pulumi-fusionauth
Version:
A Pulumi package for managing FusionAuth instances.
370 lines (369 loc) • 22.2 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "./types/input";
import * as outputs from "./types/output";
/**
* ## # OpenID Connect Identity Provider Resource
*
* OpenID Connect identity providers connect to external OpenID Connect login systems. This type of login will optionally provide a Login with … button on FusionAuth’s login page. This button is customizable by using different properties of the identity provider.
*
* Optionally, this identity provider can define one or more domains it is associated with. This is useful for allowing employees to log in with their corporate credentials. As long as the company has an identity solution that provides OpenID Connect, you can leverage this feature. This is referred to as a Domain Based Identity Provider. If you enable domains for an identity provider, the Login with … button will not be displayed. Instead, only the email form field will be displayed initially on the FusionAuth login page. Once the user types in their email address, FusionAuth will determine if the user is logging in locally or if they should be redirected to this identity provider. This is determined by extracting the domain from their email address and comparing it to the domains associated with the identity provider.
*
* FusionAuth will also leverage the /userinfo API that is part of the OpenID Connect specification. The email address returned from the Userinfo response will be used to create or lookup the existing user. Additional claims from the Userinfo response can be used to reconcile the User in FusionAuth by using an OpenID Connect Reconcile Lambda. Unless you assign a reconcile lambda to this provider, on the email address will be used from the available claims returned by the OpenID Connect identity provider.
*
* If the external OpenID Connect identity provider returns a refresh token, it will be stored in the UserRegistration object inside the tokens Map. This Map stores the tokens from the various identity providers so that you can use them in your application to call their APIs.
*
* [OpenID Connect Identity Providers API](https://fusionauth.io/docs/v1/tech/apis/identity-providers/openid-connect)
*
* ## Example Usage
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as fusionauth from "pulumi-fusionauth";
*
* const openID = new fusionauth.FusionAuthIdpOpenIdConnect("openID", {
* applicationConfigurations: [{
* applicationId: fusionauth_application.myapp.id,
* createRegistration: true,
* enabled: true,
* }],
* oauth2AuthorizationEndpoint: "https://acme.com/oauth2/authorization",
* oauth2ClientId: "191c23dc-b772-4558-bd21-dc1cbf74ae21",
* oauth2ClientSecret: "SUsnoP0pWUYfXvWbSe5pvj8Di5nAxOvO",
* oauth2ClientAuthenticationMethod: "client_secret_basic",
* oauth2Scope: "openid offline_access",
* oauth2TokenEndpoint: "https://acme.com/oauth2/token",
* oauth2UserInfoEndpoint: "https://acme.com/oauth2/userinfo",
* buttonText: "Login with OpenID Connect",
* debug: false,
* enabled: true,
* tenantConfigurations: [{
* tenantId: fusionauth_tenant.example.id,
* limitUserLinkCountEnabled: false,
* limitUserLinkCountMaximumLinks: 42,
* }],
* });
* ```
*/
export declare class FusionAuthIdpOpenIdConnect extends pulumi.CustomResource {
/**
* Get an existing FusionAuthIdpOpenIdConnect resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: FusionAuthIdpOpenIdConnectState, opts?: pulumi.CustomResourceOptions): FusionAuthIdpOpenIdConnect;
/**
* Returns true if the given object is an instance of FusionAuthIdpOpenIdConnect. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is FusionAuthIdpOpenIdConnect;
/**
* The configuration for each Application that the identity provider is enabled for.
*/
readonly applicationConfigurations: pulumi.Output<outputs.FusionAuthIdpOpenIdConnectApplicationConfiguration[] | undefined>;
/**
* The top-level button image (URL) to use on the FusionAuth login page for this Identity Provider.
*/
readonly buttonImageUrl: pulumi.Output<string | undefined>;
/**
* The top-level button text to use on the FusionAuth login page for this Identity Provider.
*/
readonly buttonText: pulumi.Output<string>;
/**
* Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created.
*/
readonly debug: pulumi.Output<boolean | undefined>;
/**
* This is an optional list of domains that this OpenID Connect provider should be used for. This converts the FusionAuth login form to a domain-based login form. This type of form first asks the user for their email. FusionAuth then uses their email to determine if an OpenID Connect identity provider should be used. If an OpenID Connect provider should be used, the browser is redirected to the authorization endpoint of that identity provider. Otherwise, the password field is revealed on the form so that the user can login using FusionAuth.
*/
readonly domains: pulumi.Output<string[] | undefined>;
/**
* Determines if this provider is enabled. If it is false then it will be disabled globally.
*/
readonly enabled: pulumi.Output<boolean | undefined>;
/**
* The ID to use for the new identity provider. If not specified a secure random UUID will be generated.
*/
readonly idpId: pulumi.Output<string | undefined>;
/**
* The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user.
*/
readonly lambdaReconcileId: pulumi.Output<string | undefined>;
/**
* The linking strategy to use when creating the link between the {idp_display_name} Identity Provider and the user.
*/
readonly linkingStrategy: pulumi.Output<string>;
/**
* The name of this OpenID Connect identity provider. This is only used for display purposes.
*/
readonly name: pulumi.Output<string>;
/**
* The top-level authorization endpoint for the OpenID Connect identity provider. You can leave this blank if you provide the issuer field, which will be used to make a request to the OpenID Connect .well-known endpoint in order to dynamically resolve the authorization endpoint. If you provide an issuer then this field will be ignored.
*/
readonly oauth2AuthorizationEndpoint: pulumi.Output<string | undefined>;
/**
* The client authentication method to use with the OpenID Connect identity provider.
*/
readonly oauth2ClientAuthenticationMethod: pulumi.Output<string | undefined>;
/**
* The top-level client id for your Application.
*/
readonly oauth2ClientId: pulumi.Output<string>;
/**
* The top-level client secret to use with the OpenID Connect identity provider.
*/
readonly oauth2ClientSecret: pulumi.Output<string | undefined>;
/**
* An optional configuration to modify the expected name of the claim returned by the IdP that contains the email address.
*/
readonly oauth2EmailClaim: pulumi.Output<string | undefined>;
/**
* An optional configuration to modify the expected name of the claim returned by the IdP that contains the email verified status.
*/
readonly oauth2EmailVerifiedClaim: pulumi.Output<string | undefined>;
/**
* The top-level issuer URI for the OpenID Connect identity provider. If this is provided, the authorization endpoint, token endpoint and userinfo endpoint will all be resolved using the issuer URI plus /.well-known/openid-configuration.
*/
readonly oauth2Issuer: pulumi.Output<string | undefined>;
/**
* The top-level scope that you are requesting from the OpenID Connect identity provider.
*/
readonly oauth2Scope: pulumi.Output<string | undefined>;
/**
* The top-level token endpoint for the OpenID Connect identity provider. You can leave this blank if you provide the issuer field, which will be used to make a request to the OpenID Connect .well-known endpoint in order to dynamically resolve the token endpoint. If you provide an issuer then this field will be ignored.
*/
readonly oauth2TokenEndpoint: pulumi.Output<string | undefined>;
/**
* An optional configuration to modify the expected name of the claim returned by the IdP that contains the user Id.
*/
readonly oauth2UniqueIdClaim: pulumi.Output<string | undefined>;
/**
* The top-level userinfo endpoint for the OpenID Connect identity provider. You can leave this blank if you provide the issuer field, which will be used to make a request to the OpenID Connect .well-known endpoint in order to dynamically resolve the userinfo endpoint. If you provide an issuer then this field will be ignored.
*/
readonly oauth2UserInfoEndpoint: pulumi.Output<string | undefined>;
/**
* An optional configuration to modify the expected name of the claim returned by the IdP that contains the username.
*/
readonly oauth2UsernameClaim: pulumi.Output<string | undefined>;
/**
* Set this value equal to true if you wish to use POST bindings with this OpenID Connect identity provider. The default value of false means that a redirect binding which uses a GET request will be used.
*/
readonly postRequest: pulumi.Output<boolean | undefined>;
/**
* The configuration for each Tenant that limits the number of links a user may have for a particular identity provider.
*/
readonly tenantConfigurations: pulumi.Output<outputs.FusionAuthIdpOpenIdConnectTenantConfiguration[] | undefined>;
/**
* Create a FusionAuthIdpOpenIdConnect resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: FusionAuthIdpOpenIdConnectArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering FusionAuthIdpOpenIdConnect resources.
*/
export interface FusionAuthIdpOpenIdConnectState {
/**
* The configuration for each Application that the identity provider is enabled for.
*/
applicationConfigurations?: pulumi.Input<pulumi.Input<inputs.FusionAuthIdpOpenIdConnectApplicationConfiguration>[]>;
/**
* The top-level button image (URL) to use on the FusionAuth login page for this Identity Provider.
*/
buttonImageUrl?: pulumi.Input<string>;
/**
* The top-level button text to use on the FusionAuth login page for this Identity Provider.
*/
buttonText?: pulumi.Input<string>;
/**
* Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created.
*/
debug?: pulumi.Input<boolean>;
/**
* This is an optional list of domains that this OpenID Connect provider should be used for. This converts the FusionAuth login form to a domain-based login form. This type of form first asks the user for their email. FusionAuth then uses their email to determine if an OpenID Connect identity provider should be used. If an OpenID Connect provider should be used, the browser is redirected to the authorization endpoint of that identity provider. Otherwise, the password field is revealed on the form so that the user can login using FusionAuth.
*/
domains?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Determines if this provider is enabled. If it is false then it will be disabled globally.
*/
enabled?: pulumi.Input<boolean>;
/**
* The ID to use for the new identity provider. If not specified a secure random UUID will be generated.
*/
idpId?: pulumi.Input<string>;
/**
* The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user.
*/
lambdaReconcileId?: pulumi.Input<string>;
/**
* The linking strategy to use when creating the link between the {idp_display_name} Identity Provider and the user.
*/
linkingStrategy?: pulumi.Input<string>;
/**
* The name of this OpenID Connect identity provider. This is only used for display purposes.
*/
name?: pulumi.Input<string>;
/**
* The top-level authorization endpoint for the OpenID Connect identity provider. You can leave this blank if you provide the issuer field, which will be used to make a request to the OpenID Connect .well-known endpoint in order to dynamically resolve the authorization endpoint. If you provide an issuer then this field will be ignored.
*/
oauth2AuthorizationEndpoint?: pulumi.Input<string>;
/**
* The client authentication method to use with the OpenID Connect identity provider.
*/
oauth2ClientAuthenticationMethod?: pulumi.Input<string>;
/**
* The top-level client id for your Application.
*/
oauth2ClientId?: pulumi.Input<string>;
/**
* The top-level client secret to use with the OpenID Connect identity provider.
*/
oauth2ClientSecret?: pulumi.Input<string>;
/**
* An optional configuration to modify the expected name of the claim returned by the IdP that contains the email address.
*/
oauth2EmailClaim?: pulumi.Input<string>;
/**
* An optional configuration to modify the expected name of the claim returned by the IdP that contains the email verified status.
*/
oauth2EmailVerifiedClaim?: pulumi.Input<string>;
/**
* The top-level issuer URI for the OpenID Connect identity provider. If this is provided, the authorization endpoint, token endpoint and userinfo endpoint will all be resolved using the issuer URI plus /.well-known/openid-configuration.
*/
oauth2Issuer?: pulumi.Input<string>;
/**
* The top-level scope that you are requesting from the OpenID Connect identity provider.
*/
oauth2Scope?: pulumi.Input<string>;
/**
* The top-level token endpoint for the OpenID Connect identity provider. You can leave this blank if you provide the issuer field, which will be used to make a request to the OpenID Connect .well-known endpoint in order to dynamically resolve the token endpoint. If you provide an issuer then this field will be ignored.
*/
oauth2TokenEndpoint?: pulumi.Input<string>;
/**
* An optional configuration to modify the expected name of the claim returned by the IdP that contains the user Id.
*/
oauth2UniqueIdClaim?: pulumi.Input<string>;
/**
* The top-level userinfo endpoint for the OpenID Connect identity provider. You can leave this blank if you provide the issuer field, which will be used to make a request to the OpenID Connect .well-known endpoint in order to dynamically resolve the userinfo endpoint. If you provide an issuer then this field will be ignored.
*/
oauth2UserInfoEndpoint?: pulumi.Input<string>;
/**
* An optional configuration to modify the expected name of the claim returned by the IdP that contains the username.
*/
oauth2UsernameClaim?: pulumi.Input<string>;
/**
* Set this value equal to true if you wish to use POST bindings with this OpenID Connect identity provider. The default value of false means that a redirect binding which uses a GET request will be used.
*/
postRequest?: pulumi.Input<boolean>;
/**
* The configuration for each Tenant that limits the number of links a user may have for a particular identity provider.
*/
tenantConfigurations?: pulumi.Input<pulumi.Input<inputs.FusionAuthIdpOpenIdConnectTenantConfiguration>[]>;
}
/**
* The set of arguments for constructing a FusionAuthIdpOpenIdConnect resource.
*/
export interface FusionAuthIdpOpenIdConnectArgs {
/**
* The configuration for each Application that the identity provider is enabled for.
*/
applicationConfigurations?: pulumi.Input<pulumi.Input<inputs.FusionAuthIdpOpenIdConnectApplicationConfiguration>[]>;
/**
* The top-level button image (URL) to use on the FusionAuth login page for this Identity Provider.
*/
buttonImageUrl?: pulumi.Input<string>;
/**
* The top-level button text to use on the FusionAuth login page for this Identity Provider.
*/
buttonText: pulumi.Input<string>;
/**
* Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created.
*/
debug?: pulumi.Input<boolean>;
/**
* This is an optional list of domains that this OpenID Connect provider should be used for. This converts the FusionAuth login form to a domain-based login form. This type of form first asks the user for their email. FusionAuth then uses their email to determine if an OpenID Connect identity provider should be used. If an OpenID Connect provider should be used, the browser is redirected to the authorization endpoint of that identity provider. Otherwise, the password field is revealed on the form so that the user can login using FusionAuth.
*/
domains?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Determines if this provider is enabled. If it is false then it will be disabled globally.
*/
enabled?: pulumi.Input<boolean>;
/**
* The ID to use for the new identity provider. If not specified a secure random UUID will be generated.
*/
idpId?: pulumi.Input<string>;
/**
* The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user.
*/
lambdaReconcileId?: pulumi.Input<string>;
/**
* The linking strategy to use when creating the link between the {idp_display_name} Identity Provider and the user.
*/
linkingStrategy?: pulumi.Input<string>;
/**
* The name of this OpenID Connect identity provider. This is only used for display purposes.
*/
name?: pulumi.Input<string>;
/**
* The top-level authorization endpoint for the OpenID Connect identity provider. You can leave this blank if you provide the issuer field, which will be used to make a request to the OpenID Connect .well-known endpoint in order to dynamically resolve the authorization endpoint. If you provide an issuer then this field will be ignored.
*/
oauth2AuthorizationEndpoint?: pulumi.Input<string>;
/**
* The client authentication method to use with the OpenID Connect identity provider.
*/
oauth2ClientAuthenticationMethod?: pulumi.Input<string>;
/**
* The top-level client id for your Application.
*/
oauth2ClientId: pulumi.Input<string>;
/**
* The top-level client secret to use with the OpenID Connect identity provider.
*/
oauth2ClientSecret?: pulumi.Input<string>;
/**
* An optional configuration to modify the expected name of the claim returned by the IdP that contains the email address.
*/
oauth2EmailClaim?: pulumi.Input<string>;
/**
* An optional configuration to modify the expected name of the claim returned by the IdP that contains the email verified status.
*/
oauth2EmailVerifiedClaim?: pulumi.Input<string>;
/**
* The top-level issuer URI for the OpenID Connect identity provider. If this is provided, the authorization endpoint, token endpoint and userinfo endpoint will all be resolved using the issuer URI plus /.well-known/openid-configuration.
*/
oauth2Issuer?: pulumi.Input<string>;
/**
* The top-level scope that you are requesting from the OpenID Connect identity provider.
*/
oauth2Scope?: pulumi.Input<string>;
/**
* The top-level token endpoint for the OpenID Connect identity provider. You can leave this blank if you provide the issuer field, which will be used to make a request to the OpenID Connect .well-known endpoint in order to dynamically resolve the token endpoint. If you provide an issuer then this field will be ignored.
*/
oauth2TokenEndpoint?: pulumi.Input<string>;
/**
* An optional configuration to modify the expected name of the claim returned by the IdP that contains the user Id.
*/
oauth2UniqueIdClaim?: pulumi.Input<string>;
/**
* The top-level userinfo endpoint for the OpenID Connect identity provider. You can leave this blank if you provide the issuer field, which will be used to make a request to the OpenID Connect .well-known endpoint in order to dynamically resolve the userinfo endpoint. If you provide an issuer then this field will be ignored.
*/
oauth2UserInfoEndpoint?: pulumi.Input<string>;
/**
* An optional configuration to modify the expected name of the claim returned by the IdP that contains the username.
*/
oauth2UsernameClaim?: pulumi.Input<string>;
/**
* Set this value equal to true if you wish to use POST bindings with this OpenID Connect identity provider. The default value of false means that a redirect binding which uses a GET request will be used.
*/
postRequest?: pulumi.Input<boolean>;
/**
* The configuration for each Tenant that limits the number of links a user may have for a particular identity provider.
*/
tenantConfigurations?: pulumi.Input<pulumi.Input<inputs.FusionAuthIdpOpenIdConnectTenantConfiguration>[]>;
}