dependabot[bot]andJohan Brandhorst-Satzkorn
85f9a3d081
* build(deps): bump the go group across 1 directory with 2 updates Bumps the go group with 2 updates in the / directory: [github.com/hashicorp/boundary/sdk](https://github.com/hashicorp/boundary) and [github.com/hashicorp/terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs). Updates `github.com/hashicorp/boundary/sdk` from 0.0.52 to 0.0.53 - [Release notes](https://github.com/hashicorp/boundary/releases) - [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/boundary/compare/api/v0.0.52...api/v0.0.53) Updates `github.com/hashicorp/terraform-plugin-docs` from 0.21.0 to 0.22.0 - [Release notes](https://github.com/hashicorp/terraform-plugin-docs/releases) - [Changelog](https://github.com/hashicorp/terraform-plugin-docs/blob/main/CHANGELOG.md) - [Commits](https://github.com/hashicorp/terraform-plugin-docs/compare/v0.21.0...v0.22.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/boundary/sdk dependency-version: 0.0.53 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/hashicorp/terraform-plugin-docs dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go ... Signed-off-by: dependabot[bot] <support@github.com> * Regenerate docs --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
102 lines
5.2 KiB
Markdown
102 lines
5.2 KiB
Markdown
---
|
|
# generated by https://github.com/hashicorp/terraform-plugin-docs
|
|
page_title: "boundary_auth_method_oidc Resource - terraform-provider-boundary"
|
|
subcategory: ""
|
|
description: |-
|
|
The OIDC auth method resource allows you to configure a Boundary auth_method_oidc.
|
|
---
|
|
|
|
# boundary_auth_method_oidc (Resource)
|
|
|
|
The OIDC auth method resource allows you to configure a Boundary auth_method_oidc.
|
|
|
|
## Example Usage
|
|
|
|
```terraform
|
|
resource "boundary_scope" "org" {
|
|
name = "organization_one"
|
|
description = "My first scope!"
|
|
scope_id = "global"
|
|
auto_create_admin_role = true
|
|
auto_create_default_role = true
|
|
}
|
|
|
|
resource "boundary_auth_method_oidc" "vault" {
|
|
api_url_prefix = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
|
|
client_id = "eieio"
|
|
client_secret = "hvo_secret_XO"
|
|
description = "My Boundary OIDC Auth Method for Vault"
|
|
issuer = "https://XO-XO-XO-XO-XOXOXO.vault.hashicorp.cloud:8200/v1/identity/oidc/provider/my-provider"
|
|
scope_id = "global"
|
|
signing_algorithms = ["RS256"]
|
|
type = "oidc"
|
|
}
|
|
|
|
resource "boundary_auth_method_oidc" "oidc_with_one_prompt" {
|
|
api_url_prefix = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
|
|
client_id = "eieio"
|
|
client_secret = "hvo_secret_XO"
|
|
description = "My Boundary OIDC Auth Method With Prompt"
|
|
issuer = "https://sts.windows.net/TENANT_ID/"
|
|
scope_id = "global"
|
|
signing_algorithms = ["RS256"]
|
|
prompts = ["select_account"]
|
|
type = "oidc"
|
|
}
|
|
|
|
resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
|
|
api_url_prefix = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
|
|
client_id = "eieio"
|
|
client_secret = "hvo_secret_XO"
|
|
description = "My Boundary OIDC Auth Method With Multiple Prompts"
|
|
issuer = "https://sts.windows.net/TENANT_ID/"
|
|
scope_id = "global"
|
|
signing_algorithms = ["RS256"]
|
|
prompts = ["consent", "select_account"]
|
|
type = "oidc"
|
|
}
|
|
```
|
|
|
|
<!-- schema generated by tfplugindocs -->
|
|
## Schema
|
|
|
|
### Required
|
|
|
|
- `scope_id` (String) The scope ID.
|
|
|
|
### Optional
|
|
|
|
- `account_claim_maps` (List of String) Account claim maps for the to_claim of sub.
|
|
- `allowed_audiences` (List of String) Audiences for which the provider responses will be allowed
|
|
- `api_url_prefix` (String) The API prefix to use when generating callback URLs for the provider. Should be set to an address at which the provider can reach back to the controller.
|
|
- `callback_url` (String) The URL that should be provided to the IdP for callbacks.
|
|
- `claims_scopes` (List of String) Claims scopes.
|
|
- `client_id` (String) The client ID assigned to this auth method from the provider.
|
|
- `client_secret` (String, Sensitive) The secret key assigned to this auth method from the provider. Once set, only the hash will be kept and the original value can be removed from configuration.
|
|
- `client_secret_hmac` (String) The HMAC of the client secret returned by the Boundary controller, which is used for comparison after initial setting of the value.
|
|
- `description` (String) The auth method description.
|
|
- `disable_discovered_config_validation` (Boolean) Disables validation logic ensuring that the OIDC provider's information from its discovery endpoint matches the information here. The validation is only performed at create or update time.
|
|
- `idp_ca_certs` (List of String) A list of CA certificates to trust when validating the IdP's token signatures.
|
|
- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the user will be automatically created when they login using an OIDC account.
|
|
- `issuer` (String) The issuer corresponding to the provider, which must match the issuer field in generated tokens.
|
|
- `max_age` (Number) The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again. A value of 0 sets an immediate requirement for all users to reauthenticate, and an unset maxAge results in a Terraform value of -1 and the default TTL of the chosen OIDC will be used.
|
|
- `name` (String) The auth method name. Defaults to the resource name.
|
|
- `prompts` (List of String) The prompts passed to the identity provider to determine whether to prompt the end-user for reauthentication, account selection or consent. Please note the values passed are case-sensitive. The valid values are: `none`, `login`, `consent` and `select_account`.
|
|
- `signing_algorithms` (List of String) Allowed signing algorithms for the provider's issued tokens.
|
|
- `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Currently automatically set to active-public.
|
|
- `type` (String) The type of auth method; hardcoded.
|
|
|
|
### Read-Only
|
|
|
|
- `id` (String) The ID of the auth method.
|
|
|
|
## Import
|
|
|
|
Import is supported using the following syntax:
|
|
|
|
The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
|
|
|
|
```shell
|
|
terraform import boundary_auth_method_oidc.foo <my-id>
|
|
```
|