GoogleIdentityProvider

Create a GoogleIdentityProvider Resource

new GoogleIdentityProvider(name: string, args: GoogleIdentityProviderArgs, opts?: CustomResourceOptions);

def GoogleIdentityProvider(resource_name, opts=None, accepts_prompt_none_forward_from_client=None, add_read_token_role_on_create=None, authenticate_by_default=None, client_id=None, client_secret=None, default_scopes=None, disable_user_info=None, enabled=None, extra_config=None, first_broker_login_flow_alias=None, hide_on_login_page=None, hosted_domain=None, link_only=None, post_broker_login_flow_alias=None, provider_id=None, realm=None, request_refresh_token=None, store_token=None, trust_email=None, use_user_ip_param=None, __props__=None);

func NewGoogleIdentityProvider(ctx *Context, name string, args GoogleIdentityProviderArgs, opts ...ResourceOption) (*GoogleIdentityProvider, error)

public GoogleIdentityProvider(string name, GoogleIdentityProviderArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args GoogleIdentityProviderArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args GoogleIdentityProviderArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args GoogleIdentityProviderArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

GoogleIdentityProvider Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The GoogleIdentityProvider resource accepts the following input properties:

ClientId string: Client ID.
ClientSecret string: Client Secret.
Realm string: Realm Name
AcceptsPromptNoneForwardFromClient bool: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
AddReadTokenRoleOnCreate bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
AuthenticateByDefault bool: Enable/disable authenticate users by default.
DefaultScopes string: The scopes to be sent when asking for authorization. See the documentation for possible values, separator and default value’. Default: ‘openid profile email’
DisableUserInfo bool: Disable usage of User Info service to obtain additional user information? Default is to use this OIDC service.
Enabled bool: Enable/disable this identity provider.
ExtraConfig Dictionary<string, object>
FirstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
HideOnLoginPage bool: Hide On Login Page.
HostedDomain string: Set ‘hd’ query parameter when logging in with Google. Google will list accounts only for this domain. Keycloak validates that the returned identity token has a claim for this domain. When ‘*’ is entered, any hosted account can be used.
LinkOnly bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
PostBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
ProviderId string: provider id, is always google, unless you have a extended custom implementation
RequestRefreshToken bool: Set ‘access_type’ query parameter to ‘offline’ when redirecting to google authorization endpoint, to get a refresh token back. Useful if planning to use Token Exchange to retrieve Google token to access Google APIs when the user is not at the browser.
StoreToken bool: Enable/disable if tokens must be stored after authenticating users.
TrustEmail bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
UseUserIpParam bool: Set ‘userIp’ query parameter when invoking on Google’s User Info service. This will use the user’s ip address. Useful if Google is throttling access to the User Info service.

ClientId string: Client ID.
ClientSecret string: Client Secret.
Realm string: Realm Name
AcceptsPromptNoneForwardFromClient bool: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
AddReadTokenRoleOnCreate bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
AuthenticateByDefault bool: Enable/disable authenticate users by default.
DefaultScopes string: The scopes to be sent when asking for authorization. See the documentation for possible values, separator and default value’. Default: ‘openid profile email’
DisableUserInfo bool: Disable usage of User Info service to obtain additional user information? Default is to use this OIDC service.
Enabled bool: Enable/disable this identity provider.
ExtraConfig map[string]interface{}
FirstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
HideOnLoginPage bool: Hide On Login Page.
HostedDomain string: Set ‘hd’ query parameter when logging in with Google. Google will list accounts only for this domain. Keycloak validates that the returned identity token has a claim for this domain. When ‘*’ is entered, any hosted account can be used.
LinkOnly bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
PostBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
ProviderId string: provider id, is always google, unless you have a extended custom implementation
RequestRefreshToken bool: Set ‘access_type’ query parameter to ‘offline’ when redirecting to google authorization endpoint, to get a refresh token back. Useful if planning to use Token Exchange to retrieve Google token to access Google APIs when the user is not at the browser.
StoreToken bool: Enable/disable if tokens must be stored after authenticating users.
TrustEmail bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
UseUserIpParam bool: Set ‘userIp’ query parameter when invoking on Google’s User Info service. This will use the user’s ip address. Useful if Google is throttling access to the User Info service.

clientId string: Client ID.
clientSecret string: Client Secret.
realm string: Realm Name
acceptsPromptNoneForwardFromClient boolean: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
addReadTokenRoleOnCreate boolean: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
authenticateByDefault boolean: Enable/disable authenticate users by default.
defaultScopes string: The scopes to be sent when asking for authorization. See the documentation for possible values, separator and default value’. Default: ‘openid profile email’
disableUserInfo boolean: Disable usage of User Info service to obtain additional user information? Default is to use this OIDC service.
enabled boolean: Enable/disable this identity provider.
extraConfig {[key: string]: any}
firstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
hideOnLoginPage boolean: Hide On Login Page.
hostedDomain string: Set ‘hd’ query parameter when logging in with Google. Google will list accounts only for this domain. Keycloak validates that the returned identity token has a claim for this domain. When ‘*’ is entered, any hosted account can be used.
linkOnly boolean: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
postBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
providerId string: provider id, is always google, unless you have a extended custom implementation
requestRefreshToken boolean: Set ‘access_type’ query parameter to ‘offline’ when redirecting to google authorization endpoint, to get a refresh token back. Useful if planning to use Token Exchange to retrieve Google token to access Google APIs when the user is not at the browser.
storeToken boolean: Enable/disable if tokens must be stored after authenticating users.
trustEmail boolean: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
useUserIpParam boolean: Set ‘userIp’ query parameter when invoking on Google’s User Info service. This will use the user’s ip address. Useful if Google is throttling access to the User Info service.

client_id str: Client ID.
client_secret str: Client Secret.
realm str: Realm Name
accepts_prompt_none_forward_from_client bool: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
add_read_token_role_on_create bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
authenticate_by_default bool: Enable/disable authenticate users by default.
default_scopes str: The scopes to be sent when asking for authorization. See the documentation for possible values, separator and default value’. Default: ‘openid profile email’
disable_user_info bool: Disable usage of User Info service to obtain additional user information? Default is to use this OIDC service.
enabled bool: Enable/disable this identity provider.
extra_config Dict[str, Any]
first_broker_login_flow_alias str: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
hide_on_login_page bool: Hide On Login Page.
hosted_domain str: Set ‘hd’ query parameter when logging in with Google. Google will list accounts only for this domain. Keycloak validates that the returned identity token has a claim for this domain. When ‘*’ is entered, any hosted account can be used.
link_only bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
post_broker_login_flow_alias str: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
provider_id str: provider id, is always google, unless you have a extended custom implementation
request_refresh_token bool: Set ‘access_type’ query parameter to ‘offline’ when redirecting to google authorization endpoint, to get a refresh token back. Useful if planning to use Token Exchange to retrieve Google token to access Google APIs when the user is not at the browser.
store_token bool: Enable/disable if tokens must be stored after authenticating users.
trust_email bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
use_user_ip_param bool: Set ‘userIp’ query parameter when invoking on Google’s User Info service. This will use the user’s ip address. Useful if Google is throttling access to the User Info service.

Outputs

All input properties are implicitly available as output properties. Additionally, the GoogleIdentityProvider resource produces the following output properties:

Alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri. In case of google this is computed and always google
DisplayName string: Not used by this provider, Will be implicitly Google
Id string: The provider-assigned unique ID for this managed resource.
InternalId string: Internal Identity Provider Id

Alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri. In case of google this is computed and always google
DisplayName string: Not used by this provider, Will be implicitly Google
Id string: The provider-assigned unique ID for this managed resource.
InternalId string: Internal Identity Provider Id

alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri. In case of google this is computed and always google
displayName string: Not used by this provider, Will be implicitly Google
id string: The provider-assigned unique ID for this managed resource.
internalId string: Internal Identity Provider Id

alias str: The alias uniquely identifies an identity provider and it is also used to build the redirect uri. In case of google this is computed and always google
display_name str: Not used by this provider, Will be implicitly Google
id str: The provider-assigned unique ID for this managed resource.
internal_id str: Internal Identity Provider Id

Look up an Existing GoogleIdentityProvider Resource

Get an existing GoogleIdentityProvider resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: GoogleIdentityProviderState, opts?: CustomResourceOptions): GoogleIdentityProvider

static get(resource_name, id, opts=None, accepts_prompt_none_forward_from_client=None, add_read_token_role_on_create=None, alias=None, authenticate_by_default=None, client_id=None, client_secret=None, default_scopes=None, disable_user_info=None, display_name=None, enabled=None, extra_config=None, first_broker_login_flow_alias=None, hide_on_login_page=None, hosted_domain=None, internal_id=None, link_only=None, post_broker_login_flow_alias=None, provider_id=None, realm=None, request_refresh_token=None, store_token=None, trust_email=None, use_user_ip_param=None, __props__=None);

func GetGoogleIdentityProvider(ctx *Context, name string, id IDInput, state *GoogleIdentityProviderState, opts ...ResourceOption) (*GoogleIdentityProvider, error)

public static GoogleIdentityProvider Get(string name, Input<string> id, GoogleIdentityProviderState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AcceptsPromptNoneForwardFromClient bool: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
AddReadTokenRoleOnCreate bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
Alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri. In case of google this is computed and always google
AuthenticateByDefault bool: Enable/disable authenticate users by default.
ClientId string: Client ID.
ClientSecret string: Client Secret.
DefaultScopes string: The scopes to be sent when asking for authorization. See the documentation for possible values, separator and default value’. Default: ‘openid profile email’
DisableUserInfo bool: Disable usage of User Info service to obtain additional user information? Default is to use this OIDC service.
DisplayName string: Not used by this provider, Will be implicitly Google
Enabled bool: Enable/disable this identity provider.
ExtraConfig Dictionary<string, object>
FirstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
HideOnLoginPage bool: Hide On Login Page.
HostedDomain string: Set ‘hd’ query parameter when logging in with Google. Google will list accounts only for this domain. Keycloak validates that the returned identity token has a claim for this domain. When ‘*’ is entered, any hosted account can be used.
InternalId string: Internal Identity Provider Id
LinkOnly bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
PostBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
ProviderId string: provider id, is always google, unless you have a extended custom implementation
Realm string: Realm Name
RequestRefreshToken bool: Set ‘access_type’ query parameter to ‘offline’ when redirecting to google authorization endpoint, to get a refresh token back. Useful if planning to use Token Exchange to retrieve Google token to access Google APIs when the user is not at the browser.
StoreToken bool: Enable/disable if tokens must be stored after authenticating users.
TrustEmail bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
UseUserIpParam bool: Set ‘userIp’ query parameter when invoking on Google’s User Info service. This will use the user’s ip address. Useful if Google is throttling access to the User Info service.

AcceptsPromptNoneForwardFromClient bool: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
AddReadTokenRoleOnCreate bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
Alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri. In case of google this is computed and always google
AuthenticateByDefault bool: Enable/disable authenticate users by default.
ClientId string: Client ID.
ClientSecret string: Client Secret.
DefaultScopes string: The scopes to be sent when asking for authorization. See the documentation for possible values, separator and default value’. Default: ‘openid profile email’
DisableUserInfo bool: Disable usage of User Info service to obtain additional user information? Default is to use this OIDC service.
DisplayName string: Not used by this provider, Will be implicitly Google
Enabled bool: Enable/disable this identity provider.
ExtraConfig map[string]interface{}
FirstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
HideOnLoginPage bool: Hide On Login Page.
HostedDomain string: Set ‘hd’ query parameter when logging in with Google. Google will list accounts only for this domain. Keycloak validates that the returned identity token has a claim for this domain. When ‘*’ is entered, any hosted account can be used.
InternalId string: Internal Identity Provider Id
LinkOnly bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
PostBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
ProviderId string: provider id, is always google, unless you have a extended custom implementation
Realm string: Realm Name
RequestRefreshToken bool: Set ‘access_type’ query parameter to ‘offline’ when redirecting to google authorization endpoint, to get a refresh token back. Useful if planning to use Token Exchange to retrieve Google token to access Google APIs when the user is not at the browser.
StoreToken bool: Enable/disable if tokens must be stored after authenticating users.
TrustEmail bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
UseUserIpParam bool: Set ‘userIp’ query parameter when invoking on Google’s User Info service. This will use the user’s ip address. Useful if Google is throttling access to the User Info service.

acceptsPromptNoneForwardFromClient boolean: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
addReadTokenRoleOnCreate boolean: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri. In case of google this is computed and always google
authenticateByDefault boolean: Enable/disable authenticate users by default.
clientId string: Client ID.
clientSecret string: Client Secret.
defaultScopes string: The scopes to be sent when asking for authorization. See the documentation for possible values, separator and default value’. Default: ‘openid profile email’
disableUserInfo boolean: Disable usage of User Info service to obtain additional user information? Default is to use this OIDC service.
displayName string: Not used by this provider, Will be implicitly Google
enabled boolean: Enable/disable this identity provider.
extraConfig {[key: string]: any}
firstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
hideOnLoginPage boolean: Hide On Login Page.
hostedDomain string: Set ‘hd’ query parameter when logging in with Google. Google will list accounts only for this domain. Keycloak validates that the returned identity token has a claim for this domain. When ‘*’ is entered, any hosted account can be used.
internalId string: Internal Identity Provider Id
linkOnly boolean: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
postBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
providerId string: provider id, is always google, unless you have a extended custom implementation
realm string: Realm Name
requestRefreshToken boolean: Set ‘access_type’ query parameter to ‘offline’ when redirecting to google authorization endpoint, to get a refresh token back. Useful if planning to use Token Exchange to retrieve Google token to access Google APIs when the user is not at the browser.
storeToken boolean: Enable/disable if tokens must be stored after authenticating users.
trustEmail boolean: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
useUserIpParam boolean: Set ‘userIp’ query parameter when invoking on Google’s User Info service. This will use the user’s ip address. Useful if Google is throttling access to the User Info service.

accepts_prompt_none_forward_from_client bool: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
add_read_token_role_on_create bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
alias str: The alias uniquely identifies an identity provider and it is also used to build the redirect uri. In case of google this is computed and always google
authenticate_by_default bool: Enable/disable authenticate users by default.
client_id str: Client ID.
client_secret str: Client Secret.
default_scopes str: The scopes to be sent when asking for authorization. See the documentation for possible values, separator and default value’. Default: ‘openid profile email’
disable_user_info bool: Disable usage of User Info service to obtain additional user information? Default is to use this OIDC service.
display_name str: Not used by this provider, Will be implicitly Google
enabled bool: Enable/disable this identity provider.
extra_config Dict[str, Any]
first_broker_login_flow_alias str: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
hide_on_login_page bool: Hide On Login Page.
hosted_domain str: Set ‘hd’ query parameter when logging in with Google. Google will list accounts only for this domain. Keycloak validates that the returned identity token has a claim for this domain. When ‘*’ is entered, any hosted account can be used.
internal_id str: Internal Identity Provider Id
link_only bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
post_broker_login_flow_alias str: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
provider_id str: provider id, is always google, unless you have a extended custom implementation
realm str: Realm Name
request_refresh_token bool: Set ‘access_type’ query parameter to ‘offline’ when redirecting to google authorization endpoint, to get a refresh token back. Useful if planning to use Token Exchange to retrieve Google token to access Google APIs when the user is not at the browser.
store_token bool: Enable/disable if tokens must be stored after authenticating users.
trust_email bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
use_user_ip_param bool: Set ‘userIp’ query parameter when invoking on Google’s User Info service. This will use the user’s ip address. Useful if Google is throttling access to the User Info service.

Package Details

Repository: https://github.com/pulumi/pulumi-keycloak
License: Apache-2.0
Notes: This Pulumi package is based on the keycloak Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud