keycloak.openid.ClientPolicy

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;

return await Deployment.RunAsync(() => 
{
    var realm = new Keycloak.Realm("realm", new()
    {
        RealmName = "my-realm",
        Enabled = true,
    });

    var openidClient = new Keycloak.OpenId.Client("openidClient", new()
    {
        ClientId = "openid_client",
        RealmId = realm.Id,
        AccessType = "CONFIDENTIAL",
        ServiceAccountsEnabled = true,
    });

    var myPermission = new Keycloak.OpenId.ClientPermissions("myPermission", new()
    {
        RealmId = realm.Id,
        ClientId = openidClient.Id,
    });

    var realmManagement = Keycloak.OpenId.GetClient.Invoke(new()
    {
        RealmId = "my-realm",
        ClientId = "realm-management",
    });

    var tokenExchange = new Keycloak.OpenId.ClientPolicy("tokenExchange", new()
    {
        ResourceServerId = realmManagement.Apply(getClientResult => getClientResult.Id),
        RealmId = realm.Id,
        Logic = "POSITIVE",
        DecisionStrategy = "UNANIMOUS",
        Clients = new[]
        {
            openidClient.Id,
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v5/go/keycloak"
	"github.com/pulumi/pulumi-keycloak/sdk/v5/go/keycloak/openid"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		realm, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm:   pulumi.String("my-realm"),
			Enabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		openidClient, err := openid.NewClient(ctx, "openidClient", &openid.ClientArgs{
			ClientId:               pulumi.String("openid_client"),
			RealmId:                realm.ID(),
			AccessType:             pulumi.String("CONFIDENTIAL"),
			ServiceAccountsEnabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		_, err = openid.NewClientPermissions(ctx, "myPermission", &openid.ClientPermissionsArgs{
			RealmId:  realm.ID(),
			ClientId: openidClient.ID(),
		})
		if err != nil {
			return err
		}
		realmManagement, err := openid.LookupClient(ctx, &openid.LookupClientArgs{
			RealmId:  "my-realm",
			ClientId: "realm-management",
		}, nil)
		if err != nil {
			return err
		}
		_, err = openid.NewClientPolicy(ctx, "tokenExchange", &openid.ClientPolicyArgs{
			ResourceServerId: *pulumi.String(realmManagement.Id),
			RealmId:          realm.ID(),
			Logic:            pulumi.String("POSITIVE"),
			DecisionStrategy: pulumi.String("UNANIMOUS"),
			Clients: pulumi.StringArray{
				openidClient.ID(),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.openid.Client;
import com.pulumi.keycloak.openid.ClientArgs;
import com.pulumi.keycloak.openid.ClientPermissions;
import com.pulumi.keycloak.openid.ClientPermissionsArgs;
import com.pulumi.keycloak.openid.OpenidFunctions;
import com.pulumi.keycloak.openid.inputs.GetClientArgs;
import com.pulumi.keycloak.openid.ClientPolicy;
import com.pulumi.keycloak.openid.ClientPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()        
            .realm("my-realm")
            .enabled(true)
            .build());

        var openidClient = new Client("openidClient", ClientArgs.builder()        
            .clientId("openid_client")
            .realmId(realm.id())
            .accessType("CONFIDENTIAL")
            .serviceAccountsEnabled(true)
            .build());

        var myPermission = new ClientPermissions("myPermission", ClientPermissionsArgs.builder()        
            .realmId(realm.id())
            .clientId(openidClient.id())
            .build());

        final var realmManagement = OpenidFunctions.getClient(GetClientArgs.builder()
            .realmId("my-realm")
            .clientId("realm-management")
            .build());

        var tokenExchange = new ClientPolicy("tokenExchange", ClientPolicyArgs.builder()        
            .resourceServerId(realmManagement.applyValue(getClientResult -> getClientResult.id()))
            .realmId(realm.id())
            .logic("POSITIVE")
            .decisionStrategy("UNANIMOUS")
            .clients(openidClient.id())
            .build());

    }
}

import pulumi
import pulumi_keycloak as keycloak

realm = keycloak.Realm("realm",
    realm="my-realm",
    enabled=True)
openid_client = keycloak.openid.Client("openidClient",
    client_id="openid_client",
    realm_id=realm.id,
    access_type="CONFIDENTIAL",
    service_accounts_enabled=True)
my_permission = keycloak.openid.ClientPermissions("myPermission",
    realm_id=realm.id,
    client_id=openid_client.id)
realm_management = keycloak.openid.get_client(realm_id="my-realm",
    client_id="realm-management")
token_exchange = keycloak.openid.ClientPolicy("tokenExchange",
    resource_server_id=realm_management.id,
    realm_id=realm.id,
    logic="POSITIVE",
    decision_strategy="UNANIMOUS",
    clients=[openid_client.id])

import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const realm = new keycloak.Realm("realm", {
    realm: "my-realm",
    enabled: true,
});
const openidClient = new keycloak.openid.Client("openidClient", {
    clientId: "openid_client",
    realmId: realm.id,
    accessType: "CONFIDENTIAL",
    serviceAccountsEnabled: true,
});
const myPermission = new keycloak.openid.ClientPermissions("myPermission", {
    realmId: realm.id,
    clientId: openidClient.id,
});
const realmManagement = keycloak.openid.getClient({
    realmId: "my-realm",
    clientId: "realm-management",
});
const tokenExchange = new keycloak.openid.ClientPolicy("tokenExchange", {
    resourceServerId: realmManagement.then(realmManagement => realmManagement.id),
    realmId: realm.id,
    logic: "POSITIVE",
    decisionStrategy: "UNANIMOUS",
    clients: [openidClient.id],
});

resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: my-realm
      enabled: true
  openidClient:
    type: keycloak:openid:Client
    properties:
      clientId: openid_client
      realmId: ${realm.id}
      accessType: CONFIDENTIAL
      serviceAccountsEnabled: true
  myPermission:
    type: keycloak:openid:ClientPermissions
    properties:
      realmId: ${realm.id}
      clientId: ${openidClient.id}
  tokenExchange:
    type: keycloak:openid:ClientPolicy
    properties:
      resourceServerId: ${realmManagement.id}
      realmId: ${realm.id}
      logic: POSITIVE
      decisionStrategy: UNANIMOUS
      clients:
        - ${openidClient.id}
variables:
  realmManagement:
    fn::invoke:
      Function: keycloak:openid:getClient
      Arguments:
        realmId: my-realm
        clientId: realm-management