IdentityProvider

# keycloak.saml.IdentityProvider

Allows to create and manage SAML Identity Providers within Keycloak.

SAML (Security Assertion Markup Language) identity providers allows to authenticate through a third-party system, using SAML standard.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const realmIdentityProvider = new keycloak.saml.IdentityProvider("realm_identity_provider", {
    alias: "my-idp",
    backchannelSupported: true,
    forceAuthn: true,
    postBindingAuthnRequest: true,
    postBindingLogout: true,
    postBindingResponse: true,
    realm: "my-realm",
    singleLogoutServiceUrl: "https://domain.com/adfs/ls/?wa=wsignout1.0",
    singleSignOnServiceUrl: "https://domain.com/adfs/ls/",
    storeToken: false,
    trustEmail: true,
});

import pulumi
import pulumi_keycloak as keycloak

realm_identity_provider = keycloak.saml.IdentityProvider("realmIdentityProvider",
    alias="my-idp",
    backchannel_supported=True,
    force_authn=True,
    post_binding_authn_request=True,
    post_binding_logout=True,
    post_binding_response=True,
    realm="my-realm",
    single_logout_service_url="https://domain.com/adfs/ls/?wa=wsignout1.0",
    single_sign_on_service_url="https://domain.com/adfs/ls/",
    store_token=False,
    trust_email=True)

using Pulumi;
using Keycloak = Pulumi.Keycloak;

class MyStack : Stack
{
    public MyStack()
    {
        var realmIdentityProvider = new Keycloak.Saml.IdentityProvider("realmIdentityProvider", new Keycloak.Saml.IdentityProviderArgs
        {
            Alias = "my-idp",
            BackchannelSupported = true,
            ForceAuthn = true,
            PostBindingAuthnRequest = true,
            PostBindingLogout = true,
            PostBindingResponse = true,
            Realm = "my-realm",
            SingleLogoutServiceUrl = "https://domain.com/adfs/ls/?wa=wsignout1.0",
            SingleSignOnServiceUrl = "https://domain.com/adfs/ls/",
            StoreToken = false,
            TrustEmail = true,
        });
    }

}

Argument Reference

The following arguments are supported:

realm - (Required) The name of the realm. This is unique across Keycloak.
alias - (Optional) The uniq name of identity provider.
enabled - (Optional) When false, users and clients will not be able to access this realm. Defaults to true.
display_name - (Optional) The display name for the realm that is shown when logging in to the admin console.
store_token - (Optional) Enable/disable if tokens must be stored after authenticating users. Defaults to true.
add_read_token_role_on_create - (Optional) Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role. Defaults to false.
trust_email - (Optional) If enabled then email provided by this provider is not verified even if verification is enabled for the realm. Defaults to false.
link_only - (Optional) If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider. Defaults to false.
hide_on_login_page - (Optional) If hidden, then login with this provider is possible only if requested explicitly, e.g. using the ‘kc_idp_hint’ parameter.
first_broker_login_flow_alias - (Optional) Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account. Defaults to first broker login.
post_broker_login_flow_alias - (Optional) Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it. Defaults to empty.
authenticate_by_default - (Optional) Authenticate users by default. Defaults to false.

SAML Configuration

single_sign_on_service_url - (Optional) The Url that must be used to send authentication requests (SAML AuthnRequest).
single_logout_service_url - (Optional) The Url that must be used to send logout requests.
backchannel_supported - (Optional) Does the external IDP support back-channel logout ?.
name_id_policy_format - (Optional) Specifies the URI reference corresponding to a name identifier format. Defaults to empty.
post_binding_response - (Optional) Indicates whether to respond to requests using HTTP-POST binding. If false, HTTP-REDIRECT binding will be used..
post_binding_authn_request - (Optional) Indicates whether the AuthnRequest must be sent using HTTP-POST binding. If false, HTTP-REDIRECT binding will be used.
post_binding_logout - (Optional) Indicates whether to respond to requests using HTTP-POST binding. If false, HTTP-REDIRECT binding will be used.
want_assertions_signed - (Optional) Indicates whether this service provider expects a signed Assertion.
want_assertions_encrypted - (Optional) Indicates whether this service provider expects an encrypted Assertion.
force_authn - (Optional) Indicates whether the identity provider must authenticate the presenter directly rather than rely on a previous security context.
validate_signature - (Optional) Enable/disable signature validation of SAML responses.
signing_certificate - (Optional) Signing Certificate.
signature_algorithm - (Optional) Signing Algorithm. Defaults to empty.
xml_sign_key_info_key_name_transformer - (Optional) Sign Key Transformer. Defaults to empty.

Create a IdentityProvider Resource

new IdentityProvider(name: string, args: IdentityProviderArgs, opts?: CustomResourceOptions);

def IdentityProvider(resource_name, opts=None, add_read_token_role_on_create=None, alias=None, authenticate_by_default=None, backchannel_supported=None, display_name=None, enabled=None, first_broker_login_flow_alias=None, force_authn=None, hide_on_login_page=None, link_only=None, name_id_policy_format=None, post_binding_authn_request=None, post_binding_logout=None, post_binding_response=None, post_broker_login_flow_alias=None, realm=None, signature_algorithm=None, signing_certificate=None, single_logout_service_url=None, single_sign_on_service_url=None, store_token=None, trust_email=None, validate_signature=None, want_assertions_encrypted=None, want_assertions_signed=None, xml_sign_key_info_key_name_transformer=None, __props__=None);

func NewIdentityProvider(ctx *Context, name string, args IdentityProviderArgs, opts ...ResourceOption) (*IdentityProvider, error)

public IdentityProvider(string name, IdentityProviderArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args IdentityProviderArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args IdentityProviderArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args IdentityProviderArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

IdentityProvider Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The IdentityProvider resource accepts the following input properties:

Alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
Realm string: Realm Name
SingleSignOnServiceUrl string: SSO Logout URL.
AddReadTokenRoleOnCreate bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
AuthenticateByDefault bool: Enable/disable authenticate users by default.
BackchannelSupported bool: Does the external IDP support backchannel logout?
DisplayName string: Friendly name for Identity Providers.
Enabled bool: Enable/disable this identity provider.
FirstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
ForceAuthn bool: Require Force Authn.
HideOnLoginPage bool: Hide On Login Page.
LinkOnly bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
NameIdPolicyFormat string: Name ID Policy Format.
PostBindingAuthnRequest bool: Post Binding Authn Request.
PostBindingLogout bool: Post Binding Logout.
PostBindingResponse bool: Post Binding Response.
PostBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
SignatureAlgorithm string: Signing Algorithm.
SigningCertificate string: Signing Certificate.
SingleLogoutServiceUrl string: Logout URL.
StoreToken bool: Enable/disable if tokens must be stored after authenticating users.
TrustEmail bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
ValidateSignature bool: Enable/disable signature validation of SAML responses.
WantAssertionsEncrypted bool: Want Assertions Encrypted.
WantAssertionsSigned bool: Want Assertions Signed.
XmlSignKeyInfoKeyNameTransformer string: Sign Key Transformer.

Alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
Realm string: Realm Name
SingleSignOnServiceUrl string: SSO Logout URL.
AddReadTokenRoleOnCreate bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
AuthenticateByDefault bool: Enable/disable authenticate users by default.
BackchannelSupported bool: Does the external IDP support backchannel logout?
DisplayName string: Friendly name for Identity Providers.
Enabled bool: Enable/disable this identity provider.
FirstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
ForceAuthn bool: Require Force Authn.
HideOnLoginPage bool: Hide On Login Page.
LinkOnly bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
NameIdPolicyFormat string: Name ID Policy Format.
PostBindingAuthnRequest bool: Post Binding Authn Request.
PostBindingLogout bool: Post Binding Logout.
PostBindingResponse bool: Post Binding Response.
PostBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
SignatureAlgorithm string: Signing Algorithm.
SigningCertificate string: Signing Certificate.
SingleLogoutServiceUrl string: Logout URL.
StoreToken bool: Enable/disable if tokens must be stored after authenticating users.
TrustEmail bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
ValidateSignature bool: Enable/disable signature validation of SAML responses.
WantAssertionsEncrypted bool: Want Assertions Encrypted.
WantAssertionsSigned bool: Want Assertions Signed.
XmlSignKeyInfoKeyNameTransformer string: Sign Key Transformer.

alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
realm string: Realm Name
singleSignOnServiceUrl string: SSO Logout URL.
addReadTokenRoleOnCreate boolean: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
authenticateByDefault boolean: Enable/disable authenticate users by default.
backchannelSupported boolean: Does the external IDP support backchannel logout?
displayName string: Friendly name for Identity Providers.
enabled boolean: Enable/disable this identity provider.
firstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
forceAuthn boolean: Require Force Authn.
hideOnLoginPage boolean: Hide On Login Page.
linkOnly boolean: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
nameIdPolicyFormat string: Name ID Policy Format.
postBindingAuthnRequest boolean: Post Binding Authn Request.
postBindingLogout boolean: Post Binding Logout.
postBindingResponse boolean: Post Binding Response.
postBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
signatureAlgorithm string: Signing Algorithm.
signingCertificate string: Signing Certificate.
singleLogoutServiceUrl string: Logout URL.
storeToken boolean: Enable/disable if tokens must be stored after authenticating users.
trustEmail boolean: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
validateSignature boolean: Enable/disable signature validation of SAML responses.
wantAssertionsEncrypted boolean: Want Assertions Encrypted.
wantAssertionsSigned boolean: Want Assertions Signed.
xmlSignKeyInfoKeyNameTransformer string: Sign Key Transformer.

alias str: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
realm str: Realm Name
single_sign_on_service_url str: SSO Logout URL.
add_read_token_role_on_create bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
authenticate_by_default bool: Enable/disable authenticate users by default.
backchannel_supported bool: Does the external IDP support backchannel logout?
display_name str: Friendly name for Identity Providers.
enabled bool: Enable/disable this identity provider.
first_broker_login_flow_alias str: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
force_authn bool: Require Force Authn.
hide_on_login_page bool: Hide On Login Page.
link_only bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
name_id_policy_format str: Name ID Policy Format.
post_binding_authn_request bool: Post Binding Authn Request.
post_binding_logout bool: Post Binding Logout.
post_binding_response bool: Post Binding Response.
post_broker_login_flow_alias str: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
signature_algorithm str: Signing Algorithm.
signing_certificate str: Signing Certificate.
single_logout_service_url str: Logout URL.
store_token bool: Enable/disable if tokens must be stored after authenticating users.
trust_email bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
validate_signature bool: Enable/disable signature validation of SAML responses.
want_assertions_encrypted bool: Want Assertions Encrypted.
want_assertions_signed bool: Want Assertions Signed.
xml_sign_key_info_key_name_transformer str: Sign Key Transformer.

Outputs

All input properties are implicitly available as output properties. Additionally, the IdentityProvider resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.
InternalId string: Internal Identity Provider Id

Id string: The provider-assigned unique ID for this managed resource.
InternalId string: Internal Identity Provider Id

id string: The provider-assigned unique ID for this managed resource.
internalId string: Internal Identity Provider Id

id str: The provider-assigned unique ID for this managed resource.
internal_id str: Internal Identity Provider Id

Look up an Existing IdentityProvider Resource

Get an existing IdentityProvider resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: IdentityProviderState, opts?: CustomResourceOptions): IdentityProvider

static get(resource_name, id, opts=None, add_read_token_role_on_create=None, alias=None, authenticate_by_default=None, backchannel_supported=None, display_name=None, enabled=None, first_broker_login_flow_alias=None, force_authn=None, hide_on_login_page=None, internal_id=None, link_only=None, name_id_policy_format=None, post_binding_authn_request=None, post_binding_logout=None, post_binding_response=None, post_broker_login_flow_alias=None, realm=None, signature_algorithm=None, signing_certificate=None, single_logout_service_url=None, single_sign_on_service_url=None, store_token=None, trust_email=None, validate_signature=None, want_assertions_encrypted=None, want_assertions_signed=None, xml_sign_key_info_key_name_transformer=None, __props__=None);

func GetIdentityProvider(ctx *Context, name string, id IDInput, state *IdentityProviderState, opts ...ResourceOption) (*IdentityProvider, error)

public static IdentityProvider Get(string name, Input<string> id, IdentityProviderState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AddReadTokenRoleOnCreate bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
Alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
AuthenticateByDefault bool: Enable/disable authenticate users by default.
BackchannelSupported bool: Does the external IDP support backchannel logout?
DisplayName string: Friendly name for Identity Providers.
Enabled bool: Enable/disable this identity provider.
FirstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
ForceAuthn bool: Require Force Authn.
HideOnLoginPage bool: Hide On Login Page.
InternalId string: Internal Identity Provider Id
LinkOnly bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
NameIdPolicyFormat string: Name ID Policy Format.
PostBindingAuthnRequest bool: Post Binding Authn Request.
PostBindingLogout bool: Post Binding Logout.
PostBindingResponse bool: Post Binding Response.
PostBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
Realm string: Realm Name
SignatureAlgorithm string: Signing Algorithm.
SigningCertificate string: Signing Certificate.
SingleLogoutServiceUrl string: Logout URL.
SingleSignOnServiceUrl string: SSO Logout URL.
StoreToken bool: Enable/disable if tokens must be stored after authenticating users.
TrustEmail bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
ValidateSignature bool: Enable/disable signature validation of SAML responses.
WantAssertionsEncrypted bool: Want Assertions Encrypted.
WantAssertionsSigned bool: Want Assertions Signed.
XmlSignKeyInfoKeyNameTransformer string: Sign Key Transformer.

AddReadTokenRoleOnCreate bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
Alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
AuthenticateByDefault bool: Enable/disable authenticate users by default.
BackchannelSupported bool: Does the external IDP support backchannel logout?
DisplayName string: Friendly name for Identity Providers.
Enabled bool: Enable/disable this identity provider.
FirstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
ForceAuthn bool: Require Force Authn.
HideOnLoginPage bool: Hide On Login Page.
InternalId string: Internal Identity Provider Id
LinkOnly bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
NameIdPolicyFormat string: Name ID Policy Format.
PostBindingAuthnRequest bool: Post Binding Authn Request.
PostBindingLogout bool: Post Binding Logout.
PostBindingResponse bool: Post Binding Response.
PostBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
Realm string: Realm Name
SignatureAlgorithm string: Signing Algorithm.
SigningCertificate string: Signing Certificate.
SingleLogoutServiceUrl string: Logout URL.
SingleSignOnServiceUrl string: SSO Logout URL.
StoreToken bool: Enable/disable if tokens must be stored after authenticating users.
TrustEmail bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
ValidateSignature bool: Enable/disable signature validation of SAML responses.
WantAssertionsEncrypted bool: Want Assertions Encrypted.
WantAssertionsSigned bool: Want Assertions Signed.
XmlSignKeyInfoKeyNameTransformer string: Sign Key Transformer.

addReadTokenRoleOnCreate boolean: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
alias string: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
authenticateByDefault boolean: Enable/disable authenticate users by default.
backchannelSupported boolean: Does the external IDP support backchannel logout?
displayName string: Friendly name for Identity Providers.
enabled boolean: Enable/disable this identity provider.
firstBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
forceAuthn boolean: Require Force Authn.
hideOnLoginPage boolean: Hide On Login Page.
internalId string: Internal Identity Provider Id
linkOnly boolean: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
nameIdPolicyFormat string: Name ID Policy Format.
postBindingAuthnRequest boolean: Post Binding Authn Request.
postBindingLogout boolean: Post Binding Logout.
postBindingResponse boolean: Post Binding Response.
postBrokerLoginFlowAlias string: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
realm string: Realm Name
signatureAlgorithm string: Signing Algorithm.
signingCertificate string: Signing Certificate.
singleLogoutServiceUrl string: Logout URL.
singleSignOnServiceUrl string: SSO Logout URL.
storeToken boolean: Enable/disable if tokens must be stored after authenticating users.
trustEmail boolean: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
validateSignature boolean: Enable/disable signature validation of SAML responses.
wantAssertionsEncrypted boolean: Want Assertions Encrypted.
wantAssertionsSigned boolean: Want Assertions Signed.
xmlSignKeyInfoKeyNameTransformer string: Sign Key Transformer.

add_read_token_role_on_create bool: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
alias str: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
authenticate_by_default bool: Enable/disable authenticate users by default.
backchannel_supported bool: Does the external IDP support backchannel logout?
display_name str: Friendly name for Identity Providers.
enabled bool: Enable/disable this identity provider.
first_broker_login_flow_alias str: Alias of authentication flow, which is triggered after first login with this identity provider. Term ‘First Login’ means that there is not yet existing Keycloak account linked with the authenticated identity provider account.
force_authn bool: Require Force Authn.
hide_on_login_page bool: Hide On Login Page.
internal_id str: Internal Identity Provider Id
link_only bool: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don’t want to allow login from the provider, but want to integrate with a provider
name_id_policy_format str: Name ID Policy Format.
post_binding_authn_request bool: Post Binding Authn Request.
post_binding_logout bool: Post Binding Logout.
post_binding_response bool: Post Binding Response.
post_broker_login_flow_alias str: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don’t want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
realm str: Realm Name
signature_algorithm str: Signing Algorithm.
signing_certificate str: Signing Certificate.
single_logout_service_url str: Logout URL.
single_sign_on_service_url str: SSO Logout URL.
store_token bool: Enable/disable if tokens must be stored after authenticating users.
trust_email bool: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
validate_signature bool: Enable/disable signature validation of SAML responses.
want_assertions_encrypted bool: Want Assertions Encrypted.
want_assertions_signed bool: Want Assertions Signed.
xml_sign_key_info_key_name_transformer str: Sign Key Transformer.

Package Details

Repository: https://github.com/pulumi/pulumi-keycloak
License: Apache-2.0
Notes: This Pulumi package is based on the keycloak Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud