Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Authentik Provider
  3. API Docs
  4. ProviderOauth2
authentik 2025.2.0 published on Monday, Mar 24, 2025 by goauthentik
goauthentik/terraform-provider-authentik

authentik.ProviderOauth2

Explore with Pulumi AI

authentik 2025.2.0 published on Monday, Mar 24, 2025 by goauthentik
goauthentik/terraform-provider-authentik

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as authentik from "@pulumi/authentik";

// Create an OAuth2 Provider
const nameProviderOauth2 = new authentik.ProviderOauth2("nameProviderOauth2", {
    clientId: "grafana",
    allowedRedirectUris: [{
        matching_mode: "strict",
        url: "http://localhost",
    }],
});
const nameApplication = new authentik.Application("nameApplication", {
    slug: "test-app",
    protocolProvider: nameProviderOauth2.providerOauth2Id,
});
Copy
import pulumi
import pulumi_authentik as authentik

# Create an OAuth2 Provider
name_provider_oauth2 = authentik.ProviderOauth2("nameProviderOauth2",
    client_id="grafana",
    allowed_redirect_uris=[{
        "matching_mode": "strict",
        "url": "http://localhost",
    }])
name_application = authentik.Application("nameApplication",
    slug="test-app",
    protocol_provider=name_provider_oauth2.provider_oauth2_id)
Copy
package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/authentik/v2025/authentik"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Create an OAuth2 Provider
		nameProviderOauth2, err := authentik.NewProviderOauth2(ctx, "nameProviderOauth2", &authentik.ProviderOauth2Args{
			ClientId: pulumi.String("grafana"),
			AllowedRedirectUris: pulumi.StringMapArray{
				pulumi.StringMap{
					"matching_mode": pulumi.String("strict"),
					"url":           pulumi.String("http://localhost"),
				},
			},
		})
		if err != nil {
			return err
		}
		_, err = authentik.NewApplication(ctx, "nameApplication", &authentik.ApplicationArgs{
			Slug:             pulumi.String("test-app"),
			ProtocolProvider: nameProviderOauth2.ProviderOauth2Id,
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Authentik = Pulumi.Authentik;

return await Deployment.RunAsync(() => 
{
    // Create an OAuth2 Provider
    var nameProviderOauth2 = new Authentik.ProviderOauth2("nameProviderOauth2", new()
    {
        ClientId = "grafana",
        AllowedRedirectUris = new[]
        {
            
            {
                { "matching_mode", "strict" },
                { "url", "http://localhost" },
            },
        },
    });

    var nameApplication = new Authentik.Application("nameApplication", new()
    {
        Slug = "test-app",
        ProtocolProvider = nameProviderOauth2.ProviderOauth2Id,
    });

});
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.authentik.ProviderOauth2;
import com.pulumi.authentik.ProviderOauth2Args;
import com.pulumi.authentik.Application;
import com.pulumi.authentik.ApplicationArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Create an OAuth2 Provider
        var nameProviderOauth2 = new ProviderOauth2("nameProviderOauth2", ProviderOauth2Args.builder()
            .clientId("grafana")
            .allowedRedirectUris(Map.ofEntries(
                Map.entry("matching_mode", "strict"),
                Map.entry("url", "http://localhost")
            ))
            .build());

        var nameApplication = new Application("nameApplication", ApplicationArgs.builder()
            .slug("test-app")
            .protocolProvider(nameProviderOauth2.providerOauth2Id())
            .build());

    }
}
Copy
resources:
  # Create an OAuth2 Provider
  nameProviderOauth2:
    type: authentik:ProviderOauth2
    properties:
      clientId: grafana
      allowedRedirectUris:
        - matching_mode: strict
          url: http://localhost
  nameApplication:
    type: authentik:Application
    properties:
      slug: test-app
      protocolProvider: ${nameProviderOauth2.providerOauth2Id}
Copy

Create ProviderOauth2 Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new ProviderOauth2(name: string, args: ProviderOauth2Args, opts?: CustomResourceOptions);
@overload
def ProviderOauth2(resource_name: str,
                   args: ProviderOauth2Args,
                   opts: Optional[ResourceOptions] = None)

@overload
def ProviderOauth2(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   invalidation_flow: Optional[str] = None,
                   authorization_flow: Optional[str] = None,
                   client_id: Optional[str] = None,
                   issuer_mode: Optional[str] = None,
                   access_code_validity: Optional[str] = None,
                   allowed_redirect_uris: Optional[Sequence[Mapping[str, str]]] = None,
                   client_secret: Optional[str] = None,
                   client_type: Optional[str] = None,
                   encryption_key: Optional[str] = None,
                   include_claims_in_id_token: Optional[bool] = None,
                   access_token_validity: Optional[str] = None,
                   jwks_sources: Optional[Sequence[str]] = None,
                   authentication_flow: Optional[str] = None,
                   jwt_federation_providers: Optional[Sequence[float]] = None,
                   jwt_federation_sources: Optional[Sequence[str]] = None,
                   name: Optional[str] = None,
                   property_mappings: Optional[Sequence[str]] = None,
                   provider_oauth2_id: Optional[str] = None,
                   refresh_token_validity: Optional[str] = None,
                   signing_key: Optional[str] = None,
                   sub_mode: Optional[str] = None)
func NewProviderOauth2(ctx *Context, name string, args ProviderOauth2Args, opts ...ResourceOption) (*ProviderOauth2, error)
public ProviderOauth2(string name, ProviderOauth2Args args, CustomResourceOptions? opts = null)
public ProviderOauth2(String name, ProviderOauth2Args args)
public ProviderOauth2(String name, ProviderOauth2Args args, CustomResourceOptions options)

type: authentik:ProviderOauth2
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args This property is required. ProviderOauth2Args
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args This property is required. ProviderOauth2Args
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args This property is required. ProviderOauth2Args
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args This property is required. ProviderOauth2Args
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. ProviderOauth2Args
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var providerOauth2Resource = new Authentik.ProviderOauth2("providerOauth2Resource", new()
{
    InvalidationFlow = "string",
    AuthorizationFlow = "string",
    ClientId = "string",
    IssuerMode = "string",
    AccessCodeValidity = "string",
    AllowedRedirectUris = new[]
    {
        
        {
            { "string", "string" },
        },
    },
    ClientSecret = "string",
    ClientType = "string",
    EncryptionKey = "string",
    IncludeClaimsInIdToken = false,
    AccessTokenValidity = "string",
    JwksSources = new[]
    {
        "string",
    },
    AuthenticationFlow = "string",
    JwtFederationProviders = new[]
    {
        0,
    },
    JwtFederationSources = new[]
    {
        "string",
    },
    Name = "string",
    PropertyMappings = new[]
    {
        "string",
    },
    ProviderOauth2Id = "string",
    RefreshTokenValidity = "string",
    SigningKey = "string",
    SubMode = "string",
});
Copy
example, err := authentik.NewProviderOauth2(ctx, "providerOauth2Resource", &authentik.ProviderOauth2Args{
	InvalidationFlow:   pulumi.String("string"),
	AuthorizationFlow:  pulumi.String("string"),
	ClientId:           pulumi.String("string"),
	IssuerMode:         pulumi.String("string"),
	AccessCodeValidity: pulumi.String("string"),
	AllowedRedirectUris: pulumi.StringMapArray{
		pulumi.StringMap{
			"string": pulumi.String("string"),
		},
	},
	ClientSecret:           pulumi.String("string"),
	ClientType:             pulumi.String("string"),
	EncryptionKey:          pulumi.String("string"),
	IncludeClaimsInIdToken: pulumi.Bool(false),
	AccessTokenValidity:    pulumi.String("string"),
	JwksSources: pulumi.StringArray{
		pulumi.String("string"),
	},
	AuthenticationFlow: pulumi.String("string"),
	JwtFederationProviders: pulumi.Float64Array{
		pulumi.Float64(0),
	},
	JwtFederationSources: pulumi.StringArray{
		pulumi.String("string"),
	},
	Name: pulumi.String("string"),
	PropertyMappings: pulumi.StringArray{
		pulumi.String("string"),
	},
	ProviderOauth2Id:     pulumi.String("string"),
	RefreshTokenValidity: pulumi.String("string"),
	SigningKey:           pulumi.String("string"),
	SubMode:              pulumi.String("string"),
})
Copy
var providerOauth2Resource = new ProviderOauth2("providerOauth2Resource", ProviderOauth2Args.builder()
    .invalidationFlow("string")
    .authorizationFlow("string")
    .clientId("string")
    .issuerMode("string")
    .accessCodeValidity("string")
    .allowedRedirectUris(Map.of("string", "string"))
    .clientSecret("string")
    .clientType("string")
    .encryptionKey("string")
    .includeClaimsInIdToken(false)
    .accessTokenValidity("string")
    .jwksSources("string")
    .authenticationFlow("string")
    .jwtFederationProviders(0)
    .jwtFederationSources("string")
    .name("string")
    .propertyMappings("string")
    .providerOauth2Id("string")
    .refreshTokenValidity("string")
    .signingKey("string")
    .subMode("string")
    .build());
Copy
provider_oauth2_resource = authentik.ProviderOauth2("providerOauth2Resource",
    invalidation_flow="string",
    authorization_flow="string",
    client_id="string",
    issuer_mode="string",
    access_code_validity="string",
    allowed_redirect_uris=[{
        "string": "string",
    }],
    client_secret="string",
    client_type="string",
    encryption_key="string",
    include_claims_in_id_token=False,
    access_token_validity="string",
    jwks_sources=["string"],
    authentication_flow="string",
    jwt_federation_providers=[0],
    jwt_federation_sources=["string"],
    name="string",
    property_mappings=["string"],
    provider_oauth2_id="string",
    refresh_token_validity="string",
    signing_key="string",
    sub_mode="string")
Copy
const providerOauth2Resource = new authentik.ProviderOauth2("providerOauth2Resource", {
    invalidationFlow: "string",
    authorizationFlow: "string",
    clientId: "string",
    issuerMode: "string",
    accessCodeValidity: "string",
    allowedRedirectUris: [{
        string: "string",
    }],
    clientSecret: "string",
    clientType: "string",
    encryptionKey: "string",
    includeClaimsInIdToken: false,
    accessTokenValidity: "string",
    jwksSources: ["string"],
    authenticationFlow: "string",
    jwtFederationProviders: [0],
    jwtFederationSources: ["string"],
    name: "string",
    propertyMappings: ["string"],
    providerOauth2Id: "string",
    refreshTokenValidity: "string",
    signingKey: "string",
    subMode: "string",
});
Copy
type: authentik:ProviderOauth2
properties:
    accessCodeValidity: string
    accessTokenValidity: string
    allowedRedirectUris:
        - string: string
    authenticationFlow: string
    authorizationFlow: string
    clientId: string
    clientSecret: string
    clientType: string
    encryptionKey: string
    includeClaimsInIdToken: false
    invalidationFlow: string
    issuerMode: string
    jwksSources:
        - string
    jwtFederationProviders:
        - 0
    jwtFederationSources:
        - string
    name: string
    propertyMappings:
        - string
    providerOauth2Id: string
    refreshTokenValidity: string
    signingKey: string
    subMode: string
Copy

ProviderOauth2 Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The ProviderOauth2 resource accepts the following input properties:

AuthorizationFlow This property is required. string
ClientId This property is required. string
InvalidationFlow This property is required. string
AccessCodeValidity string
Defaults to minutes=1.
AccessTokenValidity string
Defaults to minutes=10.
AllowedRedirectUris List<ImmutableDictionary<string, string>>
AuthenticationFlow string
ClientSecret string
Generated.
ClientType string
Allowed values: - confidential - public Defaults to confidential.
EncryptionKey string
IncludeClaimsInIdToken bool
Defaults to true.
IssuerMode string
Allowed values: - global - per_provider Defaults to per_provider.
JwksSources List<string>
Deprecated. Use jwt_federation_sources instead.
JwtFederationProviders List<double>
JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
JwtFederationSources List<string>
JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
Name string
PropertyMappings List<string>
ProviderOauth2Id string
RefreshTokenValidity string
Defaults to days=30.
SigningKey string
SubMode string
Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.
AuthorizationFlow This property is required. string
ClientId This property is required. string
InvalidationFlow This property is required. string
AccessCodeValidity string
Defaults to minutes=1.
AccessTokenValidity string
Defaults to minutes=10.
AllowedRedirectUris []map[string]string
AuthenticationFlow string
ClientSecret string
Generated.
ClientType string
Allowed values: - confidential - public Defaults to confidential.
EncryptionKey string
IncludeClaimsInIdToken bool
Defaults to true.
IssuerMode string
Allowed values: - global - per_provider Defaults to per_provider.
JwksSources []string
Deprecated. Use jwt_federation_sources instead.
JwtFederationProviders []float64
JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
JwtFederationSources []string
JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
Name string
PropertyMappings []string
ProviderOauth2Id string
RefreshTokenValidity string
Defaults to days=30.
SigningKey string
SubMode string
Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.
authorizationFlow This property is required. String
clientId This property is required. String
invalidationFlow This property is required. String
accessCodeValidity String
Defaults to minutes=1.
accessTokenValidity String
Defaults to minutes=10.
allowedRedirectUris List<Map<String,String>>
authenticationFlow String
clientSecret String
Generated.
clientType String
Allowed values: - confidential - public Defaults to confidential.
encryptionKey String
includeClaimsInIdToken Boolean
Defaults to true.
issuerMode String
Allowed values: - global - per_provider Defaults to per_provider.
jwksSources List<String>
Deprecated. Use jwt_federation_sources instead.
jwtFederationProviders List<Double>
JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwtFederationSources List<String>
JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name String
propertyMappings List<String>
providerOauth2Id String
refreshTokenValidity String
Defaults to days=30.
signingKey String
subMode String
Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.
authorizationFlow This property is required. string
clientId This property is required. string
invalidationFlow This property is required. string
accessCodeValidity string
Defaults to minutes=1.
accessTokenValidity string
Defaults to minutes=10.
allowedRedirectUris {[key: string]: string}[]
authenticationFlow string
clientSecret string
Generated.
clientType string
Allowed values: - confidential - public Defaults to confidential.
encryptionKey string
includeClaimsInIdToken boolean
Defaults to true.
issuerMode string
Allowed values: - global - per_provider Defaults to per_provider.
jwksSources string[]
Deprecated. Use jwt_federation_sources instead.
jwtFederationProviders number[]
JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwtFederationSources string[]
JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name string
propertyMappings string[]
providerOauth2Id string
refreshTokenValidity string
Defaults to days=30.
signingKey string
subMode string
Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.
authorization_flow This property is required. str
client_id This property is required. str
invalidation_flow This property is required. str
access_code_validity str
Defaults to minutes=1.
access_token_validity str
Defaults to minutes=10.
allowed_redirect_uris Sequence[Mapping[str, str]]
authentication_flow str
client_secret str
Generated.
client_type str
Allowed values: - confidential - public Defaults to confidential.
encryption_key str
include_claims_in_id_token bool
Defaults to true.
issuer_mode str
Allowed values: - global - per_provider Defaults to per_provider.
jwks_sources Sequence[str]
Deprecated. Use jwt_federation_sources instead.
jwt_federation_providers Sequence[float]
JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwt_federation_sources Sequence[str]
JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name str
property_mappings Sequence[str]
provider_oauth2_id str
refresh_token_validity str
Defaults to days=30.
signing_key str
sub_mode str
Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.
authorizationFlow This property is required. String
clientId This property is required. String
invalidationFlow This property is required. String
accessCodeValidity String
Defaults to minutes=1.
accessTokenValidity String
Defaults to minutes=10.
allowedRedirectUris List<Map<String>>
authenticationFlow String
clientSecret String
Generated.
clientType String
Allowed values: - confidential - public Defaults to confidential.
encryptionKey String
includeClaimsInIdToken Boolean
Defaults to true.
issuerMode String
Allowed values: - global - per_provider Defaults to per_provider.
jwksSources List<String>
Deprecated. Use jwt_federation_sources instead.
jwtFederationProviders List<Number>
JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwtFederationSources List<String>
JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name String
propertyMappings List<String>
providerOauth2Id String
refreshTokenValidity String
Defaults to days=30.
signingKey String
subMode String
Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.

Outputs

All input properties are implicitly available as output properties. Additionally, the ProviderOauth2 resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Id string
The provider-assigned unique ID for this managed resource.
id String
The provider-assigned unique ID for this managed resource.
id string
The provider-assigned unique ID for this managed resource.
id str
The provider-assigned unique ID for this managed resource.
id String
The provider-assigned unique ID for this managed resource.

Look up Existing ProviderOauth2 Resource

Get an existing ProviderOauth2 resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: ProviderOauth2State, opts?: CustomResourceOptions): ProviderOauth2
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        access_code_validity: Optional[str] = None,
        access_token_validity: Optional[str] = None,
        allowed_redirect_uris: Optional[Sequence[Mapping[str, str]]] = None,
        authentication_flow: Optional[str] = None,
        authorization_flow: Optional[str] = None,
        client_id: Optional[str] = None,
        client_secret: Optional[str] = None,
        client_type: Optional[str] = None,
        encryption_key: Optional[str] = None,
        include_claims_in_id_token: Optional[bool] = None,
        invalidation_flow: Optional[str] = None,
        issuer_mode: Optional[str] = None,
        jwks_sources: Optional[Sequence[str]] = None,
        jwt_federation_providers: Optional[Sequence[float]] = None,
        jwt_federation_sources: Optional[Sequence[str]] = None,
        name: Optional[str] = None,
        property_mappings: Optional[Sequence[str]] = None,
        provider_oauth2_id: Optional[str] = None,
        refresh_token_validity: Optional[str] = None,
        signing_key: Optional[str] = None,
        sub_mode: Optional[str] = None) -> ProviderOauth2
func GetProviderOauth2(ctx *Context, name string, id IDInput, state *ProviderOauth2State, opts ...ResourceOption) (*ProviderOauth2, error)
public static ProviderOauth2 Get(string name, Input<string> id, ProviderOauth2State? state, CustomResourceOptions? opts = null)
public static ProviderOauth2 get(String name, Output<String> id, ProviderOauth2State state, CustomResourceOptions options)
resources:  _:    type: authentik:ProviderOauth2    get:      id: ${id}
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
AccessCodeValidity string
Defaults to minutes=1.
AccessTokenValidity string
Defaults to minutes=10.
AllowedRedirectUris List<ImmutableDictionary<string, string>>
AuthenticationFlow string
AuthorizationFlow string
ClientId string
ClientSecret string
Generated.
ClientType string
Allowed values: - confidential - public Defaults to confidential.
EncryptionKey string
IncludeClaimsInIdToken bool
Defaults to true.
InvalidationFlow string
IssuerMode string
Allowed values: - global - per_provider Defaults to per_provider.
JwksSources List<string>
Deprecated. Use jwt_federation_sources instead.
JwtFederationProviders List<double>
JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
JwtFederationSources List<string>
JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
Name string
PropertyMappings List<string>
ProviderOauth2Id string
RefreshTokenValidity string
Defaults to days=30.
SigningKey string
SubMode string
Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.
AccessCodeValidity string
Defaults to minutes=1.
AccessTokenValidity string
Defaults to minutes=10.
AllowedRedirectUris []map[string]string
AuthenticationFlow string
AuthorizationFlow string
ClientId string
ClientSecret string
Generated.
ClientType string
Allowed values: - confidential - public Defaults to confidential.
EncryptionKey string
IncludeClaimsInIdToken bool
Defaults to true.
InvalidationFlow string
IssuerMode string
Allowed values: - global - per_provider Defaults to per_provider.
JwksSources []string
Deprecated. Use jwt_federation_sources instead.
JwtFederationProviders []float64
JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
JwtFederationSources []string
JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
Name string
PropertyMappings []string
ProviderOauth2Id string
RefreshTokenValidity string
Defaults to days=30.
SigningKey string
SubMode string
Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.
accessCodeValidity String
Defaults to minutes=1.
accessTokenValidity String
Defaults to minutes=10.
allowedRedirectUris List<Map<String,String>>
authenticationFlow String
authorizationFlow String
clientId String
clientSecret String
Generated.
clientType String
Allowed values: - confidential - public Defaults to confidential.
encryptionKey String
includeClaimsInIdToken Boolean
Defaults to true.
invalidationFlow String
issuerMode String
Allowed values: - global - per_provider Defaults to per_provider.
jwksSources List<String>
Deprecated. Use jwt_federation_sources instead.
jwtFederationProviders List<Double>
JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwtFederationSources List<String>
JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name String
propertyMappings List<String>
providerOauth2Id String
refreshTokenValidity String
Defaults to days=30.
signingKey String
subMode String
Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.
accessCodeValidity string
Defaults to minutes=1.
accessTokenValidity string
Defaults to minutes=10.
allowedRedirectUris {[key: string]: string}[]
authenticationFlow string
authorizationFlow string
clientId string
clientSecret string
Generated.
clientType string
Allowed values: - confidential - public Defaults to confidential.
encryptionKey string
includeClaimsInIdToken boolean
Defaults to true.
invalidationFlow string
issuerMode string
Allowed values: - global - per_provider Defaults to per_provider.
jwksSources string[]
Deprecated. Use jwt_federation_sources instead.
jwtFederationProviders number[]
JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwtFederationSources string[]
JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name string
propertyMappings string[]
providerOauth2Id string
refreshTokenValidity string
Defaults to days=30.
signingKey string
subMode string
Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.
access_code_validity str
Defaults to minutes=1.
access_token_validity str
Defaults to minutes=10.
allowed_redirect_uris Sequence[Mapping[str, str]]
authentication_flow str
authorization_flow str
client_id str
client_secret str
Generated.
client_type str
Allowed values: - confidential - public Defaults to confidential.
encryption_key str
include_claims_in_id_token bool
Defaults to true.
invalidation_flow str
issuer_mode str
Allowed values: - global - per_provider Defaults to per_provider.
jwks_sources Sequence[str]
Deprecated. Use jwt_federation_sources instead.
jwt_federation_providers Sequence[float]
JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwt_federation_sources Sequence[str]
JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name str
property_mappings Sequence[str]
provider_oauth2_id str
refresh_token_validity str
Defaults to days=30.
signing_key str
sub_mode str
Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.
accessCodeValidity String
Defaults to minutes=1.
accessTokenValidity String
Defaults to minutes=10.
allowedRedirectUris List<Map<String>>
authenticationFlow String
authorizationFlow String
clientId String
clientSecret String
Generated.
clientType String
Allowed values: - confidential - public Defaults to confidential.
encryptionKey String
includeClaimsInIdToken Boolean
Defaults to true.
invalidationFlow String
issuerMode String
Allowed values: - global - per_provider Defaults to per_provider.
jwksSources List<String>
Deprecated. Use jwt_federation_sources instead.
jwtFederationProviders List<Number>
JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwtFederationSources List<String>
JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name String
propertyMappings List<String>
providerOauth2Id String
refreshTokenValidity String
Defaults to days=30.
signingKey String
subMode String
Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.

Package Details

Repository
authentik goauthentik/terraform-provider-authentik
License
Notes
This Pulumi package is based on the authentik Terraform Provider.
authentik 2025.2.0 published on Monday, Mar 24, 2025 by goauthentik
goauthentik/terraform-provider-authentik