Cloudflare v6.1.2, Apr 28 25

Cloudflare v6.1.2 published on Monday, Apr 28, 2025 by Pulumi

cloudflare.getZeroTrustAccessIdentityProviders

Explore with Pulumi AI

Cloudflare v6.1.2 published on Monday, Apr 28, 2025 by Pulumi

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const exampleZeroTrustAccessIdentityProviders = cloudflare.getZeroTrustAccessIdentityProviders({
    accountId: "account_id",
    zoneId: "zone_id",
    scimEnabled: "scim_enabled",
});

import pulumi
import pulumi_cloudflare as cloudflare

example_zero_trust_access_identity_providers = cloudflare.get_zero_trust_access_identity_providers(account_id="account_id",
    zone_id="zone_id",
    scim_enabled="scim_enabled")

package main

import (
	"github.com/pulumi/pulumi-cloudflare/sdk/v6/go/cloudflare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudflare.LookupZeroTrustAccessIdentityProviders(ctx, &cloudflare.LookupZeroTrustAccessIdentityProvidersArgs{
			AccountId:   pulumi.StringRef("account_id"),
			ZoneId:      pulumi.StringRef("zone_id"),
			ScimEnabled: pulumi.StringRef("scim_enabled"),
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

return await Deployment.RunAsync(() => 
{
    var exampleZeroTrustAccessIdentityProviders = Cloudflare.GetZeroTrustAccessIdentityProviders.Invoke(new()
    {
        AccountId = "account_id",
        ZoneId = "zone_id",
        ScimEnabled = "scim_enabled",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudflare.CloudflareFunctions;
import com.pulumi.cloudflare.inputs.GetZeroTrustAccessIdentityProvidersArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var exampleZeroTrustAccessIdentityProviders = CloudflareFunctions.getZeroTrustAccessIdentityProviders(GetZeroTrustAccessIdentityProvidersArgs.builder()
            .accountId("account_id")
            .zoneId("zone_id")
            .scimEnabled("scim_enabled")
            .build());

    }
}

variables:
  exampleZeroTrustAccessIdentityProviders:
    fn::invoke:
      function: cloudflare:getZeroTrustAccessIdentityProviders
      arguments:
        accountId: account_id
        zoneId: zone_id
        scimEnabled: scim_enabled

Using getZeroTrustAccessIdentityProviders

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getZeroTrustAccessIdentityProviders(args: GetZeroTrustAccessIdentityProvidersArgs, opts?: InvokeOptions): Promise<GetZeroTrustAccessIdentityProvidersResult>
function getZeroTrustAccessIdentityProvidersOutput(args: GetZeroTrustAccessIdentityProvidersOutputArgs, opts?: InvokeOptions): Output<GetZeroTrustAccessIdentityProvidersResult>

def get_zero_trust_access_identity_providers(account_id: Optional[str] = None,
                                             max_items: Optional[int] = None,
                                             scim_enabled: Optional[str] = None,
                                             zone_id: Optional[str] = None,
                                             opts: Optional[InvokeOptions] = None) -> GetZeroTrustAccessIdentityProvidersResult
def get_zero_trust_access_identity_providers_output(account_id: Optional[pulumi.Input[str]] = None,
                                             max_items: Optional[pulumi.Input[int]] = None,
                                             scim_enabled: Optional[pulumi.Input[str]] = None,
                                             zone_id: Optional[pulumi.Input[str]] = None,
                                             opts: Optional[InvokeOptions] = None) -> Output[GetZeroTrustAccessIdentityProvidersResult]

func LookupZeroTrustAccessIdentityProviders(ctx *Context, args *LookupZeroTrustAccessIdentityProvidersArgs, opts ...InvokeOption) (*LookupZeroTrustAccessIdentityProvidersResult, error)
func LookupZeroTrustAccessIdentityProvidersOutput(ctx *Context, args *LookupZeroTrustAccessIdentityProvidersOutputArgs, opts ...InvokeOption) LookupZeroTrustAccessIdentityProvidersResultOutput

> Note: This function is named LookupZeroTrustAccessIdentityProviders in the Go SDK.

public static class GetZeroTrustAccessIdentityProviders 
{
    public static Task<GetZeroTrustAccessIdentityProvidersResult> InvokeAsync(GetZeroTrustAccessIdentityProvidersArgs args, InvokeOptions? opts = null)
    public static Output<GetZeroTrustAccessIdentityProvidersResult> Invoke(GetZeroTrustAccessIdentityProvidersInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetZeroTrustAccessIdentityProvidersResult> getZeroTrustAccessIdentityProviders(GetZeroTrustAccessIdentityProvidersArgs args, InvokeOptions options)
public static Output<GetZeroTrustAccessIdentityProvidersResult> getZeroTrustAccessIdentityProviders(GetZeroTrustAccessIdentityProvidersArgs args, InvokeOptions options)

fn::invoke:
  function: cloudflare:index/getZeroTrustAccessIdentityProviders:getZeroTrustAccessIdentityProviders
  arguments:
    # arguments dictionary

The following arguments are supported:

AccountId string: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
MaxItems int: Max items to fetch, default: 1000
ScimEnabled string: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
ZoneId string: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

AccountId string: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
MaxItems int: Max items to fetch, default: 1000
ScimEnabled string: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
ZoneId string: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

accountId String: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
maxItems Integer: Max items to fetch, default: 1000
scimEnabled String: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
zoneId String: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

accountId string: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
maxItems number: Max items to fetch, default: 1000
scimEnabled string: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
zoneId string: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

account_id str: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
max_items int: Max items to fetch, default: 1000
scim_enabled str: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
zone_id str: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

accountId String: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
maxItems Number: Max items to fetch, default: 1000
scimEnabled String: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
zoneId String: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

getZeroTrustAccessIdentityProviders Result

The following output properties are available:

Id string: The provider-assigned unique ID for this managed resource.
Results List<GetZeroTrustAccessIdentityProvidersResult>: The items returned by the data source
AccountId string: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
MaxItems int: Max items to fetch, default: 1000
ScimEnabled string: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
ZoneId string: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

Id string: The provider-assigned unique ID for this managed resource.
Results []GetZeroTrustAccessIdentityProvidersResult: The items returned by the data source
AccountId string: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
MaxItems int: Max items to fetch, default: 1000
ScimEnabled string: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
ZoneId string: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

id String: The provider-assigned unique ID for this managed resource.
results List<GetZeroTrustAccessIdentityProvidersResult>: The items returned by the data source
accountId String: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
maxItems Integer: Max items to fetch, default: 1000
scimEnabled String: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
zoneId String: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

id string: The provider-assigned unique ID for this managed resource.
results GetZeroTrustAccessIdentityProvidersResult[]: The items returned by the data source
accountId string: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
maxItems number: Max items to fetch, default: 1000
scimEnabled string: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
zoneId string: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

id str: The provider-assigned unique ID for this managed resource.
results Sequence[GetZeroTrustAccessIdentityProvidersResult]: The items returned by the data source
account_id str: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
max_items int: Max items to fetch, default: 1000
scim_enabled str: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
zone_id str: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

id String: The provider-assigned unique ID for this managed resource.
results List<Property Map>: The items returned by the data source
accountId String: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
maxItems Number: Max items to fetch, default: 1000
scimEnabled String: Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
zoneId String: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

Supporting Types

GetZeroTrustAccessIdentityProvidersResult

Config GetZeroTrustAccessIdentityProvidersResultConfig: The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Id string: UUID.
Name string: The name of the identity provider, shown to users on the login page.
ScimConfig GetZeroTrustAccessIdentityProvidersResultScimConfig: The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Type string: The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".

Config GetZeroTrustAccessIdentityProvidersResultConfig: The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Id string: UUID.
Name string: The name of the identity provider, shown to users on the login page.
ScimConfig GetZeroTrustAccessIdentityProvidersResultScimConfig: The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Type string: The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".

config GetZeroTrustAccessIdentityProvidersResultConfig: The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
id String: UUID.
name String: The name of the identity provider, shown to users on the login page.
scimConfig GetZeroTrustAccessIdentityProvidersResultScimConfig: The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
type String: The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".

config GetZeroTrustAccessIdentityProvidersResultConfig: The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
id string: UUID.
name string: The name of the identity provider, shown to users on the login page.
scimConfig GetZeroTrustAccessIdentityProvidersResultScimConfig: The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
type string: The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".

config GetZeroTrustAccessIdentityProvidersResultConfig: The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
id str: UUID.
name str: The name of the identity provider, shown to users on the login page.
scim_config GetZeroTrustAccessIdentityProvidersResultScimConfig: The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
type str: The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".

config Property Map: The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
id String: UUID.
name String: The name of the identity provider, shown to users on the login page.
scimConfig Property Map: The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
type String: The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex".

GetZeroTrustAccessIdentityProvidersResultConfig

AppsDomain string: Your companies TLD
Attributes List<string>: A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
AuthUrl string: The authorization_endpoint URL of your IdP
AuthorizationServerId string: Your okta authorization server id
CentrifyAccount string: Your centrify account url
CentrifyAppId string: Your centrify app id
CertsUrl string: The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
Claims List<string>: Custom claims
ClientId string: Your OAuth Client ID
ClientSecret string: Your OAuth Client Secret
ConditionalAccessEnabled bool: Should Cloudflare try to load authentication contexts from your account
DirectoryId string: Your Azure directory uuid
EmailAttributeName string: The attribute name for email in the SAML response.
EmailClaimName string: The claim name for email in the id_token response.
HeaderAttributes List<GetZeroTrustAccessIdentityProvidersResultConfigHeaderAttribute>: Add a list of attribute names that will be returned in the response header from the Access callback.
IdpPublicCerts List<string>: X509 certificate to verify the signature in the SAML authentication response
IssuerUrl string: IdP Entity ID or Issuer URL
OktaAccount string: Your okta account url
OneloginAccount string: Your OneLogin account url
PingEnvId string: Your PingOne environment identifier
PkceEnabled bool: Enable Proof Key for Code Exchange (PKCE)
Prompt string: Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".
Scopes List<string>: OAuth scopes
SignRequest bool: Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
SsoTargetUrl string: URL to send the SAML authentication requests to
SupportGroups bool: Should Cloudflare try to load groups from your account
TokenUrl string: The token_endpoint URL of your IdP

AppsDomain string: Your companies TLD
Attributes []string: A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
AuthUrl string: The authorization_endpoint URL of your IdP
AuthorizationServerId string: Your okta authorization server id
CentrifyAccount string: Your centrify account url
CentrifyAppId string: Your centrify app id
CertsUrl string: The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
Claims []string: Custom claims
ClientId string: Your OAuth Client ID
ClientSecret string: Your OAuth Client Secret
ConditionalAccessEnabled bool: Should Cloudflare try to load authentication contexts from your account
DirectoryId string: Your Azure directory uuid
EmailAttributeName string: The attribute name for email in the SAML response.
EmailClaimName string: The claim name for email in the id_token response.
HeaderAttributes []GetZeroTrustAccessIdentityProvidersResultConfigHeaderAttribute: Add a list of attribute names that will be returned in the response header from the Access callback.
IdpPublicCerts []string: X509 certificate to verify the signature in the SAML authentication response
IssuerUrl string: IdP Entity ID or Issuer URL
OktaAccount string: Your okta account url
OneloginAccount string: Your OneLogin account url
PingEnvId string: Your PingOne environment identifier
PkceEnabled bool: Enable Proof Key for Code Exchange (PKCE)
Prompt string: Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".
Scopes []string: OAuth scopes
SignRequest bool: Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
SsoTargetUrl string: URL to send the SAML authentication requests to
SupportGroups bool: Should Cloudflare try to load groups from your account
TokenUrl string: The token_endpoint URL of your IdP

appsDomain String: Your companies TLD
attributes List<String>: A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
authUrl String: The authorization_endpoint URL of your IdP
authorizationServerId String: Your okta authorization server id
centrifyAccount String: Your centrify account url
centrifyAppId String: Your centrify app id
certsUrl String: The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
claims List<String>: Custom claims
clientId String: Your OAuth Client ID
clientSecret String: Your OAuth Client Secret
conditionalAccessEnabled Boolean: Should Cloudflare try to load authentication contexts from your account
directoryId String: Your Azure directory uuid
emailAttributeName String: The attribute name for email in the SAML response.
emailClaimName String: The claim name for email in the id_token response.
headerAttributes List<GetZeroTrustAccessIdentityProvidersResultConfigHeaderAttribute>: Add a list of attribute names that will be returned in the response header from the Access callback.
idpPublicCerts List<String>: X509 certificate to verify the signature in the SAML authentication response
issuerUrl String: IdP Entity ID or Issuer URL
oktaAccount String: Your okta account url
oneloginAccount String: Your OneLogin account url
pingEnvId String: Your PingOne environment identifier
pkceEnabled Boolean: Enable Proof Key for Code Exchange (PKCE)
prompt String: Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".
scopes List<String>: OAuth scopes
signRequest Boolean: Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
ssoTargetUrl String: URL to send the SAML authentication requests to
supportGroups Boolean: Should Cloudflare try to load groups from your account
tokenUrl String: The token_endpoint URL of your IdP

appsDomain string: Your companies TLD
attributes string[]: A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
authUrl string: The authorization_endpoint URL of your IdP
authorizationServerId string: Your okta authorization server id
centrifyAccount string: Your centrify account url
centrifyAppId string: Your centrify app id
certsUrl string: The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
claims string[]: Custom claims
clientId string: Your OAuth Client ID
clientSecret string: Your OAuth Client Secret
conditionalAccessEnabled boolean: Should Cloudflare try to load authentication contexts from your account
directoryId string: Your Azure directory uuid
emailAttributeName string: The attribute name for email in the SAML response.
emailClaimName string: The claim name for email in the id_token response.
headerAttributes GetZeroTrustAccessIdentityProvidersResultConfigHeaderAttribute[]: Add a list of attribute names that will be returned in the response header from the Access callback.
idpPublicCerts string[]: X509 certificate to verify the signature in the SAML authentication response
issuerUrl string: IdP Entity ID or Issuer URL
oktaAccount string: Your okta account url
oneloginAccount string: Your OneLogin account url
pingEnvId string: Your PingOne environment identifier
pkceEnabled boolean: Enable Proof Key for Code Exchange (PKCE)
prompt string: Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".
scopes string[]: OAuth scopes
signRequest boolean: Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
ssoTargetUrl string: URL to send the SAML authentication requests to
supportGroups boolean: Should Cloudflare try to load groups from your account
tokenUrl string: The token_endpoint URL of your IdP

apps_domain str: Your companies TLD
attributes Sequence[str]: A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
auth_url str: The authorization_endpoint URL of your IdP
authorization_server_id str: Your okta authorization server id
centrify_account str: Your centrify account url
centrify_app_id str: Your centrify app id
certs_url str: The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
claims Sequence[str]: Custom claims
client_id str: Your OAuth Client ID
client_secret str: Your OAuth Client Secret
conditional_access_enabled bool: Should Cloudflare try to load authentication contexts from your account
directory_id str: Your Azure directory uuid
email_attribute_name str: The attribute name for email in the SAML response.
email_claim_name str: The claim name for email in the id_token response.
header_attributes Sequence[GetZeroTrustAccessIdentityProvidersResultConfigHeaderAttribute]: Add a list of attribute names that will be returned in the response header from the Access callback.
idp_public_certs Sequence[str]: X509 certificate to verify the signature in the SAML authentication response
issuer_url str: IdP Entity ID or Issuer URL
okta_account str: Your okta account url
onelogin_account str: Your OneLogin account url
ping_env_id str: Your PingOne environment identifier
pkce_enabled bool: Enable Proof Key for Code Exchange (PKCE)
prompt str: Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".
scopes Sequence[str]: OAuth scopes
sign_request bool: Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
sso_target_url str: URL to send the SAML authentication requests to
support_groups bool: Should Cloudflare try to load groups from your account
token_url str: The token_endpoint URL of your IdP

appsDomain String: Your companies TLD
attributes List<String>: A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
authUrl String: The authorization_endpoint URL of your IdP
authorizationServerId String: Your okta authorization server id
centrifyAccount String: Your centrify account url
centrifyAppId String: Your centrify app id
certsUrl String: The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
claims List<String>: Custom claims
clientId String: Your OAuth Client ID
clientSecret String: Your OAuth Client Secret
conditionalAccessEnabled Boolean: Should Cloudflare try to load authentication contexts from your account
directoryId String: Your Azure directory uuid
emailAttributeName String: The attribute name for email in the SAML response.
emailClaimName String: The claim name for email in the id_token response.
headerAttributes List<Property Map>: Add a list of attribute names that will be returned in the response header from the Access callback.
idpPublicCerts List<String>: X509 certificate to verify the signature in the SAML authentication response
issuerUrl String: IdP Entity ID or Issuer URL
oktaAccount String: Your okta account url
oneloginAccount String: Your OneLogin account url
pingEnvId String: Your PingOne environment identifier
pkceEnabled Boolean: Enable Proof Key for Code Exchange (PKCE)
prompt String: Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionrequired error. prompt=selectaccount interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "select_account", "none".
scopes List<String>: OAuth scopes
signRequest Boolean: Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
ssoTargetUrl String: URL to send the SAML authentication requests to
supportGroups Boolean: Should Cloudflare try to load groups from your account
tokenUrl String: The token_endpoint URL of your IdP

GetZeroTrustAccessIdentityProvidersResultConfigHeaderAttribute

AttributeName string: attribute name from the IDP
HeaderName string: header that will be added on the request to the origin

AttributeName string: attribute name from the IDP
HeaderName string: header that will be added on the request to the origin

attributeName String: attribute name from the IDP
headerName String: header that will be added on the request to the origin

attributeName string: attribute name from the IDP
headerName string: header that will be added on the request to the origin

attribute_name str: attribute name from the IDP
header_name str: header that will be added on the request to the origin

attributeName String: attribute name from the IDP
headerName String: header that will be added on the request to the origin

GetZeroTrustAccessIdentityProvidersResultScimConfig

Enabled bool: A flag to enable or disable SCIM for the identity provider.
IdentityUpdateBehavior string: Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
ScimBaseUrl string: The base URL of Cloudflare's SCIM V2.0 API endpoint.
SeatDeprovision bool: A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
Secret string: A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
UserDeprovision bool: A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

Enabled bool: A flag to enable or disable SCIM for the identity provider.
IdentityUpdateBehavior string: Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
ScimBaseUrl string: The base URL of Cloudflare's SCIM V2.0 API endpoint.
SeatDeprovision bool: A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
Secret string: A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
UserDeprovision bool: A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled Boolean: A flag to enable or disable SCIM for the identity provider.
identityUpdateBehavior String: Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
scimBaseUrl String: The base URL of Cloudflare's SCIM V2.0 API endpoint.
seatDeprovision Boolean: A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
secret String: A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
userDeprovision Boolean: A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled boolean: A flag to enable or disable SCIM for the identity provider.
identityUpdateBehavior string: Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
scimBaseUrl string: The base URL of Cloudflare's SCIM V2.0 API endpoint.
seatDeprovision boolean: A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
secret string: A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
userDeprovision boolean: A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled bool: A flag to enable or disable SCIM for the identity provider.
identity_update_behavior str: Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
scim_base_url str: The base URL of Cloudflare's SCIM V2.0 API endpoint.
seat_deprovision bool: A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
secret str: A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
user_deprovision bool: A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

enabled Boolean: A flag to enable or disable SCIM for the identity provider.
identityUpdateBehavior String: Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
scimBaseUrl String: The base URL of Cloudflare's SCIM V2.0 API endpoint.
seatDeprovision Boolean: A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
secret String: A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
userDeprovision Boolean: A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

Package Details

Repository: Cloudflare pulumi/pulumi-cloudflare
License: Apache-2.0
Notes: This Pulumi package is based on the cloudflare Terraform Provider.

Cloudflare v6.1.2 published on Monday, Apr 28, 2025 by Pulumi

pulumi/pulumi-cloudflare

cloudflare.getZeroTrustAccessIdentityProviders

On this page

On this page

Example Usage

Using getZeroTrustAccessIdentityProviders

getZeroTrustAccessIdentityProviders Result

Supporting Types

GetZeroTrustAccessIdentityProvidersResult

GetZeroTrustAccessIdentityProvidersResultConfig

GetZeroTrustAccessIdentityProvidersResultConfigHeaderAttribute

GetZeroTrustAccessIdentityProvidersResultScimConfig

Package Details

On this page

On this page