Class AuthBackendRoleArgs

Inheritance

System.Object

InputArgs

ResourceArgs

AuthBackendRoleArgs

Inherited Members

ResourceArgs.Empty

System.Object.Equals(System.Object)

System.Object.Equals(System.Object, System.Object)

System.Object.GetHashCode()

System.Object.GetType()

System.Object.MemberwiseClone()

System.Object.ReferenceEquals(System.Object, System.Object)

System.Object.ToString()

Namespace: Pulumi.Vault.Jwt

Assembly: Pulumi.Vault.dll

Syntax

public sealed class AuthBackendRoleArgs : ResourceArgs

Constructors

AuthBackendRoleArgs()

Declaration

public AuthBackendRoleArgs()

Properties

AllowedRedirectUris

The list of allowed values for redirect_uri during OIDC logins. Required for OIDC roles

Declaration

public InputList<string> AllowedRedirectUris { get; set; }

Property Value

Type	Description
InputList<System.String>

Backend

The unique name of the auth backend to configure. Defaults to jwt.

Declaration

public Input<string> Backend { get; set; }

Property Value

Type	Description
Input<System.String>

BoundAudiences

(Required for roles of type jwt, optional for roles of type oidc) List of aud claims to match against. Any match is sufficient.

Declaration

public InputList<string> BoundAudiences { get; set; }

Property Value

Type	Description
InputList<System.String>

BoundCidrs

If set, a list of CIDRs valid as the source address for login requests. This value is also encoded into any resulting token.

Declaration

[Obsolete("use `token_bound_cidrs` instead if you are running Vault >= 1.2")]
public InputList<string> BoundCidrs { get; set; }

Property Value

Type	Description
InputList<System.String>

BoundClaims

If set, a map of claims/values to match against. The expected value may be a single string or a list of strings.

Declaration

public InputMap<object> BoundClaims { get; set; }

Property Value

Type	Description
InputMap<System.Object>

BoundSubject

If set, requires that the sub claim matches this value.

Declaration

public Input<string> BoundSubject { get; set; }

Property Value

Type	Description
Input<System.String>

ClaimMappings

If set, a map of claims (keys) to be copied to specified metadata fields (values).

Declaration

public InputMap<object> ClaimMappings { get; set; }

Property Value

Type	Description
InputMap<System.Object>

ClockSkewLeeway

The amount of leeway to add to all claims to account for clock skew, in seconds. Defaults to 60 seconds if set to 0 and can be disabled if set to -1. Only applicable with "jwt" roles.

Declaration

public Input<int> ClockSkewLeeway { get; set; }

Property Value

Type	Description
Input<System.Int32>

ExpirationLeeway

The amount of leeway to add to expiration (exp) claims to account for clock skew, in seconds. Defaults to 60 seconds if set to 0 and can be disabled if set to -1. Only applicable with "jwt" roles.

Declaration

public Input<int> ExpirationLeeway { get; set; }

Property Value

Type	Description
Input<System.Int32>

GroupsClaim

The claim to use to uniquely identify the set of groups to which the user belongs; this will be used as the names for the Identity group aliases created due to a successful login. The claim value must be a list of strings.

Declaration

public Input<string> GroupsClaim { get; set; }

Property Value

Type	Description
Input<System.String>

GroupsClaimDelimiterPattern

(Optional; Deprecated. This field has been removed since Vault 1.1. If the groups claim is not at the top level, it can now be specified as a JSONPointer.) A pattern of delimiters used to allow the groups_claim to live outside of the top-level JWT structure. For instance, a groups_claim of meta/user.name/groups with this field set to // will expect nested structures named meta, user.name, and groups. If this field was set to /./ the groups information would expect to be via nested structures of meta, user, name, and groups.

Declaration

public Input<string> GroupsClaimDelimiterPattern { get; set; }

Property Value

Type	Description
Input<System.String>

MaxTtl

The maximum allowed lifetime of tokens issued using this role, provided as a number of seconds.

Declaration

public Input<int> MaxTtl { get; set; }

Property Value

Type	Description
Input<System.Int32>

NotBeforeLeeway

The amount of leeway to add to not before (nbf) claims to account for clock skew, in seconds. Defaults to 60 seconds if set to 0 and can be disabled if set to -1. Only applicable with "jwt" roles.

Declaration

public Input<int> NotBeforeLeeway { get; set; }

Property Value

Type	Description
Input<System.Int32>

NumUses

If set, puts a use-count limitation on the issued token.

Declaration

public Input<int> NumUses { get; set; }

Property Value

Type	Description
Input<System.Int32>

OidcScopes

If set, a list of OIDC scopes to be used with an OIDC role. The standard scope "openid" is automatically included and need not be specified.

Declaration

public InputList<string> OidcScopes { get; set; }

Property Value

Type	Description
InputList<System.String>

Period

If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token's TTL will be set to the value of this field. Specified in seconds.

Declaration

public Input<int> Period { get; set; }

Property Value

Type	Description
Input<System.Int32>

Policies

An array of strings specifying the policies to be set on tokens issued using this role.

Declaration

[Obsolete("use `token_policies` instead if you are running Vault >= 1.2")]
public InputList<string> Policies { get; set; }

Property Value

Type	Description
InputList<System.String>

RoleName

The name of the role.

Declaration

public Input<string> RoleName { get; set; }

Property Value

Type	Description
Input<System.String>

RoleType

Type of role, either "oidc" (default) or "jwt".

Declaration

public Input<string> RoleType { get; set; }

Property Value

Type	Description
Input<System.String>

TokenBoundCidrs

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

Declaration

public InputList<string> TokenBoundCidrs { get; set; }

Property Value

Type	Description
InputList<System.String>

TokenExplicitMaxTtl

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

Declaration

public Input<int> TokenExplicitMaxTtl { get; set; }

Property Value

Type	Description
Input<System.Int32>

TokenMaxTtl

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

Declaration

public Input<int> TokenMaxTtl { get; set; }

Property Value

Type	Description
Input<System.Int32>

TokenNoDefaultPolicy

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

Declaration

public Input<bool> TokenNoDefaultPolicy { get; set; }

Property Value

Type	Description
Input<System.Boolean>

TokenNumUses

The period, if any, in number of seconds to set on the token.

Declaration

public Input<int> TokenNumUses { get; set; }

Property Value

Type	Description
Input<System.Int32>

TokenPeriod

If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token's TTL will be set to the value of this field. Specified in seconds.

Declaration

public Input<int> TokenPeriod { get; set; }

Property Value

Type	Description
Input<System.Int32>

TokenPolicies

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

Declaration

public InputList<string> TokenPolicies { get; set; }

Property Value

Type	Description
InputList<System.String>

TokenTtl

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

Declaration

public Input<int> TokenTtl { get; set; }

Property Value

Type	Description
Input<System.Int32>

TokenType

The type of token that should be generated. Can be service, batch, or default to use the mount's tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

Declaration

public Input<string> TokenType { get; set; }

Property Value

Type	Description
Input<System.String>

Ttl

The TTL period of tokens issued using this role, provided as a number of seconds.

Declaration

public Input<int> Ttl { get; set; }

Property Value

Type	Description
Input<System.Int32>

UserClaim

The claim to use to uniquely identify the user; this will be used as the name for the Identity entity alias created due to a successful login.

Declaration

public Input<string> UserClaim { get; set; }

Property Value

Type	Description
Input<System.String>

VerboseOidcLogging

Log received OIDC tokens and claims when debug-level logging is active. Not recommended in production since sensitive information may be present in OIDC responses.

Declaration

public Input<bool> VerboseOidcLogging { get; set; }

Property Value

Type	Description
Input<System.Boolean>