IdentityProvider

Create a IdentityProvider Resource

new IdentityProvider(name: string, args: IdentityProviderArgs, opts?: CustomResourceOptions);

def IdentityProvider(resource_name, opts=None, accepts_prompt_none_forward_from_client=None, add_read_token_role_on_create=None, alias=None, authenticate_by_default=None, authorization_url=None, backchannel_supported=None, client_id=None, client_secret=None, default_scopes=None, display_name=None, enabled=None, extra_config=None, first_broker_login_flow_alias=None, hide_on_login_page=None, jwks_url=None, link_only=None, login_hint=None, logout_url=None, post_broker_login_flow_alias=None, provider_id=None, realm=None, store_token=None, token_url=None, trust_email=None, ui_locales=None, user_info_url=None, validate_signature=None, __props__=None);

func NewIdentityProvider(ctx *Context, name string, args IdentityProviderArgs, opts ...ResourceOption) (*IdentityProvider, error)

public IdentityProvider(string name, IdentityProviderArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args IdentityProviderArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args IdentityProviderArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args IdentityProviderArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

IdentityProvider Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The IdentityProvider resource accepts the following input properties:

Alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
AuthorizationUrl string: OIDC authorization URL.
ClientId string: Client ID.
ClientSecret string: Client Secret.
Realm string: Realm Name
TokenUrl string: Token URL.
AcceptsPromptNoneForwardFromClient bool: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
AddReadTokenRoleOnCreate bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
AuthenticateByDefault bool: Enable/disable authenticate users by default.
BackchannelSupported bool: Does the external IDP support backchannel logout?
DefaultScopes string: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to ‘openid’.
DisplayName string: Friendly name for Identity Providers.
Enabled bool: Enable/disable this identity provider.
ExtraConfig Dictionary<string, object>
FirstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
HideOnLoginPage bool: Hide On Login Page.
JwksUrl string: JSON Web Key Set URL
LinkOnly bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
LoginHint string: Login Hint.
LogoutUrl string: Logout URL
PostBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
ProviderId string: provider id, is always oidc, unless you have a custom implementation
StoreToken bool: Enable/disable if tokens must be stored after authenticating users.
TrustEmail bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
UiLocales bool: Pass current locale to identity provider
UserInfoUrl string: User Info URL
ValidateSignature bool: Enable/disable signature validation of external IDP signatures.

Alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
AuthorizationUrl string: OIDC authorization URL.
ClientId string: Client ID.
ClientSecret string: Client Secret.
Realm string: Realm Name
TokenUrl string: Token URL.
AcceptsPromptNoneForwardFromClient bool: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
AddReadTokenRoleOnCreate bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
AuthenticateByDefault bool: Enable/disable authenticate users by default.
BackchannelSupported bool: Does the external IDP support backchannel logout?
DefaultScopes string: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to ‘openid’.
DisplayName string: Friendly name for Identity Providers.
Enabled bool: Enable/disable this identity provider.
ExtraConfig map[string]interface{}
FirstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
HideOnLoginPage bool: Hide On Login Page.
JwksUrl string: JSON Web Key Set URL
LinkOnly bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
LoginHint string: Login Hint.
LogoutUrl string: Logout URL
PostBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
ProviderId string: provider id, is always oidc, unless you have a custom implementation
StoreToken bool: Enable/disable if tokens must be stored after authenticating users.
TrustEmail bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
UiLocales bool: Pass current locale to identity provider
UserInfoUrl string: User Info URL
ValidateSignature bool: Enable/disable signature validation of external IDP signatures.

alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
authorizationUrl string: OIDC authorization URL.
clientId string: Client ID.
clientSecret string: Client Secret.
realm string: Realm Name
tokenUrl string: Token URL.
acceptsPromptNoneForwardFromClient boolean: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
addReadTokenRoleOnCreate boolean: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
authenticateByDefault boolean: Enable/disable authenticate users by default.
backchannelSupported boolean: Does the external IDP support backchannel logout?
defaultScopes string: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to ‘openid’.
displayName string: Friendly name for Identity Providers.
enabled boolean: Enable/disable this identity provider.
extraConfig {[key: string]: any}
firstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
hideOnLoginPage boolean: Hide On Login Page.
jwksUrl string: JSON Web Key Set URL
linkOnly boolean: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
loginHint string: Login Hint.
logoutUrl string: Logout URL
postBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
providerId string: provider id, is always oidc, unless you have a custom implementation
storeToken boolean: Enable/disable if tokens must be stored after authenticating users.
trustEmail boolean: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
uiLocales boolean: Pass current locale to identity provider
userInfoUrl string: User Info URL
validateSignature boolean: Enable/disable signature validation of external IDP signatures.

alias str: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
authorization_url str: OIDC authorization URL.
client_id str: Client ID.
client_secret str: Client Secret.
realm str: Realm Name
token_url str: Token URL.
accepts_prompt_none_forward_from_client bool: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
add_read_token_role_on_create bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
authenticate_by_default bool: Enable/disable authenticate users by default.
backchannel_supported bool: Does the external IDP support backchannel logout?
default_scopes str: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to ‘openid’.
display_name str: Friendly name for Identity Providers.
enabled bool: Enable/disable this identity provider.
extra_config Dict[str, Any]
first_broker_login_flow_alias str: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
hide_on_login_page bool: Hide On Login Page.
jwks_url str: JSON Web Key Set URL
link_only bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
login_hint str: Login Hint.
logout_url str: Logout URL
post_broker_login_flow_alias str: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
provider_id str: provider id, is always oidc, unless you have a custom implementation
store_token bool: Enable/disable if tokens must be stored after authenticating users.
trust_email bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
ui_locales bool: Pass current locale to identity provider
user_info_url str: User Info URL
validate_signature bool: Enable/disable signature validation of external IDP signatures.

Outputs

All input properties are implicitly available as output properties. Additionally, the IdentityProvider resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.
InternalId string: Internal Identity Provider Id

Id string: The provider-assigned unique ID for this managed resource.
InternalId string: Internal Identity Provider Id

id string: The provider-assigned unique ID for this managed resource.
internalId string: Internal Identity Provider Id

id str: The provider-assigned unique ID for this managed resource.
internal_id str: Internal Identity Provider Id

Look up an Existing IdentityProvider Resource

Get an existing IdentityProvider resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: IdentityProviderState, opts?: CustomResourceOptions): IdentityProvider

static get(resource_name, id, opts=None, accepts_prompt_none_forward_from_client=None, add_read_token_role_on_create=None, alias=None, authenticate_by_default=None, authorization_url=None, backchannel_supported=None, client_id=None, client_secret=None, default_scopes=None, display_name=None, enabled=None, extra_config=None, first_broker_login_flow_alias=None, hide_on_login_page=None, internal_id=None, jwks_url=None, link_only=None, login_hint=None, logout_url=None, post_broker_login_flow_alias=None, provider_id=None, realm=None, store_token=None, token_url=None, trust_email=None, ui_locales=None, user_info_url=None, validate_signature=None, __props__=None);

func GetIdentityProvider(ctx *Context, name string, id IDInput, state *IdentityProviderState, opts ...ResourceOption) (*IdentityProvider, error)

public static IdentityProvider Get(string name, Input<string> id, IdentityProviderState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AcceptsPromptNoneForwardFromClient bool: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
AddReadTokenRoleOnCreate bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
Alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
AuthenticateByDefault bool: Enable/disable authenticate users by default.
AuthorizationUrl string: OIDC authorization URL.
BackchannelSupported bool: Does the external IDP support backchannel logout?
ClientId string: Client ID.
ClientSecret string: Client Secret.
DefaultScopes string: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to ‘openid’.
DisplayName string: Friendly name for Identity Providers.
Enabled bool: Enable/disable this identity provider.
ExtraConfig Dictionary<string, object>
FirstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
HideOnLoginPage bool: Hide On Login Page.
InternalId string: Internal Identity Provider Id
JwksUrl string: JSON Web Key Set URL
LinkOnly bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
LoginHint string: Login Hint.
LogoutUrl string: Logout URL
PostBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
ProviderId string: provider id, is always oidc, unless you have a custom implementation
Realm string: Realm Name
StoreToken bool: Enable/disable if tokens must be stored after authenticating users.
TokenUrl string: Token URL.
TrustEmail bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
UiLocales bool: Pass current locale to identity provider
UserInfoUrl string: User Info URL
ValidateSignature bool: Enable/disable signature validation of external IDP signatures.

AcceptsPromptNoneForwardFromClient bool: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
AddReadTokenRoleOnCreate bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
Alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
AuthenticateByDefault bool: Enable/disable authenticate users by default.
AuthorizationUrl string: OIDC authorization URL.
BackchannelSupported bool: Does the external IDP support backchannel logout?
ClientId string: Client ID.
ClientSecret string: Client Secret.
DefaultScopes string: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to ‘openid’.
DisplayName string: Friendly name for Identity Providers.
Enabled bool: Enable/disable this identity provider.
ExtraConfig map[string]interface{}
FirstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
HideOnLoginPage bool: Hide On Login Page.
InternalId string: Internal Identity Provider Id
JwksUrl string: JSON Web Key Set URL
LinkOnly bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
LoginHint string: Login Hint.
LogoutUrl string: Logout URL
PostBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
ProviderId string: provider id, is always oidc, unless you have a custom implementation
Realm string: Realm Name
StoreToken bool: Enable/disable if tokens must be stored after authenticating users.
TokenUrl string: Token URL.
TrustEmail bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
UiLocales bool: Pass current locale to identity provider
UserInfoUrl string: User Info URL
ValidateSignature bool: Enable/disable signature validation of external IDP signatures.

acceptsPromptNoneForwardFromClient boolean: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
addReadTokenRoleOnCreate boolean: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
authenticateByDefault boolean: Enable/disable authenticate users by default.
authorizationUrl string: OIDC authorization URL.
backchannelSupported boolean: Does the external IDP support backchannel logout?
clientId string: Client ID.
clientSecret string: Client Secret.
defaultScopes string: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to ‘openid’.
displayName string: Friendly name for Identity Providers.
enabled boolean: Enable/disable this identity provider.
extraConfig {[key: string]: any}
firstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
hideOnLoginPage boolean: Hide On Login Page.
internalId string: Internal Identity Provider Id
jwksUrl string: JSON Web Key Set URL
linkOnly boolean: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
loginHint string: Login Hint.
logoutUrl string: Logout URL
postBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
providerId string: provider id, is always oidc, unless you have a custom implementation
realm string: Realm Name
storeToken boolean: Enable/disable if tokens must be stored after authenticating users.
tokenUrl string: Token URL.
trustEmail boolean: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
uiLocales boolean: Pass current locale to identity provider
userInfoUrl string: User Info URL
validateSignature boolean: Enable/disable signature validation of external IDP signatures.

accepts_prompt_none_forward_from_client bool: This is just used together with Identity Provider Authenticator or when kc_idp_hint points to this identity provider. In case that client sends a request with prompt=none and user is not yet authenticated, the error will not be directly returned to client, but the request with prompt=none will be forwarded to this identity provider.
add_read_token_role_on_create bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
alias str: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
authenticate_by_default bool: Enable/disable authenticate users by default.
authorization_url str: OIDC authorization URL.
backchannel_supported bool: Does the external IDP support backchannel logout?
client_id str: Client ID.
client_secret str: Client Secret.
default_scopes str: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to ‘openid’.
display_name str: Friendly name for Identity Providers.
enabled bool: Enable/disable this identity provider.
extra_config Dict[str, Any]
first_broker_login_flow_alias str: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
hide_on_login_page bool: Hide On Login Page.
internal_id str: Internal Identity Provider Id
jwks_url str: JSON Web Key Set URL
link_only bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
login_hint str: Login Hint.
logout_url str: Logout URL
post_broker_login_flow_alias str: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
provider_id str: provider id, is always oidc, unless you have a custom implementation
realm str: Realm Name
store_token bool: Enable/disable if tokens must be stored after authenticating users.
token_url str: Token URL.
trust_email bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
ui_locales bool: Pass current locale to identity provider
user_info_url str: User Info URL
validate_signature bool: Enable/disable signature validation of external IDP signatures.

Package Details

Repository: https://github.com/pulumi/pulumi-keycloak
License: Apache-2.0
Notes: This Pulumi package is based on the keycloak Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud