cloudflare.ZeroTrustAccessIdentityProvider

Coming soon!

Coming soon!

Coming soon!

Coming soon!

resource_name This property is required. str

The unique name of the resource.

args This property is required. ZeroTrustAccessIdentityProviderArgs

The arguments to resource properties.

opts ResourceOptions

Bag of options to control resource's behavior.

ctx Context

Context object for the current deployment.

name This property is required. string

The unique name of the resource.

args This property is required. ZeroTrustAccessIdentityProviderArgs

The arguments to resource properties.

opts ResourceOption

Bag of options to control resource's behavior.

name This property is required. string

The unique name of the resource.

args This property is required. ZeroTrustAccessIdentityProviderArgs

The arguments to resource properties.

opts CustomResourceOptions

Bag of options to control resource's behavior.

name This property is required. String

The unique name of the resource.

args This property is required. ZeroTrustAccessIdentityProviderArgs

The arguments to resource properties.

options CustomResourceOptions

Bag of options to control resource's behavior.

Config This property is required. ZeroTrustAccessIdentityProviderConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

Name This property is required. string

The name of the identity provider, shown to users on the login page.

Type This property is required. string

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".

AccountId string

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

ScimConfig ZeroTrustAccessIdentityProviderScimConfig

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

ZoneId string

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

Config This property is required. ZeroTrustAccessIdentityProviderConfigArgs

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

Name This property is required. string

The name of the identity provider, shown to users on the login page.

Type This property is required. string

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".

AccountId string

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

ScimConfig ZeroTrustAccessIdentityProviderScimConfigArgs

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

ZoneId string

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

config This property is required. ZeroTrustAccessIdentityProviderConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

name This property is required. String

The name of the identity provider, shown to users on the login page.

type This property is required. String

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".

accountId String

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

scimConfig ZeroTrustAccessIdentityProviderScimConfig

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

zoneId String

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

config This property is required. ZeroTrustAccessIdentityProviderConfigArgs

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

name This property is required. str

The name of the identity provider, shown to users on the login page.

type This property is required. str

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".

account_id str

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

scim_config ZeroTrustAccessIdentityProviderScimConfigArgs

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

zone_id str

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

config This property is required. Property Map

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

name This property is required. String

The name of the identity provider, shown to users on the login page.

type This property is required. String

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".

accountId String

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

scimConfig Property Map

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

zoneId String

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

Id string

The provider-assigned unique ID for this managed resource.

Id string

The provider-assigned unique ID for this managed resource.

id String

The provider-assigned unique ID for this managed resource.

id str

The provider-assigned unique ID for this managed resource.

id String

The provider-assigned unique ID for this managed resource.

resource_name This property is required.

The unique name of the resulting resource.

id This property is required.

The unique provider ID of the resource to lookup.

name This property is required.

The unique name of the resulting resource.

id This property is required.

The unique provider ID of the resource to lookup.

state

Any extra arguments used during the lookup.

opts

A bag of options that control this resource's behavior.

name This property is required.

The unique name of the resulting resource.

id This property is required.

The unique provider ID of the resource to lookup.

state

Any extra arguments used during the lookup.

opts

A bag of options that control this resource's behavior.

name This property is required.

The unique name of the resulting resource.

id This property is required.

The unique provider ID of the resource to lookup.

state

Any extra arguments used during the lookup.

opts

A bag of options that control this resource's behavior.

AppsDomain string

Your companies TLD

Attributes List<string>

A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.

AuthUrl string

The authorization_endpoint URL of your IdP

AuthorizationServerId string

Your okta authorization server id

CentrifyAccount string

Your centrify account url

CentrifyAppId string

Your centrify app id

CertsUrl string

The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens

Claims List<string>

Custom claims

ClientId string

Your OAuth Client ID

ClientSecret string

Your OAuth Client Secret

ConditionalAccessEnabled bool

Should Cloudflare try to load authentication contexts from your account

DirectoryId string

Your Azure directory uuid

EmailAttributeName string

The attribute name for email in the SAML response.

EmailClaimName string

The claim name for email in the id_token response.

HeaderAttributes List<ZeroTrustAccessIdentityProviderConfigHeaderAttribute>

Add a list of attribute names that will be returned in the response header from the Access callback.

IdpPublicCerts List<string>

X509 certificate to verify the signature in the SAML authentication response

IssuerUrl string

IdP Entity ID or Issuer URL

OktaAccount string

Your okta account url

OneloginAccount string

Your OneLogin account url

PingEnvId string

Your PingOne environment identifier

PkceEnabled bool

Enable Proof Key for Code Exchange (PKCE)

Prompt string

Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".

RedirectUrl string

Scopes List<string>

OAuth scopes

SignRequest bool

Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.

SsoTargetUrl string

URL to send the SAML authentication requests to

SupportGroups bool

Should Cloudflare try to load groups from your account

TokenUrl string

The token_endpoint URL of your IdP

AppsDomain string

Your companies TLD

Attributes []string

A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.

AuthUrl string

The authorization_endpoint URL of your IdP

AuthorizationServerId string

Your okta authorization server id

CentrifyAccount string

Your centrify account url

CentrifyAppId string

Your centrify app id

CertsUrl string

The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens

Claims []string

Custom claims

ClientId string

Your OAuth Client ID

ClientSecret string

Your OAuth Client Secret

ConditionalAccessEnabled bool

Should Cloudflare try to load authentication contexts from your account

DirectoryId string

Your Azure directory uuid

EmailAttributeName string

The attribute name for email in the SAML response.

EmailClaimName string

The claim name for email in the id_token response.

HeaderAttributes []ZeroTrustAccessIdentityProviderConfigHeaderAttribute

Add a list of attribute names that will be returned in the response header from the Access callback.

IdpPublicCerts []string

X509 certificate to verify the signature in the SAML authentication response

IssuerUrl string

IdP Entity ID or Issuer URL

OktaAccount string

Your okta account url

OneloginAccount string

Your OneLogin account url

PingEnvId string

Your PingOne environment identifier

PkceEnabled bool

Enable Proof Key for Code Exchange (PKCE)

Prompt string

Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".

RedirectUrl string

Scopes []string

OAuth scopes

SignRequest bool

Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.

SsoTargetUrl string

URL to send the SAML authentication requests to

SupportGroups bool

Should Cloudflare try to load groups from your account

TokenUrl string

The token_endpoint URL of your IdP

appsDomain String

Your companies TLD

attributes List<String>

A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.

authUrl String

The authorization_endpoint URL of your IdP

authorizationServerId String

Your okta authorization server id

centrifyAccount String

Your centrify account url

centrifyAppId String

Your centrify app id

certsUrl String

The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens

claims List<String>

Custom claims

clientId String

Your OAuth Client ID

clientSecret String

Your OAuth Client Secret

conditionalAccessEnabled Boolean

Should Cloudflare try to load authentication contexts from your account

directoryId String

Your Azure directory uuid

emailAttributeName String

The attribute name for email in the SAML response.

emailClaimName String

The claim name for email in the id_token response.

headerAttributes List<ZeroTrustAccessIdentityProviderConfigHeaderAttribute>

Add a list of attribute names that will be returned in the response header from the Access callback.

idpPublicCerts List<String>

X509 certificate to verify the signature in the SAML authentication response

issuerUrl String

IdP Entity ID or Issuer URL

oktaAccount String

Your okta account url

oneloginAccount String

Your OneLogin account url

pingEnvId String

Your PingOne environment identifier

pkceEnabled Boolean

Enable Proof Key for Code Exchange (PKCE)

prompt String

Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".

redirectUrl String

scopes List<String>

OAuth scopes

signRequest Boolean

Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.

ssoTargetUrl String

URL to send the SAML authentication requests to

supportGroups Boolean

Should Cloudflare try to load groups from your account

tokenUrl String

The token_endpoint URL of your IdP

apps_domain str

Your companies TLD

attributes Sequence[str]

A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.

auth_url str

The authorization_endpoint URL of your IdP

authorization_server_id str

Your okta authorization server id

centrify_account str

Your centrify account url

centrify_app_id str

Your centrify app id

certs_url str

The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens

claims Sequence[str]

Custom claims

client_id str

Your OAuth Client ID

client_secret str

Your OAuth Client Secret

conditional_access_enabled bool

Should Cloudflare try to load authentication contexts from your account

directory_id str

Your Azure directory uuid

email_attribute_name str

The attribute name for email in the SAML response.

email_claim_name str

The claim name for email in the id_token response.

header_attributes Sequence[ZeroTrustAccessIdentityProviderConfigHeaderAttribute]

Add a list of attribute names that will be returned in the response header from the Access callback.

idp_public_certs Sequence[str]

X509 certificate to verify the signature in the SAML authentication response

issuer_url str

IdP Entity ID or Issuer URL

okta_account str

Your okta account url

onelogin_account str

Your OneLogin account url

ping_env_id str

Your PingOne environment identifier

pkce_enabled bool

Enable Proof Key for Code Exchange (PKCE)

prompt str

Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".

redirect_url str

scopes Sequence[str]

OAuth scopes

sign_request bool

Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.

sso_target_url str

URL to send the SAML authentication requests to

support_groups bool

Should Cloudflare try to load groups from your account

token_url str

The token_endpoint URL of your IdP

appsDomain String

Your companies TLD

attributes List<String>

A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.

authUrl String

The authorization_endpoint URL of your IdP

authorizationServerId String

Your okta authorization server id

centrifyAccount String

Your centrify account url

centrifyAppId String

Your centrify app id

certsUrl String

The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens

claims List<String>

Custom claims

clientId String

Your OAuth Client ID

clientSecret String

Your OAuth Client Secret

conditionalAccessEnabled Boolean

Should Cloudflare try to load authentication contexts from your account

directoryId String

Your Azure directory uuid

emailAttributeName String

The attribute name for email in the SAML response.

emailClaimName String

The claim name for email in the id_token response.

headerAttributes List<Property Map>

Add a list of attribute names that will be returned in the response header from the Access callback.

idpPublicCerts List<String>

X509 certificate to verify the signature in the SAML authentication response

issuerUrl String

IdP Entity ID or Issuer URL

oktaAccount String

Your okta account url

oneloginAccount String

Your OneLogin account url

pingEnvId String

Your PingOne environment identifier

pkceEnabled Boolean

Enable Proof Key for Code Exchange (PKCE)

prompt String

Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".

redirectUrl String

scopes List<String>

OAuth scopes

signRequest Boolean

Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.

ssoTargetUrl String

URL to send the SAML authentication requests to

supportGroups Boolean

Should Cloudflare try to load groups from your account

tokenUrl String

The token_endpoint URL of your IdP

AttributeName string

attribute name from the IDP

HeaderName string

header that will be added on the request to the origin

AttributeName string

attribute name from the IDP

HeaderName string

header that will be added on the request to the origin

attributeName String

attribute name from the IDP

headerName String

header that will be added on the request to the origin

attribute_name str

attribute name from the IDP

header_name str

header that will be added on the request to the origin

attributeName String

attribute name from the IDP

headerName String

header that will be added on the request to the origin

Enabled bool

A flag to enable or disable SCIM for the identity provider.

IdentityUpdateBehavior string

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".

ScimBaseUrl string

The base URL of Cloudflare's SCIM V2.0 API endpoint.

SeatDeprovision bool

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

Secret string

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.

UserDeprovision bool

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

Enabled bool

A flag to enable or disable SCIM for the identity provider.

IdentityUpdateBehavior string

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".

ScimBaseUrl string

The base URL of Cloudflare's SCIM V2.0 API endpoint.

SeatDeprovision bool

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

Secret string

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.

UserDeprovision bool

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled Boolean

A flag to enable or disable SCIM for the identity provider.

identityUpdateBehavior String

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".

scimBaseUrl String

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seatDeprovision Boolean

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret String

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.

userDeprovision Boolean

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled bool

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior str

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".

scim_base_url str

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision bool

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret str

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.

user_deprovision bool

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled Boolean

A flag to enable or disable SCIM for the identity provider.

identityUpdateBehavior String

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".

scimBaseUrl String

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seatDeprovision Boolean

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.

secret String

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.

userDeprovision Boolean

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.