Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. Cloudflare Provider
  4. API Docs
  5. ZeroTrustAccessIdentityProvider
Viewing docs for Cloudflare v6.18.0
published on Thursday, Jul 16, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-cloudflare

cloudflare.ZeroTrustAccessIdentityProvider

cloudflare logo
Viewing docs for Cloudflare v6.18.0
published on Thursday, Jul 16, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-cloudflare

    Accepted Permissions

    • Access: Organizations, Identity Providers, and Groups Read
    • Access: Organizations, Identity Providers, and Groups Write

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const exampleZeroTrustAccessIdentityProvider = new cloudflare.ZeroTrustAccessIdentityProvider("example_zero_trust_access_identity_provider", {
    config: {
        claims: [
            "email_verified",
            "preferred_username",
            "custom_claim_name",
        ],
        clientId: "<your client id>",
        clientSecret: "<your client secret>",
        conditionalAccessEnabled: true,
        directoryId: "<your azure directory uuid>",
        emailClaimName: "custom_claim_name",
        prompt: "login",
        supportGroups: true,
    },
    name: "Widget Corps IDP",
    type: "onetimepin",
    zoneId: "zone_id",
    scimConfig: {
        enabled: true,
        identityUpdateBehavior: "automatic",
        seatDeprovision: true,
        userDeprovision: true,
    },
});

    import pulumi
import pulumi_cloudflare as cloudflare

example_zero_trust_access_identity_provider = cloudflare.ZeroTrustAccessIdentityProvider("example_zero_trust_access_identity_provider",
    config={
        "claims": [
            "email_verified",
            "preferred_username",
            "custom_claim_name",
        ],
        "client_id": "<your client id>",
        "client_secret": "<your client secret>",
        "conditional_access_enabled": True,
        "directory_id": "<your azure directory uuid>",
        "email_claim_name": "custom_claim_name",
        "prompt": "login",
        "support_groups": True,
    },
    name="Widget Corps IDP",
    type="onetimepin",
    zone_id="zone_id",
    scim_config={
        "enabled": True,
        "identity_update_behavior": "automatic",
        "seat_deprovision": True,
        "user_deprovision": True,
    })

    package main

import (
	"github.com/pulumi/pulumi-cloudflare/sdk/v6/go/cloudflare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudflare.NewZeroTrustAccessIdentityProvider(ctx, "example_zero_trust_access_identity_provider", &cloudflare.ZeroTrustAccessIdentityProviderArgs{
			Config: &cloudflare.ZeroTrustAccessIdentityProviderConfigArgs{
				Claims: pulumi.StringArray{
					pulumi.String("email_verified"),
					pulumi.String("preferred_username"),
					pulumi.String("custom_claim_name"),
				},
				ClientId:                 pulumi.String("<your client id>"),
				ClientSecret:             pulumi.String("<your client secret>"),
				ConditionalAccessEnabled: pulumi.Bool(true),
				DirectoryId:              pulumi.String("<your azure directory uuid>"),
				EmailClaimName:           pulumi.String("custom_claim_name"),
				Prompt:                   pulumi.String("login"),
				SupportGroups:            pulumi.Bool(true),
			},
			Name:   pulumi.String("Widget Corps IDP"),
			Type:   pulumi.String("onetimepin"),
			ZoneId: pulumi.String("zone_id"),
			ScimConfig: &cloudflare.ZeroTrustAccessIdentityProviderScimConfigArgs{
				Enabled:                pulumi.Bool(true),
				IdentityUpdateBehavior: pulumi.String("automatic"),
				SeatDeprovision:        pulumi.Bool(true),
				UserDeprovision:        pulumi.Bool(true),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

return await Deployment.RunAsync(() => 
{
    var exampleZeroTrustAccessIdentityProvider = new Cloudflare.ZeroTrustAccessIdentityProvider("example_zero_trust_access_identity_provider", new()
    {
        Config = new Cloudflare.Inputs.ZeroTrustAccessIdentityProviderConfigArgs
        {
            Claims = new[]
            {
                "email_verified",
                "preferred_username",
                "custom_claim_name",
            },
            ClientId = "<your client id>",
            ClientSecret = "<your client secret>",
            ConditionalAccessEnabled = true,
            DirectoryId = "<your azure directory uuid>",
            EmailClaimName = "custom_claim_name",
            Prompt = "login",
            SupportGroups = true,
        },
        Name = "Widget Corps IDP",
        Type = "onetimepin",
        ZoneId = "zone_id",
        ScimConfig = new Cloudflare.Inputs.ZeroTrustAccessIdentityProviderScimConfigArgs
        {
            Enabled = true,
            IdentityUpdateBehavior = "automatic",
            SeatDeprovision = true,
            UserDeprovision = true,
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudflare.ZeroTrustAccessIdentityProvider;
import com.pulumi.cloudflare.ZeroTrustAccessIdentityProviderArgs;
import com.pulumi.cloudflare.inputs.ZeroTrustAccessIdentityProviderConfigArgs;
import com.pulumi.cloudflare.inputs.ZeroTrustAccessIdentityProviderScimConfigArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var exampleZeroTrustAccessIdentityProvider = new ZeroTrustAccessIdentityProvider("exampleZeroTrustAccessIdentityProvider", ZeroTrustAccessIdentityProviderArgs.builder()
            .config(ZeroTrustAccessIdentityProviderConfigArgs.builder()
                .claims(                
                    "email_verified",
                    "preferred_username",
                    "custom_claim_name")
                .clientId("<your client id>")
                .clientSecret("<your client secret>")
                .conditionalAccessEnabled(true)
                .directoryId("<your azure directory uuid>")
                .emailClaimName("custom_claim_name")
                .prompt("login")
                .supportGroups(true)
                .build())
            .name("Widget Corps IDP")
            .type("onetimepin")
            .zoneId("zone_id")
            .scimConfig(ZeroTrustAccessIdentityProviderScimConfigArgs.builder()
                .enabled(true)
                .identityUpdateBehavior("automatic")
                .seatDeprovision(true)
                .userDeprovision(true)
                .build())
            .build());

    }
}

    resources:
  exampleZeroTrustAccessIdentityProvider:
    type: cloudflare:ZeroTrustAccessIdentityProvider
    name: example_zero_trust_access_identity_provider
    properties:
      config:
        claims:
          - email_verified
          - preferred_username
          - custom_claim_name
        clientId: <your client id>
        clientSecret: <your client secret>
        conditionalAccessEnabled: true
        directoryId: <your azure directory uuid>
        emailClaimName: custom_claim_name
        prompt: login
        supportGroups: true
      name: Widget Corps IDP
      type: onetimepin
      zoneId: zone_id
      scimConfig:
        enabled: true
        identityUpdateBehavior: automatic
        seatDeprovision: true
        userDeprovision: true

    pulumi {
  required_providers {
    cloudflare = {
      source = "pulumi/cloudflare"
    }
  }
}

resource "cloudflare_zerotrustaccessidentityprovider" "example_zero_trust_access_identity_provider" {
  config = {
    claims                     = ["email_verified", "preferred_username", "custom_claim_name"]
    client_id                  = "<your client id>"
    client_secret              = "<your client secret>"
    conditional_access_enabled = true
    directory_id               = "<your azure directory uuid>"
    email_claim_name           = "custom_claim_name"
    prompt                     = "login"
    support_groups             = true
  }
  name    = "Widget Corps IDP"
  type    = "onetimepin"
  zone_id = "zone_id"
  scim_config = {
    enabled                  = true
    identity_update_behavior = "automatic"
    seat_deprovision         = true
    user_deprovision         = true
  }
}

    Create ZeroTrustAccessIdentityProvider Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ZeroTrustAccessIdentityProvider(name: string, args: ZeroTrustAccessIdentityProviderArgs, opts?: CustomResourceOptions);
    @overload
def ZeroTrustAccessIdentityProvider(resource_name: str,
                                    args: ZeroTrustAccessIdentityProviderArgs,
                                    opts: Optional[ResourceOptions] = None)

@overload
def ZeroTrustAccessIdentityProvider(resource_name: str,
                                    opts: Optional[ResourceOptions] = None,
                                    config: Optional[ZeroTrustAccessIdentityProviderConfigArgs] = None,
                                    name: Optional[str] = None,
                                    type: Optional[str] = None,
                                    account_id: Optional[str] = None,
                                    read_only: Optional[bool] = None,
                                    saml_certificate_set_id: Optional[str] = None,
                                    scim_config: Optional[ZeroTrustAccessIdentityProviderScimConfigArgs] = None,
                                    zone_id: Optional[str] = None)
    func NewZeroTrustAccessIdentityProvider(ctx *Context, name string, args ZeroTrustAccessIdentityProviderArgs, opts ...ResourceOption) (*ZeroTrustAccessIdentityProvider, error)
    public ZeroTrustAccessIdentityProvider(string name, ZeroTrustAccessIdentityProviderArgs args, CustomResourceOptions? opts = null)
    public ZeroTrustAccessIdentityProvider(String name, ZeroTrustAccessIdentityProviderArgs args)
public ZeroTrustAccessIdentityProvider(String name, ZeroTrustAccessIdentityProviderArgs args, CustomResourceOptions options)

    type: cloudflare:ZeroTrustAccessIdentityProvider
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "cloudflare_zerotrustaccessidentityprovider" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args ZeroTrustAccessIdentityProviderArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ZeroTrustAccessIdentityProviderArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ZeroTrustAccessIdentityProviderArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ZeroTrustAccessIdentityProviderArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ZeroTrustAccessIdentityProviderArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var zeroTrustAccessIdentityProviderResource = new Cloudflare.ZeroTrustAccessIdentityProvider("zeroTrustAccessIdentityProviderResource", new()
{
    Config = new Cloudflare.Inputs.ZeroTrustAccessIdentityProviderConfigArgs
    {
        AppsDomain = "string",
        Attributes = new[]
        {
            "string",
        },
        AuthUrl = "string",
        AuthorizationServerId = "string",
        CentrifyAccount = "string",
        CentrifyAppId = "string",
        CertsUrl = "string",
        Claims = new[]
        {
            "string",
        },
        ClientId = "string",
        ClientSecret = "string",
        ConditionalAccessEnabled = false,
        DirectoryId = "string",
        EmailAttributeName = "string",
        EmailClaimName = "string",
        EnableEncryption = false,
        HeaderAttributes = new[]
        {
            new Cloudflare.Inputs.ZeroTrustAccessIdentityProviderConfigHeaderAttributeArgs
            {
                AttributeName = "string",
                HeaderName = "string",
            },
        },
        IdpPublicCerts = new[]
        {
            "string",
        },
        IssuerUrl = "string",
        OktaAccount = "string",
        OneloginAccount = "string",
        PingEnvId = "string",
        PkceEnabled = false,
        Prompt = "string",
        RedirectUrl = "string",
        RestrictToAccountMembers = false,
        Scopes = new[]
        {
            "string",
        },
        SignRequest = false,
        SsoTargetUrl = "string",
        SupportGroups = false,
        TokenUrl = "string",
    },
    Name = "string",
    Type = "string",
    AccountId = "string",
    ReadOnly = false,
    SamlCertificateSetId = "string",
    ScimConfig = new Cloudflare.Inputs.ZeroTrustAccessIdentityProviderScimConfigArgs
    {
        Enabled = false,
        IdentityUpdateBehavior = "string",
        ScimBaseUrl = "string",
        SeatDeprovision = false,
        Secret = "string",
        UserDeprovision = false,
    },
    ZoneId = "string",
});

    example, err := cloudflare.NewZeroTrustAccessIdentityProvider(ctx, "zeroTrustAccessIdentityProviderResource", &cloudflare.ZeroTrustAccessIdentityProviderArgs{
	Config: &cloudflare.ZeroTrustAccessIdentityProviderConfigArgs{
		AppsDomain: pulumi.String("string"),
		Attributes: pulumi.StringArray{
			pulumi.String("string"),
		},
		AuthUrl:               pulumi.String("string"),
		AuthorizationServerId: pulumi.String("string"),
		CentrifyAccount:       pulumi.String("string"),
		CentrifyAppId:         pulumi.String("string"),
		CertsUrl:              pulumi.String("string"),
		Claims: pulumi.StringArray{
			pulumi.String("string"),
		},
		ClientId:                 pulumi.String("string"),
		ClientSecret:             pulumi.String("string"),
		ConditionalAccessEnabled: pulumi.Bool(false),
		DirectoryId:              pulumi.String("string"),
		EmailAttributeName:       pulumi.String("string"),
		EmailClaimName:           pulumi.String("string"),
		EnableEncryption:         pulumi.Bool(false),
		HeaderAttributes: cloudflare.ZeroTrustAccessIdentityProviderConfigHeaderAttributeArray{
			&cloudflare.ZeroTrustAccessIdentityProviderConfigHeaderAttributeArgs{
				AttributeName: pulumi.String("string"),
				HeaderName:    pulumi.String("string"),
			},
		},
		IdpPublicCerts: pulumi.StringArray{
			pulumi.String("string"),
		},
		IssuerUrl:                pulumi.String("string"),
		OktaAccount:              pulumi.String("string"),
		OneloginAccount:          pulumi.String("string"),
		PingEnvId:                pulumi.String("string"),
		PkceEnabled:              pulumi.Bool(false),
		Prompt:                   pulumi.String("string"),
		RedirectUrl:              pulumi.String("string"),
		RestrictToAccountMembers: pulumi.Bool(false),
		Scopes: pulumi.StringArray{
			pulumi.String("string"),
		},
		SignRequest:   pulumi.Bool(false),
		SsoTargetUrl:  pulumi.String("string"),
		SupportGroups: pulumi.Bool(false),
		TokenUrl:      pulumi.String("string"),
	},
	Name:                 pulumi.String("string"),
	Type:                 pulumi.String("string"),
	AccountId:            pulumi.String("string"),
	ReadOnly:             pulumi.Bool(false),
	SamlCertificateSetId: pulumi.String("string"),
	ScimConfig: &cloudflare.ZeroTrustAccessIdentityProviderScimConfigArgs{
		Enabled:                pulumi.Bool(false),
		IdentityUpdateBehavior: pulumi.String("string"),
		ScimBaseUrl:            pulumi.String("string"),
		SeatDeprovision:        pulumi.Bool(false),
		Secret:                 pulumi.String("string"),
		UserDeprovision:        pulumi.Bool(false),
	},
	ZoneId: pulumi.String("string"),
})

    resource "cloudflare_zerotrustaccessidentityprovider" "zeroTrustAccessIdentityProviderResource" {
  config = {
    apps_domain                = "string"
    attributes                 = ["string"]
    auth_url                   = "string"
    authorization_server_id    = "string"
    centrify_account           = "string"
    centrify_app_id            = "string"
    certs_url                  = "string"
    claims                     = ["string"]
    client_id                  = "string"
    client_secret              = "string"
    conditional_access_enabled = false
    directory_id               = "string"
    email_attribute_name       = "string"
    email_claim_name           = "string"
    enable_encryption          = false
    header_attributes = [{
      "attributeName" = "string"
      "headerName"    = "string"
    }]
    idp_public_certs            = ["string"]
    issuer_url                  = "string"
    okta_account                = "string"
    onelogin_account            = "string"
    ping_env_id                 = "string"
    pkce_enabled                = false
    prompt                      = "string"
    redirect_url                = "string"
    restrict_to_account_members = false
    scopes                      = ["string"]
    sign_request                = false
    sso_target_url              = "string"
    support_groups              = false
    token_url                   = "string"
  }
  name                    = "string"
  type                    = "string"
  account_id              = "string"
  read_only               = false
  saml_certificate_set_id = "string"
  scim_config = {
    enabled                  = false
    identity_update_behavior = "string"
    scim_base_url            = "string"
    seat_deprovision         = false
    secret                   = "string"
    user_deprovision         = false
  }
  zone_id = "string"
}

    var zeroTrustAccessIdentityProviderResource = new ZeroTrustAccessIdentityProvider("zeroTrustAccessIdentityProviderResource", ZeroTrustAccessIdentityProviderArgs.builder()
    .config(ZeroTrustAccessIdentityProviderConfigArgs.builder()
        .appsDomain("string")
        .attributes("string")
        .authUrl("string")
        .authorizationServerId("string")
        .centrifyAccount("string")
        .centrifyAppId("string")
        .certsUrl("string")
        .claims("string")
        .clientId("string")
        .clientSecret("string")
        .conditionalAccessEnabled(false)
        .directoryId("string")
        .emailAttributeName("string")
        .emailClaimName("string")
        .enableEncryption(false)
        .headerAttributes(ZeroTrustAccessIdentityProviderConfigHeaderAttributeArgs.builder()
            .attributeName("string")
            .headerName("string")
            .build())
        .idpPublicCerts("string")
        .issuerUrl("string")
        .oktaAccount("string")
        .oneloginAccount("string")
        .pingEnvId("string")
        .pkceEnabled(false)
        .prompt("string")
        .redirectUrl("string")
        .restrictToAccountMembers(false)
        .scopes("string")
        .signRequest(false)
        .ssoTargetUrl("string")
        .supportGroups(false)
        .tokenUrl("string")
        .build())
    .name("string")
    .type("string")
    .accountId("string")
    .readOnly(false)
    .samlCertificateSetId("string")
    .scimConfig(ZeroTrustAccessIdentityProviderScimConfigArgs.builder()
        .enabled(false)
        .identityUpdateBehavior("string")
        .scimBaseUrl("string")
        .seatDeprovision(false)
        .secret("string")
        .userDeprovision(false)
        .build())
    .zoneId("string")
    .build());

    zero_trust_access_identity_provider_resource = cloudflare.ZeroTrustAccessIdentityProvider("zeroTrustAccessIdentityProviderResource",
    config={
        "apps_domain": "string",
        "attributes": ["string"],
        "auth_url": "string",
        "authorization_server_id": "string",
        "centrify_account": "string",
        "centrify_app_id": "string",
        "certs_url": "string",
        "claims": ["string"],
        "client_id": "string",
        "client_secret": "string",
        "conditional_access_enabled": False,
        "directory_id": "string",
        "email_attribute_name": "string",
        "email_claim_name": "string",
        "enable_encryption": False,
        "header_attributes": [{
            "attribute_name": "string",
            "header_name": "string",
        }],
        "idp_public_certs": ["string"],
        "issuer_url": "string",
        "okta_account": "string",
        "onelogin_account": "string",
        "ping_env_id": "string",
        "pkce_enabled": False,
        "prompt": "string",
        "redirect_url": "string",
        "restrict_to_account_members": False,
        "scopes": ["string"],
        "sign_request": False,
        "sso_target_url": "string",
        "support_groups": False,
        "token_url": "string",
    },
    name="string",
    type="string",
    account_id="string",
    read_only=False,
    saml_certificate_set_id="string",
    scim_config={
        "enabled": False,
        "identity_update_behavior": "string",
        "scim_base_url": "string",
        "seat_deprovision": False,
        "secret": "string",
        "user_deprovision": False,
    },
    zone_id="string")

    const zeroTrustAccessIdentityProviderResource = new cloudflare.ZeroTrustAccessIdentityProvider("zeroTrustAccessIdentityProviderResource", {
    config: {
        appsDomain: "string",
        attributes: ["string"],
        authUrl: "string",
        authorizationServerId: "string",
        centrifyAccount: "string",
        centrifyAppId: "string",
        certsUrl: "string",
        claims: ["string"],
        clientId: "string",
        clientSecret: "string",
        conditionalAccessEnabled: false,
        directoryId: "string",
        emailAttributeName: "string",
        emailClaimName: "string",
        enableEncryption: false,
        headerAttributes: [{
            attributeName: "string",
            headerName: "string",
        }],
        idpPublicCerts: ["string"],
        issuerUrl: "string",
        oktaAccount: "string",
        oneloginAccount: "string",
        pingEnvId: "string",
        pkceEnabled: false,
        prompt: "string",
        redirectUrl: "string",
        restrictToAccountMembers: false,
        scopes: ["string"],
        signRequest: false,
        ssoTargetUrl: "string",
        supportGroups: false,
        tokenUrl: "string",
    },
    name: "string",
    type: "string",
    accountId: "string",
    readOnly: false,
    samlCertificateSetId: "string",
    scimConfig: {
        enabled: false,
        identityUpdateBehavior: "string",
        scimBaseUrl: "string",
        seatDeprovision: false,
        secret: "string",
        userDeprovision: false,
    },
    zoneId: "string",
});

    type: cloudflare:ZeroTrustAccessIdentityProvider
properties:
    accountId: string
    config:
        appsDomain: string
        attributes:
            - string
        authUrl: string
        authorizationServerId: string
        centrifyAccount: string
        centrifyAppId: string
        certsUrl: string
        claims:
            - string
        clientId: string
        clientSecret: string
        conditionalAccessEnabled: false
        directoryId: string
        emailAttributeName: string
        emailClaimName: string
        enableEncryption: false
        headerAttributes:
            - attributeName: string
              headerName: string
        idpPublicCerts:
            - string
        issuerUrl: string
        oktaAccount: string
        oneloginAccount: string
        pingEnvId: string
        pkceEnabled: false
        prompt: string
        redirectUrl: string
        restrictToAccountMembers: false
        scopes:
            - string
        signRequest: false
        ssoTargetUrl: string
        supportGroups: false
        tokenUrl: string
    name: string
    readOnly: false
    samlCertificateSetId: string
    scimConfig:
        enabled: false
        identityUpdateBehavior: string
        scimBaseUrl: string
        seatDeprovision: false
        secret: string
        userDeprovision: false
    type: string
    zoneId: string

    ZeroTrustAccessIdentityProvider Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ZeroTrustAccessIdentityProvider resource accepts the following input properties:

    Config ZeroTrustAccessIdentityProviderConfig
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    Name string
    The name of the identity provider, shown to users on the login page.
    Type string
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".
    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    ReadOnly bool
    Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
    SamlCertificateSetId string
    The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
    ScimConfig ZeroTrustAccessIdentityProviderScimConfig
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    Config ZeroTrustAccessIdentityProviderConfigArgs
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    Name string
    The name of the identity provider, shown to users on the login page.
    Type string
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".
    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    ReadOnly bool
    Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
    SamlCertificateSetId string
    The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
    ScimConfig ZeroTrustAccessIdentityProviderScimConfigArgs
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    config object
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    name string
    The name of the identity provider, shown to users on the login page.
    type string
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".
    account_id string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    read_only bool
    Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
    saml_certificate_set_id string
    The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
    scim_config object
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    zone_id string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    config ZeroTrustAccessIdentityProviderConfig
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    name String
    The name of the identity provider, shown to users on the login page.
    type String
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    readOnly Boolean
    Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
    samlCertificateSetId String
    The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
    scimConfig ZeroTrustAccessIdentityProviderScimConfig
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    config ZeroTrustAccessIdentityProviderConfig
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    name string
    The name of the identity provider, shown to users on the login page.
    type string
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".
    accountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    readOnly boolean
    Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
    samlCertificateSetId string
    The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
    scimConfig ZeroTrustAccessIdentityProviderScimConfig
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    zoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    config ZeroTrustAccessIdentityProviderConfigArgs
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    name str
    The name of the identity provider, shown to users on the login page.
    type str
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".
    account_id str
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    read_only bool
    Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
    saml_certificate_set_id str
    The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
    scim_config ZeroTrustAccessIdentityProviderScimConfigArgs
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    zone_id str
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    config Property Map
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    name String
    The name of the identity provider, shown to users on the login page.
    type String
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    readOnly Boolean
    Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
    samlCertificateSetId String
    The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
    scimConfig Property Map
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ZeroTrustAccessIdentityProvider resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    SamlCertificateSet ZeroTrustAccessIdentityProviderSamlCertificateSet
    The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
    Id string
    The provider-assigned unique ID for this managed resource.
    SamlCertificateSet ZeroTrustAccessIdentityProviderSamlCertificateSet
    The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
    id string
    The provider-assigned unique ID for this managed resource.
    saml_certificate_set object
    The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
    id String
    The provider-assigned unique ID for this managed resource.
    samlCertificateSet ZeroTrustAccessIdentityProviderSamlCertificateSet
    The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
    id string
    The provider-assigned unique ID for this managed resource.
    samlCertificateSet ZeroTrustAccessIdentityProviderSamlCertificateSet
    The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
    id str
    The provider-assigned unique ID for this managed resource.
    saml_certificate_set ZeroTrustAccessIdentityProviderSamlCertificateSet
    The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
    id String
    The provider-assigned unique ID for this managed resource.
    samlCertificateSet Property Map
    The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.

    Look up Existing ZeroTrustAccessIdentityProvider Resource

    Get an existing ZeroTrustAccessIdentityProvider resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ZeroTrustAccessIdentityProviderState, opts?: CustomResourceOptions): ZeroTrustAccessIdentityProvider
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        account_id: Optional[str] = None,
        config: Optional[ZeroTrustAccessIdentityProviderConfigArgs] = None,
        name: Optional[str] = None,
        read_only: Optional[bool] = None,
        saml_certificate_set: Optional[ZeroTrustAccessIdentityProviderSamlCertificateSetArgs] = None,
        saml_certificate_set_id: Optional[str] = None,
        scim_config: Optional[ZeroTrustAccessIdentityProviderScimConfigArgs] = None,
        type: Optional[str] = None,
        zone_id: Optional[str] = None) -> ZeroTrustAccessIdentityProvider
    func GetZeroTrustAccessIdentityProvider(ctx *Context, name string, id IDInput, state *ZeroTrustAccessIdentityProviderState, opts ...ResourceOption) (*ZeroTrustAccessIdentityProvider, error)
    public static ZeroTrustAccessIdentityProvider Get(string name, Input<string> id, ZeroTrustAccessIdentityProviderState? state, CustomResourceOptions? opts = null)
    public static ZeroTrustAccessIdentityProvider get(String name, Output<String> id, ZeroTrustAccessIdentityProviderState state, CustomResourceOptions options)
    resources:  _:    type: cloudflare:ZeroTrustAccessIdentityProvider    get:      id: ${id}
    import {
  to = cloudflare_zerotrustaccessidentityprovider.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    Config ZeroTrustAccessIdentityProviderConfig
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    Name string
    The name of the identity provider, shown to users on the login page.
    ReadOnly bool
    Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
    SamlCertificateSet ZeroTrustAccessIdentityProviderSamlCertificateSet
    The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
    SamlCertificateSetId string
    The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
    ScimConfig ZeroTrustAccessIdentityProviderScimConfig
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    Type string
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    Config ZeroTrustAccessIdentityProviderConfigArgs
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    Name string
    The name of the identity provider, shown to users on the login page.
    ReadOnly bool
    Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
    SamlCertificateSet ZeroTrustAccessIdentityProviderSamlCertificateSetArgs
    The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
    SamlCertificateSetId string
    The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
    ScimConfig ZeroTrustAccessIdentityProviderScimConfigArgs
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    Type string
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    account_id string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    config object
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    name string
    The name of the identity provider, shown to users on the login page.
    read_only bool
    Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
    saml_certificate_set object
    The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
    saml_certificate_set_id string
    The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
    scim_config object
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    type string
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".
    zone_id string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    config ZeroTrustAccessIdentityProviderConfig
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    name String
    The name of the identity provider, shown to users on the login page.
    readOnly Boolean
    Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
    samlCertificateSet ZeroTrustAccessIdentityProviderSamlCertificateSet
    The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
    samlCertificateSetId String
    The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
    scimConfig ZeroTrustAccessIdentityProviderScimConfig
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    type String
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    config ZeroTrustAccessIdentityProviderConfig
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    name string
    The name of the identity provider, shown to users on the login page.
    readOnly boolean
    Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
    samlCertificateSet ZeroTrustAccessIdentityProviderSamlCertificateSet
    The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
    samlCertificateSetId string
    The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
    scimConfig ZeroTrustAccessIdentityProviderScimConfig
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    type string
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".
    zoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    account_id str
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    config ZeroTrustAccessIdentityProviderConfigArgs
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    name str
    The name of the identity provider, shown to users on the login page.
    read_only bool
    Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
    saml_certificate_set ZeroTrustAccessIdentityProviderSamlCertificateSetArgs
    The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
    saml_certificate_set_id str
    The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
    scim_config ZeroTrustAccessIdentityProviderScimConfigArgs
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    type str
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".
    zone_id str
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    config Property Map
    The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
    name String
    The name of the identity provider, shown to users on the login page.
    readOnly Boolean
    Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
    samlCertificateSet Property Map
    The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
    samlCertificateSetId String
    The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
    scimConfig Property Map
    The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
    type String
    The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Available values: "onetimepin", "azureAD", "saml", "centrify", "facebook", "github", "google-apps", "google", "linkedin", "oidc", "okta", "onelogin", "pingone", "yandex", "cloudflare".
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

    Supporting Types

    ZeroTrustAccessIdentityProviderConfig, ZeroTrustAccessIdentityProviderConfigArgs

    AppsDomain string
    Your companies TLD
    Attributes List<string>
    A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
    AuthUrl string
    The authorizationEndpoint URL of your IdP
    AuthorizationServerId string
    Your okta authorization server id
    CentrifyAccount string
    Your centrify account url
    CentrifyAppId string
    Your centrify app id
    CertsUrl string
    The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens
    Claims List<string>
    Custom claims
    ClientId string
    Your OAuth Client ID
    ClientSecret string
    Your OAuth Client Secret
    ConditionalAccessEnabled bool
    Should Cloudflare try to load authentication contexts from your account
    DirectoryId string
    Your Azure directory uuid
    EmailAttributeName string
    The attribute name for email in the SAML response.
    EmailClaimName string
    The claim name for email in the idToken response.
    EnableEncryption bool
    Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.
    HeaderAttributes List<ZeroTrustAccessIdentityProviderConfigHeaderAttribute>
    Add a list of attribute names that will be returned in the response header from the Access callback.
    IdpPublicCerts List<string>
    X509 certificate to verify the signature in the SAML authentication response
    IssuerUrl string
    IdP Entity ID or Issuer URL
    OktaAccount string
    Your okta account url
    OneloginAccount string
    Your OneLogin account url
    PingEnvId string
    Your PingOne environment identifier
    PkceEnabled bool
    Enable Proof Key for Code Exchange (PKCE)
    Prompt string
    Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionRequired error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "selectAccount", "none".
    RedirectUrl string
    RestrictToAccountMembers bool
    When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.
    Scopes List<string>
    OAuth scopes
    SignRequest bool
    Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
    SsoTargetUrl string
    URL to send the SAML authentication requests to
    SupportGroups bool
    Should Cloudflare try to load groups from your account
    TokenUrl string
    The tokenEndpoint URL of your IdP
    AppsDomain string
    Your companies TLD
    Attributes []string
    A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
    AuthUrl string
    The authorizationEndpoint URL of your IdP
    AuthorizationServerId string
    Your okta authorization server id
    CentrifyAccount string
    Your centrify account url
    CentrifyAppId string
    Your centrify app id
    CertsUrl string
    The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens
    Claims []string
    Custom claims
    ClientId string
    Your OAuth Client ID
    ClientSecret string
    Your OAuth Client Secret
    ConditionalAccessEnabled bool
    Should Cloudflare try to load authentication contexts from your account
    DirectoryId string
    Your Azure directory uuid
    EmailAttributeName string
    The attribute name for email in the SAML response.
    EmailClaimName string
    The claim name for email in the idToken response.
    EnableEncryption bool
    Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.
    HeaderAttributes []ZeroTrustAccessIdentityProviderConfigHeaderAttribute
    Add a list of attribute names that will be returned in the response header from the Access callback.
    IdpPublicCerts []string
    X509 certificate to verify the signature in the SAML authentication response
    IssuerUrl string
    IdP Entity ID or Issuer URL
    OktaAccount string
    Your okta account url
    OneloginAccount string
    Your OneLogin account url
    PingEnvId string
    Your PingOne environment identifier
    PkceEnabled bool
    Enable Proof Key for Code Exchange (PKCE)
    Prompt string
    Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionRequired error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "selectAccount", "none".
    RedirectUrl string
    RestrictToAccountMembers bool
    When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.
    Scopes []string
    OAuth scopes
    SignRequest bool
    Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
    SsoTargetUrl string
    URL to send the SAML authentication requests to
    SupportGroups bool
    Should Cloudflare try to load groups from your account
    TokenUrl string
    The tokenEndpoint URL of your IdP
    apps_domain string
    Your companies TLD
    attributes list(string)
    A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
    auth_url string
    The authorizationEndpoint URL of your IdP
    authorization_server_id string
    Your okta authorization server id
    centrify_account string
    Your centrify account url
    centrify_app_id string
    Your centrify app id
    certs_url string
    The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens
    claims list(string)
    Custom claims
    client_id string
    Your OAuth Client ID
    client_secret string
    Your OAuth Client Secret
    conditional_access_enabled bool
    Should Cloudflare try to load authentication contexts from your account
    directory_id string
    Your Azure directory uuid
    email_attribute_name string
    The attribute name for email in the SAML response.
    email_claim_name string
    The claim name for email in the idToken response.
    enable_encryption bool
    Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.
    header_attributes list(object)
    Add a list of attribute names that will be returned in the response header from the Access callback.
    idp_public_certs list(string)
    X509 certificate to verify the signature in the SAML authentication response
    issuer_url string
    IdP Entity ID or Issuer URL
    okta_account string
    Your okta account url
    onelogin_account string
    Your OneLogin account url
    ping_env_id string
    Your PingOne environment identifier
    pkce_enabled bool
    Enable Proof Key for Code Exchange (PKCE)
    prompt string
    Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionRequired error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "selectAccount", "none".
    redirect_url string
    restrict_to_account_members bool
    When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.
    scopes list(string)
    OAuth scopes
    sign_request bool
    Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
    sso_target_url string
    URL to send the SAML authentication requests to
    support_groups bool
    Should Cloudflare try to load groups from your account
    token_url string
    The tokenEndpoint URL of your IdP
    appsDomain String
    Your companies TLD
    attributes List<String>
    A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
    authUrl String
    The authorizationEndpoint URL of your IdP
    authorizationServerId String
    Your okta authorization server id
    centrifyAccount String
    Your centrify account url
    centrifyAppId String
    Your centrify app id
    certsUrl String
    The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens
    claims List<String>
    Custom claims
    clientId String
    Your OAuth Client ID
    clientSecret String
    Your OAuth Client Secret
    conditionalAccessEnabled Boolean
    Should Cloudflare try to load authentication contexts from your account
    directoryId String
    Your Azure directory uuid
    emailAttributeName String
    The attribute name for email in the SAML response.
    emailClaimName String
    The claim name for email in the idToken response.
    enableEncryption Boolean
    Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.
    headerAttributes List<ZeroTrustAccessIdentityProviderConfigHeaderAttribute>
    Add a list of attribute names that will be returned in the response header from the Access callback.
    idpPublicCerts List<String>
    X509 certificate to verify the signature in the SAML authentication response
    issuerUrl String
    IdP Entity ID or Issuer URL
    oktaAccount String
    Your okta account url
    oneloginAccount String
    Your OneLogin account url
    pingEnvId String
    Your PingOne environment identifier
    pkceEnabled Boolean
    Enable Proof Key for Code Exchange (PKCE)
    prompt String
    Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionRequired error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "selectAccount", "none".
    redirectUrl String
    restrictToAccountMembers Boolean
    When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.
    scopes List<String>
    OAuth scopes
    signRequest Boolean
    Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
    ssoTargetUrl String
    URL to send the SAML authentication requests to
    supportGroups Boolean
    Should Cloudflare try to load groups from your account
    tokenUrl String
    The tokenEndpoint URL of your IdP
    appsDomain string
    Your companies TLD
    attributes string[]
    A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
    authUrl string
    The authorizationEndpoint URL of your IdP
    authorizationServerId string
    Your okta authorization server id
    centrifyAccount string
    Your centrify account url
    centrifyAppId string
    Your centrify app id
    certsUrl string
    The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens
    claims string[]
    Custom claims
    clientId string
    Your OAuth Client ID
    clientSecret string
    Your OAuth Client Secret
    conditionalAccessEnabled boolean
    Should Cloudflare try to load authentication contexts from your account
    directoryId string
    Your Azure directory uuid
    emailAttributeName string
    The attribute name for email in the SAML response.
    emailClaimName string
    The claim name for email in the idToken response.
    enableEncryption boolean
    Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.
    headerAttributes ZeroTrustAccessIdentityProviderConfigHeaderAttribute[]
    Add a list of attribute names that will be returned in the response header from the Access callback.
    idpPublicCerts string[]
    X509 certificate to verify the signature in the SAML authentication response
    issuerUrl string
    IdP Entity ID or Issuer URL
    oktaAccount string
    Your okta account url
    oneloginAccount string
    Your OneLogin account url
    pingEnvId string
    Your PingOne environment identifier
    pkceEnabled boolean
    Enable Proof Key for Code Exchange (PKCE)
    prompt string
    Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionRequired error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "selectAccount", "none".
    redirectUrl string
    restrictToAccountMembers boolean
    When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.
    scopes string[]
    OAuth scopes
    signRequest boolean
    Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
    ssoTargetUrl string
    URL to send the SAML authentication requests to
    supportGroups boolean
    Should Cloudflare try to load groups from your account
    tokenUrl string
    The tokenEndpoint URL of your IdP
    apps_domain str
    Your companies TLD
    attributes Sequence[str]
    A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
    auth_url str
    The authorizationEndpoint URL of your IdP
    authorization_server_id str
    Your okta authorization server id
    centrify_account str
    Your centrify account url
    centrify_app_id str
    Your centrify app id
    certs_url str
    The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens
    claims Sequence[str]
    Custom claims
    client_id str
    Your OAuth Client ID
    client_secret str
    Your OAuth Client Secret
    conditional_access_enabled bool
    Should Cloudflare try to load authentication contexts from your account
    directory_id str
    Your Azure directory uuid
    email_attribute_name str
    The attribute name for email in the SAML response.
    email_claim_name str
    The claim name for email in the idToken response.
    enable_encryption bool
    Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.
    header_attributes Sequence[ZeroTrustAccessIdentityProviderConfigHeaderAttribute]
    Add a list of attribute names that will be returned in the response header from the Access callback.
    idp_public_certs Sequence[str]
    X509 certificate to verify the signature in the SAML authentication response
    issuer_url str
    IdP Entity ID or Issuer URL
    okta_account str
    Your okta account url
    onelogin_account str
    Your OneLogin account url
    ping_env_id str
    Your PingOne environment identifier
    pkce_enabled bool
    Enable Proof Key for Code Exchange (PKCE)
    prompt str
    Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionRequired error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "selectAccount", "none".
    redirect_url str
    restrict_to_account_members bool
    When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.
    scopes Sequence[str]
    OAuth scopes
    sign_request bool
    Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
    sso_target_url str
    URL to send the SAML authentication requests to
    support_groups bool
    Should Cloudflare try to load groups from your account
    token_url str
    The tokenEndpoint URL of your IdP
    appsDomain String
    Your companies TLD
    attributes List<String>
    A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
    authUrl String
    The authorizationEndpoint URL of your IdP
    authorizationServerId String
    Your okta authorization server id
    centrifyAccount String
    Your centrify account url
    centrifyAppId String
    Your centrify app id
    certsUrl String
    The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens
    claims List<String>
    Custom claims
    clientId String
    Your OAuth Client ID
    clientSecret String
    Your OAuth Client Secret
    conditionalAccessEnabled Boolean
    Should Cloudflare try to load authentication contexts from your account
    directoryId String
    Your Azure directory uuid
    emailAttributeName String
    The attribute name for email in the SAML response.
    emailClaimName String
    The claim name for email in the idToken response.
    enableEncryption Boolean
    Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.
    headerAttributes List<Property Map>
    Add a list of attribute names that will be returned in the response header from the Access callback.
    idpPublicCerts List<String>
    X509 certificate to verify the signature in the SAML authentication response
    issuerUrl String
    IdP Entity ID or Issuer URL
    oktaAccount String
    Your okta account url
    oneloginAccount String
    Your OneLogin account url
    pingEnvId String
    Your PingOne environment identifier
    pkceEnabled Boolean
    Enable Proof Key for Code Exchange (PKCE)
    prompt String
    Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interactionRequired error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. Available values: "login", "selectAccount", "none".
    redirectUrl String
    restrictToAccountMembers Boolean
    When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.
    scopes List<String>
    OAuth scopes
    signRequest Boolean
    Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
    ssoTargetUrl String
    URL to send the SAML authentication requests to
    supportGroups Boolean
    Should Cloudflare try to load groups from your account
    tokenUrl String
    The tokenEndpoint URL of your IdP

    ZeroTrustAccessIdentityProviderConfigHeaderAttribute, ZeroTrustAccessIdentityProviderConfigHeaderAttributeArgs

    AttributeName string
    attribute name from the IDP
    HeaderName string
    header that will be added on the request to the origin
    AttributeName string
    attribute name from the IDP
    HeaderName string
    header that will be added on the request to the origin
    attribute_name string
    attribute name from the IDP
    header_name string
    header that will be added on the request to the origin
    attributeName String
    attribute name from the IDP
    headerName String
    header that will be added on the request to the origin
    attributeName string
    attribute name from the IDP
    headerName string
    header that will be added on the request to the origin
    attribute_name str
    attribute name from the IDP
    header_name str
    header that will be added on the request to the origin
    attributeName String
    attribute name from the IDP
    headerName String
    header that will be added on the request to the origin

    ZeroTrustAccessIdentityProviderSamlCertificateSet, ZeroTrustAccessIdentityProviderSamlCertificateSetArgs

    CreatedAt string
    Timestamp when the certificate set was created
    CurrentCertificate ZeroTrustAccessIdentityProviderSamlCertificateSetCurrentCertificate
    The currently active certificate used for encrypting SAML assertions
    PreviousCertificate string
    The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of samlCertificate.
    Uid string
    Unique identifier for the certificate set
    UpdatedAt string
    Timestamp when the certificate set was last updated (e.g., during rotation)
    CreatedAt string
    Timestamp when the certificate set was created
    CurrentCertificate ZeroTrustAccessIdentityProviderSamlCertificateSetCurrentCertificate
    The currently active certificate used for encrypting SAML assertions
    PreviousCertificate string
    The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of samlCertificate.
    Uid string
    Unique identifier for the certificate set
    UpdatedAt string
    Timestamp when the certificate set was last updated (e.g., during rotation)
    created_at string
    Timestamp when the certificate set was created
    current_certificate object
    The currently active certificate used for encrypting SAML assertions
    previous_certificate string
    The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of samlCertificate.
    uid string
    Unique identifier for the certificate set
    updated_at string
    Timestamp when the certificate set was last updated (e.g., during rotation)
    createdAt String
    Timestamp when the certificate set was created
    currentCertificate ZeroTrustAccessIdentityProviderSamlCertificateSetCurrentCertificate
    The currently active certificate used for encrypting SAML assertions
    previousCertificate String
    The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of samlCertificate.
    uid String
    Unique identifier for the certificate set
    updatedAt String
    Timestamp when the certificate set was last updated (e.g., during rotation)
    createdAt string
    Timestamp when the certificate set was created
    currentCertificate ZeroTrustAccessIdentityProviderSamlCertificateSetCurrentCertificate
    The currently active certificate used for encrypting SAML assertions
    previousCertificate string
    The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of samlCertificate.
    uid string
    Unique identifier for the certificate set
    updatedAt string
    Timestamp when the certificate set was last updated (e.g., during rotation)
    created_at str
    Timestamp when the certificate set was created
    current_certificate ZeroTrustAccessIdentityProviderSamlCertificateSetCurrentCertificate
    The currently active certificate used for encrypting SAML assertions
    previous_certificate str
    The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of samlCertificate.
    uid str
    Unique identifier for the certificate set
    updated_at str
    Timestamp when the certificate set was last updated (e.g., during rotation)
    createdAt String
    Timestamp when the certificate set was created
    currentCertificate Property Map
    The currently active certificate used for encrypting SAML assertions
    previousCertificate String
    The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of samlCertificate.
    uid String
    Unique identifier for the certificate set
    updatedAt String
    Timestamp when the certificate set was last updated (e.g., during rotation)

    ZeroTrustAccessIdentityProviderSamlCertificateSetCurrentCertificate, ZeroTrustAccessIdentityProviderSamlCertificateSetCurrentCertificateArgs

    IsCurrent bool
    Indicates whether this is the currently active certificate
    NotAfter string
    Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
    PublicCertificate string
    PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
    Uid string
    Unique identifier for the certificate
    IsCurrent bool
    Indicates whether this is the currently active certificate
    NotAfter string
    Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
    PublicCertificate string
    PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
    Uid string
    Unique identifier for the certificate
    is_current bool
    Indicates whether this is the currently active certificate
    not_after string
    Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
    public_certificate string
    PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
    uid string
    Unique identifier for the certificate
    isCurrent Boolean
    Indicates whether this is the currently active certificate
    notAfter String
    Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
    publicCertificate String
    PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
    uid String
    Unique identifier for the certificate
    isCurrent boolean
    Indicates whether this is the currently active certificate
    notAfter string
    Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
    publicCertificate string
    PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
    uid string
    Unique identifier for the certificate
    is_current bool
    Indicates whether this is the currently active certificate
    not_after str
    Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
    public_certificate str
    PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
    uid str
    Unique identifier for the certificate
    isCurrent Boolean
    Indicates whether this is the currently active certificate
    notAfter String
    Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
    publicCertificate String
    PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
    uid String
    Unique identifier for the certificate

    ZeroTrustAccessIdentityProviderScimConfig, ZeroTrustAccessIdentityProviderScimConfigArgs

    Enabled bool
    A flag to enable or disable SCIM for the identity provider.
    IdentityUpdateBehavior string
    Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
    ScimBaseUrl string
    The base URL of Cloudflare's SCIM V2.0 API endpoint.
    SeatDeprovision bool
    A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless userDeprovision is also enabled.
    Secret string
    A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
    UserDeprovision bool
    A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
    Enabled bool
    A flag to enable or disable SCIM for the identity provider.
    IdentityUpdateBehavior string
    Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
    ScimBaseUrl string
    The base URL of Cloudflare's SCIM V2.0 API endpoint.
    SeatDeprovision bool
    A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless userDeprovision is also enabled.
    Secret string
    A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
    UserDeprovision bool
    A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
    enabled bool
    A flag to enable or disable SCIM for the identity provider.
    identity_update_behavior string
    Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
    scim_base_url string
    The base URL of Cloudflare's SCIM V2.0 API endpoint.
    seat_deprovision bool
    A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless userDeprovision is also enabled.
    secret string
    A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
    user_deprovision bool
    A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
    enabled Boolean
    A flag to enable or disable SCIM for the identity provider.
    identityUpdateBehavior String
    Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
    scimBaseUrl String
    The base URL of Cloudflare's SCIM V2.0 API endpoint.
    seatDeprovision Boolean
    A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless userDeprovision is also enabled.
    secret String
    A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
    userDeprovision Boolean
    A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
    enabled boolean
    A flag to enable or disable SCIM for the identity provider.
    identityUpdateBehavior string
    Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
    scimBaseUrl string
    The base URL of Cloudflare's SCIM V2.0 API endpoint.
    seatDeprovision boolean
    A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless userDeprovision is also enabled.
    secret string
    A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
    userDeprovision boolean
    A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
    enabled bool
    A flag to enable or disable SCIM for the identity provider.
    identity_update_behavior str
    Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
    scim_base_url str
    The base URL of Cloudflare's SCIM V2.0 API endpoint.
    seat_deprovision bool
    A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless userDeprovision is also enabled.
    secret str
    A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
    user_deprovision bool
    A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
    enabled Boolean
    A flag to enable or disable SCIM for the identity provider.
    identityUpdateBehavior String
    Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "noaction" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. Available values: "automatic", "reauth", "noaction".
    scimBaseUrl String
    The base URL of Cloudflare's SCIM V2.0 API endpoint.
    seatDeprovision Boolean
    A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless userDeprovision is also enabled.
    secret String
    A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identityproviders/:idpID/refreshscim_secret.
    userDeprovision Boolean
    A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.

    Import

    $ pulumi import cloudflare:index/zeroTrustAccessIdentityProvider:ZeroTrustAccessIdentityProvider example '<{accounts|zones}/{account_id|zone_id}>/<identity_provider_id>'

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Cloudflare pulumi/pulumi-cloudflare
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the cloudflare Terraform Provider.
    cloudflare logo
    Viewing docs for Cloudflare v6.18.0
    published on Thursday, Jul 16, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-cloudflare

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial