pulumi-fusionauth
Version:
A Pulumi package for managing FusionAuth instances.
374 lines (373 loc) • 20.8 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "./types/input";
import * as outputs from "./types/output";
/**
* ## # SAML v2 Identity Provider Resource
*
* SAML v2 identity providers connect to external SAML v2 login systems. This type of login will optionally provide a Login with … button on FusionAuth’s login page. This button is customizable by using different properties of the identity provider.
*
* Optionally, this identity provider can define one or more domains it is associated with. This is useful for allowing employees to log in with their corporate credentials. As long as the company has an identity solution that provides SAML v2, you can leverage this feature. This is referred to as a Domain Based Identity Provider. If you enable domains for an identity provider, the Login with … button will not be displayed. Instead, only the email form field will be displayed initially on the FusionAuth login page. Once the user types in their email address, FusionAuth will determine if the user is logging in locally or if they should be redirected to this identity provider. This is determined by extracting the domain from their email address and comparing it to the domains associated with the identity provider.
*
* FusionAuth will locate the user’s email address in the SAML assertion which will be used to create or lookup the existing user. Additional claims from the SAML response can be used to reconcile the User to FusionAuth by using a SAML v2 Reconcile Lambda. Unless you assign a reconcile lambda to this provider, on the email address will be used from the available assertions returned by the SAML v2 identity provider.
*
* [SAML v2 Connect Identity Providers API](https://fusionauth.io/docs/v1/tech/apis/identity-providers/samlv2/)
*
* ## Example Usage
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as fusionauth from "pulumi-fusionauth";
*
* const saml = new fusionauth.FusionAuthIdpSamlv2("saml", {
* applicationConfigurations: [{
* applicationId: fusionauth_application.myapp.id,
* buttonText: "Login with SAML (app text)",
* createRegistration: true,
* enabled: true,
* }],
* buttonText: "Login with SAML",
* debug: false,
* emailClaim: "email",
* idpEndpoint: "https://www.example.com/login",
* postRequest: true,
* requestSigningKey: "3168129b-91fa-46f4-9676-947f5509fdce",
* signRequest: true,
* useNameForEmail: true,
* });
* ```
*/
export declare class FusionAuthIdpSamlv2 extends pulumi.CustomResource {
/**
* Get an existing FusionAuthIdpSamlv2 resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: FusionAuthIdpSamlv2State, opts?: pulumi.CustomResourceOptions): FusionAuthIdpSamlv2;
/**
* Returns true if the given object is an instance of FusionAuthIdpSamlv2. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is FusionAuthIdpSamlv2;
/**
* The configuration for each Application that the identity provider is enabled for.
*/
readonly applicationConfigurations: pulumi.Output<outputs.FusionAuthIdpSamlv2ApplicationConfiguration[] | undefined>;
/**
* The configuration for the SAML assertion.
*/
readonly assertionConfiguration: pulumi.Output<outputs.FusionAuthIdpSamlv2AssertionConfiguration | undefined>;
/**
* The top-level button image (URL) to use on the FusionAuth login page for this Identity Provider.
*/
readonly buttonImageUrl: pulumi.Output<string | undefined>;
/**
* The top-level button text to use on the FusionAuth login page for this Identity Provider.
*/
readonly buttonText: pulumi.Output<string>;
/**
* Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created.
*/
readonly debug: pulumi.Output<boolean | undefined>;
/**
* This is an optional list of domains that this OpenID Connect provider should be used for. This converts the FusionAuth login form to a domain-based login form. This type of form first asks the user for their email. FusionAuth then uses their email to determine if an OpenID Connect identity provider should be used. If an OpenID Connect provider should be used, the browser is redirected to the authorization endpoint of that identity provider. Otherwise, the password field is revealed on the form so that the user can login using FusionAuth.
*/
readonly domains: pulumi.Output<string[] | undefined>;
/**
* The name of the email claim (Attribute in the Assertion element) in the SAML response that FusionAuth uses to uniquely identity the user. If this is not set, the `useNameForEmail` flag must be true.
*/
readonly emailClaim: pulumi.Output<string | undefined>;
/**
* Determines if this provider is enabled. If it is false then it will be disabled globally.
*/
readonly enabled: pulumi.Output<boolean | undefined>;
/**
* The SAML v2 login page of the identity provider.
*/
readonly idpEndpoint: pulumi.Output<string | undefined>;
/**
* The ID to use for the new identity provider. If not specified a secure random UUID will be generated.
*/
readonly idpId: pulumi.Output<string | undefined>;
/**
* The configuration for the IdP initiated login.
*/
readonly idpInitiatedConfiguration: pulumi.Output<outputs.FusionAuthIdpSamlv2IdpInitiatedConfiguration | undefined>;
/**
* The id of the key stored in Key Master that is used to verify the SAML response sent back to FusionAuth from the identity provider. This key must be a verification only key or certificate (meaning that it only has a public key component).
*/
readonly keyId: pulumi.Output<string>;
/**
* The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user.
*/
readonly lambdaReconcileId: pulumi.Output<string | undefined>;
/**
* The linking strategy to use when creating the link between the {idp_display_name} Identity Provider and the user.
*/
readonly linkingStrategy: pulumi.Output<string>;
/**
* The configuration for the login hint.
*/
readonly loginHintConfiguration: pulumi.Output<outputs.FusionAuthIdpSamlv2LoginHintConfiguration | undefined>;
/**
* The name of this OpenID Connect identity provider. This is only used for display purposes.
*/
readonly name: pulumi.Output<string>;
/**
* Either urn:oasis:names:tc:SAML:2.0:nameid-format:persistent or urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress depending on which NameId format you wish to use.
*/
readonly nameIdFormat: pulumi.Output<string>;
/**
* Set this value equal to true if you wish to use POST bindings with this OpenID Connect identity provider. The default value of false means that a redirect binding which uses a GET request will be used.
*/
readonly postRequest: pulumi.Output<boolean | undefined>;
/**
* The key pair Id to use to sign the SAML request. Required when `signRequest` is true.
*/
readonly requestSigningKey: pulumi.Output<string | undefined>;
/**
* When true authentication requests sent to the identity provider will be signed.
*/
readonly signRequest: pulumi.Output<boolean | undefined>;
/**
* The configuration for each Tenant that limits the number of links a user may have for a particular identity provider.
*/
readonly tenantConfigurations: pulumi.Output<outputs.FusionAuthIdpSamlv2TenantConfiguration[] | undefined>;
/**
* The name of the unique claim in the SAML response that FusionAuth uses to uniquely link the user. If this is not set, `the emailClaim` will be used when linking user.
*/
readonly uniqueIdClaim: pulumi.Output<string | undefined>;
/**
* Whether or not FusionAuth will use the NameID element value as the email address of the user for reconciliation processing. If this is false, then the `emailClaim` property must be set.
*/
readonly useNameForEmail: pulumi.Output<boolean | undefined>;
/**
* The name of the claim in the SAML response that FusionAuth uses to identify the username. If this is not set, the NameId value will be used to link a user. This property is required when linkingStrategy is set to LinkByUsername or LinkByUsernameForExistingUser.
*/
readonly usernameClaim: pulumi.Output<string | undefined>;
/**
* The XML signature canonicalization method used when digesting and signing the SAML request.
*/
readonly xmlSignatureCanonicalizationMethod: pulumi.Output<string | undefined>;
/**
* Create a FusionAuthIdpSamlv2 resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: FusionAuthIdpSamlv2Args, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering FusionAuthIdpSamlv2 resources.
*/
export interface FusionAuthIdpSamlv2State {
/**
* The configuration for each Application that the identity provider is enabled for.
*/
applicationConfigurations?: pulumi.Input<pulumi.Input<inputs.FusionAuthIdpSamlv2ApplicationConfiguration>[]>;
/**
* The configuration for the SAML assertion.
*/
assertionConfiguration?: pulumi.Input<inputs.FusionAuthIdpSamlv2AssertionConfiguration>;
/**
* The top-level button image (URL) to use on the FusionAuth login page for this Identity Provider.
*/
buttonImageUrl?: pulumi.Input<string>;
/**
* The top-level button text to use on the FusionAuth login page for this Identity Provider.
*/
buttonText?: pulumi.Input<string>;
/**
* Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created.
*/
debug?: pulumi.Input<boolean>;
/**
* This is an optional list of domains that this OpenID Connect provider should be used for. This converts the FusionAuth login form to a domain-based login form. This type of form first asks the user for their email. FusionAuth then uses their email to determine if an OpenID Connect identity provider should be used. If an OpenID Connect provider should be used, the browser is redirected to the authorization endpoint of that identity provider. Otherwise, the password field is revealed on the form so that the user can login using FusionAuth.
*/
domains?: pulumi.Input<pulumi.Input<string>[]>;
/**
* The name of the email claim (Attribute in the Assertion element) in the SAML response that FusionAuth uses to uniquely identity the user. If this is not set, the `useNameForEmail` flag must be true.
*/
emailClaim?: pulumi.Input<string>;
/**
* Determines if this provider is enabled. If it is false then it will be disabled globally.
*/
enabled?: pulumi.Input<boolean>;
/**
* The SAML v2 login page of the identity provider.
*/
idpEndpoint?: pulumi.Input<string>;
/**
* The ID to use for the new identity provider. If not specified a secure random UUID will be generated.
*/
idpId?: pulumi.Input<string>;
/**
* The configuration for the IdP initiated login.
*/
idpInitiatedConfiguration?: pulumi.Input<inputs.FusionAuthIdpSamlv2IdpInitiatedConfiguration>;
/**
* The id of the key stored in Key Master that is used to verify the SAML response sent back to FusionAuth from the identity provider. This key must be a verification only key or certificate (meaning that it only has a public key component).
*/
keyId?: pulumi.Input<string>;
/**
* The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user.
*/
lambdaReconcileId?: pulumi.Input<string>;
/**
* The linking strategy to use when creating the link between the {idp_display_name} Identity Provider and the user.
*/
linkingStrategy?: pulumi.Input<string>;
/**
* The configuration for the login hint.
*/
loginHintConfiguration?: pulumi.Input<inputs.FusionAuthIdpSamlv2LoginHintConfiguration>;
/**
* The name of this OpenID Connect identity provider. This is only used for display purposes.
*/
name?: pulumi.Input<string>;
/**
* Either urn:oasis:names:tc:SAML:2.0:nameid-format:persistent or urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress depending on which NameId format you wish to use.
*/
nameIdFormat?: pulumi.Input<string>;
/**
* Set this value equal to true if you wish to use POST bindings with this OpenID Connect identity provider. The default value of false means that a redirect binding which uses a GET request will be used.
*/
postRequest?: pulumi.Input<boolean>;
/**
* The key pair Id to use to sign the SAML request. Required when `signRequest` is true.
*/
requestSigningKey?: pulumi.Input<string>;
/**
* When true authentication requests sent to the identity provider will be signed.
*/
signRequest?: pulumi.Input<boolean>;
/**
* The configuration for each Tenant that limits the number of links a user may have for a particular identity provider.
*/
tenantConfigurations?: pulumi.Input<pulumi.Input<inputs.FusionAuthIdpSamlv2TenantConfiguration>[]>;
/**
* The name of the unique claim in the SAML response that FusionAuth uses to uniquely link the user. If this is not set, `the emailClaim` will be used when linking user.
*/
uniqueIdClaim?: pulumi.Input<string>;
/**
* Whether or not FusionAuth will use the NameID element value as the email address of the user for reconciliation processing. If this is false, then the `emailClaim` property must be set.
*/
useNameForEmail?: pulumi.Input<boolean>;
/**
* The name of the claim in the SAML response that FusionAuth uses to identify the username. If this is not set, the NameId value will be used to link a user. This property is required when linkingStrategy is set to LinkByUsername or LinkByUsernameForExistingUser.
*/
usernameClaim?: pulumi.Input<string>;
/**
* The XML signature canonicalization method used when digesting and signing the SAML request.
*/
xmlSignatureCanonicalizationMethod?: pulumi.Input<string>;
}
/**
* The set of arguments for constructing a FusionAuthIdpSamlv2 resource.
*/
export interface FusionAuthIdpSamlv2Args {
/**
* The configuration for each Application that the identity provider is enabled for.
*/
applicationConfigurations?: pulumi.Input<pulumi.Input<inputs.FusionAuthIdpSamlv2ApplicationConfiguration>[]>;
/**
* The configuration for the SAML assertion.
*/
assertionConfiguration?: pulumi.Input<inputs.FusionAuthIdpSamlv2AssertionConfiguration>;
/**
* The top-level button image (URL) to use on the FusionAuth login page for this Identity Provider.
*/
buttonImageUrl?: pulumi.Input<string>;
/**
* The top-level button text to use on the FusionAuth login page for this Identity Provider.
*/
buttonText: pulumi.Input<string>;
/**
* Determines if debug is enabled for this provider. When enabled, each time this provider is invoked to reconcile a login an Event Log will be created.
*/
debug?: pulumi.Input<boolean>;
/**
* This is an optional list of domains that this OpenID Connect provider should be used for. This converts the FusionAuth login form to a domain-based login form. This type of form first asks the user for their email. FusionAuth then uses their email to determine if an OpenID Connect identity provider should be used. If an OpenID Connect provider should be used, the browser is redirected to the authorization endpoint of that identity provider. Otherwise, the password field is revealed on the form so that the user can login using FusionAuth.
*/
domains?: pulumi.Input<pulumi.Input<string>[]>;
/**
* The name of the email claim (Attribute in the Assertion element) in the SAML response that FusionAuth uses to uniquely identity the user. If this is not set, the `useNameForEmail` flag must be true.
*/
emailClaim?: pulumi.Input<string>;
/**
* Determines if this provider is enabled. If it is false then it will be disabled globally.
*/
enabled?: pulumi.Input<boolean>;
/**
* The SAML v2 login page of the identity provider.
*/
idpEndpoint?: pulumi.Input<string>;
/**
* The ID to use for the new identity provider. If not specified a secure random UUID will be generated.
*/
idpId?: pulumi.Input<string>;
/**
* The configuration for the IdP initiated login.
*/
idpInitiatedConfiguration?: pulumi.Input<inputs.FusionAuthIdpSamlv2IdpInitiatedConfiguration>;
/**
* The id of the key stored in Key Master that is used to verify the SAML response sent back to FusionAuth from the identity provider. This key must be a verification only key or certificate (meaning that it only has a public key component).
*/
keyId: pulumi.Input<string>;
/**
* The unique Id of the lambda to used during the user reconcile process to map custom claims from the external identity provider to the FusionAuth user.
*/
lambdaReconcileId?: pulumi.Input<string>;
/**
* The linking strategy to use when creating the link between the {idp_display_name} Identity Provider and the user.
*/
linkingStrategy?: pulumi.Input<string>;
/**
* The configuration for the login hint.
*/
loginHintConfiguration?: pulumi.Input<inputs.FusionAuthIdpSamlv2LoginHintConfiguration>;
/**
* The name of this OpenID Connect identity provider. This is only used for display purposes.
*/
name?: pulumi.Input<string>;
/**
* Either urn:oasis:names:tc:SAML:2.0:nameid-format:persistent or urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress depending on which NameId format you wish to use.
*/
nameIdFormat?: pulumi.Input<string>;
/**
* Set this value equal to true if you wish to use POST bindings with this OpenID Connect identity provider. The default value of false means that a redirect binding which uses a GET request will be used.
*/
postRequest?: pulumi.Input<boolean>;
/**
* The key pair Id to use to sign the SAML request. Required when `signRequest` is true.
*/
requestSigningKey?: pulumi.Input<string>;
/**
* When true authentication requests sent to the identity provider will be signed.
*/
signRequest?: pulumi.Input<boolean>;
/**
* The configuration for each Tenant that limits the number of links a user may have for a particular identity provider.
*/
tenantConfigurations?: pulumi.Input<pulumi.Input<inputs.FusionAuthIdpSamlv2TenantConfiguration>[]>;
/**
* The name of the unique claim in the SAML response that FusionAuth uses to uniquely link the user. If this is not set, `the emailClaim` will be used when linking user.
*/
uniqueIdClaim?: pulumi.Input<string>;
/**
* Whether or not FusionAuth will use the NameID element value as the email address of the user for reconciliation processing. If this is false, then the `emailClaim` property must be set.
*/
useNameForEmail?: pulumi.Input<boolean>;
/**
* The name of the claim in the SAML response that FusionAuth uses to identify the username. If this is not set, the NameId value will be used to link a user. This property is required when linkingStrategy is set to LinkByUsername or LinkByUsernameForExistingUser.
*/
usernameClaim?: pulumi.Input<string>;
/**
* The XML signature canonicalization method used when digesting and signing the SAML request.
*/
xmlSignatureCanonicalizationMethod?: pulumi.Input<string>;
}