okta.idp.Saml
Explore with Pulumi AI
Creates a SAML Identity Provider.
This resource allows you to create and configure a SAML Identity Provider.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as okta from "@pulumi/okta";
const example = new okta.idp.Saml("example", {
acsType: "INSTANCE",
issuer: "https://idp.example.com",
kid: okta_idp_saml_key.test.id,
requestSignatureScope: "REQUEST",
responseSignatureScope: "ANY",
ssoBinding: "HTTP-POST",
ssoDestination: "https://idp.example.com",
ssoUrl: "https://idp.example.com",
usernameTemplate: "idpuser.email",
});
import pulumi
import pulumi_okta as okta
example = okta.idp.Saml("example",
acs_type="INSTANCE",
issuer="https://idp.example.com",
kid=okta_idp_saml_key["test"]["id"],
request_signature_scope="REQUEST",
response_signature_scope="ANY",
sso_binding="HTTP-POST",
sso_destination="https://idp.example.com",
sso_url="https://idp.example.com",
username_template="idpuser.email")
package main
import (
"github.com/pulumi/pulumi-okta/sdk/v4/go/okta/idp"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := idp.NewSaml(ctx, "example", &idp.SamlArgs{
AcsType: pulumi.String("INSTANCE"),
Issuer: pulumi.String("https://idp.example.com"),
Kid: pulumi.Any(okta_idp_saml_key.Test.Id),
RequestSignatureScope: pulumi.String("REQUEST"),
ResponseSignatureScope: pulumi.String("ANY"),
SsoBinding: pulumi.String("HTTP-POST"),
SsoDestination: pulumi.String("https://idp.example.com"),
SsoUrl: pulumi.String("https://idp.example.com"),
UsernameTemplate: pulumi.String("idpuser.email"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Okta = Pulumi.Okta;
return await Deployment.RunAsync(() =>
{
var example = new Okta.Idp.Saml("example", new()
{
AcsType = "INSTANCE",
Issuer = "https://idp.example.com",
Kid = okta_idp_saml_key.Test.Id,
RequestSignatureScope = "REQUEST",
ResponseSignatureScope = "ANY",
SsoBinding = "HTTP-POST",
SsoDestination = "https://idp.example.com",
SsoUrl = "https://idp.example.com",
UsernameTemplate = "idpuser.email",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.okta.idp.Saml;
import com.pulumi.okta.idp.SamlArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new Saml("example", SamlArgs.builder()
.acsType("INSTANCE")
.issuer("https://idp.example.com")
.kid(okta_idp_saml_key.test().id())
.requestSignatureScope("REQUEST")
.responseSignatureScope("ANY")
.ssoBinding("HTTP-POST")
.ssoDestination("https://idp.example.com")
.ssoUrl("https://idp.example.com")
.usernameTemplate("idpuser.email")
.build());
}
}
resources:
example:
type: okta:idp:Saml
properties:
acsType: INSTANCE
issuer: https://idp.example.com
kid: ${okta_idp_saml_key.test.id}
requestSignatureScope: REQUEST
responseSignatureScope: ANY
ssoBinding: HTTP-POST
ssoDestination: https://idp.example.com
ssoUrl: https://idp.example.com
usernameTemplate: idpuser.email
Create Saml Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new Saml(name: string, args: SamlArgs, opts?: CustomResourceOptions);
@overload
def Saml(resource_name: str,
args: SamlArgs,
opts: Optional[ResourceOptions] = None)
@overload
def Saml(resource_name: str,
opts: Optional[ResourceOptions] = None,
issuer: Optional[str] = None,
sso_url: Optional[str] = None,
kid: Optional[str] = None,
profile_master: Optional[bool] = None,
request_signature_algorithm: Optional[str] = None,
groups_assignments: Optional[Sequence[str]] = None,
groups_attribute: Optional[str] = None,
groups_filters: Optional[Sequence[str]] = None,
deprovisioned_action: Optional[str] = None,
issuer_mode: Optional[str] = None,
acs_type: Optional[str] = None,
max_clock_skew: Optional[int] = None,
name: Optional[str] = None,
name_format: Optional[str] = None,
account_link_action: Optional[str] = None,
provisioning_action: Optional[str] = None,
groups_action: Optional[str] = None,
request_signature_scope: Optional[str] = None,
response_signature_algorithm: Optional[str] = None,
response_signature_scope: Optional[str] = None,
sso_binding: Optional[str] = None,
sso_destination: Optional[str] = None,
account_link_group_includes: Optional[Sequence[str]] = None,
status: Optional[str] = None,
subject_filter: Optional[str] = None,
subject_formats: Optional[Sequence[str]] = None,
subject_match_attribute: Optional[str] = None,
subject_match_type: Optional[str] = None,
suspended_action: Optional[str] = None,
username_template: Optional[str] = None)
func NewSaml(ctx *Context, name string, args SamlArgs, opts ...ResourceOption) (*Saml, error)
public Saml(string name, SamlArgs args, CustomResourceOptions? opts = null)
type: okta:idp:Saml
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args SamlArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args SamlArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args SamlArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args SamlArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args SamlArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Example
The following reference example uses placeholder values for all input properties.
var oktaSamlResource = new Okta.Idp.Saml("oktaSamlResource", new()
{
Issuer = "string",
SsoUrl = "string",
Kid = "string",
ProfileMaster = false,
RequestSignatureAlgorithm = "string",
GroupsAssignments = new[]
{
"string",
},
GroupsAttribute = "string",
GroupsFilters = new[]
{
"string",
},
DeprovisionedAction = "string",
IssuerMode = "string",
AcsType = "string",
MaxClockSkew = 0,
Name = "string",
NameFormat = "string",
AccountLinkAction = "string",
ProvisioningAction = "string",
GroupsAction = "string",
RequestSignatureScope = "string",
ResponseSignatureAlgorithm = "string",
ResponseSignatureScope = "string",
SsoBinding = "string",
SsoDestination = "string",
AccountLinkGroupIncludes = new[]
{
"string",
},
Status = "string",
SubjectFilter = "string",
SubjectFormats = new[]
{
"string",
},
SubjectMatchAttribute = "string",
SubjectMatchType = "string",
SuspendedAction = "string",
UsernameTemplate = "string",
});
example, err := idp.NewSaml(ctx, "oktaSamlResource", &idp.SamlArgs{
Issuer: pulumi.String("string"),
SsoUrl: pulumi.String("string"),
Kid: pulumi.String("string"),
ProfileMaster: pulumi.Bool(false),
RequestSignatureAlgorithm: pulumi.String("string"),
GroupsAssignments: pulumi.StringArray{
pulumi.String("string"),
},
GroupsAttribute: pulumi.String("string"),
GroupsFilters: pulumi.StringArray{
pulumi.String("string"),
},
DeprovisionedAction: pulumi.String("string"),
IssuerMode: pulumi.String("string"),
AcsType: pulumi.String("string"),
MaxClockSkew: pulumi.Int(0),
Name: pulumi.String("string"),
NameFormat: pulumi.String("string"),
AccountLinkAction: pulumi.String("string"),
ProvisioningAction: pulumi.String("string"),
GroupsAction: pulumi.String("string"),
RequestSignatureScope: pulumi.String("string"),
ResponseSignatureAlgorithm: pulumi.String("string"),
ResponseSignatureScope: pulumi.String("string"),
SsoBinding: pulumi.String("string"),
SsoDestination: pulumi.String("string"),
AccountLinkGroupIncludes: pulumi.StringArray{
pulumi.String("string"),
},
Status: pulumi.String("string"),
SubjectFilter: pulumi.String("string"),
SubjectFormats: pulumi.StringArray{
pulumi.String("string"),
},
SubjectMatchAttribute: pulumi.String("string"),
SubjectMatchType: pulumi.String("string"),
SuspendedAction: pulumi.String("string"),
UsernameTemplate: pulumi.String("string"),
})
var oktaSamlResource = new Saml("oktaSamlResource", SamlArgs.builder()
.issuer("string")
.ssoUrl("string")
.kid("string")
.profileMaster(false)
.requestSignatureAlgorithm("string")
.groupsAssignments("string")
.groupsAttribute("string")
.groupsFilters("string")
.deprovisionedAction("string")
.issuerMode("string")
.acsType("string")
.maxClockSkew(0)
.name("string")
.nameFormat("string")
.accountLinkAction("string")
.provisioningAction("string")
.groupsAction("string")
.requestSignatureScope("string")
.responseSignatureAlgorithm("string")
.responseSignatureScope("string")
.ssoBinding("string")
.ssoDestination("string")
.accountLinkGroupIncludes("string")
.status("string")
.subjectFilter("string")
.subjectFormats("string")
.subjectMatchAttribute("string")
.subjectMatchType("string")
.suspendedAction("string")
.usernameTemplate("string")
.build());
okta_saml_resource = okta.idp.Saml("oktaSamlResource",
issuer="string",
sso_url="string",
kid="string",
profile_master=False,
request_signature_algorithm="string",
groups_assignments=["string"],
groups_attribute="string",
groups_filters=["string"],
deprovisioned_action="string",
issuer_mode="string",
acs_type="string",
max_clock_skew=0,
name="string",
name_format="string",
account_link_action="string",
provisioning_action="string",
groups_action="string",
request_signature_scope="string",
response_signature_algorithm="string",
response_signature_scope="string",
sso_binding="string",
sso_destination="string",
account_link_group_includes=["string"],
status="string",
subject_filter="string",
subject_formats=["string"],
subject_match_attribute="string",
subject_match_type="string",
suspended_action="string",
username_template="string")
const oktaSamlResource = new okta.idp.Saml("oktaSamlResource", {
issuer: "string",
ssoUrl: "string",
kid: "string",
profileMaster: false,
requestSignatureAlgorithm: "string",
groupsAssignments: ["string"],
groupsAttribute: "string",
groupsFilters: ["string"],
deprovisionedAction: "string",
issuerMode: "string",
acsType: "string",
maxClockSkew: 0,
name: "string",
nameFormat: "string",
accountLinkAction: "string",
provisioningAction: "string",
groupsAction: "string",
requestSignatureScope: "string",
responseSignatureAlgorithm: "string",
responseSignatureScope: "string",
ssoBinding: "string",
ssoDestination: "string",
accountLinkGroupIncludes: ["string"],
status: "string",
subjectFilter: "string",
subjectFormats: ["string"],
subjectMatchAttribute: "string",
subjectMatchType: "string",
suspendedAction: "string",
usernameTemplate: "string",
});
type: okta:idp:Saml
properties:
accountLinkAction: string
accountLinkGroupIncludes:
- string
acsType: string
deprovisionedAction: string
groupsAction: string
groupsAssignments:
- string
groupsAttribute: string
groupsFilters:
- string
issuer: string
issuerMode: string
kid: string
maxClockSkew: 0
name: string
nameFormat: string
profileMaster: false
provisioningAction: string
requestSignatureAlgorithm: string
requestSignatureScope: string
responseSignatureAlgorithm: string
responseSignatureScope: string
ssoBinding: string
ssoDestination: string
ssoUrl: string
status: string
subjectFilter: string
subjectFormats:
- string
subjectMatchAttribute: string
subjectMatchType: string
suspendedAction: string
usernameTemplate: string
Saml Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The Saml resource accepts the following input properties:
- Issuer string
- URI that identifies the issuer.
- Kid string
- The ID of the signing key.
- Sso
Url string - URL of binding-specific endpoint to send an AuthnRequest message to IdP.
- Account
Link stringAction - Specifies the account linking action for an IdP user.
- Account
Link List<string>Group Includes - Group memberships to determine link candidates.
- Acs
Type string - The type of ACS. It can be
"INSTANCE"
or"ORG"
. - Deprovisioned
Action string - Action for a previously deprovisioned IdP user during authentication. Can be
"NONE"
or"REACTIVATE"
. - Groups
Action string - Provisioning action for IdP user's group memberships. It can be
"NONE"
,"SYNC"
,"APPEND"
, or"ASSIGN"
. - Groups
Assignments List<string> - List of Okta Group IDs to add an IdP user as a member with the
"ASSIGN"
groups_action
. - Groups
Attribute string - IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
- Groups
Filters List<string> - Whitelist of Okta Group identifiers that are allowed for the
"APPEND"
or"SYNC"
groups_action
. - Issuer
Mode string - Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be
"ORG_URL"
or"CUSTOM_URL"
. - Max
Clock intSkew - Maximum allowable clock-skew when processing messages from the IdP.
- Name string
- The Application's display name.
- Name
Format string - The name identifier format to use. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - Profile
Master bool - Determines if the IdP should act as a source of truth for user profile attributes.
- Provisioning
Action string - Provisioning action for an IdP user during authentication.
- Request
Signature stringAlgorithm - The XML digital signature algorithm used when signing an AuthnRequest message. It can be
"SHA-256"
or"SHA-1"
. - Request
Signature stringScope - Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be
"REQUEST"
or"NONE"
. - Response
Signature stringAlgorithm - The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element. It can be
"SHA-256"
or"SHA-1"
. - Response
Signature stringScope - Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be
"RESPONSE"
,"ASSERTION"
, or"ANY"
. - Sso
Binding string - The method of making an SSO request. It can be set to
"HTTP-POST"
or"HTTP-REDIRECT"
. - Sso
Destination string - URI reference indicating the address to which the AuthnRequest message is sent.
- Status string
- Status of the IdP.
- Subject
Filter string - Optional regular expression pattern used to filter untrusted IdP usernames.
- Subject
Formats List<string> - The name format. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - Subject
Match stringAttribute - Okta user profile attribute for matching transformed IdP username. Only for matchType
"CUSTOM_ATTRIBUTE"
. - Subject
Match stringType - Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to
"USERNAME"
. It can be set to"USERNAME"
,"EMAIL"
,"USERNAME_OR_EMAIL"
or"CUSTOM_ATTRIBUTE"
. - Suspended
Action string - Action for a previously suspended IdP user during authentication. Can be set to
"NONE"
or"UNSUSPEND"
- Username
Template string - Okta EL Expression to generate or transform a unique username for the IdP user.
- Issuer string
- URI that identifies the issuer.
- Kid string
- The ID of the signing key.
- Sso
Url string - URL of binding-specific endpoint to send an AuthnRequest message to IdP.
- Account
Link stringAction - Specifies the account linking action for an IdP user.
- Account
Link []stringGroup Includes - Group memberships to determine link candidates.
- Acs
Type string - The type of ACS. It can be
"INSTANCE"
or"ORG"
. - Deprovisioned
Action string - Action for a previously deprovisioned IdP user during authentication. Can be
"NONE"
or"REACTIVATE"
. - Groups
Action string - Provisioning action for IdP user's group memberships. It can be
"NONE"
,"SYNC"
,"APPEND"
, or"ASSIGN"
. - Groups
Assignments []string - List of Okta Group IDs to add an IdP user as a member with the
"ASSIGN"
groups_action
. - Groups
Attribute string - IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
- Groups
Filters []string - Whitelist of Okta Group identifiers that are allowed for the
"APPEND"
or"SYNC"
groups_action
. - Issuer
Mode string - Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be
"ORG_URL"
or"CUSTOM_URL"
. - Max
Clock intSkew - Maximum allowable clock-skew when processing messages from the IdP.
- Name string
- The Application's display name.
- Name
Format string - The name identifier format to use. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - Profile
Master bool - Determines if the IdP should act as a source of truth for user profile attributes.
- Provisioning
Action string - Provisioning action for an IdP user during authentication.
- Request
Signature stringAlgorithm - The XML digital signature algorithm used when signing an AuthnRequest message. It can be
"SHA-256"
or"SHA-1"
. - Request
Signature stringScope - Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be
"REQUEST"
or"NONE"
. - Response
Signature stringAlgorithm - The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element. It can be
"SHA-256"
or"SHA-1"
. - Response
Signature stringScope - Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be
"RESPONSE"
,"ASSERTION"
, or"ANY"
. - Sso
Binding string - The method of making an SSO request. It can be set to
"HTTP-POST"
or"HTTP-REDIRECT"
. - Sso
Destination string - URI reference indicating the address to which the AuthnRequest message is sent.
- Status string
- Status of the IdP.
- Subject
Filter string - Optional regular expression pattern used to filter untrusted IdP usernames.
- Subject
Formats []string - The name format. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - Subject
Match stringAttribute - Okta user profile attribute for matching transformed IdP username. Only for matchType
"CUSTOM_ATTRIBUTE"
. - Subject
Match stringType - Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to
"USERNAME"
. It can be set to"USERNAME"
,"EMAIL"
,"USERNAME_OR_EMAIL"
or"CUSTOM_ATTRIBUTE"
. - Suspended
Action string - Action for a previously suspended IdP user during authentication. Can be set to
"NONE"
or"UNSUSPEND"
- Username
Template string - Okta EL Expression to generate or transform a unique username for the IdP user.
- issuer String
- URI that identifies the issuer.
- kid String
- The ID of the signing key.
- sso
Url String - URL of binding-specific endpoint to send an AuthnRequest message to IdP.
- account
Link StringAction - Specifies the account linking action for an IdP user.
- account
Link List<String>Group Includes - Group memberships to determine link candidates.
- acs
Type String - The type of ACS. It can be
"INSTANCE"
or"ORG"
. - deprovisioned
Action String - Action for a previously deprovisioned IdP user during authentication. Can be
"NONE"
or"REACTIVATE"
. - groups
Action String - Provisioning action for IdP user's group memberships. It can be
"NONE"
,"SYNC"
,"APPEND"
, or"ASSIGN"
. - groups
Assignments List<String> - List of Okta Group IDs to add an IdP user as a member with the
"ASSIGN"
groups_action
. - groups
Attribute String - IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
- groups
Filters List<String> - Whitelist of Okta Group identifiers that are allowed for the
"APPEND"
or"SYNC"
groups_action
. - issuer
Mode String - Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be
"ORG_URL"
or"CUSTOM_URL"
. - max
Clock IntegerSkew - Maximum allowable clock-skew when processing messages from the IdP.
- name String
- The Application's display name.
- name
Format String - The name identifier format to use. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - profile
Master Boolean - Determines if the IdP should act as a source of truth for user profile attributes.
- provisioning
Action String - Provisioning action for an IdP user during authentication.
- request
Signature StringAlgorithm - The XML digital signature algorithm used when signing an AuthnRequest message. It can be
"SHA-256"
or"SHA-1"
. - request
Signature StringScope - Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be
"REQUEST"
or"NONE"
. - response
Signature StringAlgorithm - The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element. It can be
"SHA-256"
or"SHA-1"
. - response
Signature StringScope - Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be
"RESPONSE"
,"ASSERTION"
, or"ANY"
. - sso
Binding String - The method of making an SSO request. It can be set to
"HTTP-POST"
or"HTTP-REDIRECT"
. - sso
Destination String - URI reference indicating the address to which the AuthnRequest message is sent.
- status String
- Status of the IdP.
- subject
Filter String - Optional regular expression pattern used to filter untrusted IdP usernames.
- subject
Formats List<String> - The name format. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - subject
Match StringAttribute - Okta user profile attribute for matching transformed IdP username. Only for matchType
"CUSTOM_ATTRIBUTE"
. - subject
Match StringType - Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to
"USERNAME"
. It can be set to"USERNAME"
,"EMAIL"
,"USERNAME_OR_EMAIL"
or"CUSTOM_ATTRIBUTE"
. - suspended
Action String - Action for a previously suspended IdP user during authentication. Can be set to
"NONE"
or"UNSUSPEND"
- username
Template String - Okta EL Expression to generate or transform a unique username for the IdP user.
- issuer string
- URI that identifies the issuer.
- kid string
- The ID of the signing key.
- sso
Url string - URL of binding-specific endpoint to send an AuthnRequest message to IdP.
- account
Link stringAction - Specifies the account linking action for an IdP user.
- account
Link string[]Group Includes - Group memberships to determine link candidates.
- acs
Type string - The type of ACS. It can be
"INSTANCE"
or"ORG"
. - deprovisioned
Action string - Action for a previously deprovisioned IdP user during authentication. Can be
"NONE"
or"REACTIVATE"
. - groups
Action string - Provisioning action for IdP user's group memberships. It can be
"NONE"
,"SYNC"
,"APPEND"
, or"ASSIGN"
. - groups
Assignments string[] - List of Okta Group IDs to add an IdP user as a member with the
"ASSIGN"
groups_action
. - groups
Attribute string - IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
- groups
Filters string[] - Whitelist of Okta Group identifiers that are allowed for the
"APPEND"
or"SYNC"
groups_action
. - issuer
Mode string - Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be
"ORG_URL"
or"CUSTOM_URL"
. - max
Clock numberSkew - Maximum allowable clock-skew when processing messages from the IdP.
- name string
- The Application's display name.
- name
Format string - The name identifier format to use. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - profile
Master boolean - Determines if the IdP should act as a source of truth for user profile attributes.
- provisioning
Action string - Provisioning action for an IdP user during authentication.
- request
Signature stringAlgorithm - The XML digital signature algorithm used when signing an AuthnRequest message. It can be
"SHA-256"
or"SHA-1"
. - request
Signature stringScope - Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be
"REQUEST"
or"NONE"
. - response
Signature stringAlgorithm - The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element. It can be
"SHA-256"
or"SHA-1"
. - response
Signature stringScope - Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be
"RESPONSE"
,"ASSERTION"
, or"ANY"
. - sso
Binding string - The method of making an SSO request. It can be set to
"HTTP-POST"
or"HTTP-REDIRECT"
. - sso
Destination string - URI reference indicating the address to which the AuthnRequest message is sent.
- status string
- Status of the IdP.
- subject
Filter string - Optional regular expression pattern used to filter untrusted IdP usernames.
- subject
Formats string[] - The name format. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - subject
Match stringAttribute - Okta user profile attribute for matching transformed IdP username. Only for matchType
"CUSTOM_ATTRIBUTE"
. - subject
Match stringType - Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to
"USERNAME"
. It can be set to"USERNAME"
,"EMAIL"
,"USERNAME_OR_EMAIL"
or"CUSTOM_ATTRIBUTE"
. - suspended
Action string - Action for a previously suspended IdP user during authentication. Can be set to
"NONE"
or"UNSUSPEND"
- username
Template string - Okta EL Expression to generate or transform a unique username for the IdP user.
- issuer str
- URI that identifies the issuer.
- kid str
- The ID of the signing key.
- sso_
url str - URL of binding-specific endpoint to send an AuthnRequest message to IdP.
- account_
link_ straction - Specifies the account linking action for an IdP user.
- account_
link_ Sequence[str]group_ includes - Group memberships to determine link candidates.
- acs_
type str - The type of ACS. It can be
"INSTANCE"
or"ORG"
. - deprovisioned_
action str - Action for a previously deprovisioned IdP user during authentication. Can be
"NONE"
or"REACTIVATE"
. - groups_
action str - Provisioning action for IdP user's group memberships. It can be
"NONE"
,"SYNC"
,"APPEND"
, or"ASSIGN"
. - groups_
assignments Sequence[str] - List of Okta Group IDs to add an IdP user as a member with the
"ASSIGN"
groups_action
. - groups_
attribute str - IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
- groups_
filters Sequence[str] - Whitelist of Okta Group identifiers that are allowed for the
"APPEND"
or"SYNC"
groups_action
. - issuer_
mode str - Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be
"ORG_URL"
or"CUSTOM_URL"
. - max_
clock_ intskew - Maximum allowable clock-skew when processing messages from the IdP.
- name str
- The Application's display name.
- name_
format str - The name identifier format to use. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - profile_
master bool - Determines if the IdP should act as a source of truth for user profile attributes.
- provisioning_
action str - Provisioning action for an IdP user during authentication.
- request_
signature_ stralgorithm - The XML digital signature algorithm used when signing an AuthnRequest message. It can be
"SHA-256"
or"SHA-1"
. - request_
signature_ strscope - Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be
"REQUEST"
or"NONE"
. - response_
signature_ stralgorithm - The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element. It can be
"SHA-256"
or"SHA-1"
. - response_
signature_ strscope - Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be
"RESPONSE"
,"ASSERTION"
, or"ANY"
. - sso_
binding str - The method of making an SSO request. It can be set to
"HTTP-POST"
or"HTTP-REDIRECT"
. - sso_
destination str - URI reference indicating the address to which the AuthnRequest message is sent.
- status str
- Status of the IdP.
- subject_
filter str - Optional regular expression pattern used to filter untrusted IdP usernames.
- subject_
formats Sequence[str] - The name format. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - subject_
match_ strattribute - Okta user profile attribute for matching transformed IdP username. Only for matchType
"CUSTOM_ATTRIBUTE"
. - subject_
match_ strtype - Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to
"USERNAME"
. It can be set to"USERNAME"
,"EMAIL"
,"USERNAME_OR_EMAIL"
or"CUSTOM_ATTRIBUTE"
. - suspended_
action str - Action for a previously suspended IdP user during authentication. Can be set to
"NONE"
or"UNSUSPEND"
- username_
template str - Okta EL Expression to generate or transform a unique username for the IdP user.
- issuer String
- URI that identifies the issuer.
- kid String
- The ID of the signing key.
- sso
Url String - URL of binding-specific endpoint to send an AuthnRequest message to IdP.
- account
Link StringAction - Specifies the account linking action for an IdP user.
- account
Link List<String>Group Includes - Group memberships to determine link candidates.
- acs
Type String - The type of ACS. It can be
"INSTANCE"
or"ORG"
. - deprovisioned
Action String - Action for a previously deprovisioned IdP user during authentication. Can be
"NONE"
or"REACTIVATE"
. - groups
Action String - Provisioning action for IdP user's group memberships. It can be
"NONE"
,"SYNC"
,"APPEND"
, or"ASSIGN"
. - groups
Assignments List<String> - List of Okta Group IDs to add an IdP user as a member with the
"ASSIGN"
groups_action
. - groups
Attribute String - IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
- groups
Filters List<String> - Whitelist of Okta Group identifiers that are allowed for the
"APPEND"
or"SYNC"
groups_action
. - issuer
Mode String - Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be
"ORG_URL"
or"CUSTOM_URL"
. - max
Clock NumberSkew - Maximum allowable clock-skew when processing messages from the IdP.
- name String
- The Application's display name.
- name
Format String - The name identifier format to use. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - profile
Master Boolean - Determines if the IdP should act as a source of truth for user profile attributes.
- provisioning
Action String - Provisioning action for an IdP user during authentication.
- request
Signature StringAlgorithm - The XML digital signature algorithm used when signing an AuthnRequest message. It can be
"SHA-256"
or"SHA-1"
. - request
Signature StringScope - Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be
"REQUEST"
or"NONE"
. - response
Signature StringAlgorithm - The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element. It can be
"SHA-256"
or"SHA-1"
. - response
Signature StringScope - Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be
"RESPONSE"
,"ASSERTION"
, or"ANY"
. - sso
Binding String - The method of making an SSO request. It can be set to
"HTTP-POST"
or"HTTP-REDIRECT"
. - sso
Destination String - URI reference indicating the address to which the AuthnRequest message is sent.
- status String
- Status of the IdP.
- subject
Filter String - Optional regular expression pattern used to filter untrusted IdP usernames.
- subject
Formats List<String> - The name format. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - subject
Match StringAttribute - Okta user profile attribute for matching transformed IdP username. Only for matchType
"CUSTOM_ATTRIBUTE"
. - subject
Match StringType - Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to
"USERNAME"
. It can be set to"USERNAME"
,"EMAIL"
,"USERNAME_OR_EMAIL"
or"CUSTOM_ATTRIBUTE"
. - suspended
Action String - Action for a previously suspended IdP user during authentication. Can be set to
"NONE"
or"UNSUSPEND"
- username
Template String - Okta EL Expression to generate or transform a unique username for the IdP user.
Outputs
All input properties are implicitly available as output properties. Additionally, the Saml resource produces the following output properties:
- Acs
Binding string - Audience string
- The audience restriction for the IdP.
- Id string
- The provider-assigned unique ID for this managed resource.
- Type string
- Type of the IdP.
- User
Type stringId - User type ID. Can be used as
target_id
in theokta.profile.Mapping
resource.
- Acs
Binding string - Audience string
- The audience restriction for the IdP.
- Id string
- The provider-assigned unique ID for this managed resource.
- Type string
- Type of the IdP.
- User
Type stringId - User type ID. Can be used as
target_id
in theokta.profile.Mapping
resource.
- acs
Binding String - audience String
- The audience restriction for the IdP.
- id String
- The provider-assigned unique ID for this managed resource.
- type String
- Type of the IdP.
- user
Type StringId - User type ID. Can be used as
target_id
in theokta.profile.Mapping
resource.
- acs
Binding string - audience string
- The audience restriction for the IdP.
- id string
- The provider-assigned unique ID for this managed resource.
- type string
- Type of the IdP.
- user
Type stringId - User type ID. Can be used as
target_id
in theokta.profile.Mapping
resource.
- acs_
binding str - audience str
- The audience restriction for the IdP.
- id str
- The provider-assigned unique ID for this managed resource.
- type str
- Type of the IdP.
- user_
type_ strid - User type ID. Can be used as
target_id
in theokta.profile.Mapping
resource.
- acs
Binding String - audience String
- The audience restriction for the IdP.
- id String
- The provider-assigned unique ID for this managed resource.
- type String
- Type of the IdP.
- user
Type StringId - User type ID. Can be used as
target_id
in theokta.profile.Mapping
resource.
Look up Existing Saml Resource
Get an existing Saml resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: SamlState, opts?: CustomResourceOptions): Saml
@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
account_link_action: Optional[str] = None,
account_link_group_includes: Optional[Sequence[str]] = None,
acs_binding: Optional[str] = None,
acs_type: Optional[str] = None,
audience: Optional[str] = None,
deprovisioned_action: Optional[str] = None,
groups_action: Optional[str] = None,
groups_assignments: Optional[Sequence[str]] = None,
groups_attribute: Optional[str] = None,
groups_filters: Optional[Sequence[str]] = None,
issuer: Optional[str] = None,
issuer_mode: Optional[str] = None,
kid: Optional[str] = None,
max_clock_skew: Optional[int] = None,
name: Optional[str] = None,
name_format: Optional[str] = None,
profile_master: Optional[bool] = None,
provisioning_action: Optional[str] = None,
request_signature_algorithm: Optional[str] = None,
request_signature_scope: Optional[str] = None,
response_signature_algorithm: Optional[str] = None,
response_signature_scope: Optional[str] = None,
sso_binding: Optional[str] = None,
sso_destination: Optional[str] = None,
sso_url: Optional[str] = None,
status: Optional[str] = None,
subject_filter: Optional[str] = None,
subject_formats: Optional[Sequence[str]] = None,
subject_match_attribute: Optional[str] = None,
subject_match_type: Optional[str] = None,
suspended_action: Optional[str] = None,
type: Optional[str] = None,
user_type_id: Optional[str] = None,
username_template: Optional[str] = None) -> Saml
func GetSaml(ctx *Context, name string, id IDInput, state *SamlState, opts ...ResourceOption) (*Saml, error)
public static Saml Get(string name, Input<string> id, SamlState? state, CustomResourceOptions? opts = null)
public static Saml get(String name, Output<String> id, SamlState state, CustomResourceOptions options)
Resource lookup is not supported in YAML
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Account
Link stringAction - Specifies the account linking action for an IdP user.
- Account
Link List<string>Group Includes - Group memberships to determine link candidates.
- Acs
Binding string - Acs
Type string - The type of ACS. It can be
"INSTANCE"
or"ORG"
. - Audience string
- The audience restriction for the IdP.
- Deprovisioned
Action string - Action for a previously deprovisioned IdP user during authentication. Can be
"NONE"
or"REACTIVATE"
. - Groups
Action string - Provisioning action for IdP user's group memberships. It can be
"NONE"
,"SYNC"
,"APPEND"
, or"ASSIGN"
. - Groups
Assignments List<string> - List of Okta Group IDs to add an IdP user as a member with the
"ASSIGN"
groups_action
. - Groups
Attribute string - IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
- Groups
Filters List<string> - Whitelist of Okta Group identifiers that are allowed for the
"APPEND"
or"SYNC"
groups_action
. - Issuer string
- URI that identifies the issuer.
- Issuer
Mode string - Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be
"ORG_URL"
or"CUSTOM_URL"
. - Kid string
- The ID of the signing key.
- Max
Clock intSkew - Maximum allowable clock-skew when processing messages from the IdP.
- Name string
- The Application's display name.
- Name
Format string - The name identifier format to use. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - Profile
Master bool - Determines if the IdP should act as a source of truth for user profile attributes.
- Provisioning
Action string - Provisioning action for an IdP user during authentication.
- Request
Signature stringAlgorithm - The XML digital signature algorithm used when signing an AuthnRequest message. It can be
"SHA-256"
or"SHA-1"
. - Request
Signature stringScope - Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be
"REQUEST"
or"NONE"
. - Response
Signature stringAlgorithm - The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element. It can be
"SHA-256"
or"SHA-1"
. - Response
Signature stringScope - Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be
"RESPONSE"
,"ASSERTION"
, or"ANY"
. - Sso
Binding string - The method of making an SSO request. It can be set to
"HTTP-POST"
or"HTTP-REDIRECT"
. - Sso
Destination string - URI reference indicating the address to which the AuthnRequest message is sent.
- Sso
Url string - URL of binding-specific endpoint to send an AuthnRequest message to IdP.
- Status string
- Status of the IdP.
- Subject
Filter string - Optional regular expression pattern used to filter untrusted IdP usernames.
- Subject
Formats List<string> - The name format. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - Subject
Match stringAttribute - Okta user profile attribute for matching transformed IdP username. Only for matchType
"CUSTOM_ATTRIBUTE"
. - Subject
Match stringType - Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to
"USERNAME"
. It can be set to"USERNAME"
,"EMAIL"
,"USERNAME_OR_EMAIL"
or"CUSTOM_ATTRIBUTE"
. - Suspended
Action string - Action for a previously suspended IdP user during authentication. Can be set to
"NONE"
or"UNSUSPEND"
- Type string
- Type of the IdP.
- User
Type stringId - User type ID. Can be used as
target_id
in theokta.profile.Mapping
resource. - Username
Template string - Okta EL Expression to generate or transform a unique username for the IdP user.
- Account
Link stringAction - Specifies the account linking action for an IdP user.
- Account
Link []stringGroup Includes - Group memberships to determine link candidates.
- Acs
Binding string - Acs
Type string - The type of ACS. It can be
"INSTANCE"
or"ORG"
. - Audience string
- The audience restriction for the IdP.
- Deprovisioned
Action string - Action for a previously deprovisioned IdP user during authentication. Can be
"NONE"
or"REACTIVATE"
. - Groups
Action string - Provisioning action for IdP user's group memberships. It can be
"NONE"
,"SYNC"
,"APPEND"
, or"ASSIGN"
. - Groups
Assignments []string - List of Okta Group IDs to add an IdP user as a member with the
"ASSIGN"
groups_action
. - Groups
Attribute string - IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
- Groups
Filters []string - Whitelist of Okta Group identifiers that are allowed for the
"APPEND"
or"SYNC"
groups_action
. - Issuer string
- URI that identifies the issuer.
- Issuer
Mode string - Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be
"ORG_URL"
or"CUSTOM_URL"
. - Kid string
- The ID of the signing key.
- Max
Clock intSkew - Maximum allowable clock-skew when processing messages from the IdP.
- Name string
- The Application's display name.
- Name
Format string - The name identifier format to use. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - Profile
Master bool - Determines if the IdP should act as a source of truth for user profile attributes.
- Provisioning
Action string - Provisioning action for an IdP user during authentication.
- Request
Signature stringAlgorithm - The XML digital signature algorithm used when signing an AuthnRequest message. It can be
"SHA-256"
or"SHA-1"
. - Request
Signature stringScope - Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be
"REQUEST"
or"NONE"
. - Response
Signature stringAlgorithm - The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element. It can be
"SHA-256"
or"SHA-1"
. - Response
Signature stringScope - Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be
"RESPONSE"
,"ASSERTION"
, or"ANY"
. - Sso
Binding string - The method of making an SSO request. It can be set to
"HTTP-POST"
or"HTTP-REDIRECT"
. - Sso
Destination string - URI reference indicating the address to which the AuthnRequest message is sent.
- Sso
Url string - URL of binding-specific endpoint to send an AuthnRequest message to IdP.
- Status string
- Status of the IdP.
- Subject
Filter string - Optional regular expression pattern used to filter untrusted IdP usernames.
- Subject
Formats []string - The name format. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - Subject
Match stringAttribute - Okta user profile attribute for matching transformed IdP username. Only for matchType
"CUSTOM_ATTRIBUTE"
. - Subject
Match stringType - Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to
"USERNAME"
. It can be set to"USERNAME"
,"EMAIL"
,"USERNAME_OR_EMAIL"
or"CUSTOM_ATTRIBUTE"
. - Suspended
Action string - Action for a previously suspended IdP user during authentication. Can be set to
"NONE"
or"UNSUSPEND"
- Type string
- Type of the IdP.
- User
Type stringId - User type ID. Can be used as
target_id
in theokta.profile.Mapping
resource. - Username
Template string - Okta EL Expression to generate or transform a unique username for the IdP user.
- account
Link StringAction - Specifies the account linking action for an IdP user.
- account
Link List<String>Group Includes - Group memberships to determine link candidates.
- acs
Binding String - acs
Type String - The type of ACS. It can be
"INSTANCE"
or"ORG"
. - audience String
- The audience restriction for the IdP.
- deprovisioned
Action String - Action for a previously deprovisioned IdP user during authentication. Can be
"NONE"
or"REACTIVATE"
. - groups
Action String - Provisioning action for IdP user's group memberships. It can be
"NONE"
,"SYNC"
,"APPEND"
, or"ASSIGN"
. - groups
Assignments List<String> - List of Okta Group IDs to add an IdP user as a member with the
"ASSIGN"
groups_action
. - groups
Attribute String - IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
- groups
Filters List<String> - Whitelist of Okta Group identifiers that are allowed for the
"APPEND"
or"SYNC"
groups_action
. - issuer String
- URI that identifies the issuer.
- issuer
Mode String - Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be
"ORG_URL"
or"CUSTOM_URL"
. - kid String
- The ID of the signing key.
- max
Clock IntegerSkew - Maximum allowable clock-skew when processing messages from the IdP.
- name String
- The Application's display name.
- name
Format String - The name identifier format to use. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - profile
Master Boolean - Determines if the IdP should act as a source of truth for user profile attributes.
- provisioning
Action String - Provisioning action for an IdP user during authentication.
- request
Signature StringAlgorithm - The XML digital signature algorithm used when signing an AuthnRequest message. It can be
"SHA-256"
or"SHA-1"
. - request
Signature StringScope - Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be
"REQUEST"
or"NONE"
. - response
Signature StringAlgorithm - The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element. It can be
"SHA-256"
or"SHA-1"
. - response
Signature StringScope - Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be
"RESPONSE"
,"ASSERTION"
, or"ANY"
. - sso
Binding String - The method of making an SSO request. It can be set to
"HTTP-POST"
or"HTTP-REDIRECT"
. - sso
Destination String - URI reference indicating the address to which the AuthnRequest message is sent.
- sso
Url String - URL of binding-specific endpoint to send an AuthnRequest message to IdP.
- status String
- Status of the IdP.
- subject
Filter String - Optional regular expression pattern used to filter untrusted IdP usernames.
- subject
Formats List<String> - The name format. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - subject
Match StringAttribute - Okta user profile attribute for matching transformed IdP username. Only for matchType
"CUSTOM_ATTRIBUTE"
. - subject
Match StringType - Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to
"USERNAME"
. It can be set to"USERNAME"
,"EMAIL"
,"USERNAME_OR_EMAIL"
or"CUSTOM_ATTRIBUTE"
. - suspended
Action String - Action for a previously suspended IdP user during authentication. Can be set to
"NONE"
or"UNSUSPEND"
- type String
- Type of the IdP.
- user
Type StringId - User type ID. Can be used as
target_id
in theokta.profile.Mapping
resource. - username
Template String - Okta EL Expression to generate or transform a unique username for the IdP user.
- account
Link stringAction - Specifies the account linking action for an IdP user.
- account
Link string[]Group Includes - Group memberships to determine link candidates.
- acs
Binding string - acs
Type string - The type of ACS. It can be
"INSTANCE"
or"ORG"
. - audience string
- The audience restriction for the IdP.
- deprovisioned
Action string - Action for a previously deprovisioned IdP user during authentication. Can be
"NONE"
or"REACTIVATE"
. - groups
Action string - Provisioning action for IdP user's group memberships. It can be
"NONE"
,"SYNC"
,"APPEND"
, or"ASSIGN"
. - groups
Assignments string[] - List of Okta Group IDs to add an IdP user as a member with the
"ASSIGN"
groups_action
. - groups
Attribute string - IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
- groups
Filters string[] - Whitelist of Okta Group identifiers that are allowed for the
"APPEND"
or"SYNC"
groups_action
. - issuer string
- URI that identifies the issuer.
- issuer
Mode string - Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be
"ORG_URL"
or"CUSTOM_URL"
. - kid string
- The ID of the signing key.
- max
Clock numberSkew - Maximum allowable clock-skew when processing messages from the IdP.
- name string
- The Application's display name.
- name
Format string - The name identifier format to use. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - profile
Master boolean - Determines if the IdP should act as a source of truth for user profile attributes.
- provisioning
Action string - Provisioning action for an IdP user during authentication.
- request
Signature stringAlgorithm - The XML digital signature algorithm used when signing an AuthnRequest message. It can be
"SHA-256"
or"SHA-1"
. - request
Signature stringScope - Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be
"REQUEST"
or"NONE"
. - response
Signature stringAlgorithm - The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element. It can be
"SHA-256"
or"SHA-1"
. - response
Signature stringScope - Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be
"RESPONSE"
,"ASSERTION"
, or"ANY"
. - sso
Binding string - The method of making an SSO request. It can be set to
"HTTP-POST"
or"HTTP-REDIRECT"
. - sso
Destination string - URI reference indicating the address to which the AuthnRequest message is sent.
- sso
Url string - URL of binding-specific endpoint to send an AuthnRequest message to IdP.
- status string
- Status of the IdP.
- subject
Filter string - Optional regular expression pattern used to filter untrusted IdP usernames.
- subject
Formats string[] - The name format. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - subject
Match stringAttribute - Okta user profile attribute for matching transformed IdP username. Only for matchType
"CUSTOM_ATTRIBUTE"
. - subject
Match stringType - Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to
"USERNAME"
. It can be set to"USERNAME"
,"EMAIL"
,"USERNAME_OR_EMAIL"
or"CUSTOM_ATTRIBUTE"
. - suspended
Action string - Action for a previously suspended IdP user during authentication. Can be set to
"NONE"
or"UNSUSPEND"
- type string
- Type of the IdP.
- user
Type stringId - User type ID. Can be used as
target_id
in theokta.profile.Mapping
resource. - username
Template string - Okta EL Expression to generate or transform a unique username for the IdP user.
- account_
link_ straction - Specifies the account linking action for an IdP user.
- account_
link_ Sequence[str]group_ includes - Group memberships to determine link candidates.
- acs_
binding str - acs_
type str - The type of ACS. It can be
"INSTANCE"
or"ORG"
. - audience str
- The audience restriction for the IdP.
- deprovisioned_
action str - Action for a previously deprovisioned IdP user during authentication. Can be
"NONE"
or"REACTIVATE"
. - groups_
action str - Provisioning action for IdP user's group memberships. It can be
"NONE"
,"SYNC"
,"APPEND"
, or"ASSIGN"
. - groups_
assignments Sequence[str] - List of Okta Group IDs to add an IdP user as a member with the
"ASSIGN"
groups_action
. - groups_
attribute str - IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
- groups_
filters Sequence[str] - Whitelist of Okta Group identifiers that are allowed for the
"APPEND"
or"SYNC"
groups_action
. - issuer str
- URI that identifies the issuer.
- issuer_
mode str - Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be
"ORG_URL"
or"CUSTOM_URL"
. - kid str
- The ID of the signing key.
- max_
clock_ intskew - Maximum allowable clock-skew when processing messages from the IdP.
- name str
- The Application's display name.
- name_
format str - The name identifier format to use. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - profile_
master bool - Determines if the IdP should act as a source of truth for user profile attributes.
- provisioning_
action str - Provisioning action for an IdP user during authentication.
- request_
signature_ stralgorithm - The XML digital signature algorithm used when signing an AuthnRequest message. It can be
"SHA-256"
or"SHA-1"
. - request_
signature_ strscope - Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be
"REQUEST"
or"NONE"
. - response_
signature_ stralgorithm - The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element. It can be
"SHA-256"
or"SHA-1"
. - response_
signature_ strscope - Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be
"RESPONSE"
,"ASSERTION"
, or"ANY"
. - sso_
binding str - The method of making an SSO request. It can be set to
"HTTP-POST"
or"HTTP-REDIRECT"
. - sso_
destination str - URI reference indicating the address to which the AuthnRequest message is sent.
- sso_
url str - URL of binding-specific endpoint to send an AuthnRequest message to IdP.
- status str
- Status of the IdP.
- subject_
filter str - Optional regular expression pattern used to filter untrusted IdP usernames.
- subject_
formats Sequence[str] - The name format. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - subject_
match_ strattribute - Okta user profile attribute for matching transformed IdP username. Only for matchType
"CUSTOM_ATTRIBUTE"
. - subject_
match_ strtype - Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to
"USERNAME"
. It can be set to"USERNAME"
,"EMAIL"
,"USERNAME_OR_EMAIL"
or"CUSTOM_ATTRIBUTE"
. - suspended_
action str - Action for a previously suspended IdP user during authentication. Can be set to
"NONE"
or"UNSUSPEND"
- type str
- Type of the IdP.
- user_
type_ strid - User type ID. Can be used as
target_id
in theokta.profile.Mapping
resource. - username_
template str - Okta EL Expression to generate or transform a unique username for the IdP user.
- account
Link StringAction - Specifies the account linking action for an IdP user.
- account
Link List<String>Group Includes - Group memberships to determine link candidates.
- acs
Binding String - acs
Type String - The type of ACS. It can be
"INSTANCE"
or"ORG"
. - audience String
- The audience restriction for the IdP.
- deprovisioned
Action String - Action for a previously deprovisioned IdP user during authentication. Can be
"NONE"
or"REACTIVATE"
. - groups
Action String - Provisioning action for IdP user's group memberships. It can be
"NONE"
,"SYNC"
,"APPEND"
, or"ASSIGN"
. - groups
Assignments List<String> - List of Okta Group IDs to add an IdP user as a member with the
"ASSIGN"
groups_action
. - groups
Attribute String - IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
- groups
Filters List<String> - Whitelist of Okta Group identifiers that are allowed for the
"APPEND"
or"SYNC"
groups_action
. - issuer String
- URI that identifies the issuer.
- issuer
Mode String - Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be
"ORG_URL"
or"CUSTOM_URL"
. - kid String
- The ID of the signing key.
- max
Clock NumberSkew - Maximum allowable clock-skew when processing messages from the IdP.
- name String
- The Application's display name.
- name
Format String - The name identifier format to use. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - profile
Master Boolean - Determines if the IdP should act as a source of truth for user profile attributes.
- provisioning
Action String - Provisioning action for an IdP user during authentication.
- request
Signature StringAlgorithm - The XML digital signature algorithm used when signing an AuthnRequest message. It can be
"SHA-256"
or"SHA-1"
. - request
Signature StringScope - Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be
"REQUEST"
or"NONE"
. - response
Signature StringAlgorithm - The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element. It can be
"SHA-256"
or"SHA-1"
. - response
Signature StringScope - Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be
"RESPONSE"
,"ASSERTION"
, or"ANY"
. - sso
Binding String - The method of making an SSO request. It can be set to
"HTTP-POST"
or"HTTP-REDIRECT"
. - sso
Destination String - URI reference indicating the address to which the AuthnRequest message is sent.
- sso
Url String - URL of binding-specific endpoint to send an AuthnRequest message to IdP.
- status String
- Status of the IdP.
- subject
Filter String - Optional regular expression pattern used to filter untrusted IdP usernames.
- subject
Formats List<String> - The name format. By default
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
. - subject
Match StringAttribute - Okta user profile attribute for matching transformed IdP username. Only for matchType
"CUSTOM_ATTRIBUTE"
. - subject
Match StringType - Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to
"USERNAME"
. It can be set to"USERNAME"
,"EMAIL"
,"USERNAME_OR_EMAIL"
or"CUSTOM_ATTRIBUTE"
. - suspended
Action String - Action for a previously suspended IdP user during authentication. Can be set to
"NONE"
or"UNSUSPEND"
- type String
- Type of the IdP.
- user
Type StringId - User type ID. Can be used as
target_id
in theokta.profile.Mapping
resource. - username
Template String - Okta EL Expression to generate or transform a unique username for the IdP user.
Import
An SAML IdP can be imported via the Okta ID.
$ pulumi import okta:idp/saml:Saml example <idp id>
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Okta pulumi/pulumi-okta
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
okta
Terraform Provider.