Cloudflare v6.0.1, Apr 16 25

Cloudflare v6.0.1 published on Wednesday, Apr 16, 2025 by Pulumi

cloudflare.getZeroTrustAccessIdentityProvider

Explore with Pulumi AI

Cloudflare v6.0.1 published on Wednesday, Apr 16, 2025 by Pulumi

Example Usage

TypeScript
Python
Go
C#
Java
YAML

import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const exampleZeroTrustAccessIdentityProvider = cloudflare.getZeroTrustAccessIdentityProvider({
    identityProviderId: "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    accountId: "account_id",
    zoneId: "zone_id",
});

import pulumi
import pulumi_cloudflare as cloudflare

example_zero_trust_access_identity_provider = cloudflare.get_zero_trust_access_identity_provider(identity_provider_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    account_id="account_id",
    zone_id="zone_id")

package main

import (
	"github.com/pulumi/pulumi-cloudflare/sdk/v6/go/cloudflare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudflare.LookupZeroTrustAccessIdentityProvider(ctx, &cloudflare.LookupZeroTrustAccessIdentityProviderArgs{
			IdentityProviderId: pulumi.StringRef("f174e90a-fafe-4643-bbbc-4a0ed4fc8415"),
			AccountId:          pulumi.StringRef("account_id"),
			ZoneId:             pulumi.StringRef("zone_id"),
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

return await Deployment.RunAsync(() => 
{
    var exampleZeroTrustAccessIdentityProvider = Cloudflare.GetZeroTrustAccessIdentityProvider.Invoke(new()
    {
        IdentityProviderId = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
        AccountId = "account_id",
        ZoneId = "zone_id",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudflare.CloudflareFunctions;
import com.pulumi.cloudflare.inputs.GetZeroTrustAccessIdentityProviderArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var exampleZeroTrustAccessIdentityProvider = CloudflareFunctions.getZeroTrustAccessIdentityProvider(GetZeroTrustAccessIdentityProviderArgs.builder()
            .identityProviderId("f174e90a-fafe-4643-bbbc-4a0ed4fc8415")
            .accountId("account_id")
            .zoneId("zone_id")
            .build());

    }
}

variables:
  exampleZeroTrustAccessIdentityProvider:
    fn::invoke:
      function: cloudflare:getZeroTrustAccessIdentityProvider
      arguments:
        identityProviderId: f174e90a-fafe-4643-bbbc-4a0ed4fc8415
        accountId: account_id
        zoneId: zone_id

Using getZeroTrustAccessIdentityProvider

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

TypeScript
Python
Go
C#
Java
YAML

function getZeroTrustAccessIdentityProvider(args: GetZeroTrustAccessIdentityProviderArgs, opts?: InvokeOptions): Promise<GetZeroTrustAccessIdentityProviderResult>
function getZeroTrustAccessIdentityProviderOutput(args: GetZeroTrustAccessIdentityProviderOutputArgs, opts?: InvokeOptions): Output<GetZeroTrustAccessIdentityProviderResult>

def get_zero_trust_access_identity_provider(account_id: Optional[str] = None,
                                            filter: Optional[GetZeroTrustAccessIdentityProviderFilter] = None,
                                            identity_provider_id: Optional[str] = None,
                                            zone_id: Optional[str] = None,
                                            opts: Optional[InvokeOptions] = None) -> GetZeroTrustAccessIdentityProviderResult
def get_zero_trust_access_identity_provider_output(account_id: Optional[pulumi.Input[str]] = None,
                                            filter: Optional[pulumi.Input[GetZeroTrustAccessIdentityProviderFilterArgs]] = None,
                                            identity_provider_id: Optional[pulumi.Input[str]] = None,
                                            zone_id: Optional[pulumi.Input[str]] = None,
                                            opts: Optional[InvokeOptions] = None) -> Output[GetZeroTrustAccessIdentityProviderResult]

func LookupZeroTrustAccessIdentityProvider(ctx *Context, args *LookupZeroTrustAccessIdentityProviderArgs, opts ...InvokeOption) (*LookupZeroTrustAccessIdentityProviderResult, error)
func LookupZeroTrustAccessIdentityProviderOutput(ctx *Context, args *LookupZeroTrustAccessIdentityProviderOutputArgs, opts ...InvokeOption) LookupZeroTrustAccessIdentityProviderResultOutput

> Note: This function is named LookupZeroTrustAccessIdentityProvider in the Go SDK.

public static class GetZeroTrustAccessIdentityProvider 
{
    public static Task<GetZeroTrustAccessIdentityProviderResult> InvokeAsync(GetZeroTrustAccessIdentityProviderArgs args, InvokeOptions? opts = null)
    public static Output<GetZeroTrustAccessIdentityProviderResult> Invoke(GetZeroTrustAccessIdentityProviderInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetZeroTrustAccessIdentityProviderResult> getZeroTrustAccessIdentityProvider(GetZeroTrustAccessIdentityProviderArgs args, InvokeOptions options)
public static Output<GetZeroTrustAccessIdentityProviderResult> getZeroTrustAccessIdentityProvider(GetZeroTrustAccessIdentityProviderArgs args, InvokeOptions options)

fn::invoke:
  function: cloudflare:index/getZeroTrustAccessIdentityProvider:getZeroTrustAccessIdentityProvider
  arguments:
    # arguments dictionary

The following arguments are supported:

AccountId string: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
Filter GetZeroTrustAccessIdentityProviderFilter
IdentityProviderId string: UUID
ZoneId string: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

AccountId string: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
Filter GetZeroTrustAccessIdentityProviderFilter
IdentityProviderId string: UUID
ZoneId string: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

accountId String: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
filter GetZeroTrustAccessIdentityProviderFilter
identityProviderId String: UUID
zoneId String: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

accountId string: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
filter GetZeroTrustAccessIdentityProviderFilter
identityProviderId string: UUID
zoneId string: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

account_id str: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
filter GetZeroTrustAccessIdentityProviderFilter
identity_provider_id str: UUID
zone_id str: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

accountId String: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
filter Property Map
identityProviderId String: UUID
zoneId String: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

getZeroTrustAccessIdentityProvider Result

The following output properties are available:

Config GetZeroTrustAccessIdentityProviderConfig: The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Id string: UUID
Name string: The name of the identity provider, shown to users on the login page.
ScimConfig GetZeroTrustAccessIdentityProviderScimConfig: The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Type string: The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".
AccountId string: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
Filter GetZeroTrustAccessIdentityProviderFilter
IdentityProviderId string: UUID
ZoneId string: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

Config GetZeroTrustAccessIdentityProviderConfig: The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Id string: UUID
Name string: The name of the identity provider, shown to users on the login page.
ScimConfig GetZeroTrustAccessIdentityProviderScimConfig: The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Type string: The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".
AccountId string: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
Filter GetZeroTrustAccessIdentityProviderFilter
IdentityProviderId string: UUID
ZoneId string: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

config GetZeroTrustAccessIdentityProviderConfig: The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
id String: UUID
name String: The name of the identity provider, shown to users on the login page.
scimConfig GetZeroTrustAccessIdentityProviderScimConfig: The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
type String: The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".
accountId String: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
filter GetZeroTrustAccessIdentityProviderFilter
identityProviderId String: UUID
zoneId String: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

config GetZeroTrustAccessIdentityProviderConfig: The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
id string: UUID
name string: The name of the identity provider, shown to users on the login page.
scimConfig GetZeroTrustAccessIdentityProviderScimConfig: The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
type string: The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".
accountId string: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
filter GetZeroTrustAccessIdentityProviderFilter
identityProviderId string: UUID
zoneId string: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

config GetZeroTrustAccessIdentityProviderConfig: The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
id str: UUID
name str: The name of the identity provider, shown to users on the login page.
scim_config GetZeroTrustAccessIdentityProviderScimConfig: The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
type str: The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".
account_id str: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
filter GetZeroTrustAccessIdentityProviderFilter
identity_provider_id str: UUID
zone_id str: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

config Property Map: The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
id String: UUID
name String: The name of the identity provider, shown to users on the login page.
scimConfig Property Map: The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
type String: The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".
accountId String: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
filter Property Map
identityProviderId String: UUID
zoneId String: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

Supporting Types

GetZeroTrustAccessIdentityProviderConfig

AppsDomain string: Your companies TLD
Attributes List<string>: A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
AuthUrl string: The authorization_endpoint URL of your IdP
AuthorizationServerId string: Your okta authorization server id
CentrifyAccount string: Your centrify account url
CentrifyAppId string: Your centrify app id
CertsUrl string: The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
Claims List<string>: Custom claims
ClientId string: Your OAuth Client ID
ClientSecret string: Your OAuth Client Secret
ConditionalAccessEnabled bool: Should Cloudflare try to load authentication contexts from your account
DirectoryId string: Your Azure directory uuid
EmailAttributeName string: The attribute name for email in the SAML response.
EmailClaimName string: The claim name for email in the id_token response.
HeaderAttributes List<GetZeroTrustAccessIdentityProviderConfigHeaderAttribute>: Add a list of attribute names that will be returned in the response header from the Access callback.
IdpPublicCerts List<string>: X509 certificate to verify the signature in the SAML authentication response
IssuerUrl string: IdP Entity ID or Issuer URL
OktaAccount string: Your okta account url
OneloginAccount string: Your OneLogin account url
PingEnvId string: Your PingOne environment identifier
PkceEnabled bool: Enable Proof Key for Code Exchange (PKCE)
Prompt string: Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".
RedirectUrl string
Scopes List<string>: OAuth scopes
SignRequest bool: Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
SsoTargetUrl string: URL to send the SAML authentication requests to
SupportGroups bool: Should Cloudflare try to load groups from your account
TokenUrl string: The token_endpoint URL of your IdP

AppsDomain string: Your companies TLD
Attributes []string: A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
AuthUrl string: The authorization_endpoint URL of your IdP
AuthorizationServerId string: Your okta authorization server id
CentrifyAccount string: Your centrify account url
CentrifyAppId string: Your centrify app id
CertsUrl string: The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
Claims []string: Custom claims
ClientId string: Your OAuth Client ID
ClientSecret string: Your OAuth Client Secret
ConditionalAccessEnabled bool: Should Cloudflare try to load authentication contexts from your account
DirectoryId string: Your Azure directory uuid
EmailAttributeName string: The attribute name for email in the SAML response.
EmailClaimName string: The claim name for email in the id_token response.
HeaderAttributes []GetZeroTrustAccessIdentityProviderConfigHeaderAttribute: Add a list of attribute names that will be returned in the response header from the Access callback.
IdpPublicCerts []string: X509 certificate to verify the signature in the SAML authentication response
IssuerUrl string: IdP Entity ID or Issuer URL
OktaAccount string: Your okta account url
OneloginAccount string: Your OneLogin account url
PingEnvId string: Your PingOne environment identifier
PkceEnabled bool: Enable Proof Key for Code Exchange (PKCE)
Prompt string: Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".
RedirectUrl string
Scopes []string: OAuth scopes
SignRequest bool: Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
SsoTargetUrl string: URL to send the SAML authentication requests to
SupportGroups bool: Should Cloudflare try to load groups from your account
TokenUrl string: The token_endpoint URL of your IdP

appsDomain String: Your companies TLD
attributes List<String>: A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
authUrl String: The authorization_endpoint URL of your IdP
authorizationServerId String: Your okta authorization server id
centrifyAccount String: Your centrify account url
centrifyAppId String: Your centrify app id
certsUrl String: The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
claims List<String>: Custom claims
clientId String: Your OAuth Client ID
clientSecret String: Your OAuth Client Secret
conditionalAccessEnabled Boolean: Should Cloudflare try to load authentication contexts from your account
directoryId String: Your Azure directory uuid
emailAttributeName String: The attribute name for email in the SAML response.
emailClaimName String: The claim name for email in the id_token response.
headerAttributes List<GetZeroTrustAccessIdentityProviderConfigHeaderAttribute>: Add a list of attribute names that will be returned in the response header from the Access callback.
idpPublicCerts List<String>: X509 certificate to verify the signature in the SAML authentication response
issuerUrl String: IdP Entity ID or Issuer URL
oktaAccount String: Your okta account url
oneloginAccount String: Your OneLogin account url
pingEnvId String: Your PingOne environment identifier
pkceEnabled Boolean: Enable Proof Key for Code Exchange (PKCE)
prompt String: Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".
redirectUrl String
scopes List<String>: OAuth scopes
signRequest Boolean: Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
ssoTargetUrl String: URL to send the SAML authentication requests to
supportGroups Boolean: Should Cloudflare try to load groups from your account
tokenUrl String: The token_endpoint URL of your IdP

appsDomain string: Your companies TLD
attributes string[]: A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
authUrl string: The authorization_endpoint URL of your IdP
authorizationServerId string: Your okta authorization server id
centrifyAccount string: Your centrify account url
centrifyAppId string: Your centrify app id
certsUrl string: The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
claims string[]: Custom claims
clientId string: Your OAuth Client ID
clientSecret string: Your OAuth Client Secret
conditionalAccessEnabled boolean: Should Cloudflare try to load authentication contexts from your account
directoryId string: Your Azure directory uuid
emailAttributeName string: The attribute name for email in the SAML response.
emailClaimName string: The claim name for email in the id_token response.
headerAttributes GetZeroTrustAccessIdentityProviderConfigHeaderAttribute[]: Add a list of attribute names that will be returned in the response header from the Access callback.
idpPublicCerts string[]: X509 certificate to verify the signature in the SAML authentication response
issuerUrl string: IdP Entity ID or Issuer URL
oktaAccount string: Your okta account url
oneloginAccount string: Your OneLogin account url
pingEnvId string: Your PingOne environment identifier
pkceEnabled boolean: Enable Proof Key for Code Exchange (PKCE)
prompt string: Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".
redirectUrl string
scopes string[]: OAuth scopes
signRequest boolean: Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
ssoTargetUrl string: URL to send the SAML authentication requests to
supportGroups boolean: Should Cloudflare try to load groups from your account
tokenUrl string: The token_endpoint URL of your IdP

apps_domain str: Your companies TLD
attributes Sequence[str]: A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
auth_url str: The authorization_endpoint URL of your IdP
authorization_server_id str: Your okta authorization server id
centrify_account str: Your centrify account url
centrify_app_id str: Your centrify app id
certs_url str: The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
claims Sequence[str]: Custom claims
client_id str: Your OAuth Client ID
client_secret str: Your OAuth Client Secret
conditional_access_enabled bool: Should Cloudflare try to load authentication contexts from your account
directory_id str: Your Azure directory uuid
email_attribute_name str: The attribute name for email in the SAML response.
email_claim_name str: The claim name for email in the id_token response.
header_attributes Sequence[GetZeroTrustAccessIdentityProviderConfigHeaderAttribute]: Add a list of attribute names that will be returned in the response header from the Access callback.
idp_public_certs Sequence[str]: X509 certificate to verify the signature in the SAML authentication response
issuer_url str: IdP Entity ID or Issuer URL
okta_account str: Your okta account url
onelogin_account str: Your OneLogin account url
ping_env_id str: Your PingOne environment identifier
pkce_enabled bool: Enable Proof Key for Code Exchange (PKCE)
prompt str: Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".
redirect_url str
scopes Sequence[str]: OAuth scopes
sign_request bool: Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
sso_target_url str: URL to send the SAML authentication requests to
support_groups bool: Should Cloudflare try to load groups from your account
token_url str: The token_endpoint URL of your IdP

appsDomain String: Your companies TLD
attributes List<String>: A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
authUrl String: The authorization_endpoint URL of your IdP
authorizationServerId String: Your okta authorization server id
centrifyAccount String: Your centrify account url
centrifyAppId String: Your centrify app id
certsUrl String: The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
claims List<String>: Custom claims
clientId String: Your OAuth Client ID
clientSecret String: Your OAuth Client Secret
conditionalAccessEnabled Boolean: Should Cloudflare try to load authentication contexts from your account
directoryId String: Your Azure directory uuid
emailAttributeName String: The attribute name for email in the SAML response.
emailClaimName String: The claim name for email in the id_token response.
headerAttributes List<Property Map>: Add a list of attribute names that will be returned in the response header from the Access callback.
idpPublicCerts List<String>: X509 certificate to verify the signature in the SAML authentication response
issuerUrl String: IdP Entity ID or Issuer URL
oktaAccount String: Your okta account url
oneloginAccount String: Your OneLogin account url
pingEnvId String: Your PingOne environment identifier
pkceEnabled Boolean: Enable Proof Key for Code Exchange (PKCE)
prompt String: Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".
redirectUrl String
scopes List<String>: OAuth scopes
signRequest Boolean: Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
ssoTargetUrl String: URL to send the SAML authentication requests to
supportGroups Boolean: Should Cloudflare try to load groups from your account
tokenUrl String: The token_endpoint URL of your IdP

GetZeroTrustAccessIdentityProviderConfigHeaderAttribute

AttributeName string: attribute name from the IDP
HeaderName string: header that will be added on the request to the origin

AttributeName string: attribute name from the IDP
HeaderName string: header that will be added on the request to the origin

attributeName String: attribute name from the IDP
headerName String: header that will be added on the request to the origin

attributeName string: attribute name from the IDP
headerName string: header that will be added on the request to the origin

attribute_name str: attribute name from the IDP
header_name str: header that will be added on the request to the origin

attributeName String: attribute name from the IDP
headerName String: header that will be added on the request to the origin

GetZeroTrustAccessIdentityProviderFilter

ScimEnabled string: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.

ScimEnabled string: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.

scimEnabled String: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.

scimEnabled string: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.

scim_enabled str: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.

scimEnabled String: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.

GetZeroTrustAccessIdentityProviderScimConfig

Enabled bool: A flag to enable or disable SCIM for the identity provider.
IdentityUpdateBehavior string: Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
ScimBaseUrl string: The base URL of Cloudflare's SCIM V2.0 API endpoint.
SeatDeprovision bool: A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
Secret string: A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
UserDeprovision bool: A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

Enabled bool: A flag to enable or disable SCIM for the identity provider.
IdentityUpdateBehavior string: Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
ScimBaseUrl string: The base URL of Cloudflare's SCIM V2.0 API endpoint.
SeatDeprovision bool: A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
Secret string: A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
UserDeprovision bool: A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled Boolean: A flag to enable or disable SCIM for the identity provider.
identityUpdateBehavior String: Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
scimBaseUrl String: The base URL of Cloudflare's SCIM V2.0 API endpoint.
seatDeprovision Boolean: A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
secret String: A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
userDeprovision Boolean: A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled boolean: A flag to enable or disable SCIM for the identity provider.
identityUpdateBehavior string: Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
scimBaseUrl string: The base URL of Cloudflare's SCIM V2.0 API endpoint.
seatDeprovision boolean: A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
secret string: A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
userDeprovision boolean: A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled bool: A flag to enable or disable SCIM for the identity provider.
identity_update_behavior str: Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
scim_base_url str: The base URL of Cloudflare's SCIM V2.0 API endpoint.
seat_deprovision bool: A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
secret str: A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
user_deprovision bool: A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled Boolean: A flag to enable or disable SCIM for the identity provider.
identityUpdateBehavior String: Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
scimBaseUrl String: The base URL of Cloudflare's SCIM V2.0 API endpoint.
seatDeprovision Boolean: A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
secret String: A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
userDeprovision Boolean: A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

Package Details

Repository: Cloudflare pulumi/pulumi-cloudflare
License: Apache-2.0
Notes: This Pulumi package is based on the cloudflare Terraform Provider.

Cloudflare v6.0.1 published on Wednesday, Apr 16, 2025 by Pulumi

pulumi/pulumi-cloudflare

cloudflare.getZeroTrustAccessIdentityProvider

On this page

On this page

Example Usage

Using getZeroTrustAccessIdentityProvider

getZeroTrustAccessIdentityProvider Result

Supporting Types

GetZeroTrustAccessIdentityProviderConfig

GetZeroTrustAccessIdentityProviderConfigHeaderAttribute

GetZeroTrustAccessIdentityProviderFilter

GetZeroTrustAccessIdentityProviderScimConfig

Package Details

On this page

On this page