Identity Provider Resource
*
* This is a special type of identity provider that is only used via the JWT Reconcile API. This identity provider defines the claims inside the incoming JWT and how they map to fields in the FusionAuth User object.
*
* In order for this identity provider to use the JWT, it also needs the public key or HMAC secret that the JWT was signed with. FusionAuth will verify that the JWT is valid and has not expired. Once the JWT has been validated, FusionAuth will reconcile it to ensure that the User exists and is up-to-date.
*
* [External JWT Identity Providers API](https://fusionauth.io/docs/v1/tech/apis/identity-providers/external-jwt/)
*
* ## Example Usage
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as fusionauth from "pulumi-fusionauth";
*
* const jwt = new fusionauth.FusionAuthIdpExternalJwt("jwt", {
* claimMap: {
* dept: "RegistrationData",
* first_name: "firstName",
* last_name: "lastName",
* },
* debug: false,
* enabled: true,
* headerKeyParameter: "kid",
* oauth2AuthorizationEndpoint: "https://acme.com/adfs/oauth2/authorize?client_id=cf3b00da-9551-460a-ad18-33232e6cbff0&response_type=code&redirect_uri=https://acme.com/oauth2/redirect",
* oauth2TokenEndpoint: "https://acme.com/adfs/oauth2/token",
* uniqueIdentityClaim: "email",
* });
* ```
*/
export declare class FusionAuthIdpExternalJwt extends pulumi.CustomResource {
/**
* Get an existing FusionAuthIdpExternalJwt resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: FusionAuthIdpExternalJwtState, opts?: pulumi.CustomResourceOptions): FusionAuthIdpExternalJwt;
/**
* Returns true if the given object is an instance of FusionAuthIdpExternalJwt. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is FusionAuthIdpExternalJwt;
/**
* The configuration for each Application that the identity provider is enabled for.
*/
readonly applicationConfigurations: pulumi.Output<outputs.FusionAuthIdpExternalJwtApplicationConfiguration[] | undefined>;
/**
* A map of incoming claims to User fields, User data or Registration data. The key of the map is the incoming claim name from the configured identity provider. The following are allowed values: birthDate, firstName, lastName, fullName, middleName, mobilePhone, imageUrl, timezone, UserData and RegistrationData.
*/
readonly claimMap: pulumi.Output<{
[key: string]: string;
} | undefined>;
/**
* Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created.
*/
readonly debug: pulumi.Output<boolean | undefined>;
/**
* When configured this key will be used to verify the signature of the JWT when the header key defined by the headerKeyParameter property is not found in the JWT header. In most cases, the JWT header will contain the key identifier and this value will be used to resolve the correct public key or X.509 certificate to verify the signature. This assumes the public key or X.509 certificate has already been imported using the Key API or Key Master in the FusionAuth admin UI.
*/
readonly defaultKeyId: pulumi.Output<string | undefined>;
/**
* An array of domains that are managed by this Identity Provider.
*/
readonly domains: pulumi.Output<string[] | undefined>;
/**
* Determines if this provider is enabled. If it is false then it will be disabled globally.
*/
readonly enabled: pulumi.Output<boolean | undefined>;
/**
* The name header claim that identifies the public key used to verify the signature. In most cases this be kid or x5t.
*/
readonly headerKeyParameter: pulumi.Output<string>;
/**
* The ID to use for the new identity provider. If not specified a secure random UUID will be generated.
*/
readonly idpId: pulumi.Output<string | undefined>;
/**
* The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user.
*/
readonly lambdaReconcileId: pulumi.Output<string | undefined>;
/**
* The linking strategy to use when creating the link between the {idp_display_name} Identity Provider and the user.
*/
readonly linkingStrategy: pulumi.Output<string>;
/**
* The name of the Identity Provider.
*/
readonly name: pulumi.Output<string>;
/**
* The authorization endpoint for this Identity Provider. This value is not utilized by FusionAuth is only provided to be returned by the Lookup Identity Provider API response. During integration you may then utilize this value to perform the browser redirect to the OAuth2 authorize endpoint.
*/
readonly oauth2AuthorizationEndpoint: pulumi.Output<string | undefined>;
/**
* The name of the claim that contains the user's email address. This will only be used when the `linkingStrategy`is equal to LinkByEmail or LinkByEmailForExistingUser.
*/
readonly oauth2EmailClaim: pulumi.Output<string | undefined>;
/**
* The name of the claim that identities if the user's email address has been verified. When the `linkingStrategy` is equal to LinkByEmail or LinkByEmailForExistingUser and this claim is present and the value is false a link will not be established and an error will be returned indicating a link cannot be established using an unverified email address.
*/
readonly oauth2EmailVerifiedClaim: pulumi.Output<string | undefined>;
/**
* The token endpoint for this Identity Provider. This value is not utilized by FusionAuth is only provided to be returned by the Lookup Identity Provider API response. During integration you may then utilize this value to complete the OAuth2 grant workflow.
*/
readonly oauth2TokenEndpoint: pulumi.Output<string | undefined>;
/**
* The name of the claim that contains the user's unique user Id.
*/
readonly oauth2UniqueIdClaim: pulumi.Output<string | undefined>;
/**
* The name of the claim that contains the user's username. This will only be used when the `linkingStrategy` is equal to LinkByUsername or LinkByUsernameForExistingUser.
*/
readonly oauth2UsernameClaim: pulumi.Output<string | undefined>;
/**
* The configuration for each Tenant that limits the number of links a user may have for a particular identity provider.
*/
readonly tenantConfigurations: pulumi.Output<outputs.FusionAuthIdpExternalJwtTenantConfiguration[] | undefined>;
/**
* (Optional) The name of the claim that represents the unique identify of the User. This will generally be email or the name of the claim that provides the email address.
*
* @deprecated This field is deprecated and will be removed in a future release. Prefer the use of oauth2_unique_id_claim.
*/
readonly uniqueIdentityClaim: pulumi.Output<string | undefined>;
/**
* Create a FusionAuthIdpExternalJwt resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: FusionAuthIdpExternalJwtArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering FusionAuthIdpExternalJwt resources.
*/
export interface FusionAuthIdpExternalJwtState {
/**
* The configuration for each Application that the identity provider is enabled for.
*/
applicationConfigurations?: pulumi.Input<pulumi.Input<inputs.FusionAuthIdpExternalJwtApplicationConfiguration>[]>;
/**
* A map of incoming claims to User fields, User data or Registration data. The key of the map is the incoming claim name from the configured identity provider. The following are allowed values: birthDate, firstName, lastName, fullName, middleName, mobilePhone, imageUrl, timezone, UserData and RegistrationData.
*/
claimMap?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
}>;
/**
* Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created.
*/
debug?: pulumi.Input<boolean>;
/**
* When configured this key will be used to verify the signature of the JWT when the header key defined by the headerKeyParameter property is not found in the JWT header. In most cases, the JWT header will contain the key identifier and this value will be used to resolve the correct public key or X.509 certificate to verify the signature. This assumes the public key or X.509 certificate has already been imported using the Key API or Key Master in the FusionAuth admin UI.
*/
defaultKeyId?: pulumi.Input<string>;
/**
* An array of domains that are managed by this Identity Provider.
*/
domains?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Determines if this provider is enabled. If it is false then it will be disabled globally.
*/
enabled?: pulumi.Input<boolean>;
/**
* The name header claim that identifies the public key used to verify the signature. In most cases this be kid or x5t.
*/
headerKeyParameter?: pulumi.Input<string>;
/**
* The ID to use for the new identity provider. If not specified a secure random UUID will be generated.
*/
idpId?: pulumi.Input<string>;
/**
* The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user.
*/
lambdaReconcileId?: pulumi.Input<string>;
/**
* The linking strategy to use when creating the link between the {idp_display_name} Identity Provider and the user.
*/
linkingStrategy?: pulumi.Input<string>;
/**
* The name of the Identity Provider.
*/
name?: pulumi.Input<string>;
/**
* The authorization endpoint for this Identity Provider. This value is not utilized by FusionAuth is only provided to be returned by the Lookup Identity Provider API response. During integration you may then utilize this value to perform the browser redirect to the OAuth2 authorize endpoint.
*/
oauth2AuthorizationEndpoint?: pulumi.Input<string>;
/**
* The name of the claim that contains the user's email address. This will only be used when the `linkingStrategy`is equal to LinkByEmail or LinkByEmailForExistingUser.
*/
oauth2EmailClaim?: pulumi.Input<string>;
/**
* The name of the claim that identities if the user's email address has been verified. When the `linkingStrategy` is equal to LinkByEmail or LinkByEmailForExistingUser and this claim is present and the value is false a link will not be established and an error will be returned indicating a link cannot be established using an unverified email address.
*/
oauth2EmailVerifiedClaim?: pulumi.Input<string>;
/**
* The token endpoint for this Identity Provider. This value is not utilized by FusionAuth is only provided to be returned by the Lookup Identity Provider API response. During integration you may then utilize this value to complete the OAuth2 grant workflow.
*/
oauth2TokenEndpoint?: pulumi.Input<string>;
/**
* The name of the claim that contains the user's unique user Id.
*/
oauth2UniqueIdClaim?: pulumi.Input<string>;
/**
* The name of the claim that contains the user's username. This will only be used when the `linkingStrategy` is equal to LinkByUsername or LinkByUsernameForExistingUser.
*/
oauth2UsernameClaim?: pulumi.Input<string>;
/**
* The configuration for each Tenant that limits the number of links a user may have for a particular identity provider.
*/
tenantConfigurations?: pulumi.Input<pulumi.Input<inputs.FusionAuthIdpExternalJwtTenantConfiguration>[]>;
/**
* (Optional) The name of the claim that represents the unique identify of the User. This will generally be email or the name of the claim that provides the email address.
*
* @deprecated This field is deprecated and will be removed in a future release. Prefer the use of oauth2_unique_id_claim.
*/
uniqueIdentityClaim?: pulumi.Input<string>;
}
/**
* The set of arguments for constructing a FusionAuthIdpExternalJwt resource.
*/
export interface FusionAuthIdpExternalJwtArgs {
/**
* The configuration for each Application that the identity provider is enabled for.
*/
applicationConfigurations?: pulumi.Input<pulumi.Input<inputs.FusionAuthIdpExternalJwtApplicationConfiguration>[]>;
/**
* A map of incoming claims to User fields, User data or Registration data. The key of the map is the incoming claim name from the configured identity provider. The following are allowed values: birthDate, firstName, lastName, fullName, middleName, mobilePhone, imageUrl, timezone, UserData and RegistrationData.
*/
claimMap?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
}>;
/**
* Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created.
*/
debug?: pulumi.Input<boolean>;
/**
* When configured this key will be used to verify the signature of the JWT when the header key defined by the headerKeyParameter property is not found in the JWT header. In most cases, the JWT header will contain the key identifier and this value will be used to resolve the correct public key or X.509 certificate to verify the signature. This assumes the public key or X.509 certificate has already been imported using the Key API or Key Master in the FusionAuth admin UI.
*/
defaultKeyId?: pulumi.Input<string>;
/**
* An array of domains that are managed by this Identity Provider.
*/
domains?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Determines if this provider is enabled. If it is false then it will be disabled globally.
*/
enabled?: pulumi.Input<boolean>;
/**
* The name header claim that identifies the public key used to verify the signature. In most cases this be kid or x5t.
*/
headerKeyParameter: pulumi.Input<string>;
/**
* The ID to use for the new identity provider. If not specified a secure random UUID will be generated.
*/
idpId?: pulumi.Input<string>;
/**
* The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user.
*/
lambdaReconcileId?: pulumi.Input<string>;
/**
* The linking strategy to use when creating the link between the {idp_display_name} Identity Provider and the user.
*/
linkingStrategy?: pulumi.Input<string>;
/**
* The name of the Identity Provider.
*/
name?: pulumi.Input<string>;
/**
* The authorization endpoint for this Identity Provider. This value is not utilized by FusionAuth is only provided to be returned by the Lookup Identity Provider API response. During integration you may then utilize this value to perform the browser redirect to the OAuth2 authorize endpoint.
*/
oauth2AuthorizationEndpoint?: pulumi.Input<string>;
/**
* The name of the claim that contains the user's email address. This will only be used when the `linkingStrategy`is equal to LinkByEmail or LinkByEmailForExistingUser.
*/
oauth2EmailClaim?: pulumi.Input<string>;
/**
* The name of the claim that identities if the user's email address has been verified. When the `linkingStrategy` is equal to LinkByEmail or LinkByEmailForExistingUser and this claim is present and the value is false a link will not be established and an error will be returned indicating a link cannot be established using an unverified email address.
*/
oauth2EmailVerifiedClaim?: pulumi.Input<string>;
/**
* The token endpoint for this Identity Provider. This value is not utilized by FusionAuth is only provided to be returned by the Lookup Identity Provider API response. During integration you may then utilize this value to complete the OAuth2 grant workflow.
*/
oauth2TokenEndpoint?: pulumi.Input<string>;
/**
* The name of the claim that contains the user's unique user Id.
*/
oauth2UniqueIdClaim?: pulumi.Input<string>;
/**
* The name of the claim that contains the user's username. This will only be used when the `linkingStrategy` is equal to LinkByUsername or LinkByUsernameForExistingUser.
*/
oauth2UsernameClaim?: pulumi.Input<string>;
/**
* The configuration for each Tenant that limits the number of links a user may have for a particular identity provider.
*/
tenantConfigurations?: pulumi.Input<pulumi.Input<inputs.FusionAuthIdpExternalJwtTenantConfiguration>[]>;
/**
* (Optional) The name of the claim that represents the unique identify of the User. This will generally be email or the name of the claim that provides the email address.
*
* @deprecated This field is deprecated and will be removed in a future release. Prefer the use of oauth2_unique_id_claim.
*/
uniqueIdentityClaim?: pulumi.Input<string>;
}