48 lines
2.8 KiB
Markdown
48 lines
2.8 KiB
Markdown
---
|
|
# generated by https://github.com/hashicorp/terraform-plugin-docs
|
|
page_title: "boundary_auth_method_oidc Resource - terraform-provider-boundary"
|
|
subcategory: ""
|
|
description: |-
|
|
The OIDC auth method resource allows you to configure a Boundary authmethodoidc.
|
|
---
|
|
|
|
# boundary_auth_method_oidc (Resource)
|
|
|
|
The OIDC auth method resource allows you to configure a Boundary auth_method_oidc.
|
|
|
|
|
|
|
|
<!-- schema generated by tfplugindocs -->
|
|
## Schema
|
|
|
|
### Required
|
|
|
|
- **scope_id** (String) The scope ID.
|
|
|
|
### Optional
|
|
|
|
- **account_claim_maps** (List of String) Account claim maps for the to_claim of sub.
|
|
- **allowed_audiences** (List of String) Audiences for which the provider responses will be allowed
|
|
- **api_url_prefix** (String) The API prefix to use when generating callback URLs for the provider. Should be set to an address at which the provider can reach back to the controller.
|
|
- **callback_url** (String) The URL that should be provided to the IdP for callbacks.
|
|
- **claims_scopes** (List of String) Claims scopes.
|
|
- **client_id** (String) The client ID assigned to this auth method from the provider.
|
|
- **client_secret** (String) The secret key assigned to this auth method from the provider. Once set, only the hash will be kept and the original value can be removed from configuration.
|
|
- **client_secret_hmac** (String) The HMAC of the client secret returned by the Boundary controller, which is used for comparison after initial setting of the value.
|
|
- **description** (String) The auth method description.
|
|
- **disable_discovered_config_validation** (Boolean) Disables validation logic ensuring that the OIDC provider's information from its discovery endpoint matches the information here. The validation is only performed at create or update time.
|
|
- **idp_ca_certs** (List of String) A list of CA certificates to trust when validating the IdP's token signatures.
|
|
- **is_primary_for_scope** (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an OIDC account.
|
|
- **issuer** (String) The issuer corresponding to the provider, which must match the issuer field in generated tokens.
|
|
- **max_age** (Number) The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again.
|
|
- **name** (String) The auth method name. Defaults to the resource name.
|
|
- **signing_algorithms** (List of String) Allowed signing algorithms for the provider's issued tokens.
|
|
- **state** (String) Can be one of 'inactive', 'active-private', or 'active-public'. Currently automatically set to active-public.
|
|
- **type** (String) The type of auth method; hardcoded.
|
|
|
|
### Read-Only
|
|
|
|
- **id** (String) The ID of the auth method.
|
|
|
|
|