Social

Creates an Social Identity Provider.

This resource allows you to create and configure an Social Identity Provider.

Example Usage

using Pulumi;
using Okta = Pulumi.Okta;

class MyStack : Stack
{
    public MyStack()
    {
        var example = new Okta.Idp.Social("example", new Okta.Idp.SocialArgs
        {
            ClientId = "abcd123",
            ClientSecret = "abcd123",
            MatchAttribute = "customfieldId",
            MatchType = "CUSTOM_ATTRIBUTE",
            ProtocolType = "OAUTH2",
            Scopes = 
            {
                "public_profile",
                "email",
            },
            Type = "FACEBOOK",
            UsernameTemplate = "idpuser.email",
        });
    }

}

Coming soon!

import pulumi
import pulumi_okta as okta

example = okta.idp.Social("example",
    client_id="abcd123",
    client_secret="abcd123",
    match_attribute="customfieldId",
    match_type="CUSTOM_ATTRIBUTE",
    protocol_type="OAUTH2",
    scopes=[
        "public_profile",
        "email",
    ],
    type="FACEBOOK",
    username_template="idpuser.email")

import * as pulumi from "@pulumi/pulumi";
import * as okta from "@pulumi/okta";

const example = new okta.idp.Social("example", {
    clientId: "abcd123",
    clientSecret: "abcd123",
    matchAttribute: "customfieldId",
    matchType: "CUSTOM_ATTRIBUTE",
    protocolType: "OAUTH2",
    scopes: [
        "public_profile",
        "email",
    ],
    type: "FACEBOOK",
    usernameTemplate: "idpuser.email",
});

Create a Social Resource

new Social(name: string, args: SocialArgs, opts?: CustomResourceOptions);

def Social(resource_name, opts=None, account_link_action=None, account_link_group_includes=None, client_id=None, client_secret=None, deprovisioned_action=None, groups_action=None, groups_assignments=None, groups_attribute=None, groups_filters=None, issuer_mode=None, match_attribute=None, match_type=None, max_clock_skew=None, name=None, profile_master=None, protocol_type=None, provisioning_action=None, request_signature_algorithm=None, request_signature_scope=None, response_signature_algorithm=None, response_signature_scope=None, scopes=None, status=None, subject_match_attribute=None, subject_match_type=None, suspended_action=None, type=None, username_template=None, __props__=None);

func NewSocial(ctx *Context, name string, args SocialArgs, opts ...ResourceOption) (*Social, error)

public Social(string name, SocialArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args SocialArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args SocialArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args SocialArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

Social Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The Social resource accepts the following input properties:

Scopes List<string>: The scopes of the IdP.
Type string: The type of Social IdP. It can be "FACEBOOK", "LINKEDIN", "MICROSOFT", or "GOOGLE".
AccountLinkAction string: Specifies the account linking action for an IdP user.
AccountLinkGroupIncludes List<string>: Group memberships to determine link candidates.
ClientId string: Unique identifier issued by AS for the Okta IdP instance.
ClientSecret string: Client secret issued by AS for the Okta IdP instance.
DeprovisionedAction string: Action for a previously deprovisioned IdP user during authentication. Can be "NONE" or "REACTIVATE".
GroupsAction string: Provisioning action for IdP user’s group memberships. It can be "NONE", "SYNC", "APPEND", or "ASSIGN".
GroupsAssignments List<string>: List of Okta Group IDs to add an IdP user as a member with the "ASSIGN" groups_action.
GroupsAttribute string: IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
GroupsFilters List<string>: Whitelist of Okta Group identifiers that are allowed for the "APPEND" or "SYNC" groups_action.
IssuerMode string: Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be "ORG_URL" or "CUSTOM_URL".
MatchAttribute string: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_attribute"
MatchType string: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_type"
MaxClockSkew int: Maximum allowable clock-skew when processing messages from the IdP.
Name string: The Application’s display name.
ProfileMaster bool: Determines if the IdP should act as a source of truth for user profile attributes.
ProtocolType string: The type of protocol to use. It can be "OIDC" or "OAUTH2".
ProvisioningAction string: Provisioning action for an IdP user during authentication.
RequestSignatureAlgorithm string: The XML digital signature algorithm used when signing an AuthnRequest message.
RequestSignatureScope string: Specifies whether or not to digitally sign an AuthnRequest messages to the IdP. It can be "REQUEST" or "NONE".
ResponseSignatureAlgorithm string: The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element.
ResponseSignatureScope string: Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be "RESPONSE", "ASSERTION", or "ANY".
Status string: Status of the IdP.
SubjectMatchAttribute string: Okta user profile attribute for matching transformed IdP username. Only for matchType "CUSTOM_ATTRIBUTE".
SubjectMatchType string: Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default it is set to "USERNAME". It can be set to "USERNAME", "EMAIL", "USERNAME_OR_EMAIL" or "CUSTOM_ATTRIBUTE".
SuspendedAction string: Action for a previously suspended IdP user during authentication. Can be set to "NONE" or "UNSUSPEND"
UsernameTemplate string: Okta EL Expression to generate or transform a unique username for the IdP user.

Scopes []string: The scopes of the IdP.
Type string: The type of Social IdP. It can be "FACEBOOK", "LINKEDIN", "MICROSOFT", or "GOOGLE".
AccountLinkAction string: Specifies the account linking action for an IdP user.
AccountLinkGroupIncludes []string: Group memberships to determine link candidates.
ClientId string: Unique identifier issued by AS for the Okta IdP instance.
ClientSecret string: Client secret issued by AS for the Okta IdP instance.
DeprovisionedAction string: Action for a previously deprovisioned IdP user during authentication. Can be "NONE" or "REACTIVATE".
GroupsAction string: Provisioning action for IdP user’s group memberships. It can be "NONE", "SYNC", "APPEND", or "ASSIGN".
GroupsAssignments []string: List of Okta Group IDs to add an IdP user as a member with the "ASSIGN" groups_action.
GroupsAttribute string: IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
GroupsFilters []string: Whitelist of Okta Group identifiers that are allowed for the "APPEND" or "SYNC" groups_action.
IssuerMode string: Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be "ORG_URL" or "CUSTOM_URL".
MatchAttribute string: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_attribute"
MatchType string: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_type"
MaxClockSkew int: Maximum allowable clock-skew when processing messages from the IdP.
Name string: The Application’s display name.
ProfileMaster bool: Determines if the IdP should act as a source of truth for user profile attributes.
ProtocolType string: The type of protocol to use. It can be "OIDC" or "OAUTH2".
ProvisioningAction string: Provisioning action for an IdP user during authentication.
RequestSignatureAlgorithm string: The XML digital signature algorithm used when signing an AuthnRequest message.
RequestSignatureScope string: Specifies whether or not to digitally sign an AuthnRequest messages to the IdP. It can be "REQUEST" or "NONE".
ResponseSignatureAlgorithm string: The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element.
ResponseSignatureScope string: Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be "RESPONSE", "ASSERTION", or "ANY".
Status string: Status of the IdP.
SubjectMatchAttribute string: Okta user profile attribute for matching transformed IdP username. Only for matchType "CUSTOM_ATTRIBUTE".
SubjectMatchType string: Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default it is set to "USERNAME". It can be set to "USERNAME", "EMAIL", "USERNAME_OR_EMAIL" or "CUSTOM_ATTRIBUTE".
SuspendedAction string: Action for a previously suspended IdP user during authentication. Can be set to "NONE" or "UNSUSPEND"
UsernameTemplate string: Okta EL Expression to generate or transform a unique username for the IdP user.

scopes string[]: The scopes of the IdP.
type string: The type of Social IdP. It can be "FACEBOOK", "LINKEDIN", "MICROSOFT", or "GOOGLE".
accountLinkAction string: Specifies the account linking action for an IdP user.
accountLinkGroupIncludes string[]: Group memberships to determine link candidates.
clientId string: Unique identifier issued by AS for the Okta IdP instance.
clientSecret string: Client secret issued by AS for the Okta IdP instance.
deprovisionedAction string: Action for a previously deprovisioned IdP user during authentication. Can be "NONE" or "REACTIVATE".
groupsAction string: Provisioning action for IdP user’s group memberships. It can be "NONE", "SYNC", "APPEND", or "ASSIGN".
groupsAssignments string[]: List of Okta Group IDs to add an IdP user as a member with the "ASSIGN" groups_action.
groupsAttribute string: IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
groupsFilters string[]: Whitelist of Okta Group identifiers that are allowed for the "APPEND" or "SYNC" groups_action.
issuerMode string: Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be "ORG_URL" or "CUSTOM_URL".
matchAttribute string: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_attribute"
matchType string: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_type"
maxClockSkew number: Maximum allowable clock-skew when processing messages from the IdP.
name string: The Application’s display name.
profileMaster boolean: Determines if the IdP should act as a source of truth for user profile attributes.
protocolType string: The type of protocol to use. It can be "OIDC" or "OAUTH2".
provisioningAction string: Provisioning action for an IdP user during authentication.
requestSignatureAlgorithm string: The XML digital signature algorithm used when signing an AuthnRequest message.
requestSignatureScope string: Specifies whether or not to digitally sign an AuthnRequest messages to the IdP. It can be "REQUEST" or "NONE".
responseSignatureAlgorithm string: The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element.
responseSignatureScope string: Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be "RESPONSE", "ASSERTION", or "ANY".
status string: Status of the IdP.
subjectMatchAttribute string: Okta user profile attribute for matching transformed IdP username. Only for matchType "CUSTOM_ATTRIBUTE".
subjectMatchType string: Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default it is set to "USERNAME". It can be set to "USERNAME", "EMAIL", "USERNAME_OR_EMAIL" or "CUSTOM_ATTRIBUTE".
suspendedAction string: Action for a previously suspended IdP user during authentication. Can be set to "NONE" or "UNSUSPEND"
usernameTemplate string: Okta EL Expression to generate or transform a unique username for the IdP user.

scopes List[str]: The scopes of the IdP.
type str: The type of Social IdP. It can be "FACEBOOK", "LINKEDIN", "MICROSOFT", or "GOOGLE".
account_link_action str: Specifies the account linking action for an IdP user.
account_link_group_includes List[str]: Group memberships to determine link candidates.
client_id str: Unique identifier issued by AS for the Okta IdP instance.
client_secret str: Client secret issued by AS for the Okta IdP instance.
deprovisioned_action str: Action for a previously deprovisioned IdP user during authentication. Can be "NONE" or "REACTIVATE".
groups_action str: Provisioning action for IdP user’s group memberships. It can be "NONE", "SYNC", "APPEND", or "ASSIGN".
groups_assignments List[str]: List of Okta Group IDs to add an IdP user as a member with the "ASSIGN" groups_action.
groups_attribute str: IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
groups_filters List[str]: Whitelist of Okta Group identifiers that are allowed for the "APPEND" or "SYNC" groups_action.
issuer_mode str: Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be "ORG_URL" or "CUSTOM_URL".
match_attribute str: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_attribute"
match_type str: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_type"
max_clock_skew float: Maximum allowable clock-skew when processing messages from the IdP.
name str: The Application’s display name.
profile_master bool: Determines if the IdP should act as a source of truth for user profile attributes.
protocol_type str: The type of protocol to use. It can be "OIDC" or "OAUTH2".
provisioning_action str: Provisioning action for an IdP user during authentication.
request_signature_algorithm str: The XML digital signature algorithm used when signing an AuthnRequest message.
request_signature_scope str: Specifies whether or not to digitally sign an AuthnRequest messages to the IdP. It can be "REQUEST" or "NONE".
response_signature_algorithm str: The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element.
response_signature_scope str: Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be "RESPONSE", "ASSERTION", or "ANY".
status str: Status of the IdP.
subject_match_attribute str: Okta user profile attribute for matching transformed IdP username. Only for matchType "CUSTOM_ATTRIBUTE".
subject_match_type str: Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default it is set to "USERNAME". It can be set to "USERNAME", "EMAIL", "USERNAME_OR_EMAIL" or "CUSTOM_ATTRIBUTE".
suspended_action str: Action for a previously suspended IdP user during authentication. Can be set to "NONE" or "UNSUSPEND"
username_template str: Okta EL Expression to generate or transform a unique username for the IdP user.

Outputs

All input properties are implicitly available as output properties. Additionally, the Social resource produces the following output properties:

AuthorizationBinding string: The method of making an authorization request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
AuthorizationUrl string: IdP Authorization Server (AS) endpoint to request consent from the user and obtain an authorization code grant.
Id string: The provider-assigned unique ID for this managed resource.
TokenBinding string: The method of making a token request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
TokenUrl string: IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token.

AuthorizationBinding string: The method of making an authorization request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
AuthorizationUrl string: IdP Authorization Server (AS) endpoint to request consent from the user and obtain an authorization code grant.
Id string: The provider-assigned unique ID for this managed resource.
TokenBinding string: The method of making a token request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
TokenUrl string: IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token.

authorizationBinding string: The method of making an authorization request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
authorizationUrl string: IdP Authorization Server (AS) endpoint to request consent from the user and obtain an authorization code grant.
id string: The provider-assigned unique ID for this managed resource.
tokenBinding string: The method of making a token request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
tokenUrl string: IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token.

authorization_binding str: The method of making an authorization request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
authorization_url str: IdP Authorization Server (AS) endpoint to request consent from the user and obtain an authorization code grant.
id str: The provider-assigned unique ID for this managed resource.
token_binding str: The method of making a token request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
token_url str: IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token.

Look up an Existing Social Resource

Get an existing Social resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: SocialState, opts?: CustomResourceOptions): Social

static get(resource_name, id, opts=None, account_link_action=None, account_link_group_includes=None, authorization_binding=None, authorization_url=None, client_id=None, client_secret=None, deprovisioned_action=None, groups_action=None, groups_assignments=None, groups_attribute=None, groups_filters=None, issuer_mode=None, match_attribute=None, match_type=None, max_clock_skew=None, name=None, profile_master=None, protocol_type=None, provisioning_action=None, request_signature_algorithm=None, request_signature_scope=None, response_signature_algorithm=None, response_signature_scope=None, scopes=None, status=None, subject_match_attribute=None, subject_match_type=None, suspended_action=None, token_binding=None, token_url=None, type=None, username_template=None, __props__=None);

func GetSocial(ctx *Context, name string, id IDInput, state *SocialState, opts ...ResourceOption) (*Social, error)

public static Social Get(string name, Input<string> id, SocialState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AccountLinkAction string: Specifies the account linking action for an IdP user.
AccountLinkGroupIncludes List<string>: Group memberships to determine link candidates.
AuthorizationBinding string: The method of making an authorization request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
AuthorizationUrl string: IdP Authorization Server (AS) endpoint to request consent from the user and obtain an authorization code grant.
ClientId string: Unique identifier issued by AS for the Okta IdP instance.
ClientSecret string: Client secret issued by AS for the Okta IdP instance.
DeprovisionedAction string: Action for a previously deprovisioned IdP user during authentication. Can be "NONE" or "REACTIVATE".
GroupsAction string: Provisioning action for IdP user’s group memberships. It can be "NONE", "SYNC", "APPEND", or "ASSIGN".
GroupsAssignments List<string>: List of Okta Group IDs to add an IdP user as a member with the "ASSIGN" groups_action.
GroupsAttribute string: IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
GroupsFilters List<string>: Whitelist of Okta Group identifiers that are allowed for the "APPEND" or "SYNC" groups_action.
IssuerMode string: Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be "ORG_URL" or "CUSTOM_URL".
MatchAttribute string: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_attribute"
MatchType string: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_type"
MaxClockSkew int: Maximum allowable clock-skew when processing messages from the IdP.
Name string: The Application’s display name.
ProfileMaster bool: Determines if the IdP should act as a source of truth for user profile attributes.
ProtocolType string: The type of protocol to use. It can be "OIDC" or "OAUTH2".
ProvisioningAction string: Provisioning action for an IdP user during authentication.
RequestSignatureAlgorithm string: The XML digital signature algorithm used when signing an AuthnRequest message.
RequestSignatureScope string: Specifies whether or not to digitally sign an AuthnRequest messages to the IdP. It can be "REQUEST" or "NONE".
ResponseSignatureAlgorithm string: The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element.
ResponseSignatureScope string: Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be "RESPONSE", "ASSERTION", or "ANY".
Scopes List<string>: The scopes of the IdP.
Status string: Status of the IdP.
SubjectMatchAttribute string: Okta user profile attribute for matching transformed IdP username. Only for matchType "CUSTOM_ATTRIBUTE".
SubjectMatchType string: Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default it is set to "USERNAME". It can be set to "USERNAME", "EMAIL", "USERNAME_OR_EMAIL" or "CUSTOM_ATTRIBUTE".
SuspendedAction string: Action for a previously suspended IdP user during authentication. Can be set to "NONE" or "UNSUSPEND"
TokenBinding string: The method of making a token request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
TokenUrl string: IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token.
Type string: The type of Social IdP. It can be "FACEBOOK", "LINKEDIN", "MICROSOFT", or "GOOGLE".
UsernameTemplate string: Okta EL Expression to generate or transform a unique username for the IdP user.

AccountLinkAction string: Specifies the account linking action for an IdP user.
AccountLinkGroupIncludes []string: Group memberships to determine link candidates.
AuthorizationBinding string: The method of making an authorization request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
AuthorizationUrl string: IdP Authorization Server (AS) endpoint to request consent from the user and obtain an authorization code grant.
ClientId string: Unique identifier issued by AS for the Okta IdP instance.
ClientSecret string: Client secret issued by AS for the Okta IdP instance.
DeprovisionedAction string: Action for a previously deprovisioned IdP user during authentication. Can be "NONE" or "REACTIVATE".
GroupsAction string: Provisioning action for IdP user’s group memberships. It can be "NONE", "SYNC", "APPEND", or "ASSIGN".
GroupsAssignments []string: List of Okta Group IDs to add an IdP user as a member with the "ASSIGN" groups_action.
GroupsAttribute string: IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
GroupsFilters []string: Whitelist of Okta Group identifiers that are allowed for the "APPEND" or "SYNC" groups_action.
IssuerMode string: Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be "ORG_URL" or "CUSTOM_URL".
MatchAttribute string: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_attribute"
MatchType string: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_type"
MaxClockSkew int: Maximum allowable clock-skew when processing messages from the IdP.
Name string: The Application’s display name.
ProfileMaster bool: Determines if the IdP should act as a source of truth for user profile attributes.
ProtocolType string: The type of protocol to use. It can be "OIDC" or "OAUTH2".
ProvisioningAction string: Provisioning action for an IdP user during authentication.
RequestSignatureAlgorithm string: The XML digital signature algorithm used when signing an AuthnRequest message.
RequestSignatureScope string: Specifies whether or not to digitally sign an AuthnRequest messages to the IdP. It can be "REQUEST" or "NONE".
ResponseSignatureAlgorithm string: The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element.
ResponseSignatureScope string: Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be "RESPONSE", "ASSERTION", or "ANY".
Scopes []string: The scopes of the IdP.
Status string: Status of the IdP.
SubjectMatchAttribute string: Okta user profile attribute for matching transformed IdP username. Only for matchType "CUSTOM_ATTRIBUTE".
SubjectMatchType string: Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default it is set to "USERNAME". It can be set to "USERNAME", "EMAIL", "USERNAME_OR_EMAIL" or "CUSTOM_ATTRIBUTE".
SuspendedAction string: Action for a previously suspended IdP user during authentication. Can be set to "NONE" or "UNSUSPEND"
TokenBinding string: The method of making a token request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
TokenUrl string: IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token.
Type string: The type of Social IdP. It can be "FACEBOOK", "LINKEDIN", "MICROSOFT", or "GOOGLE".
UsernameTemplate string: Okta EL Expression to generate or transform a unique username for the IdP user.

accountLinkAction string: Specifies the account linking action for an IdP user.
accountLinkGroupIncludes string[]: Group memberships to determine link candidates.
authorizationBinding string: The method of making an authorization request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
authorizationUrl string: IdP Authorization Server (AS) endpoint to request consent from the user and obtain an authorization code grant.
clientId string: Unique identifier issued by AS for the Okta IdP instance.
clientSecret string: Client secret issued by AS for the Okta IdP instance.
deprovisionedAction string: Action for a previously deprovisioned IdP user during authentication. Can be "NONE" or "REACTIVATE".
groupsAction string: Provisioning action for IdP user’s group memberships. It can be "NONE", "SYNC", "APPEND", or "ASSIGN".
groupsAssignments string[]: List of Okta Group IDs to add an IdP user as a member with the "ASSIGN" groups_action.
groupsAttribute string: IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
groupsFilters string[]: Whitelist of Okta Group identifiers that are allowed for the "APPEND" or "SYNC" groups_action.
issuerMode string: Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be "ORG_URL" or "CUSTOM_URL".
matchAttribute string: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_attribute"
matchType string: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_type"
maxClockSkew number: Maximum allowable clock-skew when processing messages from the IdP.
name string: The Application’s display name.
profileMaster boolean: Determines if the IdP should act as a source of truth for user profile attributes.
protocolType string: The type of protocol to use. It can be "OIDC" or "OAUTH2".
provisioningAction string: Provisioning action for an IdP user during authentication.
requestSignatureAlgorithm string: The XML digital signature algorithm used when signing an AuthnRequest message.
requestSignatureScope string: Specifies whether or not to digitally sign an AuthnRequest messages to the IdP. It can be "REQUEST" or "NONE".
responseSignatureAlgorithm string: The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element.
responseSignatureScope string: Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be "RESPONSE", "ASSERTION", or "ANY".
scopes string[]: The scopes of the IdP.
status string: Status of the IdP.
subjectMatchAttribute string: Okta user profile attribute for matching transformed IdP username. Only for matchType "CUSTOM_ATTRIBUTE".
subjectMatchType string: Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default it is set to "USERNAME". It can be set to "USERNAME", "EMAIL", "USERNAME_OR_EMAIL" or "CUSTOM_ATTRIBUTE".
suspendedAction string: Action for a previously suspended IdP user during authentication. Can be set to "NONE" or "UNSUSPEND"
tokenBinding string: The method of making a token request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
tokenUrl string: IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token.
type string: The type of Social IdP. It can be "FACEBOOK", "LINKEDIN", "MICROSOFT", or "GOOGLE".
usernameTemplate string: Okta EL Expression to generate or transform a unique username for the IdP user.

account_link_action str: Specifies the account linking action for an IdP user.
account_link_group_includes List[str]: Group memberships to determine link candidates.
authorization_binding str: The method of making an authorization request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
authorization_url str: IdP Authorization Server (AS) endpoint to request consent from the user and obtain an authorization code grant.
client_id str: Unique identifier issued by AS for the Okta IdP instance.
client_secret str: Client secret issued by AS for the Okta IdP instance.
deprovisioned_action str: Action for a previously deprovisioned IdP user during authentication. Can be "NONE" or "REACTIVATE".
groups_action str: Provisioning action for IdP user’s group memberships. It can be "NONE", "SYNC", "APPEND", or "ASSIGN".
groups_assignments List[str]: List of Okta Group IDs to add an IdP user as a member with the "ASSIGN" groups_action.
groups_attribute str: IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
groups_filters List[str]: Whitelist of Okta Group identifiers that are allowed for the "APPEND" or "SYNC" groups_action.
issuer_mode str: Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be "ORG_URL" or "CUSTOM_URL".
match_attribute str: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_attribute"
match_type str: Deprecated: This property was incorrectly added to this resource, you should use "subject_match_type"
max_clock_skew float: Maximum allowable clock-skew when processing messages from the IdP.
name str: The Application’s display name.
profile_master bool: Determines if the IdP should act as a source of truth for user profile attributes.
protocol_type str: The type of protocol to use. It can be "OIDC" or "OAUTH2".
provisioning_action str: Provisioning action for an IdP user during authentication.
request_signature_algorithm str: The XML digital signature algorithm used when signing an AuthnRequest message.
request_signature_scope str: Specifies whether or not to digitally sign an AuthnRequest messages to the IdP. It can be "REQUEST" or "NONE".
response_signature_algorithm str: The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element.
response_signature_scope str: Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be "RESPONSE", "ASSERTION", or "ANY".
scopes List[str]: The scopes of the IdP.
status str: Status of the IdP.
subject_match_attribute str: Okta user profile attribute for matching transformed IdP username. Only for matchType "CUSTOM_ATTRIBUTE".
subject_match_type str: Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default it is set to "USERNAME". It can be set to "USERNAME", "EMAIL", "USERNAME_OR_EMAIL" or "CUSTOM_ATTRIBUTE".
suspended_action str: Action for a previously suspended IdP user during authentication. Can be set to "NONE" or "UNSUSPEND"
token_binding str: The method of making a token request. It can be set to "HTTP-POST" or "HTTP-REDIRECT".
token_url str: IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token.
type str: The type of Social IdP. It can be "FACEBOOK", "LINKEDIN", "MICROSOFT", or "GOOGLE".
username_template str: Okta EL Expression to generate or transform a unique username for the IdP user.

Package Details

Repository: https://github.com/pulumi/pulumi-okta
License: Apache-2.0
Notes: This Pulumi package is based on the okta Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud