1. Registry
  2. Packages
  3. CAST AI
  4. API Docs
  5. SSOConnection
Viewing docs for CAST AI v8.60.0
published on Wednesday, Aug 19, 2026 by CAST AI
castai logo
Viewing docs for CAST AI v8.60.0
published on Wednesday, Aug 19, 2026 by CAST AI

    Create SSOConnection Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SSOConnection(name: string, args: SSOConnectionArgs, opts?: CustomResourceOptions);
    @overload
    def SSOConnection(resource_name: str,
                      args: SSOConnectionArgs,
                      opts: Optional[ResourceOptions] = None)
    
    @overload
    def SSOConnection(resource_name: str,
                      opts: Optional[ResourceOptions] = None,
                      email_domain: Optional[str] = None,
                      aad: Optional[_organization.SSOConnectionAadArgs] = None,
                      additional_email_domains: Optional[Sequence[str]] = None,
                      name: Optional[str] = None,
                      oidc: Optional[_organization.SSOConnectionOidcArgs] = None,
                      okta: Optional[_organization.SSOConnectionOktaArgs] = None,
                      synchronize_user_groups: Optional[bool] = None)
    func NewSSOConnection(ctx *Context, name string, args SSOConnectionArgs, opts ...ResourceOption) (*SSOConnection, error)
    public SSOConnection(string name, SSOConnectionArgs args, CustomResourceOptions? opts = null)
    public SSOConnection(String name, SSOConnectionArgs args)
    public SSOConnection(String name, SSOConnectionArgs args, CustomResourceOptions options)
    
    type: castai:organization:SSOConnection
    properties: # The arguments to resource properties.
    options: # Bag of options to control resource's behavior.
    
    
    resource "castai_s_s_o_connection" "name" {
        # resource properties
    }

    Parameters

    name string
    The unique name of the resource.
    args SSOConnectionArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SSOConnectionArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SSOConnectionArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SSOConnectionArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SSOConnectionArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    SSOConnection Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SSOConnection resource accepts the following input properties:

    EmailDomain string
    Email domain of the connection
    Aad Pulumi.CastAI.Organization.Inputs.SSOConnectionAad
    Azure AD connector
    AdditionalEmailDomains List<string>
    Additional email domains that will be allowed to sign in via the connection
    Name string
    Connection name
    Oidc Pulumi.CastAI.Organization.Inputs.SSOConnectionOidc
    OIDC connector (e.g. Keycloak)
    Okta Pulumi.CastAI.Organization.Inputs.SSOConnectionOkta
    Okta connector
    SynchronizeUserGroups bool
    When enabled, user groups from the identity provider will be synchronized with CAST AI. A sync auth token is generated on activation and stored in sync_auth_token.
    EmailDomain string
    Email domain of the connection
    Aad SSOConnectionAadArgs
    Azure AD connector
    AdditionalEmailDomains []string
    Additional email domains that will be allowed to sign in via the connection
    Name string
    Connection name
    Oidc SSOConnectionOidcArgs
    OIDC connector (e.g. Keycloak)
    Okta SSOConnectionOktaArgs
    Okta connector
    SynchronizeUserGroups bool
    When enabled, user groups from the identity provider will be synchronized with CAST AI. A sync auth token is generated on activation and stored in sync_auth_token.
    email_domain string
    Email domain of the connection
    aad object
    Azure AD connector
    additional_email_domains list(string)
    Additional email domains that will be allowed to sign in via the connection
    name string
    Connection name
    oidc object
    OIDC connector (e.g. Keycloak)
    okta object
    Okta connector
    synchronize_user_groups bool
    When enabled, user groups from the identity provider will be synchronized with CAST AI. A sync auth token is generated on activation and stored in sync_auth_token.
    emailDomain String
    Email domain of the connection
    aad SSOConnectionAad
    Azure AD connector
    additionalEmailDomains List<String>
    Additional email domains that will be allowed to sign in via the connection
    name String
    Connection name
    oidc SSOConnectionOidc
    OIDC connector (e.g. Keycloak)
    okta SSOConnectionOkta
    Okta connector
    synchronizeUserGroups Boolean
    When enabled, user groups from the identity provider will be synchronized with CAST AI. A sync auth token is generated on activation and stored in sync_auth_token.
    emailDomain string
    Email domain of the connection
    aad organizationSSOConnectionAad
    Azure AD connector
    additionalEmailDomains string[]
    Additional email domains that will be allowed to sign in via the connection
    name string
    Connection name
    oidc organizationSSOConnectionOidc
    OIDC connector (e.g. Keycloak)
    okta organizationSSOConnectionOkta
    Okta connector
    synchronizeUserGroups boolean
    When enabled, user groups from the identity provider will be synchronized with CAST AI. A sync auth token is generated on activation and stored in sync_auth_token.
    email_domain str
    Email domain of the connection
    aad organization.SSOConnectionAadArgs
    Azure AD connector
    additional_email_domains Sequence[str]
    Additional email domains that will be allowed to sign in via the connection
    name str
    Connection name
    oidc organization.SSOConnectionOidcArgs
    OIDC connector (e.g. Keycloak)
    okta organization.SSOConnectionOktaArgs
    Okta connector
    synchronize_user_groups bool
    When enabled, user groups from the identity provider will be synchronized with CAST AI. A sync auth token is generated on activation and stored in sync_auth_token.
    emailDomain String
    Email domain of the connection
    aad Property Map
    Azure AD connector
    additionalEmailDomains List<String>
    Additional email domains that will be allowed to sign in via the connection
    name String
    Connection name
    oidc Property Map
    OIDC connector (e.g. Keycloak)
    okta Property Map
    Okta connector
    synchronizeUserGroups Boolean
    When enabled, user groups from the identity provider will be synchronized with CAST AI. A sync auth token is generated on activation and stored in sync_auth_token.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SSOConnection resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    SyncAuthToken string
    Auth token generated when synchronizeUserGroups is enabled. Only populated on the transition from false to true.
    Id string
    The provider-assigned unique ID for this managed resource.
    SyncAuthToken string
    Auth token generated when synchronizeUserGroups is enabled. Only populated on the transition from false to true.
    id string
    The provider-assigned unique ID for this managed resource.
    sync_auth_token string
    Auth token generated when synchronizeUserGroups is enabled. Only populated on the transition from false to true.
    id String
    The provider-assigned unique ID for this managed resource.
    syncAuthToken String
    Auth token generated when synchronizeUserGroups is enabled. Only populated on the transition from false to true.
    id string
    The provider-assigned unique ID for this managed resource.
    syncAuthToken string
    Auth token generated when synchronizeUserGroups is enabled. Only populated on the transition from false to true.
    id str
    The provider-assigned unique ID for this managed resource.
    sync_auth_token str
    Auth token generated when synchronizeUserGroups is enabled. Only populated on the transition from false to true.
    id String
    The provider-assigned unique ID for this managed resource.
    syncAuthToken String
    Auth token generated when synchronizeUserGroups is enabled. Only populated on the transition from false to true.

    Look up Existing SSOConnection Resource

    Get an existing SSOConnection resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SSOConnectionState, opts?: CustomResourceOptions): SSOConnection
    @staticmethod
    def get(resource_name: str,
            id: str,
            opts: Optional[ResourceOptions] = None,
            aad: Optional[_organization.SSOConnectionAadArgs] = None,
            additional_email_domains: Optional[Sequence[str]] = None,
            email_domain: Optional[str] = None,
            name: Optional[str] = None,
            oidc: Optional[_organization.SSOConnectionOidcArgs] = None,
            okta: Optional[_organization.SSOConnectionOktaArgs] = None,
            sync_auth_token: Optional[str] = None,
            synchronize_user_groups: Optional[bool] = None) -> SSOConnection
    func GetSSOConnection(ctx *Context, name string, id IDInput, state *SSOConnectionState, opts ...ResourceOption) (*SSOConnection, error)
    public static SSOConnection Get(string name, Input<string> id, SSOConnectionState? state, CustomResourceOptions? opts = null)
    public static SSOConnection get(String name, Output<String> id, SSOConnectionState state, CustomResourceOptions options)
    resources:  _:    type: castai:organization:SSOConnection    get:      id: ${id}
    import {
      to = castai_s_s_o_connection.example
      id = "${id}"
    }
    
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Aad Pulumi.CastAI.Organization.Inputs.SSOConnectionAad
    Azure AD connector
    AdditionalEmailDomains List<string>
    Additional email domains that will be allowed to sign in via the connection
    EmailDomain string
    Email domain of the connection
    Name string
    Connection name
    Oidc Pulumi.CastAI.Organization.Inputs.SSOConnectionOidc
    OIDC connector (e.g. Keycloak)
    Okta Pulumi.CastAI.Organization.Inputs.SSOConnectionOkta
    Okta connector
    SyncAuthToken string
    Auth token generated when synchronizeUserGroups is enabled. Only populated on the transition from false to true.
    SynchronizeUserGroups bool
    When enabled, user groups from the identity provider will be synchronized with CAST AI. A sync auth token is generated on activation and stored in sync_auth_token.
    Aad SSOConnectionAadArgs
    Azure AD connector
    AdditionalEmailDomains []string
    Additional email domains that will be allowed to sign in via the connection
    EmailDomain string
    Email domain of the connection
    Name string
    Connection name
    Oidc SSOConnectionOidcArgs
    OIDC connector (e.g. Keycloak)
    Okta SSOConnectionOktaArgs
    Okta connector
    SyncAuthToken string
    Auth token generated when synchronizeUserGroups is enabled. Only populated on the transition from false to true.
    SynchronizeUserGroups bool
    When enabled, user groups from the identity provider will be synchronized with CAST AI. A sync auth token is generated on activation and stored in sync_auth_token.
    aad object
    Azure AD connector
    additional_email_domains list(string)
    Additional email domains that will be allowed to sign in via the connection
    email_domain string
    Email domain of the connection
    name string
    Connection name
    oidc object
    OIDC connector (e.g. Keycloak)
    okta object
    Okta connector
    sync_auth_token string
    Auth token generated when synchronizeUserGroups is enabled. Only populated on the transition from false to true.
    synchronize_user_groups bool
    When enabled, user groups from the identity provider will be synchronized with CAST AI. A sync auth token is generated on activation and stored in sync_auth_token.
    aad SSOConnectionAad
    Azure AD connector
    additionalEmailDomains List<String>
    Additional email domains that will be allowed to sign in via the connection
    emailDomain String
    Email domain of the connection
    name String
    Connection name
    oidc SSOConnectionOidc
    OIDC connector (e.g. Keycloak)
    okta SSOConnectionOkta
    Okta connector
    syncAuthToken String
    Auth token generated when synchronizeUserGroups is enabled. Only populated on the transition from false to true.
    synchronizeUserGroups Boolean
    When enabled, user groups from the identity provider will be synchronized with CAST AI. A sync auth token is generated on activation and stored in sync_auth_token.
    aad organizationSSOConnectionAad
    Azure AD connector
    additionalEmailDomains string[]
    Additional email domains that will be allowed to sign in via the connection
    emailDomain string
    Email domain of the connection
    name string
    Connection name
    oidc organizationSSOConnectionOidc
    OIDC connector (e.g. Keycloak)
    okta organizationSSOConnectionOkta
    Okta connector
    syncAuthToken string
    Auth token generated when synchronizeUserGroups is enabled. Only populated on the transition from false to true.
    synchronizeUserGroups boolean
    When enabled, user groups from the identity provider will be synchronized with CAST AI. A sync auth token is generated on activation and stored in sync_auth_token.
    aad organization.SSOConnectionAadArgs
    Azure AD connector
    additional_email_domains Sequence[str]
    Additional email domains that will be allowed to sign in via the connection
    email_domain str
    Email domain of the connection
    name str
    Connection name
    oidc organization.SSOConnectionOidcArgs
    OIDC connector (e.g. Keycloak)
    okta organization.SSOConnectionOktaArgs
    Okta connector
    sync_auth_token str
    Auth token generated when synchronizeUserGroups is enabled. Only populated on the transition from false to true.
    synchronize_user_groups bool
    When enabled, user groups from the identity provider will be synchronized with CAST AI. A sync auth token is generated on activation and stored in sync_auth_token.
    aad Property Map
    Azure AD connector
    additionalEmailDomains List<String>
    Additional email domains that will be allowed to sign in via the connection
    emailDomain String
    Email domain of the connection
    name String
    Connection name
    oidc Property Map
    OIDC connector (e.g. Keycloak)
    okta Property Map
    Okta connector
    syncAuthToken String
    Auth token generated when synchronizeUserGroups is enabled. Only populated on the transition from false to true.
    synchronizeUserGroups Boolean
    When enabled, user groups from the identity provider will be synchronized with CAST AI. A sync auth token is generated on activation and stored in sync_auth_token.

    Supporting Types

    SSOConnectionAad, SSOConnectionAadArgs

    AdDomain string
    Azure AD domain
    ClientId string
    Azure AD client ID
    ClientSecret string
    Azure AD client secret
    AdDomain string
    Azure AD domain
    ClientId string
    Azure AD client ID
    ClientSecret string
    Azure AD client secret
    ad_domain string
    Azure AD domain
    client_id string
    Azure AD client ID
    client_secret string
    Azure AD client secret
    adDomain String
    Azure AD domain
    clientId String
    Azure AD client ID
    clientSecret String
    Azure AD client secret
    adDomain string
    Azure AD domain
    clientId string
    Azure AD client ID
    clientSecret string
    Azure AD client secret
    ad_domain str
    Azure AD domain
    client_id str
    Azure AD client ID
    client_secret str
    Azure AD client secret
    adDomain String
    Azure AD domain
    clientId String
    Azure AD client ID
    clientSecret String
    Azure AD client secret

    SSOConnectionOidc, SSOConnectionOidcArgs

    ClientId string
    OIDC client ID
    ClientSecret string
    OIDC client secret
    IssuerUrl string
    Issuer URL of the OpenID Connect provider
    Type string
    OIDC connection type (TYPE_BACK_CHANNEL or TYPE_FRONT_CHANNEL)
    ClientId string
    OIDC client ID
    ClientSecret string
    OIDC client secret
    IssuerUrl string
    Issuer URL of the OpenID Connect provider
    Type string
    OIDC connection type (TYPE_BACK_CHANNEL or TYPE_FRONT_CHANNEL)
    client_id string
    OIDC client ID
    client_secret string
    OIDC client secret
    issuer_url string
    Issuer URL of the OpenID Connect provider
    type string
    OIDC connection type (TYPE_BACK_CHANNEL or TYPE_FRONT_CHANNEL)
    clientId String
    OIDC client ID
    clientSecret String
    OIDC client secret
    issuerUrl String
    Issuer URL of the OpenID Connect provider
    type String
    OIDC connection type (TYPE_BACK_CHANNEL or TYPE_FRONT_CHANNEL)
    clientId string
    OIDC client ID
    clientSecret string
    OIDC client secret
    issuerUrl string
    Issuer URL of the OpenID Connect provider
    type string
    OIDC connection type (TYPE_BACK_CHANNEL or TYPE_FRONT_CHANNEL)
    client_id str
    OIDC client ID
    client_secret str
    OIDC client secret
    issuer_url str
    Issuer URL of the OpenID Connect provider
    type str
    OIDC connection type (TYPE_BACK_CHANNEL or TYPE_FRONT_CHANNEL)
    clientId String
    OIDC client ID
    clientSecret String
    OIDC client secret
    issuerUrl String
    Issuer URL of the OpenID Connect provider
    type String
    OIDC connection type (TYPE_BACK_CHANNEL or TYPE_FRONT_CHANNEL)

    SSOConnectionOkta, SSOConnectionOktaArgs

    ClientId string
    Okta client ID
    ClientSecret string
    Okta client secret
    OktaDomain string
    Okta domain
    ClientId string
    Okta client ID
    ClientSecret string
    Okta client secret
    OktaDomain string
    Okta domain
    client_id string
    Okta client ID
    client_secret string
    Okta client secret
    okta_domain string
    Okta domain
    clientId String
    Okta client ID
    clientSecret String
    Okta client secret
    oktaDomain String
    Okta domain
    clientId string
    Okta client ID
    clientSecret string
    Okta client secret
    oktaDomain string
    Okta domain
    client_id str
    Okta client ID
    client_secret str
    Okta client secret
    okta_domain str
    Okta domain
    clientId String
    Okta client ID
    clientSecret String
    Okta client secret
    oktaDomain String
    Okta domain

    Package Details

    Repository
    castai castai/pulumi-castai
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the castai Terraform Provider.
    castai logo
    Viewing docs for CAST AI v8.60.0
    published on Wednesday, Aug 19, 2026 by CAST AI

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial