cloudflare.getZeroTrustAccessIdentityProvider

func LookupZeroTrustAccessIdentityProvider(ctx *Context, args *LookupZeroTrustAccessIdentityProviderArgs, opts ...InvokeOption) (*LookupZeroTrustAccessIdentityProviderResult, error)
func LookupZeroTrustAccessIdentityProviderOutput(ctx *Context, args *LookupZeroTrustAccessIdentityProviderOutputArgs, opts ...InvokeOption) LookupZeroTrustAccessIdentityProviderResultOutput

> Note: This function is named LookupZeroTrustAccessIdentityProvider in the Go SDK.

AccountId string

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

Filter GetZeroTrustAccessIdentityProviderFilter

IdentityProviderId string

UUID.

ZoneId string

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

AccountId string

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

Filter GetZeroTrustAccessIdentityProviderFilter

IdentityProviderId string

UUID.

ZoneId string

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

account_id string

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

filter object

identity_provider_id string

UUID.

zone_id string

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

accountId String

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

filter GetZeroTrustAccessIdentityProviderFilter

identityProviderId String

UUID.

zoneId String

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

accountId string

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

filter GetZeroTrustAccessIdentityProviderFilter

identityProviderId string

UUID.

zoneId string

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

account_id str

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

filter GetZeroTrustAccessIdentityProviderFilter

identity_provider_id str

UUID.

zone_id str

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

accountId String

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

filter Property Map

identityProviderId String

UUID.

zoneId String

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

Config GetZeroTrustAccessIdentityProviderConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

Id string

UUID.

Name string

The name of the identity provider, shown to users on the login page.

ReadOnly bool

Indicates that the identity provider is immutable and cannot be updated or deleted via the API.

SamlCertificateSet GetZeroTrustAccessIdentityProviderSamlCertificateSet

The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.

SamlCertificateSetId string

The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.

ScimConfig GetZeroTrustAccessIdentityProviderScimConfig

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

Type string

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".

AccountId string

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

Filter GetZeroTrustAccessIdentityProviderFilter

IdentityProviderId string

UUID.

ZoneId string

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

Config GetZeroTrustAccessIdentityProviderConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

Id string

UUID.

Name string

The name of the identity provider, shown to users on the login page.

ReadOnly bool

Indicates that the identity provider is immutable and cannot be updated or deleted via the API.

SamlCertificateSet GetZeroTrustAccessIdentityProviderSamlCertificateSet

The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.

SamlCertificateSetId string

The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.

ScimConfig GetZeroTrustAccessIdentityProviderScimConfig

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

Type string

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".

AccountId string

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

Filter GetZeroTrustAccessIdentityProviderFilter

IdentityProviderId string

UUID.

ZoneId string

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

config object

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

id string

UUID.

name string

The name of the identity provider, shown to users on the login page.

read_only bool

Indicates that the identity provider is immutable and cannot be updated or deleted via the API.

saml_certificate_set object

The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.

saml_certificate_set_id string

The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.

scim_config object

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

type string

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".

account_id string

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

filter object

identity_provider_id string

UUID.

zone_id string

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

config GetZeroTrustAccessIdentityProviderConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

id String

UUID.

name String

The name of the identity provider, shown to users on the login page.

readOnly Boolean

Indicates that the identity provider is immutable and cannot be updated or deleted via the API.

samlCertificateSet GetZeroTrustAccessIdentityProviderSamlCertificateSet

The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.

samlCertificateSetId String

The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.

scimConfig GetZeroTrustAccessIdentityProviderScimConfig

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

type String

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".

accountId String

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

filter GetZeroTrustAccessIdentityProviderFilter

identityProviderId String

UUID.

zoneId String

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

config GetZeroTrustAccessIdentityProviderConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

id string

UUID.

name string

The name of the identity provider, shown to users on the login page.

readOnly boolean

Indicates that the identity provider is immutable and cannot be updated or deleted via the API.

samlCertificateSet GetZeroTrustAccessIdentityProviderSamlCertificateSet

The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.

samlCertificateSetId string

The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.

scimConfig GetZeroTrustAccessIdentityProviderScimConfig

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

type string

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".

accountId string

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

filter GetZeroTrustAccessIdentityProviderFilter

identityProviderId string

UUID.

zoneId string

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

config GetZeroTrustAccessIdentityProviderConfig

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

id str

UUID.

name str

The name of the identity provider, shown to users on the login page.

read_only bool

Indicates that the identity provider is immutable and cannot be updated or deleted via the API.

saml_certificate_set GetZeroTrustAccessIdentityProviderSamlCertificateSet

The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.

saml_certificate_set_id str

The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.

scim_config GetZeroTrustAccessIdentityProviderScimConfig

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

type str

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".

account_id str

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

filter GetZeroTrustAccessIdentityProviderFilter

identity_provider_id str

UUID.

zone_id str

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

config Property Map

The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.

id String

UUID.

name String

The name of the identity provider, shown to users on the login page.

readOnly Boolean

Indicates that the identity provider is immutable and cannot be updated or deleted via the API.

samlCertificateSet Property Map

The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.

samlCertificateSetId String

The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.

scimConfig Property Map

The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.

type String

The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".

accountId String

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

filter Property Map

identityProviderId String

UUID.

zoneId String

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

AppsDomain string

Your companies TLD

Attributes List<string>

A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.

AuthUrl string

The authorizationEndpoint URL of your IdP

AuthorizationServerId string

Your okta authorization server id

CentrifyAccount string

Your centrify account url

CentrifyAppId string

Your centrify app id

CertsUrl string

The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens

Claims List<string>

Custom claims

ClientId string

Your OAuth Client ID

ClientSecret string

Your OAuth Client Secret

ConditionalAccessEnabled bool

Should Cloudflare try to load authentication contexts from your account

DirectoryId string

Your Azure directory uuid

EmailAttributeName string

The attribute name for email in the SAML response.

EmailClaimName string

The claim name for email in the idToken response.

EnableEncryption bool

Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.

HeaderAttributes List<GetZeroTrustAccessIdentityProviderConfigHeaderAttribute>

Add a list of attribute names that will be returned in the response header from the Access callback.

IdpPublicCerts List<string>

X509 certificate to verify the signature in the SAML authentication response

IssuerUrl string

IdP Entity ID or Issuer URL

OktaAccount string

Your okta account url

OneloginAccount string

Your OneLogin account url

PingEnvId string

Your PingOne environment identifier

PkceEnabled bool

Enable Proof Key for Code Exchange (PKCE)

Prompt string

Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionRequired error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "selectAccount", "none".

RedirectUrl string

RestrictToAccountMembers bool

When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.

Scopes List<string>

OAuth scopes

SignRequest bool

Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.

SsoTargetUrl string

URL to send the SAML authentication requests to

SupportGroups bool

Should Cloudflare try to load groups from your account

TokenUrl string

The tokenEndpoint URL of your IdP

AppsDomain string

Your companies TLD

Attributes []string

A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.

AuthUrl string

The authorizationEndpoint URL of your IdP

AuthorizationServerId string

Your okta authorization server id

CentrifyAccount string

Your centrify account url

CentrifyAppId string

Your centrify app id

CertsUrl string

The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens

Claims []string

Custom claims

ClientId string

Your OAuth Client ID

ClientSecret string

Your OAuth Client Secret

ConditionalAccessEnabled bool

Should Cloudflare try to load authentication contexts from your account

DirectoryId string

Your Azure directory uuid

EmailAttributeName string

The attribute name for email in the SAML response.

EmailClaimName string

The claim name for email in the idToken response.

EnableEncryption bool

Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.

HeaderAttributes []GetZeroTrustAccessIdentityProviderConfigHeaderAttribute

Add a list of attribute names that will be returned in the response header from the Access callback.

IdpPublicCerts []string

X509 certificate to verify the signature in the SAML authentication response

IssuerUrl string

IdP Entity ID or Issuer URL

OktaAccount string

Your okta account url

OneloginAccount string

Your OneLogin account url

PingEnvId string

Your PingOne environment identifier

PkceEnabled bool

Enable Proof Key for Code Exchange (PKCE)

Prompt string

Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionRequired error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "selectAccount", "none".

RedirectUrl string

RestrictToAccountMembers bool

When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.

Scopes []string

OAuth scopes

SignRequest bool

Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.

SsoTargetUrl string

URL to send the SAML authentication requests to

SupportGroups bool

Should Cloudflare try to load groups from your account

TokenUrl string

The tokenEndpoint URL of your IdP

apps_domain string

Your companies TLD

attributes list(string)

A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.

auth_url string

The authorizationEndpoint URL of your IdP

authorization_server_id string

Your okta authorization server id

centrify_account string

Your centrify account url

centrify_app_id string

Your centrify app id

certs_url string

The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens

claims list(string)

Custom claims

client_id string

Your OAuth Client ID

client_secret string

Your OAuth Client Secret

conditional_access_enabled bool

Should Cloudflare try to load authentication contexts from your account

directory_id string

Your Azure directory uuid

email_attribute_name string

The attribute name for email in the SAML response.

email_claim_name string

The claim name for email in the idToken response.

enable_encryption bool

Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.

header_attributes list(object)

Add a list of attribute names that will be returned in the response header from the Access callback.

idp_public_certs list(string)

X509 certificate to verify the signature in the SAML authentication response

issuer_url string

IdP Entity ID or Issuer URL

okta_account string

Your okta account url

onelogin_account string

Your OneLogin account url

ping_env_id string

Your PingOne environment identifier

pkce_enabled bool

Enable Proof Key for Code Exchange (PKCE)

prompt string

Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionRequired error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "selectAccount", "none".

redirect_url string

restrict_to_account_members bool

When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.

scopes list(string)

OAuth scopes

sign_request bool

Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.

sso_target_url string

URL to send the SAML authentication requests to

support_groups bool

Should Cloudflare try to load groups from your account

token_url string

The tokenEndpoint URL of your IdP

appsDomain String

Your companies TLD

attributes List<String>

A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.

authUrl String

The authorizationEndpoint URL of your IdP

authorizationServerId String

Your okta authorization server id

centrifyAccount String

Your centrify account url

centrifyAppId String

Your centrify app id

certsUrl String

The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens

claims List<String>

Custom claims

clientId String

Your OAuth Client ID

clientSecret String

Your OAuth Client Secret

conditionalAccessEnabled Boolean

Should Cloudflare try to load authentication contexts from your account

directoryId String

Your Azure directory uuid

emailAttributeName String

The attribute name for email in the SAML response.

emailClaimName String

The claim name for email in the idToken response.

enableEncryption Boolean

Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.

headerAttributes List<GetZeroTrustAccessIdentityProviderConfigHeaderAttribute>

Add a list of attribute names that will be returned in the response header from the Access callback.

idpPublicCerts List<String>

X509 certificate to verify the signature in the SAML authentication response

issuerUrl String

IdP Entity ID or Issuer URL

oktaAccount String

Your okta account url

oneloginAccount String

Your OneLogin account url

pingEnvId String

Your PingOne environment identifier

pkceEnabled Boolean

Enable Proof Key for Code Exchange (PKCE)

prompt String

Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionRequired error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "selectAccount", "none".

redirectUrl String

restrictToAccountMembers Boolean

When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.

scopes List<String>

OAuth scopes

signRequest Boolean

Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.

ssoTargetUrl String

URL to send the SAML authentication requests to

supportGroups Boolean

Should Cloudflare try to load groups from your account

tokenUrl String

The tokenEndpoint URL of your IdP

appsDomain string

Your companies TLD

attributes string[]

A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.

authUrl string

The authorizationEndpoint URL of your IdP

authorizationServerId string

Your okta authorization server id

centrifyAccount string

Your centrify account url

centrifyAppId string

Your centrify app id

certsUrl string

The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens

claims string[]

Custom claims

clientId string

Your OAuth Client ID

clientSecret string

Your OAuth Client Secret

conditionalAccessEnabled boolean

Should Cloudflare try to load authentication contexts from your account

directoryId string

Your Azure directory uuid

emailAttributeName string

The attribute name for email in the SAML response.

emailClaimName string

The claim name for email in the idToken response.

enableEncryption boolean

Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.

headerAttributes GetZeroTrustAccessIdentityProviderConfigHeaderAttribute[]

Add a list of attribute names that will be returned in the response header from the Access callback.

idpPublicCerts string[]

X509 certificate to verify the signature in the SAML authentication response

issuerUrl string

IdP Entity ID or Issuer URL

oktaAccount string

Your okta account url

oneloginAccount string

Your OneLogin account url

pingEnvId string

Your PingOne environment identifier

pkceEnabled boolean

Enable Proof Key for Code Exchange (PKCE)

prompt string

Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionRequired error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "selectAccount", "none".

redirectUrl string

restrictToAccountMembers boolean

When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.

scopes string[]

OAuth scopes

signRequest boolean

Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.

ssoTargetUrl string

URL to send the SAML authentication requests to

supportGroups boolean

Should Cloudflare try to load groups from your account

tokenUrl string

The tokenEndpoint URL of your IdP

apps_domain str

Your companies TLD

attributes Sequence[str]

A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.

auth_url str

The authorizationEndpoint URL of your IdP

authorization_server_id str

Your okta authorization server id

centrify_account str

Your centrify account url

centrify_app_id str

Your centrify app id

certs_url str

The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens

claims Sequence[str]

Custom claims

client_id str

Your OAuth Client ID

client_secret str

Your OAuth Client Secret

conditional_access_enabled bool

Should Cloudflare try to load authentication contexts from your account

directory_id str

Your Azure directory uuid

email_attribute_name str

The attribute name for email in the SAML response.

email_claim_name str

The claim name for email in the idToken response.

enable_encryption bool

Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.

header_attributes Sequence[GetZeroTrustAccessIdentityProviderConfigHeaderAttribute]

Add a list of attribute names that will be returned in the response header from the Access callback.

idp_public_certs Sequence[str]

X509 certificate to verify the signature in the SAML authentication response

issuer_url str

IdP Entity ID or Issuer URL

okta_account str

Your okta account url

onelogin_account str

Your OneLogin account url

ping_env_id str

Your PingOne environment identifier

pkce_enabled bool

Enable Proof Key for Code Exchange (PKCE)

prompt str

Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionRequired error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "selectAccount", "none".

redirect_url str

restrict_to_account_members bool

When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.

scopes Sequence[str]

OAuth scopes

sign_request bool

Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.

sso_target_url str

URL to send the SAML authentication requests to

support_groups bool

Should Cloudflare try to load groups from your account

token_url str

The tokenEndpoint URL of your IdP

appsDomain String

Your companies TLD

attributes List<String>

A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.

authUrl String

The authorizationEndpoint URL of your IdP

authorizationServerId String

Your okta authorization server id

centrifyAccount String

Your centrify account url

centrifyAppId String

Your centrify app id

certsUrl String

The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens

claims List<String>

Custom claims

clientId String

Your OAuth Client ID

clientSecret String

Your OAuth Client Secret

conditionalAccessEnabled Boolean

Should Cloudflare try to load authentication contexts from your account

directoryId String

Your Azure directory uuid

emailAttributeName String

The attribute name for email in the SAML response.

emailClaimName String

The claim name for email in the idToken response.

enableEncryption Boolean

Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.

headerAttributes List<Property Map>

Add a list of attribute names that will be returned in the response header from the Access callback.

idpPublicCerts List<String>

X509 certificate to verify the signature in the SAML authentication response

issuerUrl String

IdP Entity ID or Issuer URL

oktaAccount String

Your okta account url

oneloginAccount String

Your OneLogin account url

pingEnvId String

Your PingOne environment identifier

pkceEnabled Boolean

Enable Proof Key for Code Exchange (PKCE)

prompt String

Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionRequired error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "selectAccount", "none".

redirectUrl String

restrictToAccountMembers Boolean

When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.

scopes List<String>

OAuth scopes

signRequest Boolean

Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.

ssoTargetUrl String

URL to send the SAML authentication requests to

supportGroups Boolean

Should Cloudflare try to load groups from your account

tokenUrl String

The tokenEndpoint URL of your IdP

AttributeName string

attribute name from the IDP

HeaderName string

header that will be added on the request to the origin

AttributeName string

attribute name from the IDP

HeaderName string

header that will be added on the request to the origin

attribute_name string

attribute name from the IDP

header_name string

header that will be added on the request to the origin

attributeName String

attribute name from the IDP

headerName String

header that will be added on the request to the origin

attributeName string

attribute name from the IDP

headerName string

header that will be added on the request to the origin

attribute_name str

attribute name from the IDP

header_name str

header that will be added on the request to the origin

attributeName String

attribute name from the IDP

headerName String

header that will be added on the request to the origin

ScimEnabled string

Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.

ScimEnabled string

Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.

scim_enabled string

Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.

scimEnabled String

Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.

scimEnabled string

Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.

scim_enabled str

Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.

scimEnabled String

Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.

CreatedAt string

Timestamp when the certificate set was created

CurrentCertificate GetZeroTrustAccessIdentityProviderSamlCertificateSetCurrentCertificate

The currently active certificate used for encrypting SAML assertions

PreviousCertificate string

The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of samlCertificate.

Uid string

Unique identifier for the certificate set

UpdatedAt string

Timestamp when the certificate set was last updated (e.g., during rotation)

CreatedAt string

Timestamp when the certificate set was created

CurrentCertificate GetZeroTrustAccessIdentityProviderSamlCertificateSetCurrentCertificate

The currently active certificate used for encrypting SAML assertions

PreviousCertificate string

The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of samlCertificate.

Uid string

Unique identifier for the certificate set

UpdatedAt string

Timestamp when the certificate set was last updated (e.g., during rotation)

created_at string

Timestamp when the certificate set was created

current_certificate object

The currently active certificate used for encrypting SAML assertions

previous_certificate string

The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of samlCertificate.

uid string

Unique identifier for the certificate set

updated_at string

Timestamp when the certificate set was last updated (e.g., during rotation)

createdAt String

Timestamp when the certificate set was created

currentCertificate GetZeroTrustAccessIdentityProviderSamlCertificateSetCurrentCertificate

The currently active certificate used for encrypting SAML assertions

previousCertificate String

The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of samlCertificate.

uid String

Unique identifier for the certificate set

updatedAt String

Timestamp when the certificate set was last updated (e.g., during rotation)

createdAt string

Timestamp when the certificate set was created

currentCertificate GetZeroTrustAccessIdentityProviderSamlCertificateSetCurrentCertificate

The currently active certificate used for encrypting SAML assertions

previousCertificate string

The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of samlCertificate.

uid string

Unique identifier for the certificate set

updatedAt string

Timestamp when the certificate set was last updated (e.g., during rotation)

created_at str

Timestamp when the certificate set was created

current_certificate GetZeroTrustAccessIdentityProviderSamlCertificateSetCurrentCertificate

The currently active certificate used for encrypting SAML assertions

previous_certificate str

The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of samlCertificate.

uid str

Unique identifier for the certificate set

updated_at str

Timestamp when the certificate set was last updated (e.g., during rotation)

createdAt String

Timestamp when the certificate set was created

currentCertificate Property Map

The currently active certificate used for encrypting SAML assertions

previousCertificate String

The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of samlCertificate.

uid String

Unique identifier for the certificate set

updatedAt String

Timestamp when the certificate set was last updated (e.g., during rotation)

IsCurrent bool

Indicates whether this is the currently active certificate

NotAfter string

Certificate expiration date. Certificates are automatically rotated 30 days before expiration.

PublicCertificate string

PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.

Uid string

Unique identifier for the certificate

IsCurrent bool

Indicates whether this is the currently active certificate

NotAfter string

Certificate expiration date. Certificates are automatically rotated 30 days before expiration.

PublicCertificate string

PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.

Uid string

Unique identifier for the certificate

is_current bool

Indicates whether this is the currently active certificate

not_after string

Certificate expiration date. Certificates are automatically rotated 30 days before expiration.

public_certificate string

PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.

uid string

Unique identifier for the certificate

isCurrent Boolean

Indicates whether this is the currently active certificate

notAfter String

Certificate expiration date. Certificates are automatically rotated 30 days before expiration.

publicCertificate String

PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.

uid String

Unique identifier for the certificate

isCurrent boolean

Indicates whether this is the currently active certificate

notAfter string

Certificate expiration date. Certificates are automatically rotated 30 days before expiration.

publicCertificate string

PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.

uid string

Unique identifier for the certificate

is_current bool

Indicates whether this is the currently active certificate

not_after str

Certificate expiration date. Certificates are automatically rotated 30 days before expiration.

public_certificate str

PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.

uid str

Unique identifier for the certificate

isCurrent Boolean

Indicates whether this is the currently active certificate

notAfter String

Certificate expiration date. Certificates are automatically rotated 30 days before expiration.

publicCertificate String

PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.

uid String

Unique identifier for the certificate

Enabled bool

A flag to enable or disable SCIM for the identity provider.

IdentityUpdateBehavior string

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".

ScimBaseUrl string

The base URL of Cloudflare's SCIM V2.0 API endpoint.

SeatDeprovision bool

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless userDeprovision is also enabled.

Secret string

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.

UserDeprovision bool

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

Enabled bool

A flag to enable or disable SCIM for the identity provider.

IdentityUpdateBehavior string

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".

ScimBaseUrl string

The base URL of Cloudflare's SCIM V2.0 API endpoint.

SeatDeprovision bool

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless userDeprovision is also enabled.

Secret string

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.

UserDeprovision bool

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled bool

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior string

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".

scim_base_url string

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision bool

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless userDeprovision is also enabled.

secret string

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.

user_deprovision bool

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled Boolean

A flag to enable or disable SCIM for the identity provider.

identityUpdateBehavior String

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".

scimBaseUrl String

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seatDeprovision Boolean

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless userDeprovision is also enabled.

secret String

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.

userDeprovision Boolean

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled boolean

A flag to enable or disable SCIM for the identity provider.

identityUpdateBehavior string

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".

scimBaseUrl string

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seatDeprovision boolean

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless userDeprovision is also enabled.

secret string

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.

userDeprovision boolean

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled bool

A flag to enable or disable SCIM for the identity provider.

identity_update_behavior str

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".

scim_base_url str

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seat_deprovision bool

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless userDeprovision is also enabled.

secret str

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.

user_deprovision bool

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled Boolean

A flag to enable or disable SCIM for the identity provider.

identityUpdateBehavior String

Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".

scimBaseUrl String

The base URL of Cloudflare's SCIM V2.0 API endpoint.

seatDeprovision Boolean

A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless userDeprovision is also enabled.

secret String

A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.

userDeprovision Boolean

A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.