Viewing docs for konnect 3.23.0
published on Friday, Sep 18, 2026 by kong
published on Friday, Sep 18, 2026 by kong
Viewing docs for konnect 3.23.0
published on Friday, Sep 18, 2026 by kong
published on Friday, Sep 18, 2026 by kong
AIGatewayAuthStrategy Resource
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as konnect from "@pulumi/konnect";
const myAigatewayauthstrategy = new konnect.AiGatewayAuthStrategy("my_aigatewayauthstrategy", {
gatewayId: "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
keyAuth: {
config: {
anonymous: "...my_anonymous...",
hideCredentials: true,
identityRealms: [{
id: "...my_id...",
region: "...my_region...",
scope: "cp",
}],
keyInBody: false,
keyInHeader: true,
keyInQuery: true,
keyNames: ["..."],
principals: {
directory: "default",
enabled: false,
errorOnMiss: true,
},
realm: "...my_realm...",
runOnPreflight: true,
},
displayName: "Okta AI SE",
labels: {
key: "value",
},
managedBy: {
key: "value",
},
name: "okta-ai-se",
},
openidConnect: {
config: {
anonymous: "...my_anonymous...",
audiences: ["..."],
audienceClaims: ["..."],
audienceRequireds: ["..."],
authMethods: ["userinfo"],
authenticatedGroupsClaims: ["..."],
authorizationCookieDomain: "...my_authorization_cookie_domain...",
authorizationCookieHttpOnly: true,
authorizationCookieName: "authorization",
authorizationCookiePath: "/",
authorizationCookieSameSite: "Default",
authorizationCookieSecure: false,
authorizationEndpoint: "...my_authorization_endpoint...",
authorizationQueryArgsClients: ["..."],
authorizationQueryArgsNames: ["..."],
authorizationQueryArgsValues: ["..."],
authorizationRollingTimeout: 600,
bearerTokenCookieName: "...my_bearer_token_cookie_name...",
bearerTokenParamTypes: ["cookie"],
byUsernameIgnoreCase: false,
cacheIntrospection: true,
cacheTokenExchange: true,
cacheTokens: true,
cacheTokensSalt: "...my_cache_tokens_salt...",
cacheTtl: 3600,
cacheTtlMax: 6.13,
cacheTtlMin: 8.74,
cacheTtlNeg: 5.39,
cacheTtlResurrect: 8.05,
cacheUserInfo: true,
claimsForbiddens: ["..."],
clientAlgs: ["RS512"],
clientArg: "client_id",
clientAuths: ["client_secret_basic"],
clientCredentialsParamTypes: ["body"],
clientIds: ["..."],
clientJwks: [{
alg: "...my_alg...",
crv: "...my_crv...",
d: "...my_d...",
dp: "...my_dp...",
dq: "...my_dq...",
e: "...my_e...",
issuer: "...my_issuer...",
k: "...my_k...",
keyOps: ["..."],
kid: "...my_kid...",
kty: "...my_kty...",
n: "...my_n...",
oth: "...my_oth...",
p: "...my_p...",
q: "...my_q...",
qi: "...my_qi...",
r: "...my_r...",
t: "...my_t...",
use: "...my_use...",
x: "...my_x...",
x5cs: ["..."],
x5t: "...my_x5t...",
x5tNumberS256: "...my_x5t_number_s256...",
x5u: "...my_x5u...",
y: "...my_y...",
}],
clientSecrets: ["..."],
clusterCacheRedis: {
cloudAuthentication: {
authProvider: "gcp",
awsAccessKeyId: "...my_aws_access_key_id...",
awsAssumeRoleArn: "...my_aws_assume_role_arn...",
awsCacheName: "...my_aws_cache_name...",
awsIsServerless: true,
awsRegion: "...my_aws_region...",
awsRoleSessionName: "...my_aws_role_session_name...",
awsSecretAccessKey: "...my_aws_secret_access_key...",
azureClientId: "...my_azure_client_id...",
azureClientSecret: "...my_azure_client_secret...",
azureTenantId: "...my_azure_tenant_id...",
gcpServiceAccountJson: "...my_gcp_service_account_json...",
},
clusterMaxRedirections: 5,
clusterNodes: [{
ip: "127.0.0.1",
port: 6379,
}],
connectTimeout: 2000,
connectionIsProxied: false,
database: 0,
host: "127.0.0.1",
keepaliveBacklog: 1429494394,
keepalivePoolSize: 256,
password: "...my_password...",
port: "6379",
readTimeout: 2000,
sendTimeout: 2000,
sentinelMaster: "...my_sentinel_master...",
sentinelNodes: [{
host: "127.0.0.1",
port: 6379,
}],
sentinelPassword: "...my_sentinel_password...",
sentinelRole: "any",
sentinelUsername: "...my_sentinel_username...",
serverName: "...my_server_name...",
ssl: false,
sslVerify: true,
username: "...my_username...",
},
clusterCacheStrategy: "off",
consumerBies: ["id"],
consumerClaims: [[]],
consumerGroupsClaims: ["..."],
consumerGroupsOptional: false,
consumerOptional: false,
credentialClaims: ["..."],
disableSessions: ["bearer"],
discoveryHeadersNames: ["..."],
discoveryHeadersValues: ["..."],
displayErrors: false,
domains: ["..."],
downstreamAccessTokenHeader: "...my_downstream_access_token_header...",
downstreamAccessTokenJwkHeader: "...my_downstream_access_token_jwk_header...",
downstreamHeaders: [{
header: "...my_header...",
paths: ["..."],
}],
downstreamHeadersClaims: ["..."],
downstreamHeadersNames: ["..."],
downstreamIdTokenHeader: "...my_downstream_id_token_header...",
downstreamIdTokenJwkHeader: "...my_downstream_id_token_jwk_header...",
downstreamIntrospectionHeader: "...my_downstream_introspection_header...",
downstreamIntrospectionJwtHeader: "...my_downstream_introspection_jwt_header...",
downstreamRefreshTokenHeader: "...my_downstream_refresh_token_header...",
downstreamSessionIdHeader: "...my_downstream_session_id_header...",
downstreamUserInfoHeader: "...my_downstream_user_info_header...",
downstreamUserInfoJwtHeader: "...my_downstream_user_info_jwt_header...",
dpopProofLifetime: 300,
dpopUseNonce: false,
enableHsSignatures: false,
endSessionEndpoint: "...my_end_session_endpoint...",
exposeErrorCode: true,
extraJwksUris: ["..."],
forbiddenDestroySession: true,
forbiddenErrorMessage: "Forbidden",
forbiddenRedirectUris: ["..."],
groupsClaims: ["..."],
groupsRequireds: ["..."],
hideCredentials: true,
httpProxy: "...my_http_proxy...",
httpProxyAuthorization: "...my_http_proxy_authorization...",
httpVersion: 9.47,
httpsProxy: "...my_https_proxy...",
httpsProxyAuthorization: "...my_https_proxy_authorization...",
idTokenParamName: "...my_id_token_param_name...",
idTokenParamTypes: ["body"],
ignoreSignatures: ["session"],
introspectJwtTokens: false,
introspectionAccept: "application/json",
introspectionCheckActive: true,
introspectionEndpoint: "...my_introspection_endpoint...",
introspectionEndpointAuthMethod: "client_secret_jwt",
introspectionHeadersClients: ["..."],
introspectionHeadersNames: ["..."],
introspectionHeadersValues: ["..."],
introspectionHint: "access_token",
introspectionPostArgsClients: ["..."],
introspectionPostArgsClientHeaders: ["..."],
introspectionPostArgsNames: ["..."],
introspectionPostArgsValues: ["..."],
introspectionTokenParamName: "token",
issuer: "...my_issuer...",
issuersAlloweds: ["..."],
jwksEndpoint: "...my_jwks_endpoint...",
jwtSessionClaim: "sid",
jwtSessionCookie: "...my_jwt_session_cookie...",
keepalive: true,
leeway: 0,
loginAction: "upstream",
loginMethods: ["client_credentials"],
loginRedirectMode: "fragment",
loginRedirectUris: ["..."],
loginTokens: ["tokens"],
logoutMethods: ["GET"],
logoutPostArg: "...my_logout_post_arg...",
logoutQueryArg: "...my_logout_query_arg...",
logoutRedirectUris: ["..."],
logoutRevoke: false,
logoutRevokeAccessToken: true,
logoutRevokeRefreshToken: true,
logoutUriSuffix: "...my_logout_uri_suffix...",
maxAge: 8.25,
mtlsIntrospectionEndpoint: "...my_mtls_introspection_endpoint...",
mtlsRevocationEndpoint: "...my_mtls_revocation_endpoint...",
mtlsTokenEndpoint: "...my_mtls_token_endpoint...",
noProxy: "...my_no_proxy...",
passwordParamTypes: ["query"],
preserveQueryArgs: false,
principals: {
directory: "default",
enabled: false,
errorOnMiss: true,
matchConsumer: true,
matchConsumerGroups: true,
principalBy: "...my_principal_by...",
principalClaims: ["..."],
},
proofOfPossessionAuthMethodsValidation: true,
proofOfPossessionDpop: "off",
proofOfPossessionMtls: "off",
pushedAuthorizationRequestEndpoint: "...my_pushed_authorization_request_endpoint...",
pushedAuthorizationRequestEndpointAuthMethod: "self_signed_tls_client_auth",
redirectUris: ["..."],
redis: {
cloudAuthentication: {
authProvider: "azure",
awsAccessKeyId: "...my_aws_access_key_id...",
awsAssumeRoleArn: "...my_aws_assume_role_arn...",
awsCacheName: "...my_aws_cache_name...",
awsIsServerless: true,
awsRegion: "...my_aws_region...",
awsRoleSessionName: "...my_aws_role_session_name...",
awsSecretAccessKey: "...my_aws_secret_access_key...",
azureClientId: "...my_azure_client_id...",
azureClientSecret: "...my_azure_client_secret...",
azureTenantId: "...my_azure_tenant_id...",
gcpServiceAccountJson: "...my_gcp_service_account_json...",
},
clusterMaxRedirections: 5,
clusterNodes: [{
ip: "127.0.0.1",
port: 6379,
}],
connectTimeout: 2000,
connectionIsProxied: false,
database: 0,
host: "127.0.0.1",
keepaliveBacklog: 73538938,
keepalivePoolSize: 256,
password: "...my_password...",
port: "6379",
prefix: "...my_prefix...",
readTimeout: 2000,
sendTimeout: 2000,
sentinelMaster: "...my_sentinel_master...",
sentinelNodes: [{
host: "127.0.0.1",
port: 6379,
}],
sentinelPassword: "...my_sentinel_password...",
sentinelRole: "slave",
sentinelUsername: "...my_sentinel_username...",
serverName: "...my_server_name...",
socket: "...my_socket...",
ssl: false,
sslVerify: true,
username: "...my_username...",
},
rediscoveryLifetime: 30,
refreshTokenParamName: "...my_refresh_token_param_name...",
refreshTokenParamTypes: ["header"],
refreshTokens: true,
requireProofKeyForCodeExchange: true,
requirePushedAuthorizationRequests: true,
requireSignedRequestObject: false,
resolveDistributedClaims: false,
responseMode: "query",
responseTypes: ["..."],
reverify: false,
revocationEndpoint: "...my_revocation_endpoint...",
revocationEndpointAuthMethod: "tls_client_auth",
revocationTokenParamName: "token",
rolesClaims: ["..."],
rolesRequireds: ["..."],
runOnPreflight: true,
scopes: ["..."],
scopesClaims: ["..."],
scopesRequireds: ["..."],
searchUserInfo: false,
sessionAbsoluteTimeout: 86400,
sessionAudience: "default",
sessionBinds: ["ip"],
sessionCookieDomain: "...my_session_cookie_domain...",
sessionCookieHttpOnly: true,
sessionCookieName: "session",
sessionCookiePath: "/",
sessionCookieSameSite: "Lax",
sessionCookieSecure: true,
sessionEnforceSameSubject: false,
sessionHashStorageKey: false,
sessionHashSubject: false,
sessionIdlingTimeout: 900,
sessionMemcachedHost: "127.0.0.1",
sessionMemcachedPort: 11211,
sessionMemcachedPrefix: "...my_session_memcached_prefix...",
sessionMemcachedSocket: "...my_session_memcached_socket...",
sessionMemcachedSsl: true,
sessionMemcachedSslVerify: true,
sessionRemember: false,
sessionRememberAbsoluteTimeout: 2592000,
sessionRememberCookieName: "remember",
sessionRememberRollingTimeout: 604800,
sessionRequestHeaders: ["subject"],
sessionResponseHeaders: ["absolute-timeout"],
sessionRollingTimeout: 3600,
sessionSecret: "...my_session_secret...",
sessionStorage: "cookie",
sessionStoreMetadata: false,
sslVerify: true,
timeout: 10000,
tlsClientAuthCertId: "...my_tls_client_auth_cert_id...",
tlsClientAuthSslVerify: true,
tokenCacheKeyIncludeScope: false,
tokenEndpoint: "...my_token_endpoint...",
tokenEndpointAuthMethod: "client_secret_basic",
tokenExchange: {
cache: {
enabled: true,
ttl: 7,
},
request: {
audiences: ["..."],
emptyAudience: false,
emptyScopes: false,
scopes: ["..."],
},
subjectTokenIssuers: [{
conditions: {
hasAudiences: ["..."],
hasScopes: ["..."],
missingAudiences: ["..."],
missingScopes: ["..."],
},
issuer: "...my_issuer...",
}],
},
tokenExchangeEndpoint: "...my_token_exchange_endpoint...",
tokenHeadersClients: ["..."],
tokenHeadersGrants: ["refresh_token"],
tokenHeadersNames: ["..."],
tokenHeadersPrefix: "...my_token_headers_prefix...",
tokenHeadersReplays: ["..."],
tokenHeadersValues: ["..."],
tokenPostArgsClients: ["..."],
tokenPostArgsNames: ["..."],
tokenPostArgsValues: ["..."],
unauthorizedDestroySession: true,
unauthorizedErrorMessage: "Unauthorized",
unauthorizedRedirectUris: ["..."],
unexpectedRedirectUris: ["..."],
upstreamAccessTokenHeader: "authorization:bearer",
upstreamAccessTokenJwkHeader: "...my_upstream_access_token_jwk_header...",
upstreamHeaders: [{
header: "...my_header...",
paths: ["..."],
}],
upstreamHeadersClaims: ["..."],
upstreamHeadersNames: ["..."],
upstreamIdTokenHeader: "...my_upstream_id_token_header...",
upstreamIdTokenJwkHeader: "...my_upstream_id_token_jwk_header...",
upstreamIntrospectionHeader: "...my_upstream_introspection_header...",
upstreamIntrospectionJwtHeader: "...my_upstream_introspection_jwt_header...",
upstreamRefreshTokenHeader: "...my_upstream_refresh_token_header...",
upstreamSessionIdHeader: "...my_upstream_session_id_header...",
upstreamUserInfoHeader: "...my_upstream_user_info_header...",
upstreamUserInfoJwtHeader: "...my_upstream_user_info_jwt_header...",
userinfoAccept: "application/json",
userinfoEndpoint: "...my_userinfo_endpoint...",
userinfoHeadersClients: ["..."],
userinfoHeadersNames: ["..."],
userinfoHeadersValues: ["..."],
userinfoQueryArgsClients: ["..."],
userinfoQueryArgsNames: ["..."],
userinfoQueryArgsValues: ["..."],
usingPseudoIssuer: false,
verifyClaims: true,
verifyNonce: true,
verifyParameters: false,
verifySignature: true,
},
displayName: "Okta AI SE",
labels: {
key: "value",
},
managedBy: {
key: "value",
},
name: "okta-ai-se",
},
});
import pulumi
import pulumi_konnect as konnect
my_aigatewayauthstrategy = konnect.AiGatewayAuthStrategy("my_aigatewayauthstrategy",
gateway_id="5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
key_auth={
"config": {
"anonymous": "...my_anonymous...",
"hide_credentials": True,
"identity_realms": [{
"id": "...my_id...",
"region": "...my_region...",
"scope": "cp",
}],
"key_in_body": False,
"key_in_header": True,
"key_in_query": True,
"key_names": ["..."],
"principals": {
"directory": "default",
"enabled": False,
"error_on_miss": True,
},
"realm": "...my_realm...",
"run_on_preflight": True,
},
"display_name": "Okta AI SE",
"labels": {
"key": "value",
},
"managed_by": {
"key": "value",
},
"name": "okta-ai-se",
},
openid_connect={
"config": {
"anonymous": "...my_anonymous...",
"audiences": ["..."],
"audience_claims": ["..."],
"audience_requireds": ["..."],
"auth_methods": ["userinfo"],
"authenticated_groups_claims": ["..."],
"authorization_cookie_domain": "...my_authorization_cookie_domain...",
"authorization_cookie_http_only": True,
"authorization_cookie_name": "authorization",
"authorization_cookie_path": "/",
"authorization_cookie_same_site": "Default",
"authorization_cookie_secure": False,
"authorization_endpoint": "...my_authorization_endpoint...",
"authorization_query_args_clients": ["..."],
"authorization_query_args_names": ["..."],
"authorization_query_args_values": ["..."],
"authorization_rolling_timeout": 600,
"bearer_token_cookie_name": "...my_bearer_token_cookie_name...",
"bearer_token_param_types": ["cookie"],
"by_username_ignore_case": False,
"cache_introspection": True,
"cache_token_exchange": True,
"cache_tokens": True,
"cache_tokens_salt": "...my_cache_tokens_salt...",
"cache_ttl": 3600,
"cache_ttl_max": 6.13,
"cache_ttl_min": 8.74,
"cache_ttl_neg": 5.39,
"cache_ttl_resurrect": 8.05,
"cache_user_info": True,
"claims_forbiddens": ["..."],
"client_algs": ["RS512"],
"client_arg": "client_id",
"client_auths": ["client_secret_basic"],
"client_credentials_param_types": ["body"],
"client_ids": ["..."],
"client_jwks": [{
"alg": "...my_alg...",
"crv": "...my_crv...",
"d": "...my_d...",
"dp": "...my_dp...",
"dq": "...my_dq...",
"e": "...my_e...",
"issuer": "...my_issuer...",
"k": "...my_k...",
"key_ops": ["..."],
"kid": "...my_kid...",
"kty": "...my_kty...",
"n": "...my_n...",
"oth": "...my_oth...",
"p": "...my_p...",
"q": "...my_q...",
"qi": "...my_qi...",
"r": "...my_r...",
"t": "...my_t...",
"use": "...my_use...",
"x": "...my_x...",
"x5cs": ["..."],
"x5t": "...my_x5t...",
"x5t_number_s256": "...my_x5t_number_s256...",
"x5u": "...my_x5u...",
"y": "...my_y...",
}],
"client_secrets": ["..."],
"cluster_cache_redis": {
"cloud_authentication": {
"auth_provider": "gcp",
"aws_access_key_id": "...my_aws_access_key_id...",
"aws_assume_role_arn": "...my_aws_assume_role_arn...",
"aws_cache_name": "...my_aws_cache_name...",
"aws_is_serverless": True,
"aws_region": "...my_aws_region...",
"aws_role_session_name": "...my_aws_role_session_name...",
"aws_secret_access_key": "...my_aws_secret_access_key...",
"azure_client_id": "...my_azure_client_id...",
"azure_client_secret": "...my_azure_client_secret...",
"azure_tenant_id": "...my_azure_tenant_id...",
"gcp_service_account_json": "...my_gcp_service_account_json...",
},
"cluster_max_redirections": 5,
"cluster_nodes": [{
"ip": "127.0.0.1",
"port": 6379,
}],
"connect_timeout": 2000,
"connection_is_proxied": False,
"database": 0,
"host": "127.0.0.1",
"keepalive_backlog": 1429494394,
"keepalive_pool_size": 256,
"password": "...my_password...",
"port": "6379",
"read_timeout": 2000,
"send_timeout": 2000,
"sentinel_master": "...my_sentinel_master...",
"sentinel_nodes": [{
"host": "127.0.0.1",
"port": 6379,
}],
"sentinel_password": "...my_sentinel_password...",
"sentinel_role": "any",
"sentinel_username": "...my_sentinel_username...",
"server_name": "...my_server_name...",
"ssl": False,
"ssl_verify": True,
"username": "...my_username...",
},
"cluster_cache_strategy": "off",
"consumer_bies": ["id"],
"consumer_claims": [[]],
"consumer_groups_claims": ["..."],
"consumer_groups_optional": False,
"consumer_optional": False,
"credential_claims": ["..."],
"disable_sessions": ["bearer"],
"discovery_headers_names": ["..."],
"discovery_headers_values": ["..."],
"display_errors": False,
"domains": ["..."],
"downstream_access_token_header": "...my_downstream_access_token_header...",
"downstream_access_token_jwk_header": "...my_downstream_access_token_jwk_header...",
"downstream_headers": [{
"header": "...my_header...",
"paths": ["..."],
}],
"downstream_headers_claims": ["..."],
"downstream_headers_names": ["..."],
"downstream_id_token_header": "...my_downstream_id_token_header...",
"downstream_id_token_jwk_header": "...my_downstream_id_token_jwk_header...",
"downstream_introspection_header": "...my_downstream_introspection_header...",
"downstream_introspection_jwt_header": "...my_downstream_introspection_jwt_header...",
"downstream_refresh_token_header": "...my_downstream_refresh_token_header...",
"downstream_session_id_header": "...my_downstream_session_id_header...",
"downstream_user_info_header": "...my_downstream_user_info_header...",
"downstream_user_info_jwt_header": "...my_downstream_user_info_jwt_header...",
"dpop_proof_lifetime": 300,
"dpop_use_nonce": False,
"enable_hs_signatures": False,
"end_session_endpoint": "...my_end_session_endpoint...",
"expose_error_code": True,
"extra_jwks_uris": ["..."],
"forbidden_destroy_session": True,
"forbidden_error_message": "Forbidden",
"forbidden_redirect_uris": ["..."],
"groups_claims": ["..."],
"groups_requireds": ["..."],
"hide_credentials": True,
"http_proxy": "...my_http_proxy...",
"http_proxy_authorization": "...my_http_proxy_authorization...",
"http_version": 9.47,
"https_proxy": "...my_https_proxy...",
"https_proxy_authorization": "...my_https_proxy_authorization...",
"id_token_param_name": "...my_id_token_param_name...",
"id_token_param_types": ["body"],
"ignore_signatures": ["session"],
"introspect_jwt_tokens": False,
"introspection_accept": "application/json",
"introspection_check_active": True,
"introspection_endpoint": "...my_introspection_endpoint...",
"introspection_endpoint_auth_method": "client_secret_jwt",
"introspection_headers_clients": ["..."],
"introspection_headers_names": ["..."],
"introspection_headers_values": ["..."],
"introspection_hint": "access_token",
"introspection_post_args_clients": ["..."],
"introspection_post_args_client_headers": ["..."],
"introspection_post_args_names": ["..."],
"introspection_post_args_values": ["..."],
"introspection_token_param_name": "token",
"issuer": "...my_issuer...",
"issuers_alloweds": ["..."],
"jwks_endpoint": "...my_jwks_endpoint...",
"jwt_session_claim": "sid",
"jwt_session_cookie": "...my_jwt_session_cookie...",
"keepalive": True,
"leeway": 0,
"login_action": "upstream",
"login_methods": ["client_credentials"],
"login_redirect_mode": "fragment",
"login_redirect_uris": ["..."],
"login_tokens": ["tokens"],
"logout_methods": ["GET"],
"logout_post_arg": "...my_logout_post_arg...",
"logout_query_arg": "...my_logout_query_arg...",
"logout_redirect_uris": ["..."],
"logout_revoke": False,
"logout_revoke_access_token": True,
"logout_revoke_refresh_token": True,
"logout_uri_suffix": "...my_logout_uri_suffix...",
"max_age": 8.25,
"mtls_introspection_endpoint": "...my_mtls_introspection_endpoint...",
"mtls_revocation_endpoint": "...my_mtls_revocation_endpoint...",
"mtls_token_endpoint": "...my_mtls_token_endpoint...",
"no_proxy": "...my_no_proxy...",
"password_param_types": ["query"],
"preserve_query_args": False,
"principals": {
"directory": "default",
"enabled": False,
"error_on_miss": True,
"match_consumer": True,
"match_consumer_groups": True,
"principal_by": "...my_principal_by...",
"principal_claims": ["..."],
},
"proof_of_possession_auth_methods_validation": True,
"proof_of_possession_dpop": "off",
"proof_of_possession_mtls": "off",
"pushed_authorization_request_endpoint": "...my_pushed_authorization_request_endpoint...",
"pushed_authorization_request_endpoint_auth_method": "self_signed_tls_client_auth",
"redirect_uris": ["..."],
"redis": {
"cloud_authentication": {
"auth_provider": "azure",
"aws_access_key_id": "...my_aws_access_key_id...",
"aws_assume_role_arn": "...my_aws_assume_role_arn...",
"aws_cache_name": "...my_aws_cache_name...",
"aws_is_serverless": True,
"aws_region": "...my_aws_region...",
"aws_role_session_name": "...my_aws_role_session_name...",
"aws_secret_access_key": "...my_aws_secret_access_key...",
"azure_client_id": "...my_azure_client_id...",
"azure_client_secret": "...my_azure_client_secret...",
"azure_tenant_id": "...my_azure_tenant_id...",
"gcp_service_account_json": "...my_gcp_service_account_json...",
},
"cluster_max_redirections": 5,
"cluster_nodes": [{
"ip": "127.0.0.1",
"port": 6379,
}],
"connect_timeout": 2000,
"connection_is_proxied": False,
"database": 0,
"host": "127.0.0.1",
"keepalive_backlog": 73538938,
"keepalive_pool_size": 256,
"password": "...my_password...",
"port": "6379",
"prefix": "...my_prefix...",
"read_timeout": 2000,
"send_timeout": 2000,
"sentinel_master": "...my_sentinel_master...",
"sentinel_nodes": [{
"host": "127.0.0.1",
"port": 6379,
}],
"sentinel_password": "...my_sentinel_password...",
"sentinel_role": "slave",
"sentinel_username": "...my_sentinel_username...",
"server_name": "...my_server_name...",
"socket": "...my_socket...",
"ssl": False,
"ssl_verify": True,
"username": "...my_username...",
},
"rediscovery_lifetime": 30,
"refresh_token_param_name": "...my_refresh_token_param_name...",
"refresh_token_param_types": ["header"],
"refresh_tokens": True,
"require_proof_key_for_code_exchange": True,
"require_pushed_authorization_requests": True,
"require_signed_request_object": False,
"resolve_distributed_claims": False,
"response_mode": "query",
"response_types": ["..."],
"reverify": False,
"revocation_endpoint": "...my_revocation_endpoint...",
"revocation_endpoint_auth_method": "tls_client_auth",
"revocation_token_param_name": "token",
"roles_claims": ["..."],
"roles_requireds": ["..."],
"run_on_preflight": True,
"scopes": ["..."],
"scopes_claims": ["..."],
"scopes_requireds": ["..."],
"search_user_info": False,
"session_absolute_timeout": 86400,
"session_audience": "default",
"session_binds": ["ip"],
"session_cookie_domain": "...my_session_cookie_domain...",
"session_cookie_http_only": True,
"session_cookie_name": "session",
"session_cookie_path": "/",
"session_cookie_same_site": "Lax",
"session_cookie_secure": True,
"session_enforce_same_subject": False,
"session_hash_storage_key": False,
"session_hash_subject": False,
"session_idling_timeout": 900,
"session_memcached_host": "127.0.0.1",
"session_memcached_port": 11211,
"session_memcached_prefix": "...my_session_memcached_prefix...",
"session_memcached_socket": "...my_session_memcached_socket...",
"session_memcached_ssl": True,
"session_memcached_ssl_verify": True,
"session_remember": False,
"session_remember_absolute_timeout": 2592000,
"session_remember_cookie_name": "remember",
"session_remember_rolling_timeout": 604800,
"session_request_headers": ["subject"],
"session_response_headers": ["absolute-timeout"],
"session_rolling_timeout": 3600,
"session_secret": "...my_session_secret...",
"session_storage": "cookie",
"session_store_metadata": False,
"ssl_verify": True,
"timeout": 10000,
"tls_client_auth_cert_id": "...my_tls_client_auth_cert_id...",
"tls_client_auth_ssl_verify": True,
"token_cache_key_include_scope": False,
"token_endpoint": "...my_token_endpoint...",
"token_endpoint_auth_method": "client_secret_basic",
"token_exchange": {
"cache": {
"enabled": True,
"ttl": 7,
},
"request": {
"audiences": ["..."],
"empty_audience": False,
"empty_scopes": False,
"scopes": ["..."],
},
"subject_token_issuers": [{
"conditions": {
"has_audiences": ["..."],
"has_scopes": ["..."],
"missing_audiences": ["..."],
"missing_scopes": ["..."],
},
"issuer": "...my_issuer...",
}],
},
"token_exchange_endpoint": "...my_token_exchange_endpoint...",
"token_headers_clients": ["..."],
"token_headers_grants": ["refresh_token"],
"token_headers_names": ["..."],
"token_headers_prefix": "...my_token_headers_prefix...",
"token_headers_replays": ["..."],
"token_headers_values": ["..."],
"token_post_args_clients": ["..."],
"token_post_args_names": ["..."],
"token_post_args_values": ["..."],
"unauthorized_destroy_session": True,
"unauthorized_error_message": "Unauthorized",
"unauthorized_redirect_uris": ["..."],
"unexpected_redirect_uris": ["..."],
"upstream_access_token_header": "authorization:bearer",
"upstream_access_token_jwk_header": "...my_upstream_access_token_jwk_header...",
"upstream_headers": [{
"header": "...my_header...",
"paths": ["..."],
}],
"upstream_headers_claims": ["..."],
"upstream_headers_names": ["..."],
"upstream_id_token_header": "...my_upstream_id_token_header...",
"upstream_id_token_jwk_header": "...my_upstream_id_token_jwk_header...",
"upstream_introspection_header": "...my_upstream_introspection_header...",
"upstream_introspection_jwt_header": "...my_upstream_introspection_jwt_header...",
"upstream_refresh_token_header": "...my_upstream_refresh_token_header...",
"upstream_session_id_header": "...my_upstream_session_id_header...",
"upstream_user_info_header": "...my_upstream_user_info_header...",
"upstream_user_info_jwt_header": "...my_upstream_user_info_jwt_header...",
"userinfo_accept": "application/json",
"userinfo_endpoint": "...my_userinfo_endpoint...",
"userinfo_headers_clients": ["..."],
"userinfo_headers_names": ["..."],
"userinfo_headers_values": ["..."],
"userinfo_query_args_clients": ["..."],
"userinfo_query_args_names": ["..."],
"userinfo_query_args_values": ["..."],
"using_pseudo_issuer": False,
"verify_claims": True,
"verify_nonce": True,
"verify_parameters": False,
"verify_signature": True,
},
"display_name": "Okta AI SE",
"labels": {
"key": "value",
},
"managed_by": {
"key": "value",
},
"name": "okta-ai-se",
})
package main
import (
"github.com/pulumi/pulumi-terraform-provider/sdks/go/konnect/v3/konnect"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := konnect.NewAiGatewayAuthStrategy(ctx, "my_aigatewayauthstrategy", &konnect.AiGatewayAuthStrategyArgs{
GatewayId: pulumi.String("5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"),
KeyAuth: &konnect.AiGatewayAuthStrategyKeyAuthArgs{
Config: &konnect.AiGatewayAuthStrategyKeyAuthConfigArgs{
Anonymous: pulumi.String("...my_anonymous..."),
HideCredentials: pulumi.Bool(true),
IdentityRealms: konnect.AiGatewayAuthStrategyKeyAuthConfigIdentityRealmArray{
&konnect.AiGatewayAuthStrategyKeyAuthConfigIdentityRealmArgs{
Id: pulumi.String("...my_id..."),
Region: pulumi.String("...my_region..."),
Scope: pulumi.String("cp"),
},
},
KeyInBody: pulumi.Bool(false),
KeyInHeader: pulumi.Bool(true),
KeyInQuery: pulumi.Bool(true),
KeyNames: pulumi.StringArray{
pulumi.String("..."),
},
Principals: &konnect.AiGatewayAuthStrategyKeyAuthConfigPrincipalsArgs{
Directory: pulumi.String("default"),
Enabled: pulumi.Bool(false),
ErrorOnMiss: pulumi.Bool(true),
},
Realm: pulumi.String("...my_realm..."),
RunOnPreflight: pulumi.Bool(true),
},
DisplayName: pulumi.String("Okta AI SE"),
Labels: pulumi.StringMap{
"key": pulumi.String("value"),
},
ManagedBy: pulumi.StringMap{
"key": pulumi.String("value"),
},
Name: pulumi.String("okta-ai-se"),
},
OpenidConnect: &konnect.AiGatewayAuthStrategyOpenidConnectArgs{
Config: &konnect.AiGatewayAuthStrategyOpenidConnectConfigArgs{
Anonymous: pulumi.String("...my_anonymous..."),
Audiences: pulumi.StringArray{
pulumi.String("..."),
},
AudienceClaims: pulumi.StringArray{
pulumi.String("..."),
},
AudienceRequireds: pulumi.StringArray{
pulumi.String("..."),
},
AuthMethods: pulumi.StringArray{
pulumi.String("userinfo"),
},
AuthenticatedGroupsClaims: pulumi.StringArray{
pulumi.String("..."),
},
AuthorizationCookieDomain: pulumi.String("...my_authorization_cookie_domain..."),
AuthorizationCookieHttpOnly: pulumi.Bool(true),
AuthorizationCookieName: pulumi.String("authorization"),
AuthorizationCookiePath: pulumi.String("/"),
AuthorizationCookieSameSite: pulumi.String("Default"),
AuthorizationCookieSecure: pulumi.Bool(false),
AuthorizationEndpoint: pulumi.String("...my_authorization_endpoint..."),
AuthorizationQueryArgsClients: pulumi.StringArray{
pulumi.String("..."),
},
AuthorizationQueryArgsNames: pulumi.StringArray{
pulumi.String("..."),
},
AuthorizationQueryArgsValues: pulumi.StringArray{
pulumi.String("..."),
},
AuthorizationRollingTimeout: pulumi.Float64(600),
BearerTokenCookieName: pulumi.String("...my_bearer_token_cookie_name..."),
BearerTokenParamTypes: pulumi.StringArray{
pulumi.String("cookie"),
},
ByUsernameIgnoreCase: pulumi.Bool(false),
CacheIntrospection: pulumi.Bool(true),
CacheTokenExchange: pulumi.Bool(true),
CacheTokens: pulumi.Bool(true),
CacheTokensSalt: pulumi.String("...my_cache_tokens_salt..."),
CacheTtl: pulumi.Float64(3600),
CacheTtlMax: pulumi.Float64(6.13),
CacheTtlMin: pulumi.Float64(8.74),
CacheTtlNeg: pulumi.Float64(5.39),
CacheTtlResurrect: pulumi.Float64(8.05),
CacheUserInfo: pulumi.Bool(true),
ClaimsForbiddens: pulumi.StringArray{
pulumi.String("..."),
},
ClientAlgs: pulumi.StringArray{
pulumi.String("RS512"),
},
ClientArg: pulumi.String("client_id"),
ClientAuths: pulumi.StringArray{
pulumi.String("client_secret_basic"),
},
ClientCredentialsParamTypes: pulumi.StringArray{
pulumi.String("body"),
},
ClientIds: pulumi.StringArray{
pulumi.String("..."),
},
ClientJwks: konnect.AiGatewayAuthStrategyOpenidConnectConfigClientJwkArray{
&konnect.AiGatewayAuthStrategyOpenidConnectConfigClientJwkArgs{
Alg: pulumi.String("...my_alg..."),
Crv: pulumi.String("...my_crv..."),
D: pulumi.String("...my_d..."),
Dp: pulumi.String("...my_dp..."),
Dq: pulumi.String("...my_dq..."),
E: pulumi.String("...my_e..."),
Issuer: pulumi.String("...my_issuer..."),
K: pulumi.String("...my_k..."),
KeyOps: pulumi.StringArray{
pulumi.String("..."),
},
Kid: pulumi.String("...my_kid..."),
Kty: pulumi.String("...my_kty..."),
N: pulumi.String("...my_n..."),
Oth: pulumi.String("...my_oth..."),
P: pulumi.String("...my_p..."),
Q: pulumi.String("...my_q..."),
Qi: pulumi.String("...my_qi..."),
R: pulumi.String("...my_r..."),
T: pulumi.String("...my_t..."),
Use: pulumi.String("...my_use..."),
X: pulumi.String("...my_x..."),
X5cs: pulumi.StringArray{
pulumi.String("..."),
},
X5t: pulumi.String("...my_x5t..."),
X5tNumberS256: pulumi.String("...my_x5t_number_s256..."),
X5u: pulumi.String("...my_x5u..."),
Y: pulumi.String("...my_y..."),
},
},
ClientSecrets: pulumi.StringArray{
pulumi.String("..."),
},
ClusterCacheRedis: &konnect.AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisArgs{
CloudAuthentication: &konnect.AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisCloudAuthenticationArgs{
AuthProvider: pulumi.String("gcp"),
AwsAccessKeyId: pulumi.String("...my_aws_access_key_id..."),
AwsAssumeRoleArn: pulumi.String("...my_aws_assume_role_arn..."),
AwsCacheName: pulumi.String("...my_aws_cache_name..."),
AwsIsServerless: pulumi.Bool(true),
AwsRegion: pulumi.String("...my_aws_region..."),
AwsRoleSessionName: pulumi.String("...my_aws_role_session_name..."),
AwsSecretAccessKey: pulumi.String("...my_aws_secret_access_key..."),
AzureClientId: pulumi.String("...my_azure_client_id..."),
AzureClientSecret: pulumi.String("...my_azure_client_secret..."),
AzureTenantId: pulumi.String("...my_azure_tenant_id..."),
GcpServiceAccountJson: pulumi.String("...my_gcp_service_account_json..."),
},
ClusterMaxRedirections: pulumi.Float64(5),
ClusterNodes: konnect.AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisClusterNodeArray{
&konnect.AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisClusterNodeArgs{
Ip: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
ConnectTimeout: pulumi.Float64(2000),
ConnectionIsProxied: pulumi.Bool(false),
Database: pulumi.Float64(0),
Host: pulumi.String("127.0.0.1"),
KeepaliveBacklog: pulumi.Float64(1429494394),
KeepalivePoolSize: pulumi.Float64(256),
Password: pulumi.String("...my_password..."),
Port: pulumi.String("6379"),
ReadTimeout: pulumi.Float64(2000),
SendTimeout: pulumi.Float64(2000),
SentinelMaster: pulumi.String("...my_sentinel_master..."),
SentinelNodes: konnect.AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisSentinelNodeArray{
&konnect.AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisSentinelNodeArgs{
Host: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
SentinelPassword: pulumi.String("...my_sentinel_password..."),
SentinelRole: pulumi.String("any"),
SentinelUsername: pulumi.String("...my_sentinel_username..."),
ServerName: pulumi.String("...my_server_name..."),
Ssl: pulumi.Bool(false),
SslVerify: pulumi.Bool(true),
Username: pulumi.String("...my_username..."),
},
ClusterCacheStrategy: pulumi.String("off"),
ConsumerBies: pulumi.StringArray{
pulumi.String("id"),
},
ConsumerClaims: pulumi.StringArrayArray{
pulumi.StringArray{},
},
ConsumerGroupsClaims: pulumi.StringArray{
pulumi.String("..."),
},
ConsumerGroupsOptional: pulumi.Bool(false),
ConsumerOptional: pulumi.Bool(false),
CredentialClaims: pulumi.StringArray{
pulumi.String("..."),
},
DisableSessions: pulumi.StringArray{
pulumi.String("bearer"),
},
DiscoveryHeadersNames: pulumi.StringArray{
pulumi.String("..."),
},
DiscoveryHeadersValues: pulumi.StringArray{
pulumi.String("..."),
},
DisplayErrors: pulumi.Bool(false),
Domains: pulumi.StringArray{
pulumi.String("..."),
},
DownstreamAccessTokenHeader: pulumi.String("...my_downstream_access_token_header..."),
DownstreamAccessTokenJwkHeader: pulumi.String("...my_downstream_access_token_jwk_header..."),
DownstreamHeaders: konnect.AiGatewayAuthStrategyOpenidConnectConfigDownstreamHeaderArray{
&konnect.AiGatewayAuthStrategyOpenidConnectConfigDownstreamHeaderArgs{
Header: pulumi.String("...my_header..."),
Paths: pulumi.StringArray{
pulumi.String("..."),
},
},
},
DownstreamHeadersClaims: pulumi.StringArray{
pulumi.String("..."),
},
DownstreamHeadersNames: pulumi.StringArray{
pulumi.String("..."),
},
DownstreamIdTokenHeader: pulumi.String("...my_downstream_id_token_header..."),
DownstreamIdTokenJwkHeader: pulumi.String("...my_downstream_id_token_jwk_header..."),
DownstreamIntrospectionHeader: pulumi.String("...my_downstream_introspection_header..."),
DownstreamIntrospectionJwtHeader: pulumi.String("...my_downstream_introspection_jwt_header..."),
DownstreamRefreshTokenHeader: pulumi.String("...my_downstream_refresh_token_header..."),
DownstreamSessionIdHeader: pulumi.String("...my_downstream_session_id_header..."),
DownstreamUserInfoHeader: pulumi.String("...my_downstream_user_info_header..."),
DownstreamUserInfoJwtHeader: pulumi.String("...my_downstream_user_info_jwt_header..."),
DpopProofLifetime: pulumi.Float64(300),
DpopUseNonce: pulumi.Bool(false),
EnableHsSignatures: pulumi.Bool(false),
EndSessionEndpoint: pulumi.String("...my_end_session_endpoint..."),
ExposeErrorCode: pulumi.Bool(true),
ExtraJwksUris: pulumi.StringArray{
pulumi.String("..."),
},
ForbiddenDestroySession: pulumi.Bool(true),
ForbiddenErrorMessage: pulumi.String("Forbidden"),
ForbiddenRedirectUris: pulumi.StringArray{
pulumi.String("..."),
},
GroupsClaims: pulumi.StringArray{
pulumi.String("..."),
},
GroupsRequireds: pulumi.StringArray{
pulumi.String("..."),
},
HideCredentials: pulumi.Bool(true),
HttpProxy: pulumi.String("...my_http_proxy..."),
HttpProxyAuthorization: pulumi.String("...my_http_proxy_authorization..."),
HttpVersion: pulumi.Float64(9.47),
HttpsProxy: pulumi.String("...my_https_proxy..."),
HttpsProxyAuthorization: pulumi.String("...my_https_proxy_authorization..."),
IdTokenParamName: pulumi.String("...my_id_token_param_name..."),
IdTokenParamTypes: pulumi.StringArray{
pulumi.String("body"),
},
IgnoreSignatures: pulumi.StringArray{
pulumi.String("session"),
},
IntrospectJwtTokens: pulumi.Bool(false),
IntrospectionAccept: pulumi.String("application/json"),
IntrospectionCheckActive: pulumi.Bool(true),
IntrospectionEndpoint: pulumi.String("...my_introspection_endpoint..."),
IntrospectionEndpointAuthMethod: pulumi.String("client_secret_jwt"),
IntrospectionHeadersClients: pulumi.StringArray{
pulumi.String("..."),
},
IntrospectionHeadersNames: pulumi.StringArray{
pulumi.String("..."),
},
IntrospectionHeadersValues: pulumi.StringArray{
pulumi.String("..."),
},
IntrospectionHint: pulumi.String("access_token"),
IntrospectionPostArgsClients: pulumi.StringArray{
pulumi.String("..."),
},
IntrospectionPostArgsClientHeaders: pulumi.StringArray{
pulumi.String("..."),
},
IntrospectionPostArgsNames: pulumi.StringArray{
pulumi.String("..."),
},
IntrospectionPostArgsValues: pulumi.StringArray{
pulumi.String("..."),
},
IntrospectionTokenParamName: pulumi.String("token"),
Issuer: pulumi.String("...my_issuer..."),
IssuersAlloweds: pulumi.StringArray{
pulumi.String("..."),
},
JwksEndpoint: pulumi.String("...my_jwks_endpoint..."),
JwtSessionClaim: pulumi.String("sid"),
JwtSessionCookie: pulumi.String("...my_jwt_session_cookie..."),
Keepalive: pulumi.Bool(true),
Leeway: pulumi.Float64(0),
LoginAction: pulumi.String("upstream"),
LoginMethods: pulumi.StringArray{
pulumi.String("client_credentials"),
},
LoginRedirectMode: pulumi.String("fragment"),
LoginRedirectUris: pulumi.StringArray{
pulumi.String("..."),
},
LoginTokens: pulumi.StringArray{
pulumi.String("tokens"),
},
LogoutMethods: pulumi.StringArray{
pulumi.String("GET"),
},
LogoutPostArg: pulumi.String("...my_logout_post_arg..."),
LogoutQueryArg: pulumi.String("...my_logout_query_arg..."),
LogoutRedirectUris: pulumi.StringArray{
pulumi.String("..."),
},
LogoutRevoke: pulumi.Bool(false),
LogoutRevokeAccessToken: pulumi.Bool(true),
LogoutRevokeRefreshToken: pulumi.Bool(true),
LogoutUriSuffix: pulumi.String("...my_logout_uri_suffix..."),
MaxAge: pulumi.Float64(8.25),
MtlsIntrospectionEndpoint: pulumi.String("...my_mtls_introspection_endpoint..."),
MtlsRevocationEndpoint: pulumi.String("...my_mtls_revocation_endpoint..."),
MtlsTokenEndpoint: pulumi.String("...my_mtls_token_endpoint..."),
NoProxy: pulumi.String("...my_no_proxy..."),
PasswordParamTypes: pulumi.StringArray{
pulumi.String("query"),
},
PreserveQueryArgs: pulumi.Bool(false),
Principals: &konnect.AiGatewayAuthStrategyOpenidConnectConfigPrincipalsArgs{
Directory: pulumi.String("default"),
Enabled: pulumi.Bool(false),
ErrorOnMiss: pulumi.Bool(true),
MatchConsumer: pulumi.Bool(true),
MatchConsumerGroups: pulumi.Bool(true),
PrincipalBy: pulumi.String("...my_principal_by..."),
PrincipalClaims: pulumi.StringArray{
pulumi.String("..."),
},
},
ProofOfPossessionAuthMethodsValidation: pulumi.Bool(true),
ProofOfPossessionDpop: pulumi.String("off"),
ProofOfPossessionMtls: pulumi.String("off"),
PushedAuthorizationRequestEndpoint: pulumi.String("...my_pushed_authorization_request_endpoint..."),
PushedAuthorizationRequestEndpointAuthMethod: pulumi.String("self_signed_tls_client_auth"),
RedirectUris: pulumi.StringArray{
pulumi.String("..."),
},
Redis: &konnect.AiGatewayAuthStrategyOpenidConnectConfigRedisArgs{
CloudAuthentication: &konnect.AiGatewayAuthStrategyOpenidConnectConfigRedisCloudAuthenticationArgs{
AuthProvider: pulumi.String("azure"),
AwsAccessKeyId: pulumi.String("...my_aws_access_key_id..."),
AwsAssumeRoleArn: pulumi.String("...my_aws_assume_role_arn..."),
AwsCacheName: pulumi.String("...my_aws_cache_name..."),
AwsIsServerless: pulumi.Bool(true),
AwsRegion: pulumi.String("...my_aws_region..."),
AwsRoleSessionName: pulumi.String("...my_aws_role_session_name..."),
AwsSecretAccessKey: pulumi.String("...my_aws_secret_access_key..."),
AzureClientId: pulumi.String("...my_azure_client_id..."),
AzureClientSecret: pulumi.String("...my_azure_client_secret..."),
AzureTenantId: pulumi.String("...my_azure_tenant_id..."),
GcpServiceAccountJson: pulumi.String("...my_gcp_service_account_json..."),
},
ClusterMaxRedirections: pulumi.Float64(5),
ClusterNodes: konnect.AiGatewayAuthStrategyOpenidConnectConfigRedisClusterNodeArray{
&konnect.AiGatewayAuthStrategyOpenidConnectConfigRedisClusterNodeArgs{
Ip: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
ConnectTimeout: pulumi.Float64(2000),
ConnectionIsProxied: pulumi.Bool(false),
Database: pulumi.Float64(0),
Host: pulumi.String("127.0.0.1"),
KeepaliveBacklog: pulumi.Float64(73538938),
KeepalivePoolSize: pulumi.Float64(256),
Password: pulumi.String("...my_password..."),
Port: pulumi.String("6379"),
Prefix: pulumi.String("...my_prefix..."),
ReadTimeout: pulumi.Float64(2000),
SendTimeout: pulumi.Float64(2000),
SentinelMaster: pulumi.String("...my_sentinel_master..."),
SentinelNodes: konnect.AiGatewayAuthStrategyOpenidConnectConfigRedisSentinelNodeArray{
&konnect.AiGatewayAuthStrategyOpenidConnectConfigRedisSentinelNodeArgs{
Host: pulumi.String("127.0.0.1"),
Port: pulumi.Float64(6379),
},
},
SentinelPassword: pulumi.String("...my_sentinel_password..."),
SentinelRole: pulumi.String("slave"),
SentinelUsername: pulumi.String("...my_sentinel_username..."),
ServerName: pulumi.String("...my_server_name..."),
Socket: pulumi.String("...my_socket..."),
Ssl: pulumi.Bool(false),
SslVerify: pulumi.Bool(true),
Username: pulumi.String("...my_username..."),
},
RediscoveryLifetime: pulumi.Float64(30),
RefreshTokenParamName: pulumi.String("...my_refresh_token_param_name..."),
RefreshTokenParamTypes: pulumi.StringArray{
pulumi.String("header"),
},
RefreshTokens: pulumi.Bool(true),
RequireProofKeyForCodeExchange: pulumi.Bool(true),
RequirePushedAuthorizationRequests: pulumi.Bool(true),
RequireSignedRequestObject: pulumi.Bool(false),
ResolveDistributedClaims: pulumi.Bool(false),
ResponseMode: pulumi.String("query"),
ResponseTypes: pulumi.StringArray{
pulumi.String("..."),
},
Reverify: pulumi.Bool(false),
RevocationEndpoint: pulumi.String("...my_revocation_endpoint..."),
RevocationEndpointAuthMethod: pulumi.String("tls_client_auth"),
RevocationTokenParamName: pulumi.String("token"),
RolesClaims: pulumi.StringArray{
pulumi.String("..."),
},
RolesRequireds: pulumi.StringArray{
pulumi.String("..."),
},
RunOnPreflight: pulumi.Bool(true),
Scopes: pulumi.StringArray{
pulumi.String("..."),
},
ScopesClaims: pulumi.StringArray{
pulumi.String("..."),
},
ScopesRequireds: pulumi.StringArray{
pulumi.String("..."),
},
SearchUserInfo: pulumi.Bool(false),
SessionAbsoluteTimeout: pulumi.Float64(86400),
SessionAudience: pulumi.String("default"),
SessionBinds: pulumi.StringArray{
pulumi.String("ip"),
},
SessionCookieDomain: pulumi.String("...my_session_cookie_domain..."),
SessionCookieHttpOnly: pulumi.Bool(true),
SessionCookieName: pulumi.String("session"),
SessionCookiePath: pulumi.String("/"),
SessionCookieSameSite: pulumi.String("Lax"),
SessionCookieSecure: pulumi.Bool(true),
SessionEnforceSameSubject: pulumi.Bool(false),
SessionHashStorageKey: pulumi.Bool(false),
SessionHashSubject: pulumi.Bool(false),
SessionIdlingTimeout: pulumi.Float64(900),
SessionMemcachedHost: pulumi.String("127.0.0.1"),
SessionMemcachedPort: pulumi.Float64(11211),
SessionMemcachedPrefix: pulumi.String("...my_session_memcached_prefix..."),
SessionMemcachedSocket: pulumi.String("...my_session_memcached_socket..."),
SessionMemcachedSsl: pulumi.Bool(true),
SessionMemcachedSslVerify: pulumi.Bool(true),
SessionRemember: pulumi.Bool(false),
SessionRememberAbsoluteTimeout: pulumi.Float64(2592000),
SessionRememberCookieName: pulumi.String("remember"),
SessionRememberRollingTimeout: pulumi.Float64(604800),
SessionRequestHeaders: pulumi.StringArray{
pulumi.String("subject"),
},
SessionResponseHeaders: pulumi.StringArray{
pulumi.String("absolute-timeout"),
},
SessionRollingTimeout: pulumi.Float64(3600),
SessionSecret: pulumi.String("...my_session_secret..."),
SessionStorage: pulumi.String("cookie"),
SessionStoreMetadata: pulumi.Bool(false),
SslVerify: pulumi.Bool(true),
Timeout: pulumi.Float64(10000),
TlsClientAuthCertId: pulumi.String("...my_tls_client_auth_cert_id..."),
TlsClientAuthSslVerify: pulumi.Bool(true),
TokenCacheKeyIncludeScope: pulumi.Bool(false),
TokenEndpoint: pulumi.String("...my_token_endpoint..."),
TokenEndpointAuthMethod: pulumi.String("client_secret_basic"),
TokenExchange: &konnect.AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeArgs{
Cache: &konnect.AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeCacheArgs{
Enabled: pulumi.Bool(true),
Ttl: pulumi.Float64(7),
},
Request: &konnect.AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeRequestArgs{
Audiences: pulumi.StringArray{
pulumi.String("..."),
},
EmptyAudience: pulumi.Bool(false),
EmptyScopes: pulumi.Bool(false),
Scopes: pulumi.StringArray{
pulumi.String("..."),
},
},
SubjectTokenIssuers: konnect.AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeSubjectTokenIssuerArray{
&konnect.AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeSubjectTokenIssuerArgs{
Conditions: &konnect.AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeSubjectTokenIssuerConditionsArgs{
HasAudiences: pulumi.StringArray{
pulumi.String("..."),
},
HasScopes: pulumi.StringArray{
pulumi.String("..."),
},
MissingAudiences: pulumi.StringArray{
pulumi.String("..."),
},
MissingScopes: pulumi.StringArray{
pulumi.String("..."),
},
},
Issuer: pulumi.String("...my_issuer..."),
},
},
},
TokenExchangeEndpoint: pulumi.String("...my_token_exchange_endpoint..."),
TokenHeadersClients: pulumi.StringArray{
pulumi.String("..."),
},
TokenHeadersGrants: pulumi.StringArray{
pulumi.String("refresh_token"),
},
TokenHeadersNames: pulumi.StringArray{
pulumi.String("..."),
},
TokenHeadersPrefix: pulumi.String("...my_token_headers_prefix..."),
TokenHeadersReplays: pulumi.StringArray{
pulumi.String("..."),
},
TokenHeadersValues: pulumi.StringArray{
pulumi.String("..."),
},
TokenPostArgsClients: pulumi.StringArray{
pulumi.String("..."),
},
TokenPostArgsNames: pulumi.StringArray{
pulumi.String("..."),
},
TokenPostArgsValues: pulumi.StringArray{
pulumi.String("..."),
},
UnauthorizedDestroySession: pulumi.Bool(true),
UnauthorizedErrorMessage: pulumi.String("Unauthorized"),
UnauthorizedRedirectUris: pulumi.StringArray{
pulumi.String("..."),
},
UnexpectedRedirectUris: pulumi.StringArray{
pulumi.String("..."),
},
UpstreamAccessTokenHeader: pulumi.String("authorization:bearer"),
UpstreamAccessTokenJwkHeader: pulumi.String("...my_upstream_access_token_jwk_header..."),
UpstreamHeaders: konnect.AiGatewayAuthStrategyOpenidConnectConfigUpstreamHeaderArray{
&konnect.AiGatewayAuthStrategyOpenidConnectConfigUpstreamHeaderArgs{
Header: pulumi.String("...my_header..."),
Paths: pulumi.StringArray{
pulumi.String("..."),
},
},
},
UpstreamHeadersClaims: pulumi.StringArray{
pulumi.String("..."),
},
UpstreamHeadersNames: pulumi.StringArray{
pulumi.String("..."),
},
UpstreamIdTokenHeader: pulumi.String("...my_upstream_id_token_header..."),
UpstreamIdTokenJwkHeader: pulumi.String("...my_upstream_id_token_jwk_header..."),
UpstreamIntrospectionHeader: pulumi.String("...my_upstream_introspection_header..."),
UpstreamIntrospectionJwtHeader: pulumi.String("...my_upstream_introspection_jwt_header..."),
UpstreamRefreshTokenHeader: pulumi.String("...my_upstream_refresh_token_header..."),
UpstreamSessionIdHeader: pulumi.String("...my_upstream_session_id_header..."),
UpstreamUserInfoHeader: pulumi.String("...my_upstream_user_info_header..."),
UpstreamUserInfoJwtHeader: pulumi.String("...my_upstream_user_info_jwt_header..."),
UserinfoAccept: pulumi.String("application/json"),
UserinfoEndpoint: pulumi.String("...my_userinfo_endpoint..."),
UserinfoHeadersClients: pulumi.StringArray{
pulumi.String("..."),
},
UserinfoHeadersNames: pulumi.StringArray{
pulumi.String("..."),
},
UserinfoHeadersValues: pulumi.StringArray{
pulumi.String("..."),
},
UserinfoQueryArgsClients: pulumi.StringArray{
pulumi.String("..."),
},
UserinfoQueryArgsNames: pulumi.StringArray{
pulumi.String("..."),
},
UserinfoQueryArgsValues: pulumi.StringArray{
pulumi.String("..."),
},
UsingPseudoIssuer: pulumi.Bool(false),
VerifyClaims: pulumi.Bool(true),
VerifyNonce: pulumi.Bool(true),
VerifyParameters: pulumi.Bool(false),
VerifySignature: pulumi.Bool(true),
},
DisplayName: pulumi.String("Okta AI SE"),
Labels: pulumi.StringMap{
"key": pulumi.String("value"),
},
ManagedBy: pulumi.StringMap{
"key": pulumi.String("value"),
},
Name: pulumi.String("okta-ai-se"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Konnect = Pulumi.Konnect;
return await Deployment.RunAsync(() =>
{
var myAigatewayauthstrategy = new Konnect.AiGatewayAuthStrategy("my_aigatewayauthstrategy", new()
{
GatewayId = "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
KeyAuth = new Konnect.Inputs.AiGatewayAuthStrategyKeyAuthArgs
{
Config = new Konnect.Inputs.AiGatewayAuthStrategyKeyAuthConfigArgs
{
Anonymous = "...my_anonymous...",
HideCredentials = true,
IdentityRealms = new[]
{
new Konnect.Inputs.AiGatewayAuthStrategyKeyAuthConfigIdentityRealmArgs
{
Id = "...my_id...",
Region = "...my_region...",
Scope = "cp",
},
},
KeyInBody = false,
KeyInHeader = true,
KeyInQuery = true,
KeyNames = new[]
{
"...",
},
Principals = new Konnect.Inputs.AiGatewayAuthStrategyKeyAuthConfigPrincipalsArgs
{
Directory = "default",
Enabled = false,
ErrorOnMiss = true,
},
Realm = "...my_realm...",
RunOnPreflight = true,
},
DisplayName = "Okta AI SE",
Labels =
{
{ "key", "value" },
},
ManagedBy =
{
{ "key", "value" },
},
Name = "okta-ai-se",
},
OpenidConnect = new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectArgs
{
Config = new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigArgs
{
Anonymous = "...my_anonymous...",
Audiences = new[]
{
"...",
},
AudienceClaims = new[]
{
"...",
},
AudienceRequireds = new[]
{
"...",
},
AuthMethods = new[]
{
"userinfo",
},
AuthenticatedGroupsClaims = new[]
{
"...",
},
AuthorizationCookieDomain = "...my_authorization_cookie_domain...",
AuthorizationCookieHttpOnly = true,
AuthorizationCookieName = "authorization",
AuthorizationCookiePath = "/",
AuthorizationCookieSameSite = "Default",
AuthorizationCookieSecure = false,
AuthorizationEndpoint = "...my_authorization_endpoint...",
AuthorizationQueryArgsClients = new[]
{
"...",
},
AuthorizationQueryArgsNames = new[]
{
"...",
},
AuthorizationQueryArgsValues = new[]
{
"...",
},
AuthorizationRollingTimeout = 600,
BearerTokenCookieName = "...my_bearer_token_cookie_name...",
BearerTokenParamTypes = new[]
{
"cookie",
},
ByUsernameIgnoreCase = false,
CacheIntrospection = true,
CacheTokenExchange = true,
CacheTokens = true,
CacheTokensSalt = "...my_cache_tokens_salt...",
CacheTtl = 3600,
CacheTtlMax = 6.13,
CacheTtlMin = 8.74,
CacheTtlNeg = 5.39,
CacheTtlResurrect = 8.05,
CacheUserInfo = true,
ClaimsForbiddens = new[]
{
"...",
},
ClientAlgs = new[]
{
"RS512",
},
ClientArg = "client_id",
ClientAuths = new[]
{
"client_secret_basic",
},
ClientCredentialsParamTypes = new[]
{
"body",
},
ClientIds = new[]
{
"...",
},
ClientJwks = new[]
{
new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigClientJwkArgs
{
Alg = "...my_alg...",
Crv = "...my_crv...",
D = "...my_d...",
Dp = "...my_dp...",
Dq = "...my_dq...",
E = "...my_e...",
Issuer = "...my_issuer...",
K = "...my_k...",
KeyOps = new[]
{
"...",
},
Kid = "...my_kid...",
Kty = "...my_kty...",
N = "...my_n...",
Oth = "...my_oth...",
P = "...my_p...",
Q = "...my_q...",
Qi = "...my_qi...",
R = "...my_r...",
T = "...my_t...",
Use = "...my_use...",
X = "...my_x...",
X5cs = new[]
{
"...",
},
X5t = "...my_x5t...",
X5tNumberS256 = "...my_x5t_number_s256...",
X5u = "...my_x5u...",
Y = "...my_y...",
},
},
ClientSecrets = new[]
{
"...",
},
ClusterCacheRedis = new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisArgs
{
CloudAuthentication = new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisCloudAuthenticationArgs
{
AuthProvider = "gcp",
AwsAccessKeyId = "...my_aws_access_key_id...",
AwsAssumeRoleArn = "...my_aws_assume_role_arn...",
AwsCacheName = "...my_aws_cache_name...",
AwsIsServerless = true,
AwsRegion = "...my_aws_region...",
AwsRoleSessionName = "...my_aws_role_session_name...",
AwsSecretAccessKey = "...my_aws_secret_access_key...",
AzureClientId = "...my_azure_client_id...",
AzureClientSecret = "...my_azure_client_secret...",
AzureTenantId = "...my_azure_tenant_id...",
GcpServiceAccountJson = "...my_gcp_service_account_json...",
},
ClusterMaxRedirections = 5,
ClusterNodes = new[]
{
new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisClusterNodeArgs
{
Ip = "127.0.0.1",
Port = 6379,
},
},
ConnectTimeout = 2000,
ConnectionIsProxied = false,
Database = 0,
Host = "127.0.0.1",
KeepaliveBacklog = 1429494394,
KeepalivePoolSize = 256,
Password = "...my_password...",
Port = "6379",
ReadTimeout = 2000,
SendTimeout = 2000,
SentinelMaster = "...my_sentinel_master...",
SentinelNodes = new[]
{
new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisSentinelNodeArgs
{
Host = "127.0.0.1",
Port = 6379,
},
},
SentinelPassword = "...my_sentinel_password...",
SentinelRole = "any",
SentinelUsername = "...my_sentinel_username...",
ServerName = "...my_server_name...",
Ssl = false,
SslVerify = true,
Username = "...my_username...",
},
ClusterCacheStrategy = "off",
ConsumerBies = new[]
{
"id",
},
ConsumerClaims = new[]
{
new[] {},
},
ConsumerGroupsClaims = new[]
{
"...",
},
ConsumerGroupsOptional = false,
ConsumerOptional = false,
CredentialClaims = new[]
{
"...",
},
DisableSessions = new[]
{
"bearer",
},
DiscoveryHeadersNames = new[]
{
"...",
},
DiscoveryHeadersValues = new[]
{
"...",
},
DisplayErrors = false,
Domains = new[]
{
"...",
},
DownstreamAccessTokenHeader = "...my_downstream_access_token_header...",
DownstreamAccessTokenJwkHeader = "...my_downstream_access_token_jwk_header...",
DownstreamHeaders = new[]
{
new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigDownstreamHeaderArgs
{
Header = "...my_header...",
Paths = new[]
{
"...",
},
},
},
DownstreamHeadersClaims = new[]
{
"...",
},
DownstreamHeadersNames = new[]
{
"...",
},
DownstreamIdTokenHeader = "...my_downstream_id_token_header...",
DownstreamIdTokenJwkHeader = "...my_downstream_id_token_jwk_header...",
DownstreamIntrospectionHeader = "...my_downstream_introspection_header...",
DownstreamIntrospectionJwtHeader = "...my_downstream_introspection_jwt_header...",
DownstreamRefreshTokenHeader = "...my_downstream_refresh_token_header...",
DownstreamSessionIdHeader = "...my_downstream_session_id_header...",
DownstreamUserInfoHeader = "...my_downstream_user_info_header...",
DownstreamUserInfoJwtHeader = "...my_downstream_user_info_jwt_header...",
DpopProofLifetime = 300,
DpopUseNonce = false,
EnableHsSignatures = false,
EndSessionEndpoint = "...my_end_session_endpoint...",
ExposeErrorCode = true,
ExtraJwksUris = new[]
{
"...",
},
ForbiddenDestroySession = true,
ForbiddenErrorMessage = "Forbidden",
ForbiddenRedirectUris = new[]
{
"...",
},
GroupsClaims = new[]
{
"...",
},
GroupsRequireds = new[]
{
"...",
},
HideCredentials = true,
HttpProxy = "...my_http_proxy...",
HttpProxyAuthorization = "...my_http_proxy_authorization...",
HttpVersion = 9.47,
HttpsProxy = "...my_https_proxy...",
HttpsProxyAuthorization = "...my_https_proxy_authorization...",
IdTokenParamName = "...my_id_token_param_name...",
IdTokenParamTypes = new[]
{
"body",
},
IgnoreSignatures = new[]
{
"session",
},
IntrospectJwtTokens = false,
IntrospectionAccept = "application/json",
IntrospectionCheckActive = true,
IntrospectionEndpoint = "...my_introspection_endpoint...",
IntrospectionEndpointAuthMethod = "client_secret_jwt",
IntrospectionHeadersClients = new[]
{
"...",
},
IntrospectionHeadersNames = new[]
{
"...",
},
IntrospectionHeadersValues = new[]
{
"...",
},
IntrospectionHint = "access_token",
IntrospectionPostArgsClients = new[]
{
"...",
},
IntrospectionPostArgsClientHeaders = new[]
{
"...",
},
IntrospectionPostArgsNames = new[]
{
"...",
},
IntrospectionPostArgsValues = new[]
{
"...",
},
IntrospectionTokenParamName = "token",
Issuer = "...my_issuer...",
IssuersAlloweds = new[]
{
"...",
},
JwksEndpoint = "...my_jwks_endpoint...",
JwtSessionClaim = "sid",
JwtSessionCookie = "...my_jwt_session_cookie...",
Keepalive = true,
Leeway = 0,
LoginAction = "upstream",
LoginMethods = new[]
{
"client_credentials",
},
LoginRedirectMode = "fragment",
LoginRedirectUris = new[]
{
"...",
},
LoginTokens = new[]
{
"tokens",
},
LogoutMethods = new[]
{
"GET",
},
LogoutPostArg = "...my_logout_post_arg...",
LogoutQueryArg = "...my_logout_query_arg...",
LogoutRedirectUris = new[]
{
"...",
},
LogoutRevoke = false,
LogoutRevokeAccessToken = true,
LogoutRevokeRefreshToken = true,
LogoutUriSuffix = "...my_logout_uri_suffix...",
MaxAge = 8.25,
MtlsIntrospectionEndpoint = "...my_mtls_introspection_endpoint...",
MtlsRevocationEndpoint = "...my_mtls_revocation_endpoint...",
MtlsTokenEndpoint = "...my_mtls_token_endpoint...",
NoProxy = "...my_no_proxy...",
PasswordParamTypes = new[]
{
"query",
},
PreserveQueryArgs = false,
Principals = new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigPrincipalsArgs
{
Directory = "default",
Enabled = false,
ErrorOnMiss = true,
MatchConsumer = true,
MatchConsumerGroups = true,
PrincipalBy = "...my_principal_by...",
PrincipalClaims = new[]
{
"...",
},
},
ProofOfPossessionAuthMethodsValidation = true,
ProofOfPossessionDpop = "off",
ProofOfPossessionMtls = "off",
PushedAuthorizationRequestEndpoint = "...my_pushed_authorization_request_endpoint...",
PushedAuthorizationRequestEndpointAuthMethod = "self_signed_tls_client_auth",
RedirectUris = new[]
{
"...",
},
Redis = new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigRedisArgs
{
CloudAuthentication = new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigRedisCloudAuthenticationArgs
{
AuthProvider = "azure",
AwsAccessKeyId = "...my_aws_access_key_id...",
AwsAssumeRoleArn = "...my_aws_assume_role_arn...",
AwsCacheName = "...my_aws_cache_name...",
AwsIsServerless = true,
AwsRegion = "...my_aws_region...",
AwsRoleSessionName = "...my_aws_role_session_name...",
AwsSecretAccessKey = "...my_aws_secret_access_key...",
AzureClientId = "...my_azure_client_id...",
AzureClientSecret = "...my_azure_client_secret...",
AzureTenantId = "...my_azure_tenant_id...",
GcpServiceAccountJson = "...my_gcp_service_account_json...",
},
ClusterMaxRedirections = 5,
ClusterNodes = new[]
{
new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigRedisClusterNodeArgs
{
Ip = "127.0.0.1",
Port = 6379,
},
},
ConnectTimeout = 2000,
ConnectionIsProxied = false,
Database = 0,
Host = "127.0.0.1",
KeepaliveBacklog = 73538938,
KeepalivePoolSize = 256,
Password = "...my_password...",
Port = "6379",
Prefix = "...my_prefix...",
ReadTimeout = 2000,
SendTimeout = 2000,
SentinelMaster = "...my_sentinel_master...",
SentinelNodes = new[]
{
new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigRedisSentinelNodeArgs
{
Host = "127.0.0.1",
Port = 6379,
},
},
SentinelPassword = "...my_sentinel_password...",
SentinelRole = "slave",
SentinelUsername = "...my_sentinel_username...",
ServerName = "...my_server_name...",
Socket = "...my_socket...",
Ssl = false,
SslVerify = true,
Username = "...my_username...",
},
RediscoveryLifetime = 30,
RefreshTokenParamName = "...my_refresh_token_param_name...",
RefreshTokenParamTypes = new[]
{
"header",
},
RefreshTokens = true,
RequireProofKeyForCodeExchange = true,
RequirePushedAuthorizationRequests = true,
RequireSignedRequestObject = false,
ResolveDistributedClaims = false,
ResponseMode = "query",
ResponseTypes = new[]
{
"...",
},
Reverify = false,
RevocationEndpoint = "...my_revocation_endpoint...",
RevocationEndpointAuthMethod = "tls_client_auth",
RevocationTokenParamName = "token",
RolesClaims = new[]
{
"...",
},
RolesRequireds = new[]
{
"...",
},
RunOnPreflight = true,
Scopes = new[]
{
"...",
},
ScopesClaims = new[]
{
"...",
},
ScopesRequireds = new[]
{
"...",
},
SearchUserInfo = false,
SessionAbsoluteTimeout = 86400,
SessionAudience = "default",
SessionBinds = new[]
{
"ip",
},
SessionCookieDomain = "...my_session_cookie_domain...",
SessionCookieHttpOnly = true,
SessionCookieName = "session",
SessionCookiePath = "/",
SessionCookieSameSite = "Lax",
SessionCookieSecure = true,
SessionEnforceSameSubject = false,
SessionHashStorageKey = false,
SessionHashSubject = false,
SessionIdlingTimeout = 900,
SessionMemcachedHost = "127.0.0.1",
SessionMemcachedPort = 11211,
SessionMemcachedPrefix = "...my_session_memcached_prefix...",
SessionMemcachedSocket = "...my_session_memcached_socket...",
SessionMemcachedSsl = true,
SessionMemcachedSslVerify = true,
SessionRemember = false,
SessionRememberAbsoluteTimeout = 2592000,
SessionRememberCookieName = "remember",
SessionRememberRollingTimeout = 604800,
SessionRequestHeaders = new[]
{
"subject",
},
SessionResponseHeaders = new[]
{
"absolute-timeout",
},
SessionRollingTimeout = 3600,
SessionSecret = "...my_session_secret...",
SessionStorage = "cookie",
SessionStoreMetadata = false,
SslVerify = true,
Timeout = 10000,
TlsClientAuthCertId = "...my_tls_client_auth_cert_id...",
TlsClientAuthSslVerify = true,
TokenCacheKeyIncludeScope = false,
TokenEndpoint = "...my_token_endpoint...",
TokenEndpointAuthMethod = "client_secret_basic",
TokenExchange = new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeArgs
{
Cache = new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeCacheArgs
{
Enabled = true,
Ttl = 7,
},
Request = new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeRequestArgs
{
Audiences = new[]
{
"...",
},
EmptyAudience = false,
EmptyScopes = false,
Scopes = new[]
{
"...",
},
},
SubjectTokenIssuers = new[]
{
new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeSubjectTokenIssuerArgs
{
Conditions = new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeSubjectTokenIssuerConditionsArgs
{
HasAudiences = new[]
{
"...",
},
HasScopes = new[]
{
"...",
},
MissingAudiences = new[]
{
"...",
},
MissingScopes = new[]
{
"...",
},
},
Issuer = "...my_issuer...",
},
},
},
TokenExchangeEndpoint = "...my_token_exchange_endpoint...",
TokenHeadersClients = new[]
{
"...",
},
TokenHeadersGrants = new[]
{
"refresh_token",
},
TokenHeadersNames = new[]
{
"...",
},
TokenHeadersPrefix = "...my_token_headers_prefix...",
TokenHeadersReplays = new[]
{
"...",
},
TokenHeadersValues = new[]
{
"...",
},
TokenPostArgsClients = new[]
{
"...",
},
TokenPostArgsNames = new[]
{
"...",
},
TokenPostArgsValues = new[]
{
"...",
},
UnauthorizedDestroySession = true,
UnauthorizedErrorMessage = "Unauthorized",
UnauthorizedRedirectUris = new[]
{
"...",
},
UnexpectedRedirectUris = new[]
{
"...",
},
UpstreamAccessTokenHeader = "authorization:bearer",
UpstreamAccessTokenJwkHeader = "...my_upstream_access_token_jwk_header...",
UpstreamHeaders = new[]
{
new Konnect.Inputs.AiGatewayAuthStrategyOpenidConnectConfigUpstreamHeaderArgs
{
Header = "...my_header...",
Paths = new[]
{
"...",
},
},
},
UpstreamHeadersClaims = new[]
{
"...",
},
UpstreamHeadersNames = new[]
{
"...",
},
UpstreamIdTokenHeader = "...my_upstream_id_token_header...",
UpstreamIdTokenJwkHeader = "...my_upstream_id_token_jwk_header...",
UpstreamIntrospectionHeader = "...my_upstream_introspection_header...",
UpstreamIntrospectionJwtHeader = "...my_upstream_introspection_jwt_header...",
UpstreamRefreshTokenHeader = "...my_upstream_refresh_token_header...",
UpstreamSessionIdHeader = "...my_upstream_session_id_header...",
UpstreamUserInfoHeader = "...my_upstream_user_info_header...",
UpstreamUserInfoJwtHeader = "...my_upstream_user_info_jwt_header...",
UserinfoAccept = "application/json",
UserinfoEndpoint = "...my_userinfo_endpoint...",
UserinfoHeadersClients = new[]
{
"...",
},
UserinfoHeadersNames = new[]
{
"...",
},
UserinfoHeadersValues = new[]
{
"...",
},
UserinfoQueryArgsClients = new[]
{
"...",
},
UserinfoQueryArgsNames = new[]
{
"...",
},
UserinfoQueryArgsValues = new[]
{
"...",
},
UsingPseudoIssuer = false,
VerifyClaims = true,
VerifyNonce = true,
VerifyParameters = false,
VerifySignature = true,
},
DisplayName = "Okta AI SE",
Labels =
{
{ "key", "value" },
},
ManagedBy =
{
{ "key", "value" },
},
Name = "okta-ai-se",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.konnect.AiGatewayAuthStrategy;
import com.pulumi.konnect.AiGatewayAuthStrategyArgs;
import com.pulumi.konnect.inputs.AiGatewayAuthStrategyKeyAuthArgs;
import com.pulumi.konnect.inputs.AiGatewayAuthStrategyKeyAuthConfigArgs;
import com.pulumi.konnect.inputs.AiGatewayAuthStrategyKeyAuthConfigPrincipalsArgs;
import com.pulumi.konnect.inputs.AiGatewayAuthStrategyOpenidConnectArgs;
import com.pulumi.konnect.inputs.AiGatewayAuthStrategyOpenidConnectConfigArgs;
import com.pulumi.konnect.inputs.AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisArgs;
import com.pulumi.konnect.inputs.AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisCloudAuthenticationArgs;
import com.pulumi.konnect.inputs.AiGatewayAuthStrategyOpenidConnectConfigPrincipalsArgs;
import com.pulumi.konnect.inputs.AiGatewayAuthStrategyOpenidConnectConfigRedisArgs;
import com.pulumi.konnect.inputs.AiGatewayAuthStrategyOpenidConnectConfigRedisCloudAuthenticationArgs;
import com.pulumi.konnect.inputs.AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeArgs;
import com.pulumi.konnect.inputs.AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeCacheArgs;
import com.pulumi.konnect.inputs.AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeRequestArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var myAigatewayauthstrategy = new AiGatewayAuthStrategy("myAigatewayauthstrategy", AiGatewayAuthStrategyArgs.builder()
.gatewayId("5f9fd312-a987-4628-b4c5-bb4f4fddd5f7")
.keyAuth(AiGatewayAuthStrategyKeyAuthArgs.builder()
.config(AiGatewayAuthStrategyKeyAuthConfigArgs.builder()
.anonymous("...my_anonymous...")
.hideCredentials(true)
.identityRealms(AiGatewayAuthStrategyKeyAuthConfigIdentityRealmArgs.builder()
.id("...my_id...")
.region("...my_region...")
.scope("cp")
.build())
.keyInBody(false)
.keyInHeader(true)
.keyInQuery(true)
.keyNames("...")
.principals(AiGatewayAuthStrategyKeyAuthConfigPrincipalsArgs.builder()
.directory("default")
.enabled(false)
.errorOnMiss(true)
.build())
.realm("...my_realm...")
.runOnPreflight(true)
.build())
.displayName("Okta AI SE")
.labels(Map.of("key", "value"))
.managedBy(Map.of("key", "value"))
.name("okta-ai-se")
.build())
.openidConnect(AiGatewayAuthStrategyOpenidConnectArgs.builder()
.config(AiGatewayAuthStrategyOpenidConnectConfigArgs.builder()
.anonymous("...my_anonymous...")
.audiences("...")
.audienceClaims("...")
.audienceRequireds("...")
.authMethods("userinfo")
.authenticatedGroupsClaims("...")
.authorizationCookieDomain("...my_authorization_cookie_domain...")
.authorizationCookieHttpOnly(true)
.authorizationCookieName("authorization")
.authorizationCookiePath("/")
.authorizationCookieSameSite("Default")
.authorizationCookieSecure(false)
.authorizationEndpoint("...my_authorization_endpoint...")
.authorizationQueryArgsClients("...")
.authorizationQueryArgsNames("...")
.authorizationQueryArgsValues("...")
.authorizationRollingTimeout(600.0)
.bearerTokenCookieName("...my_bearer_token_cookie_name...")
.bearerTokenParamTypes("cookie")
.byUsernameIgnoreCase(false)
.cacheIntrospection(true)
.cacheTokenExchange(true)
.cacheTokens(true)
.cacheTokensSalt("...my_cache_tokens_salt...")
.cacheTtl(3600.0)
.cacheTtlMax(6.13)
.cacheTtlMin(8.74)
.cacheTtlNeg(5.39)
.cacheTtlResurrect(8.05)
.cacheUserInfo(true)
.claimsForbiddens("...")
.clientAlgs("RS512")
.clientArg("client_id")
.clientAuths("client_secret_basic")
.clientCredentialsParamTypes("body")
.clientIds("...")
.clientJwks(AiGatewayAuthStrategyOpenidConnectConfigClientJwkArgs.builder()
.alg("...my_alg...")
.crv("...my_crv...")
.d("...my_d...")
.dp("...my_dp...")
.dq("...my_dq...")
.e("...my_e...")
.issuer("...my_issuer...")
.k("...my_k...")
.keyOps("...")
.kid("...my_kid...")
.kty("...my_kty...")
.n("...my_n...")
.oth("...my_oth...")
.p("...my_p...")
.q("...my_q...")
.qi("...my_qi...")
.r("...my_r...")
.t("...my_t...")
.use("...my_use...")
.x("...my_x...")
.x5cs("...")
.x5t("...my_x5t...")
.x5tNumberS256("...my_x5t_number_s256...")
.x5u("...my_x5u...")
.y("...my_y...")
.build())
.clientSecrets("...")
.clusterCacheRedis(AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisArgs.builder()
.cloudAuthentication(AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisCloudAuthenticationArgs.builder()
.authProvider("gcp")
.awsAccessKeyId("...my_aws_access_key_id...")
.awsAssumeRoleArn("...my_aws_assume_role_arn...")
.awsCacheName("...my_aws_cache_name...")
.awsIsServerless(true)
.awsRegion("...my_aws_region...")
.awsRoleSessionName("...my_aws_role_session_name...")
.awsSecretAccessKey("...my_aws_secret_access_key...")
.azureClientId("...my_azure_client_id...")
.azureClientSecret("...my_azure_client_secret...")
.azureTenantId("...my_azure_tenant_id...")
.gcpServiceAccountJson("...my_gcp_service_account_json...")
.build())
.clusterMaxRedirections(5.0)
.clusterNodes(AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisClusterNodeArgs.builder()
.ip("127.0.0.1")
.port(6379.0)
.build())
.connectTimeout(2000.0)
.connectionIsProxied(false)
.database(0.0)
.host("127.0.0.1")
.keepaliveBacklog(1429494394.0)
.keepalivePoolSize(256.0)
.password("...my_password...")
.port("6379")
.readTimeout(2000.0)
.sendTimeout(2000.0)
.sentinelMaster("...my_sentinel_master...")
.sentinelNodes(AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisSentinelNodeArgs.builder()
.host("127.0.0.1")
.port(6379.0)
.build())
.sentinelPassword("...my_sentinel_password...")
.sentinelRole("any")
.sentinelUsername("...my_sentinel_username...")
.serverName("...my_server_name...")
.ssl(false)
.sslVerify(true)
.username("...my_username...")
.build())
.clusterCacheStrategy("off")
.consumerBies("id")
.consumerClaims()
.consumerGroupsClaims("...")
.consumerGroupsOptional(false)
.consumerOptional(false)
.credentialClaims("...")
.disableSessions("bearer")
.discoveryHeadersNames("...")
.discoveryHeadersValues("...")
.displayErrors(false)
.domains("...")
.downstreamAccessTokenHeader("...my_downstream_access_token_header...")
.downstreamAccessTokenJwkHeader("...my_downstream_access_token_jwk_header...")
.downstreamHeaders(AiGatewayAuthStrategyOpenidConnectConfigDownstreamHeaderArgs.builder()
.header("...my_header...")
.paths("...")
.build())
.downstreamHeadersClaims("...")
.downstreamHeadersNames("...")
.downstreamIdTokenHeader("...my_downstream_id_token_header...")
.downstreamIdTokenJwkHeader("...my_downstream_id_token_jwk_header...")
.downstreamIntrospectionHeader("...my_downstream_introspection_header...")
.downstreamIntrospectionJwtHeader("...my_downstream_introspection_jwt_header...")
.downstreamRefreshTokenHeader("...my_downstream_refresh_token_header...")
.downstreamSessionIdHeader("...my_downstream_session_id_header...")
.downstreamUserInfoHeader("...my_downstream_user_info_header...")
.downstreamUserInfoJwtHeader("...my_downstream_user_info_jwt_header...")
.dpopProofLifetime(300.0)
.dpopUseNonce(false)
.enableHsSignatures(false)
.endSessionEndpoint("...my_end_session_endpoint...")
.exposeErrorCode(true)
.extraJwksUris("...")
.forbiddenDestroySession(true)
.forbiddenErrorMessage("Forbidden")
.forbiddenRedirectUris("...")
.groupsClaims("...")
.groupsRequireds("...")
.hideCredentials(true)
.httpProxy("...my_http_proxy...")
.httpProxyAuthorization("...my_http_proxy_authorization...")
.httpVersion(9.47)
.httpsProxy("...my_https_proxy...")
.httpsProxyAuthorization("...my_https_proxy_authorization...")
.idTokenParamName("...my_id_token_param_name...")
.idTokenParamTypes("body")
.ignoreSignatures("session")
.introspectJwtTokens(false)
.introspectionAccept("application/json")
.introspectionCheckActive(true)
.introspectionEndpoint("...my_introspection_endpoint...")
.introspectionEndpointAuthMethod("client_secret_jwt")
.introspectionHeadersClients("...")
.introspectionHeadersNames("...")
.introspectionHeadersValues("...")
.introspectionHint("access_token")
.introspectionPostArgsClients("...")
.introspectionPostArgsClientHeaders("...")
.introspectionPostArgsNames("...")
.introspectionPostArgsValues("...")
.introspectionTokenParamName("token")
.issuer("...my_issuer...")
.issuersAlloweds("...")
.jwksEndpoint("...my_jwks_endpoint...")
.jwtSessionClaim("sid")
.jwtSessionCookie("...my_jwt_session_cookie...")
.keepalive(true)
.leeway(0.0)
.loginAction("upstream")
.loginMethods("client_credentials")
.loginRedirectMode("fragment")
.loginRedirectUris("...")
.loginTokens("tokens")
.logoutMethods("GET")
.logoutPostArg("...my_logout_post_arg...")
.logoutQueryArg("...my_logout_query_arg...")
.logoutRedirectUris("...")
.logoutRevoke(false)
.logoutRevokeAccessToken(true)
.logoutRevokeRefreshToken(true)
.logoutUriSuffix("...my_logout_uri_suffix...")
.maxAge(8.25)
.mtlsIntrospectionEndpoint("...my_mtls_introspection_endpoint...")
.mtlsRevocationEndpoint("...my_mtls_revocation_endpoint...")
.mtlsTokenEndpoint("...my_mtls_token_endpoint...")
.noProxy("...my_no_proxy...")
.passwordParamTypes("query")
.preserveQueryArgs(false)
.principals(AiGatewayAuthStrategyOpenidConnectConfigPrincipalsArgs.builder()
.directory("default")
.enabled(false)
.errorOnMiss(true)
.matchConsumer(true)
.matchConsumerGroups(true)
.principalBy("...my_principal_by...")
.principalClaims("...")
.build())
.proofOfPossessionAuthMethodsValidation(true)
.proofOfPossessionDpop("off")
.proofOfPossessionMtls("off")
.pushedAuthorizationRequestEndpoint("...my_pushed_authorization_request_endpoint...")
.pushedAuthorizationRequestEndpointAuthMethod("self_signed_tls_client_auth")
.redirectUris("...")
.redis(AiGatewayAuthStrategyOpenidConnectConfigRedisArgs.builder()
.cloudAuthentication(AiGatewayAuthStrategyOpenidConnectConfigRedisCloudAuthenticationArgs.builder()
.authProvider("azure")
.awsAccessKeyId("...my_aws_access_key_id...")
.awsAssumeRoleArn("...my_aws_assume_role_arn...")
.awsCacheName("...my_aws_cache_name...")
.awsIsServerless(true)
.awsRegion("...my_aws_region...")
.awsRoleSessionName("...my_aws_role_session_name...")
.awsSecretAccessKey("...my_aws_secret_access_key...")
.azureClientId("...my_azure_client_id...")
.azureClientSecret("...my_azure_client_secret...")
.azureTenantId("...my_azure_tenant_id...")
.gcpServiceAccountJson("...my_gcp_service_account_json...")
.build())
.clusterMaxRedirections(5.0)
.clusterNodes(AiGatewayAuthStrategyOpenidConnectConfigRedisClusterNodeArgs.builder()
.ip("127.0.0.1")
.port(6379.0)
.build())
.connectTimeout(2000.0)
.connectionIsProxied(false)
.database(0.0)
.host("127.0.0.1")
.keepaliveBacklog(73538938.0)
.keepalivePoolSize(256.0)
.password("...my_password...")
.port("6379")
.prefix("...my_prefix...")
.readTimeout(2000.0)
.sendTimeout(2000.0)
.sentinelMaster("...my_sentinel_master...")
.sentinelNodes(AiGatewayAuthStrategyOpenidConnectConfigRedisSentinelNodeArgs.builder()
.host("127.0.0.1")
.port(6379.0)
.build())
.sentinelPassword("...my_sentinel_password...")
.sentinelRole("slave")
.sentinelUsername("...my_sentinel_username...")
.serverName("...my_server_name...")
.socket("...my_socket...")
.ssl(false)
.sslVerify(true)
.username("...my_username...")
.build())
.rediscoveryLifetime(30.0)
.refreshTokenParamName("...my_refresh_token_param_name...")
.refreshTokenParamTypes("header")
.refreshTokens(true)
.requireProofKeyForCodeExchange(true)
.requirePushedAuthorizationRequests(true)
.requireSignedRequestObject(false)
.resolveDistributedClaims(false)
.responseMode("query")
.responseTypes("...")
.reverify(false)
.revocationEndpoint("...my_revocation_endpoint...")
.revocationEndpointAuthMethod("tls_client_auth")
.revocationTokenParamName("token")
.rolesClaims("...")
.rolesRequireds("...")
.runOnPreflight(true)
.scopes("...")
.scopesClaims("...")
.scopesRequireds("...")
.searchUserInfo(false)
.sessionAbsoluteTimeout(86400.0)
.sessionAudience("default")
.sessionBinds("ip")
.sessionCookieDomain("...my_session_cookie_domain...")
.sessionCookieHttpOnly(true)
.sessionCookieName("session")
.sessionCookiePath("/")
.sessionCookieSameSite("Lax")
.sessionCookieSecure(true)
.sessionEnforceSameSubject(false)
.sessionHashStorageKey(false)
.sessionHashSubject(false)
.sessionIdlingTimeout(900.0)
.sessionMemcachedHost("127.0.0.1")
.sessionMemcachedPort(11211.0)
.sessionMemcachedPrefix("...my_session_memcached_prefix...")
.sessionMemcachedSocket("...my_session_memcached_socket...")
.sessionMemcachedSsl(true)
.sessionMemcachedSslVerify(true)
.sessionRemember(false)
.sessionRememberAbsoluteTimeout(2592000.0)
.sessionRememberCookieName("remember")
.sessionRememberRollingTimeout(604800.0)
.sessionRequestHeaders("subject")
.sessionResponseHeaders("absolute-timeout")
.sessionRollingTimeout(3600.0)
.sessionSecret("...my_session_secret...")
.sessionStorage("cookie")
.sessionStoreMetadata(false)
.sslVerify(true)
.timeout(10000.0)
.tlsClientAuthCertId("...my_tls_client_auth_cert_id...")
.tlsClientAuthSslVerify(true)
.tokenCacheKeyIncludeScope(false)
.tokenEndpoint("...my_token_endpoint...")
.tokenEndpointAuthMethod("client_secret_basic")
.tokenExchange(AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeArgs.builder()
.cache(AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeCacheArgs.builder()
.enabled(true)
.ttl(7.0)
.build())
.request(AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeRequestArgs.builder()
.audiences("...")
.emptyAudience(false)
.emptyScopes(false)
.scopes("...")
.build())
.subjectTokenIssuers(AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeSubjectTokenIssuerArgs.builder()
.conditions(AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeSubjectTokenIssuerConditionsArgs.builder()
.hasAudiences("...")
.hasScopes("...")
.missingAudiences("...")
.missingScopes("...")
.build())
.issuer("...my_issuer...")
.build())
.build())
.tokenExchangeEndpoint("...my_token_exchange_endpoint...")
.tokenHeadersClients("...")
.tokenHeadersGrants("refresh_token")
.tokenHeadersNames("...")
.tokenHeadersPrefix("...my_token_headers_prefix...")
.tokenHeadersReplays("...")
.tokenHeadersValues("...")
.tokenPostArgsClients("...")
.tokenPostArgsNames("...")
.tokenPostArgsValues("...")
.unauthorizedDestroySession(true)
.unauthorizedErrorMessage("Unauthorized")
.unauthorizedRedirectUris("...")
.unexpectedRedirectUris("...")
.upstreamAccessTokenHeader("authorization:bearer")
.upstreamAccessTokenJwkHeader("...my_upstream_access_token_jwk_header...")
.upstreamHeaders(AiGatewayAuthStrategyOpenidConnectConfigUpstreamHeaderArgs.builder()
.header("...my_header...")
.paths("...")
.build())
.upstreamHeadersClaims("...")
.upstreamHeadersNames("...")
.upstreamIdTokenHeader("...my_upstream_id_token_header...")
.upstreamIdTokenJwkHeader("...my_upstream_id_token_jwk_header...")
.upstreamIntrospectionHeader("...my_upstream_introspection_header...")
.upstreamIntrospectionJwtHeader("...my_upstream_introspection_jwt_header...")
.upstreamRefreshTokenHeader("...my_upstream_refresh_token_header...")
.upstreamSessionIdHeader("...my_upstream_session_id_header...")
.upstreamUserInfoHeader("...my_upstream_user_info_header...")
.upstreamUserInfoJwtHeader("...my_upstream_user_info_jwt_header...")
.userinfoAccept("application/json")
.userinfoEndpoint("...my_userinfo_endpoint...")
.userinfoHeadersClients("...")
.userinfoHeadersNames("...")
.userinfoHeadersValues("...")
.userinfoQueryArgsClients("...")
.userinfoQueryArgsNames("...")
.userinfoQueryArgsValues("...")
.usingPseudoIssuer(false)
.verifyClaims(true)
.verifyNonce(true)
.verifyParameters(false)
.verifySignature(true)
.build())
.displayName("Okta AI SE")
.labels(Map.of("key", "value"))
.managedBy(Map.of("key", "value"))
.name("okta-ai-se")
.build())
.build());
}
}
resources:
myAigatewayauthstrategy:
type: konnect:AiGatewayAuthStrategy
name: my_aigatewayauthstrategy
properties:
gatewayId: 5f9fd312-a987-4628-b4c5-bb4f4fddd5f7
keyAuth:
config:
anonymous: '...my_anonymous...'
hideCredentials: true
identityRealms:
- id: '...my_id...'
region: '...my_region...'
scope: cp
keyInBody: false
keyInHeader: true
keyInQuery: true
keyNames:
- '...'
principals:
directory: default
enabled: false
errorOnMiss: true
realm: '...my_realm...'
runOnPreflight: true
displayName: Okta AI SE
labels:
key: value
managedBy:
key: value
name: okta-ai-se
openidConnect:
config:
anonymous: '...my_anonymous...'
audiences:
- '...'
audienceClaims:
- '...'
audienceRequireds:
- '...'
authMethods:
- userinfo
authenticatedGroupsClaims:
- '...'
authorizationCookieDomain: '...my_authorization_cookie_domain...'
authorizationCookieHttpOnly: true
authorizationCookieName: authorization
authorizationCookiePath: /
authorizationCookieSameSite: Default
authorizationCookieSecure: false
authorizationEndpoint: '...my_authorization_endpoint...'
authorizationQueryArgsClients:
- '...'
authorizationQueryArgsNames:
- '...'
authorizationQueryArgsValues:
- '...'
authorizationRollingTimeout: 600
bearerTokenCookieName: '...my_bearer_token_cookie_name...'
bearerTokenParamTypes:
- cookie
byUsernameIgnoreCase: false
cacheIntrospection: true
cacheTokenExchange: true
cacheTokens: true
cacheTokensSalt: '...my_cache_tokens_salt...'
cacheTtl: 3600
cacheTtlMax: 6.13
cacheTtlMin: 8.74
cacheTtlNeg: 5.39
cacheTtlResurrect: 8.05
cacheUserInfo: true
claimsForbiddens:
- '...'
clientAlgs:
- RS512
clientArg: client_id
clientAuths:
- client_secret_basic
clientCredentialsParamTypes:
- body
clientIds:
- '...'
clientJwks:
- alg: '...my_alg...'
crv: '...my_crv...'
d: '...my_d...'
dp: '...my_dp...'
dq: '...my_dq...'
e: '...my_e...'
issuer: '...my_issuer...'
k: '...my_k...'
keyOps:
- '...'
kid: '...my_kid...'
kty: '...my_kty...'
n: '...my_n...'
oth: '...my_oth...'
p: '...my_p...'
q: '...my_q...'
qi: '...my_qi...'
r: '...my_r...'
t: '...my_t...'
use: '...my_use...'
x: '...my_x...'
x5cs:
- '...'
x5t: '...my_x5t...'
x5tNumberS256: '...my_x5t_number_s256...'
x5u: '...my_x5u...'
y: '...my_y...'
clientSecrets:
- '...'
clusterCacheRedis:
cloudAuthentication:
authProvider: gcp
awsAccessKeyId: '...my_aws_access_key_id...'
awsAssumeRoleArn: '...my_aws_assume_role_arn...'
awsCacheName: '...my_aws_cache_name...'
awsIsServerless: true
awsRegion: '...my_aws_region...'
awsRoleSessionName: '...my_aws_role_session_name...'
awsSecretAccessKey: '...my_aws_secret_access_key...'
azureClientId: '...my_azure_client_id...'
azureClientSecret: '...my_azure_client_secret...'
azureTenantId: '...my_azure_tenant_id...'
gcpServiceAccountJson: '...my_gcp_service_account_json...'
clusterMaxRedirections: 5
clusterNodes:
- ip: 127.0.0.1
port: 6379
connectTimeout: 2000
connectionIsProxied: false
database: 0
host: 127.0.0.1
keepaliveBacklog: 1.429494394e+09
keepalivePoolSize: 256
password: '...my_password...'
port: '6379'
readTimeout: 2000
sendTimeout: 2000
sentinelMaster: '...my_sentinel_master...'
sentinelNodes:
- host: 127.0.0.1
port: 6379
sentinelPassword: '...my_sentinel_password...'
sentinelRole: any
sentinelUsername: '...my_sentinel_username...'
serverName: '...my_server_name...'
ssl: false
sslVerify: true
username: '...my_username...'
clusterCacheStrategy: off
consumerBies:
- id
consumerClaims:
- []
consumerGroupsClaims:
- '...'
consumerGroupsOptional: false
consumerOptional: false
credentialClaims:
- '...'
disableSessions:
- bearer
discoveryHeadersNames:
- '...'
discoveryHeadersValues:
- '...'
displayErrors: false
domains:
- '...'
downstreamAccessTokenHeader: '...my_downstream_access_token_header...'
downstreamAccessTokenJwkHeader: '...my_downstream_access_token_jwk_header...'
downstreamHeaders:
- header: '...my_header...'
paths:
- '...'
downstreamHeadersClaims:
- '...'
downstreamHeadersNames:
- '...'
downstreamIdTokenHeader: '...my_downstream_id_token_header...'
downstreamIdTokenJwkHeader: '...my_downstream_id_token_jwk_header...'
downstreamIntrospectionHeader: '...my_downstream_introspection_header...'
downstreamIntrospectionJwtHeader: '...my_downstream_introspection_jwt_header...'
downstreamRefreshTokenHeader: '...my_downstream_refresh_token_header...'
downstreamSessionIdHeader: '...my_downstream_session_id_header...'
downstreamUserInfoHeader: '...my_downstream_user_info_header...'
downstreamUserInfoJwtHeader: '...my_downstream_user_info_jwt_header...'
dpopProofLifetime: 300
dpopUseNonce: false
enableHsSignatures: false
endSessionEndpoint: '...my_end_session_endpoint...'
exposeErrorCode: true
extraJwksUris:
- '...'
forbiddenDestroySession: true
forbiddenErrorMessage: Forbidden
forbiddenRedirectUris:
- '...'
groupsClaims:
- '...'
groupsRequireds:
- '...'
hideCredentials: true
httpProxy: '...my_http_proxy...'
httpProxyAuthorization: '...my_http_proxy_authorization...'
httpVersion: 9.47
httpsProxy: '...my_https_proxy...'
httpsProxyAuthorization: '...my_https_proxy_authorization...'
idTokenParamName: '...my_id_token_param_name...'
idTokenParamTypes:
- body
ignoreSignatures:
- session
introspectJwtTokens: false
introspectionAccept: application/json
introspectionCheckActive: true
introspectionEndpoint: '...my_introspection_endpoint...'
introspectionEndpointAuthMethod: client_secret_jwt
introspectionHeadersClients:
- '...'
introspectionHeadersNames:
- '...'
introspectionHeadersValues:
- '...'
introspectionHint: access_token
introspectionPostArgsClients:
- '...'
introspectionPostArgsClientHeaders:
- '...'
introspectionPostArgsNames:
- '...'
introspectionPostArgsValues:
- '...'
introspectionTokenParamName: token
issuer: '...my_issuer...'
issuersAlloweds:
- '...'
jwksEndpoint: '...my_jwks_endpoint...'
jwtSessionClaim: sid
jwtSessionCookie: '...my_jwt_session_cookie...'
keepalive: true
leeway: 0
loginAction: upstream
loginMethods:
- client_credentials
loginRedirectMode: fragment
loginRedirectUris:
- '...'
loginTokens:
- tokens
logoutMethods:
- GET
logoutPostArg: '...my_logout_post_arg...'
logoutQueryArg: '...my_logout_query_arg...'
logoutRedirectUris:
- '...'
logoutRevoke: false
logoutRevokeAccessToken: true
logoutRevokeRefreshToken: true
logoutUriSuffix: '...my_logout_uri_suffix...'
maxAge: 8.25
mtlsIntrospectionEndpoint: '...my_mtls_introspection_endpoint...'
mtlsRevocationEndpoint: '...my_mtls_revocation_endpoint...'
mtlsTokenEndpoint: '...my_mtls_token_endpoint...'
noProxy: '...my_no_proxy...'
passwordParamTypes:
- query
preserveQueryArgs: false
principals:
directory: default
enabled: false
errorOnMiss: true
matchConsumer: true
matchConsumerGroups: true
principalBy: '...my_principal_by...'
principalClaims:
- '...'
proofOfPossessionAuthMethodsValidation: true
proofOfPossessionDpop: off
proofOfPossessionMtls: off
pushedAuthorizationRequestEndpoint: '...my_pushed_authorization_request_endpoint...'
pushedAuthorizationRequestEndpointAuthMethod: self_signed_tls_client_auth
redirectUris:
- '...'
redis:
cloudAuthentication:
authProvider: azure
awsAccessKeyId: '...my_aws_access_key_id...'
awsAssumeRoleArn: '...my_aws_assume_role_arn...'
awsCacheName: '...my_aws_cache_name...'
awsIsServerless: true
awsRegion: '...my_aws_region...'
awsRoleSessionName: '...my_aws_role_session_name...'
awsSecretAccessKey: '...my_aws_secret_access_key...'
azureClientId: '...my_azure_client_id...'
azureClientSecret: '...my_azure_client_secret...'
azureTenantId: '...my_azure_tenant_id...'
gcpServiceAccountJson: '...my_gcp_service_account_json...'
clusterMaxRedirections: 5
clusterNodes:
- ip: 127.0.0.1
port: 6379
connectTimeout: 2000
connectionIsProxied: false
database: 0
host: 127.0.0.1
keepaliveBacklog: 7.3538938e+07
keepalivePoolSize: 256
password: '...my_password...'
port: '6379'
prefix: '...my_prefix...'
readTimeout: 2000
sendTimeout: 2000
sentinelMaster: '...my_sentinel_master...'
sentinelNodes:
- host: 127.0.0.1
port: 6379
sentinelPassword: '...my_sentinel_password...'
sentinelRole: slave
sentinelUsername: '...my_sentinel_username...'
serverName: '...my_server_name...'
socket: '...my_socket...'
ssl: false
sslVerify: true
username: '...my_username...'
rediscoveryLifetime: 30
refreshTokenParamName: '...my_refresh_token_param_name...'
refreshTokenParamTypes:
- header
refreshTokens: true
requireProofKeyForCodeExchange: true
requirePushedAuthorizationRequests: true
requireSignedRequestObject: false
resolveDistributedClaims: false
responseMode: query
responseTypes:
- '...'
reverify: false
revocationEndpoint: '...my_revocation_endpoint...'
revocationEndpointAuthMethod: tls_client_auth
revocationTokenParamName: token
rolesClaims:
- '...'
rolesRequireds:
- '...'
runOnPreflight: true
scopes:
- '...'
scopesClaims:
- '...'
scopesRequireds:
- '...'
searchUserInfo: false
sessionAbsoluteTimeout: 86400
sessionAudience: default
sessionBinds:
- ip
sessionCookieDomain: '...my_session_cookie_domain...'
sessionCookieHttpOnly: true
sessionCookieName: session
sessionCookiePath: /
sessionCookieSameSite: Lax
sessionCookieSecure: true
sessionEnforceSameSubject: false
sessionHashStorageKey: false
sessionHashSubject: false
sessionIdlingTimeout: 900
sessionMemcachedHost: 127.0.0.1
sessionMemcachedPort: 11211
sessionMemcachedPrefix: '...my_session_memcached_prefix...'
sessionMemcachedSocket: '...my_session_memcached_socket...'
sessionMemcachedSsl: true
sessionMemcachedSslVerify: true
sessionRemember: false
sessionRememberAbsoluteTimeout: 2.592e+06
sessionRememberCookieName: remember
sessionRememberRollingTimeout: 604800
sessionRequestHeaders:
- subject
sessionResponseHeaders:
- absolute-timeout
sessionRollingTimeout: 3600
sessionSecret: '...my_session_secret...'
sessionStorage: cookie
sessionStoreMetadata: false
sslVerify: true
timeout: 10000
tlsClientAuthCertId: '...my_tls_client_auth_cert_id...'
tlsClientAuthSslVerify: true
tokenCacheKeyIncludeScope: false
tokenEndpoint: '...my_token_endpoint...'
tokenEndpointAuthMethod: client_secret_basic
tokenExchange:
cache:
enabled: true
ttl: 7
request:
audiences:
- '...'
emptyAudience: false
emptyScopes: false
scopes:
- '...'
subjectTokenIssuers:
- conditions:
hasAudiences:
- '...'
hasScopes:
- '...'
missingAudiences:
- '...'
missingScopes:
- '...'
issuer: '...my_issuer...'
tokenExchangeEndpoint: '...my_token_exchange_endpoint...'
tokenHeadersClients:
- '...'
tokenHeadersGrants:
- refresh_token
tokenHeadersNames:
- '...'
tokenHeadersPrefix: '...my_token_headers_prefix...'
tokenHeadersReplays:
- '...'
tokenHeadersValues:
- '...'
tokenPostArgsClients:
- '...'
tokenPostArgsNames:
- '...'
tokenPostArgsValues:
- '...'
unauthorizedDestroySession: true
unauthorizedErrorMessage: Unauthorized
unauthorizedRedirectUris:
- '...'
unexpectedRedirectUris:
- '...'
upstreamAccessTokenHeader: authorization:bearer
upstreamAccessTokenJwkHeader: '...my_upstream_access_token_jwk_header...'
upstreamHeaders:
- header: '...my_header...'
paths:
- '...'
upstreamHeadersClaims:
- '...'
upstreamHeadersNames:
- '...'
upstreamIdTokenHeader: '...my_upstream_id_token_header...'
upstreamIdTokenJwkHeader: '...my_upstream_id_token_jwk_header...'
upstreamIntrospectionHeader: '...my_upstream_introspection_header...'
upstreamIntrospectionJwtHeader: '...my_upstream_introspection_jwt_header...'
upstreamRefreshTokenHeader: '...my_upstream_refresh_token_header...'
upstreamSessionIdHeader: '...my_upstream_session_id_header...'
upstreamUserInfoHeader: '...my_upstream_user_info_header...'
upstreamUserInfoJwtHeader: '...my_upstream_user_info_jwt_header...'
userinfoAccept: application/json
userinfoEndpoint: '...my_userinfo_endpoint...'
userinfoHeadersClients:
- '...'
userinfoHeadersNames:
- '...'
userinfoHeadersValues:
- '...'
userinfoQueryArgsClients:
- '...'
userinfoQueryArgsNames:
- '...'
userinfoQueryArgsValues:
- '...'
usingPseudoIssuer: false
verifyClaims: true
verifyNonce: true
verifyParameters: false
verifySignature: true
displayName: Okta AI SE
labels:
key: value
managedBy:
key: value
name: okta-ai-se
Example coming soon!
Create AiGatewayAuthStrategy Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new AiGatewayAuthStrategy(name: string, args: AiGatewayAuthStrategyArgs, opts?: CustomResourceOptions);@overload
def AiGatewayAuthStrategy(resource_name: str,
args: AiGatewayAuthStrategyArgs,
opts: Optional[ResourceOptions] = None)
@overload
def AiGatewayAuthStrategy(resource_name: str,
opts: Optional[ResourceOptions] = None,
gateway_id: Optional[str] = None,
key_auth: Optional[AiGatewayAuthStrategyKeyAuthArgs] = None,
openid_connect: Optional[AiGatewayAuthStrategyOpenidConnectArgs] = None)func NewAiGatewayAuthStrategy(ctx *Context, name string, args AiGatewayAuthStrategyArgs, opts ...ResourceOption) (*AiGatewayAuthStrategy, error)public AiGatewayAuthStrategy(string name, AiGatewayAuthStrategyArgs args, CustomResourceOptions? opts = null)
public AiGatewayAuthStrategy(String name, AiGatewayAuthStrategyArgs args)
public AiGatewayAuthStrategy(String name, AiGatewayAuthStrategyArgs args, CustomResourceOptions options)
type: konnect:AiGatewayAuthStrategy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
resource "konnect_ai_gateway_auth_strategy" "name" {
# resource properties
}Parameters
- name string
- The unique name of the resource.
- args AiGatewayAuthStrategyArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args AiGatewayAuthStrategyArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args AiGatewayAuthStrategyArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args AiGatewayAuthStrategyArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args AiGatewayAuthStrategyArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
AiGatewayAuthStrategy Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The AiGatewayAuthStrategy resource accepts the following input properties:
- Gateway
Id string - The unique ID of the AI Gateway.
- Key
Auth AiGateway Auth Strategy Key Auth - Configuration for an auth strategy.
- Openid
Connect AiGateway Auth Strategy Openid Connect - Configuration for an auth strategy.
- Gateway
Id string - The unique ID of the AI Gateway.
- Key
Auth AiGateway Auth Strategy Key Auth Args - Configuration for an auth strategy.
- Openid
Connect AiGateway Auth Strategy Openid Connect Args - Configuration for an auth strategy.
- gateway_
id string - The unique ID of the AI Gateway.
- key_
auth object - Configuration for an auth strategy.
- openid_
connect object - Configuration for an auth strategy.
- gateway
Id String - The unique ID of the AI Gateway.
- key
Auth AiGateway Auth Strategy Key Auth - Configuration for an auth strategy.
- openid
Connect AiGateway Auth Strategy Openid Connect - Configuration for an auth strategy.
- gateway
Id string - The unique ID of the AI Gateway.
- key
Auth AiGateway Auth Strategy Key Auth - Configuration for an auth strategy.
- openid
Connect AiGateway Auth Strategy Openid Connect - Configuration for an auth strategy.
- gateway_
id str - The unique ID of the AI Gateway.
- key_
auth AiGateway Auth Strategy Key Auth Args - Configuration for an auth strategy.
- openid_
connect AiGateway Auth Strategy Openid Connect Args - Configuration for an auth strategy.
- gateway
Id String - The unique ID of the AI Gateway.
- key
Auth Property Map - Configuration for an auth strategy.
- openid
Connect Property Map - Configuration for an auth strategy.
Outputs
All input properties are implicitly available as output properties. Additionally, the AiGatewayAuthStrategy resource produces the following output properties:
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Display
Name string - The display name for this auth strategy instance.
- Id string
- The provider-assigned unique ID for this managed resource.
- Name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Display
Name string - The display name for this auth strategy instance.
- Id string
- The provider-assigned unique ID for this managed resource.
- Name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- display_
name string - The display name for this auth strategy instance.
- id string
- The provider-assigned unique ID for this managed resource.
- name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- display
Name String - The display name for this auth strategy instance.
- id String
- The provider-assigned unique ID for this managed resource.
- name String
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- display
Name string - The display name for this auth strategy instance.
- id string
- The provider-assigned unique ID for this managed resource.
- name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- display_
name str - The display name for this auth strategy instance.
- id str
- The provider-assigned unique ID for this managed resource.
- name str
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- display
Name String - The display name for this auth strategy instance.
- id String
- The provider-assigned unique ID for this managed resource.
- name String
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
Look up Existing AiGatewayAuthStrategy Resource
Get an existing AiGatewayAuthStrategy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: AiGatewayAuthStrategyState, opts?: CustomResourceOptions): AiGatewayAuthStrategy@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
created_at: Optional[str] = None,
display_name: Optional[str] = None,
gateway_id: Optional[str] = None,
key_auth: Optional[AiGatewayAuthStrategyKeyAuthArgs] = None,
name: Optional[str] = None,
openid_connect: Optional[AiGatewayAuthStrategyOpenidConnectArgs] = None,
updated_at: Optional[str] = None) -> AiGatewayAuthStrategyfunc GetAiGatewayAuthStrategy(ctx *Context, name string, id IDInput, state *AiGatewayAuthStrategyState, opts ...ResourceOption) (*AiGatewayAuthStrategy, error)public static AiGatewayAuthStrategy Get(string name, Input<string> id, AiGatewayAuthStrategyState? state, CustomResourceOptions? opts = null)public static AiGatewayAuthStrategy get(String name, Output<String> id, AiGatewayAuthStrategyState state, CustomResourceOptions options)resources: _: type: konnect:AiGatewayAuthStrategy get: id: ${id}import {
to = konnect_ai_gateway_auth_strategy.example
id = "${id}"
}
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Display
Name string - The display name for this auth strategy instance.
- Gateway
Id string - The unique ID of the AI Gateway.
- Key
Auth AiGateway Auth Strategy Key Auth - Configuration for an auth strategy.
- Name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- Openid
Connect AiGateway Auth Strategy Openid Connect - Configuration for an auth strategy.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Display
Name string - The display name for this auth strategy instance.
- Gateway
Id string - The unique ID of the AI Gateway.
- Key
Auth AiGateway Auth Strategy Key Auth Args - Configuration for an auth strategy.
- Name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- Openid
Connect AiGateway Auth Strategy Openid Connect Args - Configuration for an auth strategy.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- display_
name string - The display name for this auth strategy instance.
- gateway_
id string - The unique ID of the AI Gateway.
- key_
auth object - Configuration for an auth strategy.
- name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- openid_
connect object - Configuration for an auth strategy.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- display
Name String - The display name for this auth strategy instance.
- gateway
Id String - The unique ID of the AI Gateway.
- key
Auth AiGateway Auth Strategy Key Auth - Configuration for an auth strategy.
- name String
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- openid
Connect AiGateway Auth Strategy Openid Connect - Configuration for an auth strategy.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- display
Name string - The display name for this auth strategy instance.
- gateway
Id string - The unique ID of the AI Gateway.
- key
Auth AiGateway Auth Strategy Key Auth - Configuration for an auth strategy.
- name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- openid
Connect AiGateway Auth Strategy Openid Connect - Configuration for an auth strategy.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- display_
name str - The display name for this auth strategy instance.
- gateway_
id str - The unique ID of the AI Gateway.
- key_
auth AiGateway Auth Strategy Key Auth Args - Configuration for an auth strategy.
- name str
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- openid_
connect AiGateway Auth Strategy Openid Connect Args - Configuration for an auth strategy.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- display
Name String - The display name for this auth strategy instance.
- gateway
Id String - The unique ID of the AI Gateway.
- key
Auth Property Map - Configuration for an auth strategy.
- name String
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- openid
Connect Property Map - Configuration for an auth strategy.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
Supporting Types
AiGatewayAuthStrategyKeyAuth, AiGatewayAuthStrategyKeyAuthArgs
- Config
Ai
Gateway Auth Strategy Key Auth Config - Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Display
Name string - The display name for this auth strategy instance. Not Null
- Id string
- Contains a unique identifier used for this resource.
- Labels Dictionary<string, string>
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By Dictionary<string, string> - Name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Config
Ai
Gateway Auth Strategy Key Auth Config - Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Display
Name string - The display name for this auth strategy instance. Not Null
- Id string
- Contains a unique identifier used for this resource.
- Labels map[string]string
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By map[string]string - Name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- config object
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- display_
name string - The display name for this auth strategy instance. Not Null
- id string
- Contains a unique identifier used for this resource.
- labels map(string)
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by map(string) - name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Auth Strategy Key Auth Config - created
At String - An ISO-8601 timestamp representation of entity creation date.
- display
Name String - The display name for this auth strategy instance. Not Null
- id String
- Contains a unique identifier used for this resource.
- labels Map<String,String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String,String> - name String
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Auth Strategy Key Auth Config - created
At string - An ISO-8601 timestamp representation of entity creation date.
- display
Name string - The display name for this auth strategy instance. Not Null
- id string
- Contains a unique identifier used for this resource.
- labels {[key: string]: string}
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By {[key: string]: string} - name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Auth Strategy Key Auth Config - created_
at str - An ISO-8601 timestamp representation of entity creation date.
- display_
name str - The display name for this auth strategy instance. Not Null
- id str
- Contains a unique identifier used for this resource.
- labels Mapping[str, str]
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by Mapping[str, str] - name str
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- config Property Map
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- display
Name String - The display name for this auth strategy instance. Not Null
- id String
- Contains a unique identifier used for this resource.
- labels Map<String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String> - name String
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
AiGatewayAuthStrategyKeyAuthConfig, AiGatewayAuthStrategyKeyAuthConfigArgs
- Anonymous string
- An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure
4xx. - Hide
Credentials bool - An optional boolean value telling the plugin to show or hide the credential from the upstream service. If
true, the plugin strips the credential from the request. Default: true - Identity
Realms List<AiGateway Auth Strategy Key Auth Config Identity Realm> - A configuration of Konnect Identity Realms that indicate where to source a consumer from.
- Key
In boolBody - If enabled, the plugin reads the request body. Supported MIME types:
application/www-form-urlencoded,application/json, andmultipart/form-data. Default: false - Key
In boolHeader - If enabled (default), the plugin reads the request header and tries to find the key in it. Default: true
- Key
In boolQuery - If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it. Default: true
- Key
Names List<string> - Describes an array of parameter names where the plugin will look for a key. The key names may only contain [a-z], [A-Z], [0-9], [_] underscore, and [-] hyphen. Default: ["apikey"]
- Principals
Ai
Gateway Auth Strategy Key Auth Config Principals - Realm string
- When authentication fails the plugin sends
WWW-Authenticateheader withrealmattribute value. - Run
On boolPreflight - A boolean value that indicates whether the plugin should run (and try to authenticate) on
OPTIONSpreflight requests. If set tofalse, thenOPTIONSrequests are always allowed. Default: true
- Anonymous string
- An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure
4xx. - Hide
Credentials bool - An optional boolean value telling the plugin to show or hide the credential from the upstream service. If
true, the plugin strips the credential from the request. Default: true - Identity
Realms []AiGateway Auth Strategy Key Auth Config Identity Realm - A configuration of Konnect Identity Realms that indicate where to source a consumer from.
- Key
In boolBody - If enabled, the plugin reads the request body. Supported MIME types:
application/www-form-urlencoded,application/json, andmultipart/form-data. Default: false - Key
In boolHeader - If enabled (default), the plugin reads the request header and tries to find the key in it. Default: true
- Key
In boolQuery - If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it. Default: true
- Key
Names []string - Describes an array of parameter names where the plugin will look for a key. The key names may only contain [a-z], [A-Z], [0-9], [_] underscore, and [-] hyphen. Default: ["apikey"]
- Principals
Ai
Gateway Auth Strategy Key Auth Config Principals - Realm string
- When authentication fails the plugin sends
WWW-Authenticateheader withrealmattribute value. - Run
On boolPreflight - A boolean value that indicates whether the plugin should run (and try to authenticate) on
OPTIONSpreflight requests. If set tofalse, thenOPTIONSrequests are always allowed. Default: true
- anonymous string
- An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure
4xx. - hide_
credentials bool - An optional boolean value telling the plugin to show or hide the credential from the upstream service. If
true, the plugin strips the credential from the request. Default: true - identity_
realms list(object) - A configuration of Konnect Identity Realms that indicate where to source a consumer from.
- key_
in_ boolbody - If enabled, the plugin reads the request body. Supported MIME types:
application/www-form-urlencoded,application/json, andmultipart/form-data. Default: false - key_
in_ boolheader - If enabled (default), the plugin reads the request header and tries to find the key in it. Default: true
- key_
in_ boolquery - If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it. Default: true
- key_
names list(string) - Describes an array of parameter names where the plugin will look for a key. The key names may only contain [a-z], [A-Z], [0-9], [_] underscore, and [-] hyphen. Default: ["apikey"]
- principals object
- realm string
- When authentication fails the plugin sends
WWW-Authenticateheader withrealmattribute value. - run_
on_ boolpreflight - A boolean value that indicates whether the plugin should run (and try to authenticate) on
OPTIONSpreflight requests. If set tofalse, thenOPTIONSrequests are always allowed. Default: true
- anonymous String
- An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure
4xx. - hide
Credentials Boolean - An optional boolean value telling the plugin to show or hide the credential from the upstream service. If
true, the plugin strips the credential from the request. Default: true - identity
Realms List<AiGateway Auth Strategy Key Auth Config Identity Realm> - A configuration of Konnect Identity Realms that indicate where to source a consumer from.
- key
In BooleanBody - If enabled, the plugin reads the request body. Supported MIME types:
application/www-form-urlencoded,application/json, andmultipart/form-data. Default: false - key
In BooleanHeader - If enabled (default), the plugin reads the request header and tries to find the key in it. Default: true
- key
In BooleanQuery - If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it. Default: true
- key
Names List<String> - Describes an array of parameter names where the plugin will look for a key. The key names may only contain [a-z], [A-Z], [0-9], [_] underscore, and [-] hyphen. Default: ["apikey"]
- principals
Ai
Gateway Auth Strategy Key Auth Config Principals - realm String
- When authentication fails the plugin sends
WWW-Authenticateheader withrealmattribute value. - run
On BooleanPreflight - A boolean value that indicates whether the plugin should run (and try to authenticate) on
OPTIONSpreflight requests. If set tofalse, thenOPTIONSrequests are always allowed. Default: true
- anonymous string
- An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure
4xx. - hide
Credentials boolean - An optional boolean value telling the plugin to show or hide the credential from the upstream service. If
true, the plugin strips the credential from the request. Default: true - identity
Realms AiGateway Auth Strategy Key Auth Config Identity Realm[] - A configuration of Konnect Identity Realms that indicate where to source a consumer from.
- key
In booleanBody - If enabled, the plugin reads the request body. Supported MIME types:
application/www-form-urlencoded,application/json, andmultipart/form-data. Default: false - key
In booleanHeader - If enabled (default), the plugin reads the request header and tries to find the key in it. Default: true
- key
In booleanQuery - If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it. Default: true
- key
Names string[] - Describes an array of parameter names where the plugin will look for a key. The key names may only contain [a-z], [A-Z], [0-9], [_] underscore, and [-] hyphen. Default: ["apikey"]
- principals
Ai
Gateway Auth Strategy Key Auth Config Principals - realm string
- When authentication fails the plugin sends
WWW-Authenticateheader withrealmattribute value. - run
On booleanPreflight - A boolean value that indicates whether the plugin should run (and try to authenticate) on
OPTIONSpreflight requests. If set tofalse, thenOPTIONSrequests are always allowed. Default: true
- anonymous str
- An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure
4xx. - hide_
credentials bool - An optional boolean value telling the plugin to show or hide the credential from the upstream service. If
true, the plugin strips the credential from the request. Default: true - identity_
realms Sequence[AiGateway Auth Strategy Key Auth Config Identity Realm] - A configuration of Konnect Identity Realms that indicate where to source a consumer from.
- key_
in_ boolbody - If enabled, the plugin reads the request body. Supported MIME types:
application/www-form-urlencoded,application/json, andmultipart/form-data. Default: false - key_
in_ boolheader - If enabled (default), the plugin reads the request header and tries to find the key in it. Default: true
- key_
in_ boolquery - If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it. Default: true
- key_
names Sequence[str] - Describes an array of parameter names where the plugin will look for a key. The key names may only contain [a-z], [A-Z], [0-9], [_] underscore, and [-] hyphen. Default: ["apikey"]
- principals
Ai
Gateway Auth Strategy Key Auth Config Principals - realm str
- When authentication fails the plugin sends
WWW-Authenticateheader withrealmattribute value. - run_
on_ boolpreflight - A boolean value that indicates whether the plugin should run (and try to authenticate) on
OPTIONSpreflight requests. If set tofalse, thenOPTIONSrequests are always allowed. Default: true
- anonymous String
- An optional string (consumer UUID or username) value to use as an “anonymous” consumer if authentication fails. If empty (default null), the request will fail with an authentication failure
4xx. - hide
Credentials Boolean - An optional boolean value telling the plugin to show or hide the credential from the upstream service. If
true, the plugin strips the credential from the request. Default: true - identity
Realms List<Property Map> - A configuration of Konnect Identity Realms that indicate where to source a consumer from.
- key
In BooleanBody - If enabled, the plugin reads the request body. Supported MIME types:
application/www-form-urlencoded,application/json, andmultipart/form-data. Default: false - key
In BooleanHeader - If enabled (default), the plugin reads the request header and tries to find the key in it. Default: true
- key
In BooleanQuery - If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it. Default: true
- key
Names List<String> - Describes an array of parameter names where the plugin will look for a key. The key names may only contain [a-z], [A-Z], [0-9], [_] underscore, and [-] hyphen. Default: ["apikey"]
- principals Property Map
- realm String
- When authentication fails the plugin sends
WWW-Authenticateheader withrealmattribute value. - run
On BooleanPreflight - A boolean value that indicates whether the plugin should run (and try to authenticate) on
OPTIONSpreflight requests. If set tofalse, thenOPTIONSrequests are always allowed. Default: true
AiGatewayAuthStrategyKeyAuthConfigIdentityRealm, AiGatewayAuthStrategyKeyAuthConfigIdentityRealmArgs
AiGatewayAuthStrategyKeyAuthConfigPrincipals, AiGatewayAuthStrategyKeyAuthConfigPrincipalsArgs
- Directory string
- The Kong Identity directory instance to authenticate against. Default: "default"
- Enabled bool
- When true, authenticate against Kong Identity instead of local credentials. Default: false
- Error
On boolMiss - When true (default), return 401 if no matching principal is found in Kong Identity. When false, allow the request to continue unauthenticated instead. Default: true
- Directory string
- The Kong Identity directory instance to authenticate against. Default: "default"
- Enabled bool
- When true, authenticate against Kong Identity instead of local credentials. Default: false
- Error
On boolMiss - When true (default), return 401 if no matching principal is found in Kong Identity. When false, allow the request to continue unauthenticated instead. Default: true
- directory string
- The Kong Identity directory instance to authenticate against. Default: "default"
- enabled bool
- When true, authenticate against Kong Identity instead of local credentials. Default: false
- error_
on_ boolmiss - When true (default), return 401 if no matching principal is found in Kong Identity. When false, allow the request to continue unauthenticated instead. Default: true
- directory String
- The Kong Identity directory instance to authenticate against. Default: "default"
- enabled Boolean
- When true, authenticate against Kong Identity instead of local credentials. Default: false
- error
On BooleanMiss - When true (default), return 401 if no matching principal is found in Kong Identity. When false, allow the request to continue unauthenticated instead. Default: true
- directory string
- The Kong Identity directory instance to authenticate against. Default: "default"
- enabled boolean
- When true, authenticate against Kong Identity instead of local credentials. Default: false
- error
On booleanMiss - When true (default), return 401 if no matching principal is found in Kong Identity. When false, allow the request to continue unauthenticated instead. Default: true
- directory str
- The Kong Identity directory instance to authenticate against. Default: "default"
- enabled bool
- When true, authenticate against Kong Identity instead of local credentials. Default: false
- error_
on_ boolmiss - When true (default), return 401 if no matching principal is found in Kong Identity. When false, allow the request to continue unauthenticated instead. Default: true
- directory String
- The Kong Identity directory instance to authenticate against. Default: "default"
- enabled Boolean
- When true, authenticate against Kong Identity instead of local credentials. Default: false
- error
On BooleanMiss - When true (default), return 401 if no matching principal is found in Kong Identity. When false, allow the request to continue unauthenticated instead. Default: true
AiGatewayAuthStrategyOpenidConnect, AiGatewayAuthStrategyOpenidConnectArgs
- Config
Ai
Gateway Auth Strategy Openid Connect Config - Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Display
Name string - The display name for this auth strategy instance. Not Null
- Id string
- Contains a unique identifier used for this resource.
- Labels Dictionary<string, string>
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By Dictionary<string, string> - Name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Config
Ai
Gateway Auth Strategy Openid Connect Config - Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Display
Name string - The display name for this auth strategy instance. Not Null
- Id string
- Contains a unique identifier used for this resource.
- Labels map[string]string
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By map[string]string - Name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- config object
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- display_
name string - The display name for this auth strategy instance. Not Null
- id string
- Contains a unique identifier used for this resource.
- labels map(string)
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by map(string) - name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Auth Strategy Openid Connect Config - created
At String - An ISO-8601 timestamp representation of entity creation date.
- display
Name String - The display name for this auth strategy instance. Not Null
- id String
- Contains a unique identifier used for this resource.
- labels Map<String,String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String,String> - name String
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Auth Strategy Openid Connect Config - created
At string - An ISO-8601 timestamp representation of entity creation date.
- display
Name string - The display name for this auth strategy instance. Not Null
- id string
- Contains a unique identifier used for this resource.
- labels {[key: string]: string}
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By {[key: string]: string} - name string
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Auth Strategy Openid Connect Config - created_
at str - An ISO-8601 timestamp representation of entity creation date.
- display_
name str - The display name for this auth strategy instance. Not Null
- id str
- Contains a unique identifier used for this resource.
- labels Mapping[str, str]
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by Mapping[str, str] - name str
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- config Property Map
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- display
Name String - The display name for this auth strategy instance. Not Null
- id String
- Contains a unique identifier used for this resource.
- labels Map<String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String> - name String
- A user-defined unique identifier for this auth strategy instance, used as a stable human-readable reference. This value is immutable after creation.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
AiGatewayAuthStrategyOpenidConnectConfig, AiGatewayAuthStrategyOpenidConnectConfigArgs
- Anonymous string
- An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a
4xxHTTP status code. This value must refer to the consumeridorusernameattribute, and not itscustom_id. - Audience
Claims List<string> - The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["aud"]
- Audience
Requireds List<string> - The audiences (
audience_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - Audiences List<string>
- The audience passed to the authorization endpoint.
- Auth
Methods List<string> - Types of credentials/grants to enable. Default: ["authorizationcode","bearer","clientcredentials","introspection","kongoauth2","password","refreshtoken","session","userinfo"]
- Authenticated
Groups List<string>Claims - The claim that contains authenticated groups. This setting can be used together with ACL plugin, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload.
- string
- The authorization cookie Domain flag.
- bool
- Forbids JavaScript from accessing the cookie, for example, through the
Document.cookieproperty. Default: true - string
- The authorization cookie name. Default: "authorization"
- string
- The authorization cookie Path flag. Default: "/"
- string
- Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks. possible known values include one of ["Default", "Lax", "None", "Strict"]; Default: "Default"
- bool
- Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
- string
- The authorization endpoint. If set it overrides the value in
authorization_endpointreturned by the discovery endpoint. - List<string>
- Extra query arguments passed from the client to the authorization endpoint.
- List<string>
- Extra query argument names passed to the authorization endpoint.
- List<string>
- Extra query argument values passed to the authorization endpoint.
- double
- Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling. Default: 600
- string
- The name of the cookie in which the bearer token is passed.
- Bearer
Token List<string>Param Types - Where to look for the bearer token: -
header: search theAuthorization,access-token, andx-access-tokenHTTP headers -query: search the URL's query string -body: search the HTTP request body -cookie: search the HTTP request cookies specified withconfig.bearer_token_cookie_name. Default: ["body","header","query"] - By
Username boolIgnore Case - If
consumer_byis set tousername, specify whetherusernamecan match consumers case-insensitively. Default: false - Cache
Introspection bool - Cache the introspection endpoint requests. Default: true
- Cache
Token boolExchange - Cache the legacy token exchange endpoint requests. Default: true
- Cache
Tokens bool - Cache the token endpoint requests. Default: true
- Cache
Tokens stringSalt - Salt used for generating the cache key that is used for caching the token endpoint requests.
- Cache
Ttl double - The default cache ttl in seconds that is used in case the cached object does not specify the expiry. Default: 3600
- Cache
Ttl doubleMax - The maximum cache ttl in seconds (enforced).
- Cache
Ttl doubleMin - The minimum cache ttl in seconds (enforced).
- Cache
Ttl doubleNeg - The negative cache ttl in seconds.
- Cache
Ttl doubleResurrect - The resurrection ttl in seconds.
- Cache
User boolInfo - Cache the user info requests. Default: true
- Claims
Forbiddens List<string> - If given, these claims are forbidden in the token payload.
- Client
Algs List<string> - The algorithm to use for clientsecretjwt (only HS***) or private*key*jwt authentication.
- Client
Arg string - The client to use for this request (the selection is made with a request parameter with the same name). Default: "client_id"
- Client
Auths List<string> - The default OpenID Connect client authentication method is 'clientsecretbasic' (using 'Authorization: Basic' header), 'clientsecretpost' (credentials in body), 'clientsecretjwt' (signed client assertion in body), 'privatekeyjwt' (private key-signed assertion), 'tlsclientauth' (client certificate), 'selfsignedtlsclientauth' (self-signed client certificate), and 'none' (no authentication).
- Client
Credentials List<string>Param Types - Where to look for the client credentials: -
header: search the HTTP headers -query: search the URL's query string -body: search from the HTTP request body. Default: ["body","header","query"] - Client
Ids List<string> - The client id(s) that the plugin uses when it calls authenticated endpoints on the identity provider.
- Client
Jwks List<AiGateway Auth Strategy Openid Connect Config Client Jwk> - The JWK used for the privatekeyjwt authentication.
- Client
Secrets List<string> - The client secret.
- Cluster
Cache AiRedis Gateway Auth Strategy Openid Connect Config Cluster Cache Redis - Cluster
Cache stringStrategy - The strategy to use for the cluster cache. If set, the plugin will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared. possible known values include one of ["off", "redis"]; Default: "off"
- Consumer
Bies List<string> - Consumer fields used for mapping: -
id: try to find the matching Consumer byid-username: try to find the matching Consumer byusername-custom_id: try to find the matching Consumer bycustom_id. Default: ["custom_id","username"] - Consumer
Claims List<ImmutableArray<string>> - The claims used for consumer mapping. Each entry represents a claim path inside the token payload. The paths are evaluated in order, and the first matching claim is used.
- Consumer
Groups List<string>Claims - The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload.
- Consumer
Groups boolOptional - Do not terminate the request if consumer groups mapping fails. Default: false
- Consumer
Optional bool - Do not terminate the request if consumer mapping fails. Default: false
- Credential
Claims List<string> - The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting plugin), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["sub"]
- Disable
Sessions List<string> - Disable issuing the session cookie with the specified grants.
- Discovery
Headers List<string>Names - Extra header names passed to the discovery endpoint.
- Discovery
Headers List<string>Values - Extra header values passed to the discovery endpoint.
- Display
Errors bool - Display errors on failure responses. Default: false
- Domains List<string>
- The allowed values for the
hdclaim. - Downstream
Access stringToken Header - The downstream access token header.
- Downstream
Access stringToken Jwk Header - The downstream access token JWK header.
- Downstream
Headers List<AiGateway Auth Strategy Openid Connect Config Downstream Header> - The downstream claim to header mappings.
- Downstream
Headers List<string>Claims - The downstream header claims. Only top level claims are supported.
- Downstream
Headers List<string>Names - The downstream header names for the claim values.
- Downstream
Id stringToken Header - The downstream id token header.
- Downstream
Id stringToken Jwk Header - The downstream id token JWK header.
- Downstream
Introspection stringHeader - The downstream introspection header.
- Downstream
Introspection stringJwt Header - The downstream introspection JWT header.
- Downstream
Refresh stringToken Header - The downstream refresh token header.
- Downstream
Session stringId Header - The downstream session id header.
- Downstream
User stringInfo Header - The downstream user info header.
- Downstream
User stringInfo Jwt Header - The downstream user info JWT header (in case the user info returns a JWT response).
- Dpop
Proof doubleLifetime - Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise. Default: 300
- Dpop
Use boolNonce - Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime. Default: false
- Enable
Hs boolSignatures - Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted). Default: false
- End
Session stringEndpoint - The end session endpoint. If set it overrides the value in
end_session_endpointreturned by the discovery endpoint. - Expose
Error boolCode - Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to
falseto disable. Default: true - Extra
Jwks List<string>Uris - JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery).
- Forbidden
Destroy boolSession - Destroy any active session for the forbidden requests. Default: true
- Forbidden
Error stringMessage - The error message for the forbidden requests (when not using the redirection). Default: "Forbidden"
- Forbidden
Redirect List<string>Uris - Where to redirect the client on forbidden requests.
- Groups
Claims List<string> - The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["groups"]
- Groups
Requireds List<string> - The groups (
groups_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - Hide
Credentials bool - Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the plugin will remove those that were used for successful authentication. Default: true
- Http
Proxy string - The HTTP proxy.
- string
- The HTTP proxy authorization.
- Http
Version double - The HTTP version used for the requests by this plugin: -
1.1: HTTP 1.1 (the default) -1.0: HTTP 1.0. - Https
Proxy string - The HTTPS proxy.
- string
- The HTTPS proxy authorization.
- Id
Token stringParam Name - The name of the parameter used to pass the id token.
- Id
Token List<string>Param Types - Where to look for the id token: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - Ignore
Signatures List<string> - Skip the token signature verification on certain grants. This is insecure and logs a warning; use it only for providers that publish no verification key. Grants: -
password: OAuth password grant -client_credentials: OAuth client credentials grant -authorization_code: authorization code flow -refresh_token: OAuth refresh token grant -session: session cookie authentication -introspection: OAuth introspection -userinfo: OpenID Connect user info endpoint authentication. Default: [] - Introspect
Jwt boolTokens - Specifies whether to introspect the JWT access tokens (can be used to check for revocations). Default: false
- Introspection
Accept string - The value of
Acceptheader for introspection requests: -application/json: introspection response as JSON -application/token-introspection+jwt: introspection response as JWT (from the current IETF draft document) -application/jwt: introspection response as JWT (from the obsolete IETF draft document). possible known values include one of ["application/json", "application/jwt", "application/token-introspection+jwt"]; Default: "application/json" - Introspection
Check boolActive - Check that the introspection response has an
activeclaim with a value oftrue. Default: true - Introspection
Endpoint string - The introspection endpoint. If set it overrides the value in
introspection_endpointreturned by the discovery endpoint. - Introspection
Endpoint stringAuth Method - The introspection endpoint authentication method: :
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["clientsecretbasic", "clientsecretjwt", "clientsecretpost", "none", "privatekeyjwt", "selfsignedtlsclientauth", "tlsclientauth"] - Introspection
Headers List<string>Clients - Extra headers passed from the client to the introspection endpoint.
- Introspection
Headers List<string>Names - Extra header names passed to the introspection endpoint.
- Introspection
Headers List<string>Values - Extra header values passed to the introspection endpoint.
- Introspection
Hint string - Introspection hint parameter value passed to the introspection endpoint. Default: "access_token"
- Introspection
Post List<string>Args Client Headers - Extra post arguments passed from the client headers to the introspection endpoint.
- Introspection
Post List<string>Args Clients - Extra post arguments passed from the client to the introspection endpoint.
- Introspection
Post List<string>Args Names - Extra post argument names passed to the introspection endpoint.
- Introspection
Post List<string>Args Values - Extra post argument values passed to the introspection endpoint.
- Introspection
Token stringParam Name - Designate token's parameter name for introspection. Default: "token"
- Issuer string
- The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure
config.using_pseudo_issuer=true. Not Null - Issuers
Alloweds List<string> - The issuers allowed to be present in the tokens (
issclaim). - Jwks
Endpoint string - Overrides the
jwks_urireturned by discovery. Use when the IdP exposes a non-standard JWKS endpoint. - Jwt
Session stringClaim - The claim to match against the JWT session cookie. Default: "sid"
- string
- The name of the JWT session cookie.
- Keepalive bool
- Use keepalive with the HTTP client. Default: true
- Leeway double
- Defines leeway time (in seconds) for
auth_time,exp,iat, andnbfclaims. Default: 0 - Login
Action string - What to do after successful login: -
upstream: proxy request to upstream service -response: terminate request with a response -redirect: redirect to a different location. possible known values include one of ["redirect", "response", "upstream"]; Default: "upstream" - Login
Methods List<string> - Enable login functionality with specified grants. Default: ["authorization_code"]
- Login
Redirect stringMode - Where to place
login_tokenswhen usingredirectlogin_action: -query: place tokens in query string -fragment: place tokens in url fragment (not readable by servers). possible known values include one of ["fragment", "query"]; Default: "fragment" - Login
Redirect List<string>Uris - Where to redirect the client when
login_actionis set toredirect. - Login
Tokens List<string> - What tokens to include in
responsebody orredirectquery string or fragment: -id_token: include id token -access_token: include access token -refresh_token: include refresh token -tokens: include the full token endpoint response -introspection: include introspection response. Default: ["id_token"] - Logout
Methods List<string> - The request methods that can activate the logout: -
POST: HTTP POST method -GET: HTTP GET method -DELETE: HTTP DELETE method. Default: ["DELETE","POST"] - Logout
Post stringArg - The request body argument that activates the logout.
- Logout
Query stringArg - The request query argument that activates the logout.
- Logout
Redirect List<string>Uris - Where to redirect the client after the logout.
- Logout
Revoke bool - Revoke tokens as part of the logout.
- Logout
Revoke boolAccess Token - Revoke the access token as part of the logout. Requires
logout_revoketo be set totrue. Default: true - Logout
Revoke boolRefresh Token - Revoke the refresh token as part of the logout. Requires
logout_revoketo be set totrue. Default: true - Logout
Uri stringSuffix - The request URI suffix that activates the logout.
- Max
Age double - The maximum age (in seconds) compared to the
auth_timeclaim. - Mtls
Introspection stringEndpoint - Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - Mtls
Revocation stringEndpoint - Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - Mtls
Token stringEndpoint - Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - No
Proxy string - Do not use proxy with these hosts.
- Password
Param List<string>Types - Where to look for the username and password: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - Preserve
Query boolArgs - With this parameter, you can preserve request query arguments even when doing authorization code flow. Default: false
- Principals
Ai
Gateway Auth Strategy Openid Connect Config Principals - Configuration for Kong Identity principal hydration after token verification.
- Proof
Of boolPossession Auth Methods Validation - If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP. Default: true
- Proof
Of stringPossession Dpop - Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof. possible known values include one of ["off", "optional", "strict"]; Default: "off"
- Proof
Of stringPossession Mtls - Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401. possible known values include one of ["off", "optional", "strict"]; Default: "off"
- string
- The pushed authorization endpoint. If set it overrides the value in
pushed_authorization_request_endpointreturned by the discovery endpoint. - string
- The pushed authorization request endpoint authentication method:
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - Redirect
Uris List<string> - The redirect URI passed to the authorization and token endpoints.
- Redis
Ai
Gateway Auth Strategy Openid Connect Config Redis - Rediscovery
Lifetime double - Specifies how long (in seconds) the plugin waits between discovery attempts. Discovery is still triggered on an as-needed basis. Default: 30
- Refresh
Token stringParam Name - The name of the parameter used to pass the refresh token.
- Refresh
Token List<string>Param Types - Where to look for the refresh token: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - Refresh
Tokens bool - Specifies whether the plugin should try to refresh (soon to be) expired access tokens if the plugin has a
refresh_tokenavailable. Default: true - Require
Proof boolKey For Code Exchange - Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of
code_challenge_methods_supported, and enabled automatically (in case thecode_challenge_methods_supportedis missing, the PKCE will not be enabled). - bool
- Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of
require_pushed_authorization_requests(which defaults tofalse). - Require
Signed boolRequest Object - Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of
require_signed_request_object, and enabled automatically (in case therequire_signed_request_objectis missing, the feature will not be enabled). - Resolve
Distributed boolClaims - Distributed claims are represented by the
_claim_namesand_claim_sourcesmembers of the JSON object containing the claims. If this parameter is set totrue, the plugin explicitly resolves these distributed claims. Default: false - Response
Mode string - Response mode passed to the authorization endpoint: -
query: for parameters in query string -form_post: for parameters in request body -fragment: for parameters in uri fragment (rarely useful as the plugin itself cannot read it) -query.jwt,form_post.jwt,fragment.jwt: similar toquery,form_postandfragmentbut the parameters are encoded in a JWT -jwt: shortcut that indicates the default encoding for the requested response type. possible known values include one of ["form_post", "form_post.jwt", "fragment", "fragment.jwt", "jwt", "query", "query.jwt"]; Default: "query" - Response
Types List<string> - The response type passed to the authorization endpoint. Default: ["code"]
- Reverify bool
- Specifies whether to always verify tokens stored in the session. Default: false
- Revocation
Endpoint string - The revocation endpoint. If set it overrides the value in
revocation_endpointreturned by the discovery endpoint. - Revocation
Endpoint stringAuth Method - The revocation endpoint authentication method: :
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - Revocation
Token stringParam Name - Designate token's parameter name for revocation. Default: "token"
- Roles
Claims List<string> - The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["roles"]
- Roles
Requireds List<string> - The roles (
roles_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - Run
On boolPreflight - Specifies whether to run this plugin on pre-flight (
OPTIONS) requests. Default: true - Scopes List<string>
- The scopes passed to the authorization and token endpoints. Default: ["openid"]
- Scopes
Claims List<string> - The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["scope"]
- Scopes
Requireds List<string> - The scopes (
scopes_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - Search
User boolInfo - Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers. Default: false
- Session
Absolute doubleTimeout - Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks. Default: 86400
- Session
Audience string - The session audience, which is the intended target application. For example
"my-application". Default: "default" - Session
Binds List<string> - Bind the session to data acquired from the HTTP request or connection.
- string
- The session cookie Domain flag.
- bool
- Forbids JavaScript from accessing the cookie, for example, through the
Document.cookieproperty. Default: true - string
- The session cookie name. Default: "session"
- string
- The session cookie Path flag. Default: "/"
- string
- Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks. possible known values include one of ["Default", "Lax", "None", "Strict"]; Default: "Lax"
- bool
- Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
- Session
Enforce boolSame Subject - When set to
true, audiences are forced to share the same subject. Default: false - Session
Hash boolStorage Key - When set to
true, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie. Default: false - Session
Hash boolSubject - When set to
true, the value of subject is hashed before being stored. Only applies whensession_store_metadatais enabled. Default: false - Session
Idling doubleTimeout - Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching. Default: 900
- Session
Memcached stringHost - The memcached host. Default: "127.0.0.1"
- Session
Memcached doublePort - The memcached port. Default: 11211
- Session
Memcached stringPrefix - The memcached session key prefix.
- Session
Memcached stringSocket - The memcached unix socket path.
- Session
Memcached boolSsl - If set to true, uses SSL to connect to memcached
- Session
Memcached boolSsl Verify - If set to true, verifies the validity of the memcached server SSL certificate. Default: true
- Session
Remember bool - Enables or disables persistent sessions. Default: false
- Session
Remember doubleAbsolute Timeout - Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks. Default: 2592000
- string
- Persistent session cookie name. Use with the
rememberconfiguration parameter. Default: "remember" - Session
Remember doubleRolling Timeout - Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling. Default: 604800
- Session
Request List<string>Headers - Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g.
[ "id", "timeout" ]will set Session-Id and Session-Timeout request headers. - Session
Response List<string>Headers - Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g.
[ "id", "timeout" ]will set Session-Id and Session-Timeout response headers. - Session
Rolling doubleTimeout - Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling. Default: 3600
- Session
Secret string - The session secret.
- Session
Storage string - The session storage for session data: -
cookie: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) -memcache: stores session data in memcached -redis: stores session data in Redis. possible known values include one of ["cookie", "memcache", "memcached", "redis"]; Default: "cookie" - Session
Store boolMetadata - Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject. Default: false
- Ssl
Verify bool - Verify identity provider server certificate. If set to
true, the plugin uses the CA certificate set in thekong.confconfig parameterlua_ssl_trusted_certificate. Default: true - Timeout double
- Network IO timeout in milliseconds. Default: 10000
- Tls
Client stringAuth Cert Id - ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server.
- Tls
Client boolAuth Ssl Verify - Verify identity provider server certificate during mTLS client authentication. Default: true
- Token
Cache boolKey Include Scope - Include the scope in the token cache key, so token with different scopes are considered diffrent tokens. Default: false
- Token
Endpoint string - The token endpoint. If set it overrides the value in
token_endpointreturned by the discovery endpoint. - Token
Endpoint stringAuth Method - The token endpoint authentication method:
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - Token
Exchange AiGateway Auth Strategy Openid Connect Config Token Exchange - Details on how to accept tokens from other identity providers.
- Token
Exchange stringEndpoint - Endpoint used to perform the legacy token exchange.
- Token
Headers List<string>Clients - Extra headers passed from the client to the token endpoint.
- Token
Headers List<string>Grants - Enable the sending of the token endpoint response headers only with certain grants: -
password: with OAuth password grant -client_credentials: with OAuth client credentials grant -authorization_code: with authorization code flow -refresh_tokenwith refresh token grant. - Token
Headers List<string>Names - Extra header names passed to the token endpoint.
- Token
Headers stringPrefix - Add a prefix to the token endpoint response headers before forwarding them to the downstream client.
- Token
Headers List<string>Replays - The names of token endpoint response headers to forward to the downstream client.
- Token
Headers List<string>Values - Extra header values passed to the token endpoint.
- Token
Post List<string>Args Clients - Pass extra arguments from the client to the OpenID-Connect plugin. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header This parameter can be used with
scopevalues, like this:config.token_post_args_client=scopeIn this case, the token would take thescopevalue from the query parameter or from the request body or from the header and send it to the token endpoint. - Token
Post List<string>Args Names - Extra post argument names passed to the token endpoint.
- Token
Post List<string>Args Values - Extra post argument values passed to the token endpoint.
- bool
- Destroy any active session for the unauthorized requests. Default: true
- string
- The error message for the unauthorized requests (when not using the redirection). Default: "Unauthorized"
- List<string>
- Where to redirect the client on unauthorized requests.
- Unexpected
Redirect List<string>Uris - Where to redirect the client when unexpected errors happen with the requests.
- Upstream
Access stringToken Header - The upstream access token header. Default: "authorization:bearer"
- Upstream
Access stringToken Jwk Header - The upstream access token JWK header.
- Upstream
Headers List<AiGateway Auth Strategy Openid Connect Config Upstream Header> - The upstream claim to header mappings.
- Upstream
Headers List<string>Claims - The upstream header claims. Only top level claims are supported.
- Upstream
Headers List<string>Names - The upstream header names for the claim values.
- Upstream
Id stringToken Header - The upstream id token header.
- Upstream
Id stringToken Jwk Header - The upstream id token JWK header.
- Upstream
Introspection stringHeader - The upstream introspection header.
- Upstream
Introspection stringJwt Header - The upstream introspection JWT header.
- Upstream
Refresh stringToken Header - The upstream refresh token header.
- Upstream
Session stringId Header - The upstream session id header.
- Upstream
User stringInfo Header - The upstream user info header.
- Upstream
User stringInfo Jwt Header - The upstream user info JWT header (in case the user info returns a JWT response).
- Userinfo
Accept string - The value of
Acceptheader for user info requests: -application/json: user info response as JSON -application/jwt: user info response as JWT (from the obsolete IETF draft document). possible known values include one of ["application/json", "application/jwt"]; Default: "application/json" - Userinfo
Endpoint string - The user info endpoint. If set it overrides the value in
userinfo_endpointreturned by the discovery endpoint. - Userinfo
Headers List<string>Clients - Extra headers passed from the client to the user info endpoint.
- Userinfo
Headers List<string>Names - Extra header names passed to the user info endpoint.
- Userinfo
Headers List<string>Values - Extra header values passed to the user info endpoint.
- Userinfo
Query List<string>Args Clients - Extra query arguments passed from the client to the user info endpoint.
- Userinfo
Query List<string>Args Names - Extra query argument names passed to the user info endpoint.
- Userinfo
Query List<string>Args Values - Extra query argument values passed to the user info endpoint.
- Using
Pseudo boolIssuer - If the plugin uses a pseudo issuer. When set to true, the plugin will not discover the configuration from the issuer URL specified with
config.issuer. Default: false - Verify
Claims bool - Verify tokens for standard claims. Default: true
- Verify
Nonce bool - Verify nonce on authorization code flow. Default: true
- Verify
Parameters bool - Verify plugin configuration against discovery. Default: false
- Verify
Signature bool - Verify signature of tokens. Default: true
- Anonymous string
- An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a
4xxHTTP status code. This value must refer to the consumeridorusernameattribute, and not itscustom_id. - Audience
Claims []string - The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["aud"]
- Audience
Requireds []string - The audiences (
audience_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - Audiences []string
- The audience passed to the authorization endpoint.
- Auth
Methods []string - Types of credentials/grants to enable. Default: ["authorizationcode","bearer","clientcredentials","introspection","kongoauth2","password","refreshtoken","session","userinfo"]
- Authenticated
Groups []stringClaims - The claim that contains authenticated groups. This setting can be used together with ACL plugin, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload.
- string
- The authorization cookie Domain flag.
- bool
- Forbids JavaScript from accessing the cookie, for example, through the
Document.cookieproperty. Default: true - string
- The authorization cookie name. Default: "authorization"
- string
- The authorization cookie Path flag. Default: "/"
- string
- Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks. possible known values include one of ["Default", "Lax", "None", "Strict"]; Default: "Default"
- bool
- Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
- string
- The authorization endpoint. If set it overrides the value in
authorization_endpointreturned by the discovery endpoint. - []string
- Extra query arguments passed from the client to the authorization endpoint.
- []string
- Extra query argument names passed to the authorization endpoint.
- []string
- Extra query argument values passed to the authorization endpoint.
- float64
- Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling. Default: 600
- string
- The name of the cookie in which the bearer token is passed.
- Bearer
Token []stringParam Types - Where to look for the bearer token: -
header: search theAuthorization,access-token, andx-access-tokenHTTP headers -query: search the URL's query string -body: search the HTTP request body -cookie: search the HTTP request cookies specified withconfig.bearer_token_cookie_name. Default: ["body","header","query"] - By
Username boolIgnore Case - If
consumer_byis set tousername, specify whetherusernamecan match consumers case-insensitively. Default: false - Cache
Introspection bool - Cache the introspection endpoint requests. Default: true
- Cache
Token boolExchange - Cache the legacy token exchange endpoint requests. Default: true
- Cache
Tokens bool - Cache the token endpoint requests. Default: true
- Cache
Tokens stringSalt - Salt used for generating the cache key that is used for caching the token endpoint requests.
- Cache
Ttl float64 - The default cache ttl in seconds that is used in case the cached object does not specify the expiry. Default: 3600
- Cache
Ttl float64Max - The maximum cache ttl in seconds (enforced).
- Cache
Ttl float64Min - The minimum cache ttl in seconds (enforced).
- Cache
Ttl float64Neg - The negative cache ttl in seconds.
- Cache
Ttl float64Resurrect - The resurrection ttl in seconds.
- Cache
User boolInfo - Cache the user info requests. Default: true
- Claims
Forbiddens []string - If given, these claims are forbidden in the token payload.
- Client
Algs []string - The algorithm to use for clientsecretjwt (only HS***) or private*key*jwt authentication.
- Client
Arg string - The client to use for this request (the selection is made with a request parameter with the same name). Default: "client_id"
- Client
Auths []string - The default OpenID Connect client authentication method is 'clientsecretbasic' (using 'Authorization: Basic' header), 'clientsecretpost' (credentials in body), 'clientsecretjwt' (signed client assertion in body), 'privatekeyjwt' (private key-signed assertion), 'tlsclientauth' (client certificate), 'selfsignedtlsclientauth' (self-signed client certificate), and 'none' (no authentication).
- Client
Credentials []stringParam Types - Where to look for the client credentials: -
header: search the HTTP headers -query: search the URL's query string -body: search from the HTTP request body. Default: ["body","header","query"] - Client
Ids []string - The client id(s) that the plugin uses when it calls authenticated endpoints on the identity provider.
- Client
Jwks []AiGateway Auth Strategy Openid Connect Config Client Jwk - The JWK used for the privatekeyjwt authentication.
- Client
Secrets []string - The client secret.
- Cluster
Cache AiRedis Gateway Auth Strategy Openid Connect Config Cluster Cache Redis - Cluster
Cache stringStrategy - The strategy to use for the cluster cache. If set, the plugin will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared. possible known values include one of ["off", "redis"]; Default: "off"
- Consumer
Bies []string - Consumer fields used for mapping: -
id: try to find the matching Consumer byid-username: try to find the matching Consumer byusername-custom_id: try to find the matching Consumer bycustom_id. Default: ["custom_id","username"] - Consumer
Claims [][]string - The claims used for consumer mapping. Each entry represents a claim path inside the token payload. The paths are evaluated in order, and the first matching claim is used.
- Consumer
Groups []stringClaims - The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload.
- Consumer
Groups boolOptional - Do not terminate the request if consumer groups mapping fails. Default: false
- Consumer
Optional bool - Do not terminate the request if consumer mapping fails. Default: false
- Credential
Claims []string - The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting plugin), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["sub"]
- Disable
Sessions []string - Disable issuing the session cookie with the specified grants.
- Discovery
Headers []stringNames - Extra header names passed to the discovery endpoint.
- Discovery
Headers []stringValues - Extra header values passed to the discovery endpoint.
- Display
Errors bool - Display errors on failure responses. Default: false
- Domains []string
- The allowed values for the
hdclaim. - Downstream
Access stringToken Header - The downstream access token header.
- Downstream
Access stringToken Jwk Header - The downstream access token JWK header.
- Downstream
Headers []AiGateway Auth Strategy Openid Connect Config Downstream Header - The downstream claim to header mappings.
- Downstream
Headers []stringClaims - The downstream header claims. Only top level claims are supported.
- Downstream
Headers []stringNames - The downstream header names for the claim values.
- Downstream
Id stringToken Header - The downstream id token header.
- Downstream
Id stringToken Jwk Header - The downstream id token JWK header.
- Downstream
Introspection stringHeader - The downstream introspection header.
- Downstream
Introspection stringJwt Header - The downstream introspection JWT header.
- Downstream
Refresh stringToken Header - The downstream refresh token header.
- Downstream
Session stringId Header - The downstream session id header.
- Downstream
User stringInfo Header - The downstream user info header.
- Downstream
User stringInfo Jwt Header - The downstream user info JWT header (in case the user info returns a JWT response).
- Dpop
Proof float64Lifetime - Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise. Default: 300
- Dpop
Use boolNonce - Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime. Default: false
- Enable
Hs boolSignatures - Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted). Default: false
- End
Session stringEndpoint - The end session endpoint. If set it overrides the value in
end_session_endpointreturned by the discovery endpoint. - Expose
Error boolCode - Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to
falseto disable. Default: true - Extra
Jwks []stringUris - JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery).
- Forbidden
Destroy boolSession - Destroy any active session for the forbidden requests. Default: true
- Forbidden
Error stringMessage - The error message for the forbidden requests (when not using the redirection). Default: "Forbidden"
- Forbidden
Redirect []stringUris - Where to redirect the client on forbidden requests.
- Groups
Claims []string - The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["groups"]
- Groups
Requireds []string - The groups (
groups_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - Hide
Credentials bool - Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the plugin will remove those that were used for successful authentication. Default: true
- Http
Proxy string - The HTTP proxy.
- string
- The HTTP proxy authorization.
- Http
Version float64 - The HTTP version used for the requests by this plugin: -
1.1: HTTP 1.1 (the default) -1.0: HTTP 1.0. - Https
Proxy string - The HTTPS proxy.
- string
- The HTTPS proxy authorization.
- Id
Token stringParam Name - The name of the parameter used to pass the id token.
- Id
Token []stringParam Types - Where to look for the id token: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - Ignore
Signatures []string - Skip the token signature verification on certain grants. This is insecure and logs a warning; use it only for providers that publish no verification key. Grants: -
password: OAuth password grant -client_credentials: OAuth client credentials grant -authorization_code: authorization code flow -refresh_token: OAuth refresh token grant -session: session cookie authentication -introspection: OAuth introspection -userinfo: OpenID Connect user info endpoint authentication. Default: [] - Introspect
Jwt boolTokens - Specifies whether to introspect the JWT access tokens (can be used to check for revocations). Default: false
- Introspection
Accept string - The value of
Acceptheader for introspection requests: -application/json: introspection response as JSON -application/token-introspection+jwt: introspection response as JWT (from the current IETF draft document) -application/jwt: introspection response as JWT (from the obsolete IETF draft document). possible known values include one of ["application/json", "application/jwt", "application/token-introspection+jwt"]; Default: "application/json" - Introspection
Check boolActive - Check that the introspection response has an
activeclaim with a value oftrue. Default: true - Introspection
Endpoint string - The introspection endpoint. If set it overrides the value in
introspection_endpointreturned by the discovery endpoint. - Introspection
Endpoint stringAuth Method - The introspection endpoint authentication method: :
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["clientsecretbasic", "clientsecretjwt", "clientsecretpost", "none", "privatekeyjwt", "selfsignedtlsclientauth", "tlsclientauth"] - Introspection
Headers []stringClients - Extra headers passed from the client to the introspection endpoint.
- Introspection
Headers []stringNames - Extra header names passed to the introspection endpoint.
- Introspection
Headers []stringValues - Extra header values passed to the introspection endpoint.
- Introspection
Hint string - Introspection hint parameter value passed to the introspection endpoint. Default: "access_token"
- Introspection
Post []stringArgs Client Headers - Extra post arguments passed from the client headers to the introspection endpoint.
- Introspection
Post []stringArgs Clients - Extra post arguments passed from the client to the introspection endpoint.
- Introspection
Post []stringArgs Names - Extra post argument names passed to the introspection endpoint.
- Introspection
Post []stringArgs Values - Extra post argument values passed to the introspection endpoint.
- Introspection
Token stringParam Name - Designate token's parameter name for introspection. Default: "token"
- Issuer string
- The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure
config.using_pseudo_issuer=true. Not Null - Issuers
Alloweds []string - The issuers allowed to be present in the tokens (
issclaim). - Jwks
Endpoint string - Overrides the
jwks_urireturned by discovery. Use when the IdP exposes a non-standard JWKS endpoint. - Jwt
Session stringClaim - The claim to match against the JWT session cookie. Default: "sid"
- string
- The name of the JWT session cookie.
- Keepalive bool
- Use keepalive with the HTTP client. Default: true
- Leeway float64
- Defines leeway time (in seconds) for
auth_time,exp,iat, andnbfclaims. Default: 0 - Login
Action string - What to do after successful login: -
upstream: proxy request to upstream service -response: terminate request with a response -redirect: redirect to a different location. possible known values include one of ["redirect", "response", "upstream"]; Default: "upstream" - Login
Methods []string - Enable login functionality with specified grants. Default: ["authorization_code"]
- Login
Redirect stringMode - Where to place
login_tokenswhen usingredirectlogin_action: -query: place tokens in query string -fragment: place tokens in url fragment (not readable by servers). possible known values include one of ["fragment", "query"]; Default: "fragment" - Login
Redirect []stringUris - Where to redirect the client when
login_actionis set toredirect. - Login
Tokens []string - What tokens to include in
responsebody orredirectquery string or fragment: -id_token: include id token -access_token: include access token -refresh_token: include refresh token -tokens: include the full token endpoint response -introspection: include introspection response. Default: ["id_token"] - Logout
Methods []string - The request methods that can activate the logout: -
POST: HTTP POST method -GET: HTTP GET method -DELETE: HTTP DELETE method. Default: ["DELETE","POST"] - Logout
Post stringArg - The request body argument that activates the logout.
- Logout
Query stringArg - The request query argument that activates the logout.
- Logout
Redirect []stringUris - Where to redirect the client after the logout.
- Logout
Revoke bool - Revoke tokens as part of the logout.
- Logout
Revoke boolAccess Token - Revoke the access token as part of the logout. Requires
logout_revoketo be set totrue. Default: true - Logout
Revoke boolRefresh Token - Revoke the refresh token as part of the logout. Requires
logout_revoketo be set totrue. Default: true - Logout
Uri stringSuffix - The request URI suffix that activates the logout.
- Max
Age float64 - The maximum age (in seconds) compared to the
auth_timeclaim. - Mtls
Introspection stringEndpoint - Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - Mtls
Revocation stringEndpoint - Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - Mtls
Token stringEndpoint - Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - No
Proxy string - Do not use proxy with these hosts.
- Password
Param []stringTypes - Where to look for the username and password: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - Preserve
Query boolArgs - With this parameter, you can preserve request query arguments even when doing authorization code flow. Default: false
- Principals
Ai
Gateway Auth Strategy Openid Connect Config Principals - Configuration for Kong Identity principal hydration after token verification.
- Proof
Of boolPossession Auth Methods Validation - If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP. Default: true
- Proof
Of stringPossession Dpop - Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof. possible known values include one of ["off", "optional", "strict"]; Default: "off"
- Proof
Of stringPossession Mtls - Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401. possible known values include one of ["off", "optional", "strict"]; Default: "off"
- string
- The pushed authorization endpoint. If set it overrides the value in
pushed_authorization_request_endpointreturned by the discovery endpoint. - string
- The pushed authorization request endpoint authentication method:
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - Redirect
Uris []string - The redirect URI passed to the authorization and token endpoints.
- Redis
Ai
Gateway Auth Strategy Openid Connect Config Redis - Rediscovery
Lifetime float64 - Specifies how long (in seconds) the plugin waits between discovery attempts. Discovery is still triggered on an as-needed basis. Default: 30
- Refresh
Token stringParam Name - The name of the parameter used to pass the refresh token.
- Refresh
Token []stringParam Types - Where to look for the refresh token: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - Refresh
Tokens bool - Specifies whether the plugin should try to refresh (soon to be) expired access tokens if the plugin has a
refresh_tokenavailable. Default: true - Require
Proof boolKey For Code Exchange - Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of
code_challenge_methods_supported, and enabled automatically (in case thecode_challenge_methods_supportedis missing, the PKCE will not be enabled). - bool
- Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of
require_pushed_authorization_requests(which defaults tofalse). - Require
Signed boolRequest Object - Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of
require_signed_request_object, and enabled automatically (in case therequire_signed_request_objectis missing, the feature will not be enabled). - Resolve
Distributed boolClaims - Distributed claims are represented by the
_claim_namesand_claim_sourcesmembers of the JSON object containing the claims. If this parameter is set totrue, the plugin explicitly resolves these distributed claims. Default: false - Response
Mode string - Response mode passed to the authorization endpoint: -
query: for parameters in query string -form_post: for parameters in request body -fragment: for parameters in uri fragment (rarely useful as the plugin itself cannot read it) -query.jwt,form_post.jwt,fragment.jwt: similar toquery,form_postandfragmentbut the parameters are encoded in a JWT -jwt: shortcut that indicates the default encoding for the requested response type. possible known values include one of ["form_post", "form_post.jwt", "fragment", "fragment.jwt", "jwt", "query", "query.jwt"]; Default: "query" - Response
Types []string - The response type passed to the authorization endpoint. Default: ["code"]
- Reverify bool
- Specifies whether to always verify tokens stored in the session. Default: false
- Revocation
Endpoint string - The revocation endpoint. If set it overrides the value in
revocation_endpointreturned by the discovery endpoint. - Revocation
Endpoint stringAuth Method - The revocation endpoint authentication method: :
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - Revocation
Token stringParam Name - Designate token's parameter name for revocation. Default: "token"
- Roles
Claims []string - The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["roles"]
- Roles
Requireds []string - The roles (
roles_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - Run
On boolPreflight - Specifies whether to run this plugin on pre-flight (
OPTIONS) requests. Default: true - Scopes []string
- The scopes passed to the authorization and token endpoints. Default: ["openid"]
- Scopes
Claims []string - The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["scope"]
- Scopes
Requireds []string - The scopes (
scopes_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - Search
User boolInfo - Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers. Default: false
- Session
Absolute float64Timeout - Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks. Default: 86400
- Session
Audience string - The session audience, which is the intended target application. For example
"my-application". Default: "default" - Session
Binds []string - Bind the session to data acquired from the HTTP request or connection.
- string
- The session cookie Domain flag.
- bool
- Forbids JavaScript from accessing the cookie, for example, through the
Document.cookieproperty. Default: true - string
- The session cookie name. Default: "session"
- string
- The session cookie Path flag. Default: "/"
- string
- Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks. possible known values include one of ["Default", "Lax", "None", "Strict"]; Default: "Lax"
- bool
- Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
- Session
Enforce boolSame Subject - When set to
true, audiences are forced to share the same subject. Default: false - Session
Hash boolStorage Key - When set to
true, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie. Default: false - Session
Hash boolSubject - When set to
true, the value of subject is hashed before being stored. Only applies whensession_store_metadatais enabled. Default: false - Session
Idling float64Timeout - Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching. Default: 900
- Session
Memcached stringHost - The memcached host. Default: "127.0.0.1"
- Session
Memcached float64Port - The memcached port. Default: 11211
- Session
Memcached stringPrefix - The memcached session key prefix.
- Session
Memcached stringSocket - The memcached unix socket path.
- Session
Memcached boolSsl - If set to true, uses SSL to connect to memcached
- Session
Memcached boolSsl Verify - If set to true, verifies the validity of the memcached server SSL certificate. Default: true
- Session
Remember bool - Enables or disables persistent sessions. Default: false
- Session
Remember float64Absolute Timeout - Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks. Default: 2592000
- string
- Persistent session cookie name. Use with the
rememberconfiguration parameter. Default: "remember" - Session
Remember float64Rolling Timeout - Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling. Default: 604800
- Session
Request []stringHeaders - Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g.
[ "id", "timeout" ]will set Session-Id and Session-Timeout request headers. - Session
Response []stringHeaders - Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g.
[ "id", "timeout" ]will set Session-Id and Session-Timeout response headers. - Session
Rolling float64Timeout - Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling. Default: 3600
- Session
Secret string - The session secret.
- Session
Storage string - The session storage for session data: -
cookie: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) -memcache: stores session data in memcached -redis: stores session data in Redis. possible known values include one of ["cookie", "memcache", "memcached", "redis"]; Default: "cookie" - Session
Store boolMetadata - Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject. Default: false
- Ssl
Verify bool - Verify identity provider server certificate. If set to
true, the plugin uses the CA certificate set in thekong.confconfig parameterlua_ssl_trusted_certificate. Default: true - Timeout float64
- Network IO timeout in milliseconds. Default: 10000
- Tls
Client stringAuth Cert Id - ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server.
- Tls
Client boolAuth Ssl Verify - Verify identity provider server certificate during mTLS client authentication. Default: true
- Token
Cache boolKey Include Scope - Include the scope in the token cache key, so token with different scopes are considered diffrent tokens. Default: false
- Token
Endpoint string - The token endpoint. If set it overrides the value in
token_endpointreturned by the discovery endpoint. - Token
Endpoint stringAuth Method - The token endpoint authentication method:
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - Token
Exchange AiGateway Auth Strategy Openid Connect Config Token Exchange - Details on how to accept tokens from other identity providers.
- Token
Exchange stringEndpoint - Endpoint used to perform the legacy token exchange.
- Token
Headers []stringClients - Extra headers passed from the client to the token endpoint.
- Token
Headers []stringGrants - Enable the sending of the token endpoint response headers only with certain grants: -
password: with OAuth password grant -client_credentials: with OAuth client credentials grant -authorization_code: with authorization code flow -refresh_tokenwith refresh token grant. - Token
Headers []stringNames - Extra header names passed to the token endpoint.
- Token
Headers stringPrefix - Add a prefix to the token endpoint response headers before forwarding them to the downstream client.
- Token
Headers []stringReplays - The names of token endpoint response headers to forward to the downstream client.
- Token
Headers []stringValues - Extra header values passed to the token endpoint.
- Token
Post []stringArgs Clients - Pass extra arguments from the client to the OpenID-Connect plugin. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header This parameter can be used with
scopevalues, like this:config.token_post_args_client=scopeIn this case, the token would take thescopevalue from the query parameter or from the request body or from the header and send it to the token endpoint. - Token
Post []stringArgs Names - Extra post argument names passed to the token endpoint.
- Token
Post []stringArgs Values - Extra post argument values passed to the token endpoint.
- bool
- Destroy any active session for the unauthorized requests. Default: true
- string
- The error message for the unauthorized requests (when not using the redirection). Default: "Unauthorized"
- []string
- Where to redirect the client on unauthorized requests.
- Unexpected
Redirect []stringUris - Where to redirect the client when unexpected errors happen with the requests.
- Upstream
Access stringToken Header - The upstream access token header. Default: "authorization:bearer"
- Upstream
Access stringToken Jwk Header - The upstream access token JWK header.
- Upstream
Headers []AiGateway Auth Strategy Openid Connect Config Upstream Header - The upstream claim to header mappings.
- Upstream
Headers []stringClaims - The upstream header claims. Only top level claims are supported.
- Upstream
Headers []stringNames - The upstream header names for the claim values.
- Upstream
Id stringToken Header - The upstream id token header.
- Upstream
Id stringToken Jwk Header - The upstream id token JWK header.
- Upstream
Introspection stringHeader - The upstream introspection header.
- Upstream
Introspection stringJwt Header - The upstream introspection JWT header.
- Upstream
Refresh stringToken Header - The upstream refresh token header.
- Upstream
Session stringId Header - The upstream session id header.
- Upstream
User stringInfo Header - The upstream user info header.
- Upstream
User stringInfo Jwt Header - The upstream user info JWT header (in case the user info returns a JWT response).
- Userinfo
Accept string - The value of
Acceptheader for user info requests: -application/json: user info response as JSON -application/jwt: user info response as JWT (from the obsolete IETF draft document). possible known values include one of ["application/json", "application/jwt"]; Default: "application/json" - Userinfo
Endpoint string - The user info endpoint. If set it overrides the value in
userinfo_endpointreturned by the discovery endpoint. - Userinfo
Headers []stringClients - Extra headers passed from the client to the user info endpoint.
- Userinfo
Headers []stringNames - Extra header names passed to the user info endpoint.
- Userinfo
Headers []stringValues - Extra header values passed to the user info endpoint.
- Userinfo
Query []stringArgs Clients - Extra query arguments passed from the client to the user info endpoint.
- Userinfo
Query []stringArgs Names - Extra query argument names passed to the user info endpoint.
- Userinfo
Query []stringArgs Values - Extra query argument values passed to the user info endpoint.
- Using
Pseudo boolIssuer - If the plugin uses a pseudo issuer. When set to true, the plugin will not discover the configuration from the issuer URL specified with
config.issuer. Default: false - Verify
Claims bool - Verify tokens for standard claims. Default: true
- Verify
Nonce bool - Verify nonce on authorization code flow. Default: true
- Verify
Parameters bool - Verify plugin configuration against discovery. Default: false
- Verify
Signature bool - Verify signature of tokens. Default: true
- anonymous string
- An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a
4xxHTTP status code. This value must refer to the consumeridorusernameattribute, and not itscustom_id. - audience_
claims list(string) - The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["aud"]
- audience_
requireds list(string) - The audiences (
audience_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - audiences list(string)
- The audience passed to the authorization endpoint.
- auth_
methods list(string) - Types of credentials/grants to enable. Default: ["authorizationcode","bearer","clientcredentials","introspection","kongoauth2","password","refreshtoken","session","userinfo"]
- authenticated_
groups_ list(string)claims - The claim that contains authenticated groups. This setting can be used together with ACL plugin, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload.
- string
- The authorization cookie Domain flag.
- bool
- Forbids JavaScript from accessing the cookie, for example, through the
Document.cookieproperty. Default: true - string
- The authorization cookie name. Default: "authorization"
- string
- The authorization cookie Path flag. Default: "/"
- string
- Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks. possible known values include one of ["Default", "Lax", "None", "Strict"]; Default: "Default"
- bool
- Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
- string
- The authorization endpoint. If set it overrides the value in
authorization_endpointreturned by the discovery endpoint. - list(string)
- Extra query arguments passed from the client to the authorization endpoint.
- list(string)
- Extra query argument names passed to the authorization endpoint.
- list(string)
- Extra query argument values passed to the authorization endpoint.
- number
- Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling. Default: 600
- string
- The name of the cookie in which the bearer token is passed.
- bearer_
token_ list(string)param_ types - Where to look for the bearer token: -
header: search theAuthorization,access-token, andx-access-tokenHTTP headers -query: search the URL's query string -body: search the HTTP request body -cookie: search the HTTP request cookies specified withconfig.bearer_token_cookie_name. Default: ["body","header","query"] - by_
username_ boolignore_ case - If
consumer_byis set tousername, specify whetherusernamecan match consumers case-insensitively. Default: false - cache_
introspection bool - Cache the introspection endpoint requests. Default: true
- cache_
token_ boolexchange - Cache the legacy token exchange endpoint requests. Default: true
- cache_
tokens bool - Cache the token endpoint requests. Default: true
- cache_
tokens_ stringsalt - Salt used for generating the cache key that is used for caching the token endpoint requests.
- cache_
ttl number - The default cache ttl in seconds that is used in case the cached object does not specify the expiry. Default: 3600
- cache_
ttl_ numbermax - The maximum cache ttl in seconds (enforced).
- cache_
ttl_ numbermin - The minimum cache ttl in seconds (enforced).
- cache_
ttl_ numberneg - The negative cache ttl in seconds.
- cache_
ttl_ numberresurrect - The resurrection ttl in seconds.
- cache_
user_ boolinfo - Cache the user info requests. Default: true
- claims_
forbiddens list(string) - If given, these claims are forbidden in the token payload.
- client_
algs list(string) - The algorithm to use for clientsecretjwt (only HS***) or private*key*jwt authentication.
- client_
arg string - The client to use for this request (the selection is made with a request parameter with the same name). Default: "client_id"
- client_
auths list(string) - The default OpenID Connect client authentication method is 'clientsecretbasic' (using 'Authorization: Basic' header), 'clientsecretpost' (credentials in body), 'clientsecretjwt' (signed client assertion in body), 'privatekeyjwt' (private key-signed assertion), 'tlsclientauth' (client certificate), 'selfsignedtlsclientauth' (self-signed client certificate), and 'none' (no authentication).
- client_
credentials_ list(string)param_ types - Where to look for the client credentials: -
header: search the HTTP headers -query: search the URL's query string -body: search from the HTTP request body. Default: ["body","header","query"] - client_
ids list(string) - The client id(s) that the plugin uses when it calls authenticated endpoints on the identity provider.
- client_
jwks list(object) - The JWK used for the privatekeyjwt authentication.
- client_
secrets list(string) - The client secret.
- cluster_
cache_ objectredis - cluster_
cache_ stringstrategy - The strategy to use for the cluster cache. If set, the plugin will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared. possible known values include one of ["off", "redis"]; Default: "off"
- consumer_
bies list(string) - Consumer fields used for mapping: -
id: try to find the matching Consumer byid-username: try to find the matching Consumer byusername-custom_id: try to find the matching Consumer bycustom_id. Default: ["custom_id","username"] - consumer_
claims list(list(string)) - The claims used for consumer mapping. Each entry represents a claim path inside the token payload. The paths are evaluated in order, and the first matching claim is used.
- consumer_
groups_ list(string)claims - The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload.
- consumer_
groups_ booloptional - Do not terminate the request if consumer groups mapping fails. Default: false
- consumer_
optional bool - Do not terminate the request if consumer mapping fails. Default: false
- credential_
claims list(string) - The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting plugin), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["sub"]
- disable_
sessions list(string) - Disable issuing the session cookie with the specified grants.
- discovery_
headers_ list(string)names - Extra header names passed to the discovery endpoint.
- discovery_
headers_ list(string)values - Extra header values passed to the discovery endpoint.
- display_
errors bool - Display errors on failure responses. Default: false
- domains list(string)
- The allowed values for the
hdclaim. - downstream_
access_ stringtoken_ header - The downstream access token header.
- downstream_
access_ stringtoken_ jwk_ header - The downstream access token JWK header.
- downstream_
headers list(object) - The downstream claim to header mappings.
- downstream_
headers_ list(string)claims - The downstream header claims. Only top level claims are supported.
- downstream_
headers_ list(string)names - The downstream header names for the claim values.
- downstream_
id_ stringtoken_ header - The downstream id token header.
- downstream_
id_ stringtoken_ jwk_ header - The downstream id token JWK header.
- downstream_
introspection_ stringheader - The downstream introspection header.
- downstream_
introspection_ stringjwt_ header - The downstream introspection JWT header.
- downstream_
refresh_ stringtoken_ header - The downstream refresh token header.
- downstream_
session_ stringid_ header - The downstream session id header.
- downstream_
user_ stringinfo_ header - The downstream user info header.
- downstream_
user_ stringinfo_ jwt_ header - The downstream user info JWT header (in case the user info returns a JWT response).
- dpop_
proof_ numberlifetime - Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise. Default: 300
- dpop_
use_ boolnonce - Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime. Default: false
- enable_
hs_ boolsignatures - Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted). Default: false
- end_
session_ stringendpoint - The end session endpoint. If set it overrides the value in
end_session_endpointreturned by the discovery endpoint. - expose_
error_ boolcode - Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to
falseto disable. Default: true - extra_
jwks_ list(string)uris - JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery).
- forbidden_
destroy_ boolsession - Destroy any active session for the forbidden requests. Default: true
- forbidden_
error_ stringmessage - The error message for the forbidden requests (when not using the redirection). Default: "Forbidden"
- forbidden_
redirect_ list(string)uris - Where to redirect the client on forbidden requests.
- groups_
claims list(string) - The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["groups"]
- groups_
requireds list(string) - The groups (
groups_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - hide_
credentials bool - Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the plugin will remove those that were used for successful authentication. Default: true
- http_
proxy string - The HTTP proxy.
- string
- The HTTP proxy authorization.
- http_
version number - The HTTP version used for the requests by this plugin: -
1.1: HTTP 1.1 (the default) -1.0: HTTP 1.0. - https_
proxy string - The HTTPS proxy.
- string
- The HTTPS proxy authorization.
- id_
token_ stringparam_ name - The name of the parameter used to pass the id token.
- id_
token_ list(string)param_ types - Where to look for the id token: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - ignore_
signatures list(string) - Skip the token signature verification on certain grants. This is insecure and logs a warning; use it only for providers that publish no verification key. Grants: -
password: OAuth password grant -client_credentials: OAuth client credentials grant -authorization_code: authorization code flow -refresh_token: OAuth refresh token grant -session: session cookie authentication -introspection: OAuth introspection -userinfo: OpenID Connect user info endpoint authentication. Default: [] - introspect_
jwt_ booltokens - Specifies whether to introspect the JWT access tokens (can be used to check for revocations). Default: false
- introspection_
accept string - The value of
Acceptheader for introspection requests: -application/json: introspection response as JSON -application/token-introspection+jwt: introspection response as JWT (from the current IETF draft document) -application/jwt: introspection response as JWT (from the obsolete IETF draft document). possible known values include one of ["application/json", "application/jwt", "application/token-introspection+jwt"]; Default: "application/json" - introspection_
check_ boolactive - Check that the introspection response has an
activeclaim with a value oftrue. Default: true - introspection_
endpoint string - The introspection endpoint. If set it overrides the value in
introspection_endpointreturned by the discovery endpoint. - introspection_
endpoint_ stringauth_ method - The introspection endpoint authentication method: :
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["clientsecretbasic", "clientsecretjwt", "clientsecretpost", "none", "privatekeyjwt", "selfsignedtlsclientauth", "tlsclientauth"] - introspection_
headers_ list(string)clients - Extra headers passed from the client to the introspection endpoint.
- introspection_
headers_ list(string)names - Extra header names passed to the introspection endpoint.
- introspection_
headers_ list(string)values - Extra header values passed to the introspection endpoint.
- introspection_
hint string - Introspection hint parameter value passed to the introspection endpoint. Default: "access_token"
- introspection_
post_ list(string)args_ client_ headers - Extra post arguments passed from the client headers to the introspection endpoint.
- introspection_
post_ list(string)args_ clients - Extra post arguments passed from the client to the introspection endpoint.
- introspection_
post_ list(string)args_ names - Extra post argument names passed to the introspection endpoint.
- introspection_
post_ list(string)args_ values - Extra post argument values passed to the introspection endpoint.
- introspection_
token_ stringparam_ name - Designate token's parameter name for introspection. Default: "token"
- issuer string
- The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure
config.using_pseudo_issuer=true. Not Null - issuers_
alloweds list(string) - The issuers allowed to be present in the tokens (
issclaim). - jwks_
endpoint string - Overrides the
jwks_urireturned by discovery. Use when the IdP exposes a non-standard JWKS endpoint. - jwt_
session_ stringclaim - The claim to match against the JWT session cookie. Default: "sid"
- string
- The name of the JWT session cookie.
- keepalive bool
- Use keepalive with the HTTP client. Default: true
- leeway number
- Defines leeway time (in seconds) for
auth_time,exp,iat, andnbfclaims. Default: 0 - login_
action string - What to do after successful login: -
upstream: proxy request to upstream service -response: terminate request with a response -redirect: redirect to a different location. possible known values include one of ["redirect", "response", "upstream"]; Default: "upstream" - login_
methods list(string) - Enable login functionality with specified grants. Default: ["authorization_code"]
- login_
redirect_ stringmode - Where to place
login_tokenswhen usingredirectlogin_action: -query: place tokens in query string -fragment: place tokens in url fragment (not readable by servers). possible known values include one of ["fragment", "query"]; Default: "fragment" - login_
redirect_ list(string)uris - Where to redirect the client when
login_actionis set toredirect. - login_
tokens list(string) - What tokens to include in
responsebody orredirectquery string or fragment: -id_token: include id token -access_token: include access token -refresh_token: include refresh token -tokens: include the full token endpoint response -introspection: include introspection response. Default: ["id_token"] - logout_
methods list(string) - The request methods that can activate the logout: -
POST: HTTP POST method -GET: HTTP GET method -DELETE: HTTP DELETE method. Default: ["DELETE","POST"] - logout_
post_ stringarg - The request body argument that activates the logout.
- logout_
query_ stringarg - The request query argument that activates the logout.
- logout_
redirect_ list(string)uris - Where to redirect the client after the logout.
- logout_
revoke bool - Revoke tokens as part of the logout.
- logout_
revoke_ boolaccess_ token - Revoke the access token as part of the logout. Requires
logout_revoketo be set totrue. Default: true - logout_
revoke_ boolrefresh_ token - Revoke the refresh token as part of the logout. Requires
logout_revoketo be set totrue. Default: true - logout_
uri_ stringsuffix - The request URI suffix that activates the logout.
- max_
age number - The maximum age (in seconds) compared to the
auth_timeclaim. - mtls_
introspection_ stringendpoint - Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - mtls_
revocation_ stringendpoint - Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - mtls_
token_ stringendpoint - Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - no_
proxy string - Do not use proxy with these hosts.
- password_
param_ list(string)types - Where to look for the username and password: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - preserve_
query_ boolargs - With this parameter, you can preserve request query arguments even when doing authorization code flow. Default: false
- principals object
- Configuration for Kong Identity principal hydration after token verification.
- proof_
of_ boolpossession_ auth_ methods_ validation - If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP. Default: true
- proof_
of_ stringpossession_ dpop - Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof. possible known values include one of ["off", "optional", "strict"]; Default: "off"
- proof_
of_ stringpossession_ mtls - Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401. possible known values include one of ["off", "optional", "strict"]; Default: "off"
- string
- The pushed authorization endpoint. If set it overrides the value in
pushed_authorization_request_endpointreturned by the discovery endpoint. - string
- The pushed authorization request endpoint authentication method:
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - redirect_
uris list(string) - The redirect URI passed to the authorization and token endpoints.
- redis object
- rediscovery_
lifetime number - Specifies how long (in seconds) the plugin waits between discovery attempts. Discovery is still triggered on an as-needed basis. Default: 30
- refresh_
token_ stringparam_ name - The name of the parameter used to pass the refresh token.
- refresh_
token_ list(string)param_ types - Where to look for the refresh token: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - refresh_
tokens bool - Specifies whether the plugin should try to refresh (soon to be) expired access tokens if the plugin has a
refresh_tokenavailable. Default: true - require_
proof_ boolkey_ for_ code_ exchange - Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of
code_challenge_methods_supported, and enabled automatically (in case thecode_challenge_methods_supportedis missing, the PKCE will not be enabled). - bool
- Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of
require_pushed_authorization_requests(which defaults tofalse). - require_
signed_ boolrequest_ object - Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of
require_signed_request_object, and enabled automatically (in case therequire_signed_request_objectis missing, the feature will not be enabled). - resolve_
distributed_ boolclaims - Distributed claims are represented by the
_claim_namesand_claim_sourcesmembers of the JSON object containing the claims. If this parameter is set totrue, the plugin explicitly resolves these distributed claims. Default: false - response_
mode string - Response mode passed to the authorization endpoint: -
query: for parameters in query string -form_post: for parameters in request body -fragment: for parameters in uri fragment (rarely useful as the plugin itself cannot read it) -query.jwt,form_post.jwt,fragment.jwt: similar toquery,form_postandfragmentbut the parameters are encoded in a JWT -jwt: shortcut that indicates the default encoding for the requested response type. possible known values include one of ["form_post", "form_post.jwt", "fragment", "fragment.jwt", "jwt", "query", "query.jwt"]; Default: "query" - response_
types list(string) - The response type passed to the authorization endpoint. Default: ["code"]
- reverify bool
- Specifies whether to always verify tokens stored in the session. Default: false
- revocation_
endpoint string - The revocation endpoint. If set it overrides the value in
revocation_endpointreturned by the discovery endpoint. - revocation_
endpoint_ stringauth_ method - The revocation endpoint authentication method: :
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - revocation_
token_ stringparam_ name - Designate token's parameter name for revocation. Default: "token"
- roles_
claims list(string) - The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["roles"]
- roles_
requireds list(string) - The roles (
roles_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - run_
on_ boolpreflight - Specifies whether to run this plugin on pre-flight (
OPTIONS) requests. Default: true - scopes list(string)
- The scopes passed to the authorization and token endpoints. Default: ["openid"]
- scopes_
claims list(string) - The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["scope"]
- scopes_
requireds list(string) - The scopes (
scopes_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - search_
user_ boolinfo - Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers. Default: false
- session_
absolute_ numbertimeout - Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks. Default: 86400
- session_
audience string - The session audience, which is the intended target application. For example
"my-application". Default: "default" - session_
binds list(string) - Bind the session to data acquired from the HTTP request or connection.
- string
- The session cookie Domain flag.
- bool
- Forbids JavaScript from accessing the cookie, for example, through the
Document.cookieproperty. Default: true - string
- The session cookie name. Default: "session"
- string
- The session cookie Path flag. Default: "/"
- string
- Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks. possible known values include one of ["Default", "Lax", "None", "Strict"]; Default: "Lax"
- bool
- Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
- session_
enforce_ boolsame_ subject - When set to
true, audiences are forced to share the same subject. Default: false - session_
hash_ boolstorage_ key - When set to
true, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie. Default: false - session_
hash_ boolsubject - When set to
true, the value of subject is hashed before being stored. Only applies whensession_store_metadatais enabled. Default: false - session_
idling_ numbertimeout - Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching. Default: 900
- session_
memcached_ stringhost - The memcached host. Default: "127.0.0.1"
- session_
memcached_ numberport - The memcached port. Default: 11211
- session_
memcached_ stringprefix - The memcached session key prefix.
- session_
memcached_ stringsocket - The memcached unix socket path.
- session_
memcached_ boolssl - If set to true, uses SSL to connect to memcached
- session_
memcached_ boolssl_ verify - If set to true, verifies the validity of the memcached server SSL certificate. Default: true
- session_
remember bool - Enables or disables persistent sessions. Default: false
- session_
remember_ numberabsolute_ timeout - Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks. Default: 2592000
- string
- Persistent session cookie name. Use with the
rememberconfiguration parameter. Default: "remember" - session_
remember_ numberrolling_ timeout - Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling. Default: 604800
- session_
request_ list(string)headers - Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g.
[ "id", "timeout" ]will set Session-Id and Session-Timeout request headers. - session_
response_ list(string)headers - Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g.
[ "id", "timeout" ]will set Session-Id and Session-Timeout response headers. - session_
rolling_ numbertimeout - Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling. Default: 3600
- session_
secret string - The session secret.
- session_
storage string - The session storage for session data: -
cookie: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) -memcache: stores session data in memcached -redis: stores session data in Redis. possible known values include one of ["cookie", "memcache", "memcached", "redis"]; Default: "cookie" - session_
store_ boolmetadata - Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject. Default: false
- ssl_
verify bool - Verify identity provider server certificate. If set to
true, the plugin uses the CA certificate set in thekong.confconfig parameterlua_ssl_trusted_certificate. Default: true - timeout number
- Network IO timeout in milliseconds. Default: 10000
- tls_
client_ stringauth_ cert_ id - ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server.
- tls_
client_ boolauth_ ssl_ verify - Verify identity provider server certificate during mTLS client authentication. Default: true
- token_
cache_ boolkey_ include_ scope - Include the scope in the token cache key, so token with different scopes are considered diffrent tokens. Default: false
- token_
endpoint string - The token endpoint. If set it overrides the value in
token_endpointreturned by the discovery endpoint. - token_
endpoint_ stringauth_ method - The token endpoint authentication method:
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - token_
exchange object - Details on how to accept tokens from other identity providers.
- token_
exchange_ stringendpoint - Endpoint used to perform the legacy token exchange.
- token_
headers_ list(string)clients - Extra headers passed from the client to the token endpoint.
- token_
headers_ list(string)grants - Enable the sending of the token endpoint response headers only with certain grants: -
password: with OAuth password grant -client_credentials: with OAuth client credentials grant -authorization_code: with authorization code flow -refresh_tokenwith refresh token grant. - token_
headers_ list(string)names - Extra header names passed to the token endpoint.
- token_
headers_ stringprefix - Add a prefix to the token endpoint response headers before forwarding them to the downstream client.
- token_
headers_ list(string)replays - The names of token endpoint response headers to forward to the downstream client.
- token_
headers_ list(string)values - Extra header values passed to the token endpoint.
- token_
post_ list(string)args_ clients - Pass extra arguments from the client to the OpenID-Connect plugin. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header This parameter can be used with
scopevalues, like this:config.token_post_args_client=scopeIn this case, the token would take thescopevalue from the query parameter or from the request body or from the header and send it to the token endpoint. - token_
post_ list(string)args_ names - Extra post argument names passed to the token endpoint.
- token_
post_ list(string)args_ values - Extra post argument values passed to the token endpoint.
- bool
- Destroy any active session for the unauthorized requests. Default: true
- string
- The error message for the unauthorized requests (when not using the redirection). Default: "Unauthorized"
- list(string)
- Where to redirect the client on unauthorized requests.
- unexpected_
redirect_ list(string)uris - Where to redirect the client when unexpected errors happen with the requests.
- upstream_
access_ stringtoken_ header - The upstream access token header. Default: "authorization:bearer"
- upstream_
access_ stringtoken_ jwk_ header - The upstream access token JWK header.
- upstream_
headers list(object) - The upstream claim to header mappings.
- upstream_
headers_ list(string)claims - The upstream header claims. Only top level claims are supported.
- upstream_
headers_ list(string)names - The upstream header names for the claim values.
- upstream_
id_ stringtoken_ header - The upstream id token header.
- upstream_
id_ stringtoken_ jwk_ header - The upstream id token JWK header.
- upstream_
introspection_ stringheader - The upstream introspection header.
- upstream_
introspection_ stringjwt_ header - The upstream introspection JWT header.
- upstream_
refresh_ stringtoken_ header - The upstream refresh token header.
- upstream_
session_ stringid_ header - The upstream session id header.
- upstream_
user_ stringinfo_ header - The upstream user info header.
- upstream_
user_ stringinfo_ jwt_ header - The upstream user info JWT header (in case the user info returns a JWT response).
- userinfo_
accept string - The value of
Acceptheader for user info requests: -application/json: user info response as JSON -application/jwt: user info response as JWT (from the obsolete IETF draft document). possible known values include one of ["application/json", "application/jwt"]; Default: "application/json" - userinfo_
endpoint string - The user info endpoint. If set it overrides the value in
userinfo_endpointreturned by the discovery endpoint. - userinfo_
headers_ list(string)clients - Extra headers passed from the client to the user info endpoint.
- userinfo_
headers_ list(string)names - Extra header names passed to the user info endpoint.
- userinfo_
headers_ list(string)values - Extra header values passed to the user info endpoint.
- userinfo_
query_ list(string)args_ clients - Extra query arguments passed from the client to the user info endpoint.
- userinfo_
query_ list(string)args_ names - Extra query argument names passed to the user info endpoint.
- userinfo_
query_ list(string)args_ values - Extra query argument values passed to the user info endpoint.
- using_
pseudo_ boolissuer - If the plugin uses a pseudo issuer. When set to true, the plugin will not discover the configuration from the issuer URL specified with
config.issuer. Default: false - verify_
claims bool - Verify tokens for standard claims. Default: true
- verify_
nonce bool - Verify nonce on authorization code flow. Default: true
- verify_
parameters bool - Verify plugin configuration against discovery. Default: false
- verify_
signature bool - Verify signature of tokens. Default: true
- anonymous String
- An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a
4xxHTTP status code. This value must refer to the consumeridorusernameattribute, and not itscustom_id. - audience
Claims List<String> - The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["aud"]
- audience
Requireds List<String> - The audiences (
audience_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - audiences List<String>
- The audience passed to the authorization endpoint.
- auth
Methods List<String> - Types of credentials/grants to enable. Default: ["authorizationcode","bearer","clientcredentials","introspection","kongoauth2","password","refreshtoken","session","userinfo"]
- authenticated
Groups List<String>Claims - The claim that contains authenticated groups. This setting can be used together with ACL plugin, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload.
- String
- The authorization cookie Domain flag.
- Boolean
- Forbids JavaScript from accessing the cookie, for example, through the
Document.cookieproperty. Default: true - String
- The authorization cookie name. Default: "authorization"
- String
- The authorization cookie Path flag. Default: "/"
- String
- Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks. possible known values include one of ["Default", "Lax", "None", "Strict"]; Default: "Default"
- Boolean
- Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
- String
- The authorization endpoint. If set it overrides the value in
authorization_endpointreturned by the discovery endpoint. - List<String>
- Extra query arguments passed from the client to the authorization endpoint.
- List<String>
- Extra query argument names passed to the authorization endpoint.
- List<String>
- Extra query argument values passed to the authorization endpoint.
- Double
- Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling. Default: 600
- String
- The name of the cookie in which the bearer token is passed.
- bearer
Token List<String>Param Types - Where to look for the bearer token: -
header: search theAuthorization,access-token, andx-access-tokenHTTP headers -query: search the URL's query string -body: search the HTTP request body -cookie: search the HTTP request cookies specified withconfig.bearer_token_cookie_name. Default: ["body","header","query"] - by
Username BooleanIgnore Case - If
consumer_byis set tousername, specify whetherusernamecan match consumers case-insensitively. Default: false - cache
Introspection Boolean - Cache the introspection endpoint requests. Default: true
- cache
Token BooleanExchange - Cache the legacy token exchange endpoint requests. Default: true
- cache
Tokens Boolean - Cache the token endpoint requests. Default: true
- cache
Tokens StringSalt - Salt used for generating the cache key that is used for caching the token endpoint requests.
- cache
Ttl Double - The default cache ttl in seconds that is used in case the cached object does not specify the expiry. Default: 3600
- cache
Ttl DoubleMax - The maximum cache ttl in seconds (enforced).
- cache
Ttl DoubleMin - The minimum cache ttl in seconds (enforced).
- cache
Ttl DoubleNeg - The negative cache ttl in seconds.
- cache
Ttl DoubleResurrect - The resurrection ttl in seconds.
- cache
User BooleanInfo - Cache the user info requests. Default: true
- claims
Forbiddens List<String> - If given, these claims are forbidden in the token payload.
- client
Algs List<String> - The algorithm to use for clientsecretjwt (only HS***) or private*key*jwt authentication.
- client
Arg String - The client to use for this request (the selection is made with a request parameter with the same name). Default: "client_id"
- client
Auths List<String> - The default OpenID Connect client authentication method is 'clientsecretbasic' (using 'Authorization: Basic' header), 'clientsecretpost' (credentials in body), 'clientsecretjwt' (signed client assertion in body), 'privatekeyjwt' (private key-signed assertion), 'tlsclientauth' (client certificate), 'selfsignedtlsclientauth' (self-signed client certificate), and 'none' (no authentication).
- client
Credentials List<String>Param Types - Where to look for the client credentials: -
header: search the HTTP headers -query: search the URL's query string -body: search from the HTTP request body. Default: ["body","header","query"] - client
Ids List<String> - The client id(s) that the plugin uses when it calls authenticated endpoints on the identity provider.
- client
Jwks List<AiGateway Auth Strategy Openid Connect Config Client Jwk> - The JWK used for the privatekeyjwt authentication.
- client
Secrets List<String> - The client secret.
- cluster
Cache AiRedis Gateway Auth Strategy Openid Connect Config Cluster Cache Redis - cluster
Cache StringStrategy - The strategy to use for the cluster cache. If set, the plugin will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared. possible known values include one of ["off", "redis"]; Default: "off"
- consumer
Bies List<String> - Consumer fields used for mapping: -
id: try to find the matching Consumer byid-username: try to find the matching Consumer byusername-custom_id: try to find the matching Consumer bycustom_id. Default: ["custom_id","username"] - consumer
Claims List<List<String>> - The claims used for consumer mapping. Each entry represents a claim path inside the token payload. The paths are evaluated in order, and the first matching claim is used.
- consumer
Groups List<String>Claims - The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload.
- consumer
Groups BooleanOptional - Do not terminate the request if consumer groups mapping fails. Default: false
- consumer
Optional Boolean - Do not terminate the request if consumer mapping fails. Default: false
- credential
Claims List<String> - The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting plugin), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["sub"]
- disable
Sessions List<String> - Disable issuing the session cookie with the specified grants.
- discovery
Headers List<String>Names - Extra header names passed to the discovery endpoint.
- discovery
Headers List<String>Values - Extra header values passed to the discovery endpoint.
- display
Errors Boolean - Display errors on failure responses. Default: false
- domains List<String>
- The allowed values for the
hdclaim. - downstream
Access StringToken Header - The downstream access token header.
- downstream
Access StringToken Jwk Header - The downstream access token JWK header.
- downstream
Headers List<AiGateway Auth Strategy Openid Connect Config Downstream Header> - The downstream claim to header mappings.
- downstream
Headers List<String>Claims - The downstream header claims. Only top level claims are supported.
- downstream
Headers List<String>Names - The downstream header names for the claim values.
- downstream
Id StringToken Header - The downstream id token header.
- downstream
Id StringToken Jwk Header - The downstream id token JWK header.
- downstream
Introspection StringHeader - The downstream introspection header.
- downstream
Introspection StringJwt Header - The downstream introspection JWT header.
- downstream
Refresh StringToken Header - The downstream refresh token header.
- downstream
Session StringId Header - The downstream session id header.
- downstream
User StringInfo Header - The downstream user info header.
- downstream
User StringInfo Jwt Header - The downstream user info JWT header (in case the user info returns a JWT response).
- dpop
Proof DoubleLifetime - Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise. Default: 300
- dpop
Use BooleanNonce - Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime. Default: false
- enable
Hs BooleanSignatures - Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted). Default: false
- end
Session StringEndpoint - The end session endpoint. If set it overrides the value in
end_session_endpointreturned by the discovery endpoint. - expose
Error BooleanCode - Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to
falseto disable. Default: true - extra
Jwks List<String>Uris - JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery).
- forbidden
Destroy BooleanSession - Destroy any active session for the forbidden requests. Default: true
- forbidden
Error StringMessage - The error message for the forbidden requests (when not using the redirection). Default: "Forbidden"
- forbidden
Redirect List<String>Uris - Where to redirect the client on forbidden requests.
- groups
Claims List<String> - The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["groups"]
- groups
Requireds List<String> - The groups (
groups_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - hide
Credentials Boolean - Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the plugin will remove those that were used for successful authentication. Default: true
- http
Proxy String - The HTTP proxy.
- String
- The HTTP proxy authorization.
- http
Version Double - The HTTP version used for the requests by this plugin: -
1.1: HTTP 1.1 (the default) -1.0: HTTP 1.0. - https
Proxy String - The HTTPS proxy.
- String
- The HTTPS proxy authorization.
- id
Token StringParam Name - The name of the parameter used to pass the id token.
- id
Token List<String>Param Types - Where to look for the id token: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - ignore
Signatures List<String> - Skip the token signature verification on certain grants. This is insecure and logs a warning; use it only for providers that publish no verification key. Grants: -
password: OAuth password grant -client_credentials: OAuth client credentials grant -authorization_code: authorization code flow -refresh_token: OAuth refresh token grant -session: session cookie authentication -introspection: OAuth introspection -userinfo: OpenID Connect user info endpoint authentication. Default: [] - introspect
Jwt BooleanTokens - Specifies whether to introspect the JWT access tokens (can be used to check for revocations). Default: false
- introspection
Accept String - The value of
Acceptheader for introspection requests: -application/json: introspection response as JSON -application/token-introspection+jwt: introspection response as JWT (from the current IETF draft document) -application/jwt: introspection response as JWT (from the obsolete IETF draft document). possible known values include one of ["application/json", "application/jwt", "application/token-introspection+jwt"]; Default: "application/json" - introspection
Check BooleanActive - Check that the introspection response has an
activeclaim with a value oftrue. Default: true - introspection
Endpoint String - The introspection endpoint. If set it overrides the value in
introspection_endpointreturned by the discovery endpoint. - introspection
Endpoint StringAuth Method - The introspection endpoint authentication method: :
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["clientsecretbasic", "clientsecretjwt", "clientsecretpost", "none", "privatekeyjwt", "selfsignedtlsclientauth", "tlsclientauth"] - introspection
Headers List<String>Clients - Extra headers passed from the client to the introspection endpoint.
- introspection
Headers List<String>Names - Extra header names passed to the introspection endpoint.
- introspection
Headers List<String>Values - Extra header values passed to the introspection endpoint.
- introspection
Hint String - Introspection hint parameter value passed to the introspection endpoint. Default: "access_token"
- introspection
Post List<String>Args Client Headers - Extra post arguments passed from the client headers to the introspection endpoint.
- introspection
Post List<String>Args Clients - Extra post arguments passed from the client to the introspection endpoint.
- introspection
Post List<String>Args Names - Extra post argument names passed to the introspection endpoint.
- introspection
Post List<String>Args Values - Extra post argument values passed to the introspection endpoint.
- introspection
Token StringParam Name - Designate token's parameter name for introspection. Default: "token"
- issuer String
- The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure
config.using_pseudo_issuer=true. Not Null - issuers
Alloweds List<String> - The issuers allowed to be present in the tokens (
issclaim). - jwks
Endpoint String - Overrides the
jwks_urireturned by discovery. Use when the IdP exposes a non-standard JWKS endpoint. - jwt
Session StringClaim - The claim to match against the JWT session cookie. Default: "sid"
- String
- The name of the JWT session cookie.
- keepalive Boolean
- Use keepalive with the HTTP client. Default: true
- leeway Double
- Defines leeway time (in seconds) for
auth_time,exp,iat, andnbfclaims. Default: 0 - login
Action String - What to do after successful login: -
upstream: proxy request to upstream service -response: terminate request with a response -redirect: redirect to a different location. possible known values include one of ["redirect", "response", "upstream"]; Default: "upstream" - login
Methods List<String> - Enable login functionality with specified grants. Default: ["authorization_code"]
- login
Redirect StringMode - Where to place
login_tokenswhen usingredirectlogin_action: -query: place tokens in query string -fragment: place tokens in url fragment (not readable by servers). possible known values include one of ["fragment", "query"]; Default: "fragment" - login
Redirect List<String>Uris - Where to redirect the client when
login_actionis set toredirect. - login
Tokens List<String> - What tokens to include in
responsebody orredirectquery string or fragment: -id_token: include id token -access_token: include access token -refresh_token: include refresh token -tokens: include the full token endpoint response -introspection: include introspection response. Default: ["id_token"] - logout
Methods List<String> - The request methods that can activate the logout: -
POST: HTTP POST method -GET: HTTP GET method -DELETE: HTTP DELETE method. Default: ["DELETE","POST"] - logout
Post StringArg - The request body argument that activates the logout.
- logout
Query StringArg - The request query argument that activates the logout.
- logout
Redirect List<String>Uris - Where to redirect the client after the logout.
- logout
Revoke Boolean - Revoke tokens as part of the logout.
- logout
Revoke BooleanAccess Token - Revoke the access token as part of the logout. Requires
logout_revoketo be set totrue. Default: true - logout
Revoke BooleanRefresh Token - Revoke the refresh token as part of the logout. Requires
logout_revoketo be set totrue. Default: true - logout
Uri StringSuffix - The request URI suffix that activates the logout.
- max
Age Double - The maximum age (in seconds) compared to the
auth_timeclaim. - mtls
Introspection StringEndpoint - Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - mtls
Revocation StringEndpoint - Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - mtls
Token StringEndpoint - Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - no
Proxy String - Do not use proxy with these hosts.
- password
Param List<String>Types - Where to look for the username and password: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - preserve
Query BooleanArgs - With this parameter, you can preserve request query arguments even when doing authorization code flow. Default: false
- principals
Ai
Gateway Auth Strategy Openid Connect Config Principals - Configuration for Kong Identity principal hydration after token verification.
- proof
Of BooleanPossession Auth Methods Validation - If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP. Default: true
- proof
Of StringPossession Dpop - Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof. possible known values include one of ["off", "optional", "strict"]; Default: "off"
- proof
Of StringPossession Mtls - Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401. possible known values include one of ["off", "optional", "strict"]; Default: "off"
- String
- The pushed authorization endpoint. If set it overrides the value in
pushed_authorization_request_endpointreturned by the discovery endpoint. - String
- The pushed authorization request endpoint authentication method:
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - redirect
Uris List<String> - The redirect URI passed to the authorization and token endpoints.
- redis
Ai
Gateway Auth Strategy Openid Connect Config Redis - rediscovery
Lifetime Double - Specifies how long (in seconds) the plugin waits between discovery attempts. Discovery is still triggered on an as-needed basis. Default: 30
- refresh
Token StringParam Name - The name of the parameter used to pass the refresh token.
- refresh
Token List<String>Param Types - Where to look for the refresh token: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - refresh
Tokens Boolean - Specifies whether the plugin should try to refresh (soon to be) expired access tokens if the plugin has a
refresh_tokenavailable. Default: true - require
Proof BooleanKey For Code Exchange - Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of
code_challenge_methods_supported, and enabled automatically (in case thecode_challenge_methods_supportedis missing, the PKCE will not be enabled). - Boolean
- Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of
require_pushed_authorization_requests(which defaults tofalse). - require
Signed BooleanRequest Object - Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of
require_signed_request_object, and enabled automatically (in case therequire_signed_request_objectis missing, the feature will not be enabled). - resolve
Distributed BooleanClaims - Distributed claims are represented by the
_claim_namesand_claim_sourcesmembers of the JSON object containing the claims. If this parameter is set totrue, the plugin explicitly resolves these distributed claims. Default: false - response
Mode String - Response mode passed to the authorization endpoint: -
query: for parameters in query string -form_post: for parameters in request body -fragment: for parameters in uri fragment (rarely useful as the plugin itself cannot read it) -query.jwt,form_post.jwt,fragment.jwt: similar toquery,form_postandfragmentbut the parameters are encoded in a JWT -jwt: shortcut that indicates the default encoding for the requested response type. possible known values include one of ["form_post", "form_post.jwt", "fragment", "fragment.jwt", "jwt", "query", "query.jwt"]; Default: "query" - response
Types List<String> - The response type passed to the authorization endpoint. Default: ["code"]
- reverify Boolean
- Specifies whether to always verify tokens stored in the session. Default: false
- revocation
Endpoint String - The revocation endpoint. If set it overrides the value in
revocation_endpointreturned by the discovery endpoint. - revocation
Endpoint StringAuth Method - The revocation endpoint authentication method: :
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - revocation
Token StringParam Name - Designate token's parameter name for revocation. Default: "token"
- roles
Claims List<String> - The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["roles"]
- roles
Requireds List<String> - The roles (
roles_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - run
On BooleanPreflight - Specifies whether to run this plugin on pre-flight (
OPTIONS) requests. Default: true - scopes List<String>
- The scopes passed to the authorization and token endpoints. Default: ["openid"]
- scopes
Claims List<String> - The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["scope"]
- scopes
Requireds List<String> - The scopes (
scopes_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - search
User BooleanInfo - Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers. Default: false
- session
Absolute DoubleTimeout - Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks. Default: 86400
- session
Audience String - The session audience, which is the intended target application. For example
"my-application". Default: "default" - session
Binds List<String> - Bind the session to data acquired from the HTTP request or connection.
- String
- The session cookie Domain flag.
- Boolean
- Forbids JavaScript from accessing the cookie, for example, through the
Document.cookieproperty. Default: true - String
- The session cookie name. Default: "session"
- String
- The session cookie Path flag. Default: "/"
- String
- Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks. possible known values include one of ["Default", "Lax", "None", "Strict"]; Default: "Lax"
- Boolean
- Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
- session
Enforce BooleanSame Subject - When set to
true, audiences are forced to share the same subject. Default: false - session
Hash BooleanStorage Key - When set to
true, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie. Default: false - session
Hash BooleanSubject - When set to
true, the value of subject is hashed before being stored. Only applies whensession_store_metadatais enabled. Default: false - session
Idling DoubleTimeout - Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching. Default: 900
- session
Memcached StringHost - The memcached host. Default: "127.0.0.1"
- session
Memcached DoublePort - The memcached port. Default: 11211
- session
Memcached StringPrefix - The memcached session key prefix.
- session
Memcached StringSocket - The memcached unix socket path.
- session
Memcached BooleanSsl - If set to true, uses SSL to connect to memcached
- session
Memcached BooleanSsl Verify - If set to true, verifies the validity of the memcached server SSL certificate. Default: true
- session
Remember Boolean - Enables or disables persistent sessions. Default: false
- session
Remember DoubleAbsolute Timeout - Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks. Default: 2592000
- String
- Persistent session cookie name. Use with the
rememberconfiguration parameter. Default: "remember" - session
Remember DoubleRolling Timeout - Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling. Default: 604800
- session
Request List<String>Headers - Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g.
[ "id", "timeout" ]will set Session-Id and Session-Timeout request headers. - session
Response List<String>Headers - Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g.
[ "id", "timeout" ]will set Session-Id and Session-Timeout response headers. - session
Rolling DoubleTimeout - Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling. Default: 3600
- session
Secret String - The session secret.
- session
Storage String - The session storage for session data: -
cookie: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) -memcache: stores session data in memcached -redis: stores session data in Redis. possible known values include one of ["cookie", "memcache", "memcached", "redis"]; Default: "cookie" - session
Store BooleanMetadata - Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject. Default: false
- ssl
Verify Boolean - Verify identity provider server certificate. If set to
true, the plugin uses the CA certificate set in thekong.confconfig parameterlua_ssl_trusted_certificate. Default: true - timeout Double
- Network IO timeout in milliseconds. Default: 10000
- tls
Client StringAuth Cert Id - ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server.
- tls
Client BooleanAuth Ssl Verify - Verify identity provider server certificate during mTLS client authentication. Default: true
- token
Cache BooleanKey Include Scope - Include the scope in the token cache key, so token with different scopes are considered diffrent tokens. Default: false
- token
Endpoint String - The token endpoint. If set it overrides the value in
token_endpointreturned by the discovery endpoint. - token
Endpoint StringAuth Method - The token endpoint authentication method:
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - token
Exchange AiGateway Auth Strategy Openid Connect Config Token Exchange - Details on how to accept tokens from other identity providers.
- token
Exchange StringEndpoint - Endpoint used to perform the legacy token exchange.
- token
Headers List<String>Clients - Extra headers passed from the client to the token endpoint.
- token
Headers List<String>Grants - Enable the sending of the token endpoint response headers only with certain grants: -
password: with OAuth password grant -client_credentials: with OAuth client credentials grant -authorization_code: with authorization code flow -refresh_tokenwith refresh token grant. - token
Headers List<String>Names - Extra header names passed to the token endpoint.
- token
Headers StringPrefix - Add a prefix to the token endpoint response headers before forwarding them to the downstream client.
- token
Headers List<String>Replays - The names of token endpoint response headers to forward to the downstream client.
- token
Headers List<String>Values - Extra header values passed to the token endpoint.
- token
Post List<String>Args Clients - Pass extra arguments from the client to the OpenID-Connect plugin. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header This parameter can be used with
scopevalues, like this:config.token_post_args_client=scopeIn this case, the token would take thescopevalue from the query parameter or from the request body or from the header and send it to the token endpoint. - token
Post List<String>Args Names - Extra post argument names passed to the token endpoint.
- token
Post List<String>Args Values - Extra post argument values passed to the token endpoint.
- Boolean
- Destroy any active session for the unauthorized requests. Default: true
- String
- The error message for the unauthorized requests (when not using the redirection). Default: "Unauthorized"
- List<String>
- Where to redirect the client on unauthorized requests.
- unexpected
Redirect List<String>Uris - Where to redirect the client when unexpected errors happen with the requests.
- upstream
Access StringToken Header - The upstream access token header. Default: "authorization:bearer"
- upstream
Access StringToken Jwk Header - The upstream access token JWK header.
- upstream
Headers List<AiGateway Auth Strategy Openid Connect Config Upstream Header> - The upstream claim to header mappings.
- upstream
Headers List<String>Claims - The upstream header claims. Only top level claims are supported.
- upstream
Headers List<String>Names - The upstream header names for the claim values.
- upstream
Id StringToken Header - The upstream id token header.
- upstream
Id StringToken Jwk Header - The upstream id token JWK header.
- upstream
Introspection StringHeader - The upstream introspection header.
- upstream
Introspection StringJwt Header - The upstream introspection JWT header.
- upstream
Refresh StringToken Header - The upstream refresh token header.
- upstream
Session StringId Header - The upstream session id header.
- upstream
User StringInfo Header - The upstream user info header.
- upstream
User StringInfo Jwt Header - The upstream user info JWT header (in case the user info returns a JWT response).
- userinfo
Accept String - The value of
Acceptheader for user info requests: -application/json: user info response as JSON -application/jwt: user info response as JWT (from the obsolete IETF draft document). possible known values include one of ["application/json", "application/jwt"]; Default: "application/json" - userinfo
Endpoint String - The user info endpoint. If set it overrides the value in
userinfo_endpointreturned by the discovery endpoint. - userinfo
Headers List<String>Clients - Extra headers passed from the client to the user info endpoint.
- userinfo
Headers List<String>Names - Extra header names passed to the user info endpoint.
- userinfo
Headers List<String>Values - Extra header values passed to the user info endpoint.
- userinfo
Query List<String>Args Clients - Extra query arguments passed from the client to the user info endpoint.
- userinfo
Query List<String>Args Names - Extra query argument names passed to the user info endpoint.
- userinfo
Query List<String>Args Values - Extra query argument values passed to the user info endpoint.
- using
Pseudo BooleanIssuer - If the plugin uses a pseudo issuer. When set to true, the plugin will not discover the configuration from the issuer URL specified with
config.issuer. Default: false - verify
Claims Boolean - Verify tokens for standard claims. Default: true
- verify
Nonce Boolean - Verify nonce on authorization code flow. Default: true
- verify
Parameters Boolean - Verify plugin configuration against discovery. Default: false
- verify
Signature Boolean - Verify signature of tokens. Default: true
- anonymous string
- An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a
4xxHTTP status code. This value must refer to the consumeridorusernameattribute, and not itscustom_id. - audience
Claims string[] - The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["aud"]
- audience
Requireds string[] - The audiences (
audience_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - audiences string[]
- The audience passed to the authorization endpoint.
- auth
Methods string[] - Types of credentials/grants to enable. Default: ["authorizationcode","bearer","clientcredentials","introspection","kongoauth2","password","refreshtoken","session","userinfo"]
- authenticated
Groups string[]Claims - The claim that contains authenticated groups. This setting can be used together with ACL plugin, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload.
- string
- The authorization cookie Domain flag.
- boolean
- Forbids JavaScript from accessing the cookie, for example, through the
Document.cookieproperty. Default: true - string
- The authorization cookie name. Default: "authorization"
- string
- The authorization cookie Path flag. Default: "/"
- string
- Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks. possible known values include one of ["Default", "Lax", "None", "Strict"]; Default: "Default"
- boolean
- Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
- string
- The authorization endpoint. If set it overrides the value in
authorization_endpointreturned by the discovery endpoint. - string[]
- Extra query arguments passed from the client to the authorization endpoint.
- string[]
- Extra query argument names passed to the authorization endpoint.
- string[]
- Extra query argument values passed to the authorization endpoint.
- number
- Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling. Default: 600
- string
- The name of the cookie in which the bearer token is passed.
- bearer
Token string[]Param Types - Where to look for the bearer token: -
header: search theAuthorization,access-token, andx-access-tokenHTTP headers -query: search the URL's query string -body: search the HTTP request body -cookie: search the HTTP request cookies specified withconfig.bearer_token_cookie_name. Default: ["body","header","query"] - by
Username booleanIgnore Case - If
consumer_byis set tousername, specify whetherusernamecan match consumers case-insensitively. Default: false - cache
Introspection boolean - Cache the introspection endpoint requests. Default: true
- cache
Token booleanExchange - Cache the legacy token exchange endpoint requests. Default: true
- cache
Tokens boolean - Cache the token endpoint requests. Default: true
- cache
Tokens stringSalt - Salt used for generating the cache key that is used for caching the token endpoint requests.
- cache
Ttl number - The default cache ttl in seconds that is used in case the cached object does not specify the expiry. Default: 3600
- cache
Ttl numberMax - The maximum cache ttl in seconds (enforced).
- cache
Ttl numberMin - The minimum cache ttl in seconds (enforced).
- cache
Ttl numberNeg - The negative cache ttl in seconds.
- cache
Ttl numberResurrect - The resurrection ttl in seconds.
- cache
User booleanInfo - Cache the user info requests. Default: true
- claims
Forbiddens string[] - If given, these claims are forbidden in the token payload.
- client
Algs string[] - The algorithm to use for clientsecretjwt (only HS***) or private*key*jwt authentication.
- client
Arg string - The client to use for this request (the selection is made with a request parameter with the same name). Default: "client_id"
- client
Auths string[] - The default OpenID Connect client authentication method is 'clientsecretbasic' (using 'Authorization: Basic' header), 'clientsecretpost' (credentials in body), 'clientsecretjwt' (signed client assertion in body), 'privatekeyjwt' (private key-signed assertion), 'tlsclientauth' (client certificate), 'selfsignedtlsclientauth' (self-signed client certificate), and 'none' (no authentication).
- client
Credentials string[]Param Types - Where to look for the client credentials: -
header: search the HTTP headers -query: search the URL's query string -body: search from the HTTP request body. Default: ["body","header","query"] - client
Ids string[] - The client id(s) that the plugin uses when it calls authenticated endpoints on the identity provider.
- client
Jwks AiGateway Auth Strategy Openid Connect Config Client Jwk[] - The JWK used for the privatekeyjwt authentication.
- client
Secrets string[] - The client secret.
- cluster
Cache AiRedis Gateway Auth Strategy Openid Connect Config Cluster Cache Redis - cluster
Cache stringStrategy - The strategy to use for the cluster cache. If set, the plugin will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared. possible known values include one of ["off", "redis"]; Default: "off"
- consumer
Bies string[] - Consumer fields used for mapping: -
id: try to find the matching Consumer byid-username: try to find the matching Consumer byusername-custom_id: try to find the matching Consumer bycustom_id. Default: ["custom_id","username"] - consumer
Claims string[][] - The claims used for consumer mapping. Each entry represents a claim path inside the token payload. The paths are evaluated in order, and the first matching claim is used.
- consumer
Groups string[]Claims - The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload.
- consumer
Groups booleanOptional - Do not terminate the request if consumer groups mapping fails. Default: false
- consumer
Optional boolean - Do not terminate the request if consumer mapping fails. Default: false
- credential
Claims string[] - The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting plugin), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["sub"]
- disable
Sessions string[] - Disable issuing the session cookie with the specified grants.
- discovery
Headers string[]Names - Extra header names passed to the discovery endpoint.
- discovery
Headers string[]Values - Extra header values passed to the discovery endpoint.
- display
Errors boolean - Display errors on failure responses. Default: false
- domains string[]
- The allowed values for the
hdclaim. - downstream
Access stringToken Header - The downstream access token header.
- downstream
Access stringToken Jwk Header - The downstream access token JWK header.
- downstream
Headers AiGateway Auth Strategy Openid Connect Config Downstream Header[] - The downstream claim to header mappings.
- downstream
Headers string[]Claims - The downstream header claims. Only top level claims are supported.
- downstream
Headers string[]Names - The downstream header names for the claim values.
- downstream
Id stringToken Header - The downstream id token header.
- downstream
Id stringToken Jwk Header - The downstream id token JWK header.
- downstream
Introspection stringHeader - The downstream introspection header.
- downstream
Introspection stringJwt Header - The downstream introspection JWT header.
- downstream
Refresh stringToken Header - The downstream refresh token header.
- downstream
Session stringId Header - The downstream session id header.
- downstream
User stringInfo Header - The downstream user info header.
- downstream
User stringInfo Jwt Header - The downstream user info JWT header (in case the user info returns a JWT response).
- dpop
Proof numberLifetime - Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise. Default: 300
- dpop
Use booleanNonce - Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime. Default: false
- enable
Hs booleanSignatures - Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted). Default: false
- end
Session stringEndpoint - The end session endpoint. If set it overrides the value in
end_session_endpointreturned by the discovery endpoint. - expose
Error booleanCode - Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to
falseto disable. Default: true - extra
Jwks string[]Uris - JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery).
- forbidden
Destroy booleanSession - Destroy any active session for the forbidden requests. Default: true
- forbidden
Error stringMessage - The error message for the forbidden requests (when not using the redirection). Default: "Forbidden"
- forbidden
Redirect string[]Uris - Where to redirect the client on forbidden requests.
- groups
Claims string[] - The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["groups"]
- groups
Requireds string[] - The groups (
groups_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - hide
Credentials boolean - Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the plugin will remove those that were used for successful authentication. Default: true
- http
Proxy string - The HTTP proxy.
- string
- The HTTP proxy authorization.
- http
Version number - The HTTP version used for the requests by this plugin: -
1.1: HTTP 1.1 (the default) -1.0: HTTP 1.0. - https
Proxy string - The HTTPS proxy.
- string
- The HTTPS proxy authorization.
- id
Token stringParam Name - The name of the parameter used to pass the id token.
- id
Token string[]Param Types - Where to look for the id token: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - ignore
Signatures string[] - Skip the token signature verification on certain grants. This is insecure and logs a warning; use it only for providers that publish no verification key. Grants: -
password: OAuth password grant -client_credentials: OAuth client credentials grant -authorization_code: authorization code flow -refresh_token: OAuth refresh token grant -session: session cookie authentication -introspection: OAuth introspection -userinfo: OpenID Connect user info endpoint authentication. Default: [] - introspect
Jwt booleanTokens - Specifies whether to introspect the JWT access tokens (can be used to check for revocations). Default: false
- introspection
Accept string - The value of
Acceptheader for introspection requests: -application/json: introspection response as JSON -application/token-introspection+jwt: introspection response as JWT (from the current IETF draft document) -application/jwt: introspection response as JWT (from the obsolete IETF draft document). possible known values include one of ["application/json", "application/jwt", "application/token-introspection+jwt"]; Default: "application/json" - introspection
Check booleanActive - Check that the introspection response has an
activeclaim with a value oftrue. Default: true - introspection
Endpoint string - The introspection endpoint. If set it overrides the value in
introspection_endpointreturned by the discovery endpoint. - introspection
Endpoint stringAuth Method - The introspection endpoint authentication method: :
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["clientsecretbasic", "clientsecretjwt", "clientsecretpost", "none", "privatekeyjwt", "selfsignedtlsclientauth", "tlsclientauth"] - introspection
Headers string[]Clients - Extra headers passed from the client to the introspection endpoint.
- introspection
Headers string[]Names - Extra header names passed to the introspection endpoint.
- introspection
Headers string[]Values - Extra header values passed to the introspection endpoint.
- introspection
Hint string - Introspection hint parameter value passed to the introspection endpoint. Default: "access_token"
- introspection
Post string[]Args Client Headers - Extra post arguments passed from the client headers to the introspection endpoint.
- introspection
Post string[]Args Clients - Extra post arguments passed from the client to the introspection endpoint.
- introspection
Post string[]Args Names - Extra post argument names passed to the introspection endpoint.
- introspection
Post string[]Args Values - Extra post argument values passed to the introspection endpoint.
- introspection
Token stringParam Name - Designate token's parameter name for introspection. Default: "token"
- issuer string
- The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure
config.using_pseudo_issuer=true. Not Null - issuers
Alloweds string[] - The issuers allowed to be present in the tokens (
issclaim). - jwks
Endpoint string - Overrides the
jwks_urireturned by discovery. Use when the IdP exposes a non-standard JWKS endpoint. - jwt
Session stringClaim - The claim to match against the JWT session cookie. Default: "sid"
- string
- The name of the JWT session cookie.
- keepalive boolean
- Use keepalive with the HTTP client. Default: true
- leeway number
- Defines leeway time (in seconds) for
auth_time,exp,iat, andnbfclaims. Default: 0 - login
Action string - What to do after successful login: -
upstream: proxy request to upstream service -response: terminate request with a response -redirect: redirect to a different location. possible known values include one of ["redirect", "response", "upstream"]; Default: "upstream" - login
Methods string[] - Enable login functionality with specified grants. Default: ["authorization_code"]
- login
Redirect stringMode - Where to place
login_tokenswhen usingredirectlogin_action: -query: place tokens in query string -fragment: place tokens in url fragment (not readable by servers). possible known values include one of ["fragment", "query"]; Default: "fragment" - login
Redirect string[]Uris - Where to redirect the client when
login_actionis set toredirect. - login
Tokens string[] - What tokens to include in
responsebody orredirectquery string or fragment: -id_token: include id token -access_token: include access token -refresh_token: include refresh token -tokens: include the full token endpoint response -introspection: include introspection response. Default: ["id_token"] - logout
Methods string[] - The request methods that can activate the logout: -
POST: HTTP POST method -GET: HTTP GET method -DELETE: HTTP DELETE method. Default: ["DELETE","POST"] - logout
Post stringArg - The request body argument that activates the logout.
- logout
Query stringArg - The request query argument that activates the logout.
- logout
Redirect string[]Uris - Where to redirect the client after the logout.
- logout
Revoke boolean - Revoke tokens as part of the logout.
- logout
Revoke booleanAccess Token - Revoke the access token as part of the logout. Requires
logout_revoketo be set totrue. Default: true - logout
Revoke booleanRefresh Token - Revoke the refresh token as part of the logout. Requires
logout_revoketo be set totrue. Default: true - logout
Uri stringSuffix - The request URI suffix that activates the logout.
- max
Age number - The maximum age (in seconds) compared to the
auth_timeclaim. - mtls
Introspection stringEndpoint - Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - mtls
Revocation stringEndpoint - Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - mtls
Token stringEndpoint - Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - no
Proxy string - Do not use proxy with these hosts.
- password
Param string[]Types - Where to look for the username and password: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - preserve
Query booleanArgs - With this parameter, you can preserve request query arguments even when doing authorization code flow. Default: false
- principals
Ai
Gateway Auth Strategy Openid Connect Config Principals - Configuration for Kong Identity principal hydration after token verification.
- proof
Of booleanPossession Auth Methods Validation - If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP. Default: true
- proof
Of stringPossession Dpop - Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof. possible known values include one of ["off", "optional", "strict"]; Default: "off"
- proof
Of stringPossession Mtls - Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401. possible known values include one of ["off", "optional", "strict"]; Default: "off"
- string
- The pushed authorization endpoint. If set it overrides the value in
pushed_authorization_request_endpointreturned by the discovery endpoint. - string
- The pushed authorization request endpoint authentication method:
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - redirect
Uris string[] - The redirect URI passed to the authorization and token endpoints.
- redis
Ai
Gateway Auth Strategy Openid Connect Config Redis - rediscovery
Lifetime number - Specifies how long (in seconds) the plugin waits between discovery attempts. Discovery is still triggered on an as-needed basis. Default: 30
- refresh
Token stringParam Name - The name of the parameter used to pass the refresh token.
- refresh
Token string[]Param Types - Where to look for the refresh token: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - refresh
Tokens boolean - Specifies whether the plugin should try to refresh (soon to be) expired access tokens if the plugin has a
refresh_tokenavailable. Default: true - require
Proof booleanKey For Code Exchange - Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of
code_challenge_methods_supported, and enabled automatically (in case thecode_challenge_methods_supportedis missing, the PKCE will not be enabled). - boolean
- Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of
require_pushed_authorization_requests(which defaults tofalse). - require
Signed booleanRequest Object - Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of
require_signed_request_object, and enabled automatically (in case therequire_signed_request_objectis missing, the feature will not be enabled). - resolve
Distributed booleanClaims - Distributed claims are represented by the
_claim_namesand_claim_sourcesmembers of the JSON object containing the claims. If this parameter is set totrue, the plugin explicitly resolves these distributed claims. Default: false - response
Mode string - Response mode passed to the authorization endpoint: -
query: for parameters in query string -form_post: for parameters in request body -fragment: for parameters in uri fragment (rarely useful as the plugin itself cannot read it) -query.jwt,form_post.jwt,fragment.jwt: similar toquery,form_postandfragmentbut the parameters are encoded in a JWT -jwt: shortcut that indicates the default encoding for the requested response type. possible known values include one of ["form_post", "form_post.jwt", "fragment", "fragment.jwt", "jwt", "query", "query.jwt"]; Default: "query" - response
Types string[] - The response type passed to the authorization endpoint. Default: ["code"]
- reverify boolean
- Specifies whether to always verify tokens stored in the session. Default: false
- revocation
Endpoint string - The revocation endpoint. If set it overrides the value in
revocation_endpointreturned by the discovery endpoint. - revocation
Endpoint stringAuth Method - The revocation endpoint authentication method: :
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - revocation
Token stringParam Name - Designate token's parameter name for revocation. Default: "token"
- roles
Claims string[] - The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["roles"]
- roles
Requireds string[] - The roles (
roles_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - run
On booleanPreflight - Specifies whether to run this plugin on pre-flight (
OPTIONS) requests. Default: true - scopes string[]
- The scopes passed to the authorization and token endpoints. Default: ["openid"]
- scopes
Claims string[] - The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["scope"]
- scopes
Requireds string[] - The scopes (
scopes_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - search
User booleanInfo - Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers. Default: false
- session
Absolute numberTimeout - Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks. Default: 86400
- session
Audience string - The session audience, which is the intended target application. For example
"my-application". Default: "default" - session
Binds string[] - Bind the session to data acquired from the HTTP request or connection.
- string
- The session cookie Domain flag.
- boolean
- Forbids JavaScript from accessing the cookie, for example, through the
Document.cookieproperty. Default: true - string
- The session cookie name. Default: "session"
- string
- The session cookie Path flag. Default: "/"
- string
- Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks. possible known values include one of ["Default", "Lax", "None", "Strict"]; Default: "Lax"
- boolean
- Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
- session
Enforce booleanSame Subject - When set to
true, audiences are forced to share the same subject. Default: false - session
Hash booleanStorage Key - When set to
true, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie. Default: false - session
Hash booleanSubject - When set to
true, the value of subject is hashed before being stored. Only applies whensession_store_metadatais enabled. Default: false - session
Idling numberTimeout - Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching. Default: 900
- session
Memcached stringHost - The memcached host. Default: "127.0.0.1"
- session
Memcached numberPort - The memcached port. Default: 11211
- session
Memcached stringPrefix - The memcached session key prefix.
- session
Memcached stringSocket - The memcached unix socket path.
- session
Memcached booleanSsl - If set to true, uses SSL to connect to memcached
- session
Memcached booleanSsl Verify - If set to true, verifies the validity of the memcached server SSL certificate. Default: true
- session
Remember boolean - Enables or disables persistent sessions. Default: false
- session
Remember numberAbsolute Timeout - Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks. Default: 2592000
- string
- Persistent session cookie name. Use with the
rememberconfiguration parameter. Default: "remember" - session
Remember numberRolling Timeout - Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling. Default: 604800
- session
Request string[]Headers - Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g.
[ "id", "timeout" ]will set Session-Id and Session-Timeout request headers. - session
Response string[]Headers - Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g.
[ "id", "timeout" ]will set Session-Id and Session-Timeout response headers. - session
Rolling numberTimeout - Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling. Default: 3600
- session
Secret string - The session secret.
- session
Storage string - The session storage for session data: -
cookie: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) -memcache: stores session data in memcached -redis: stores session data in Redis. possible known values include one of ["cookie", "memcache", "memcached", "redis"]; Default: "cookie" - session
Store booleanMetadata - Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject. Default: false
- ssl
Verify boolean - Verify identity provider server certificate. If set to
true, the plugin uses the CA certificate set in thekong.confconfig parameterlua_ssl_trusted_certificate. Default: true - timeout number
- Network IO timeout in milliseconds. Default: 10000
- tls
Client stringAuth Cert Id - ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server.
- tls
Client booleanAuth Ssl Verify - Verify identity provider server certificate during mTLS client authentication. Default: true
- token
Cache booleanKey Include Scope - Include the scope in the token cache key, so token with different scopes are considered diffrent tokens. Default: false
- token
Endpoint string - The token endpoint. If set it overrides the value in
token_endpointreturned by the discovery endpoint. - token
Endpoint stringAuth Method - The token endpoint authentication method:
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - token
Exchange AiGateway Auth Strategy Openid Connect Config Token Exchange - Details on how to accept tokens from other identity providers.
- token
Exchange stringEndpoint - Endpoint used to perform the legacy token exchange.
- token
Headers string[]Clients - Extra headers passed from the client to the token endpoint.
- token
Headers string[]Grants - Enable the sending of the token endpoint response headers only with certain grants: -
password: with OAuth password grant -client_credentials: with OAuth client credentials grant -authorization_code: with authorization code flow -refresh_tokenwith refresh token grant. - token
Headers string[]Names - Extra header names passed to the token endpoint.
- token
Headers stringPrefix - Add a prefix to the token endpoint response headers before forwarding them to the downstream client.
- token
Headers string[]Replays - The names of token endpoint response headers to forward to the downstream client.
- token
Headers string[]Values - Extra header values passed to the token endpoint.
- token
Post string[]Args Clients - Pass extra arguments from the client to the OpenID-Connect plugin. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header This parameter can be used with
scopevalues, like this:config.token_post_args_client=scopeIn this case, the token would take thescopevalue from the query parameter or from the request body or from the header and send it to the token endpoint. - token
Post string[]Args Names - Extra post argument names passed to the token endpoint.
- token
Post string[]Args Values - Extra post argument values passed to the token endpoint.
- boolean
- Destroy any active session for the unauthorized requests. Default: true
- string
- The error message for the unauthorized requests (when not using the redirection). Default: "Unauthorized"
- string[]
- Where to redirect the client on unauthorized requests.
- unexpected
Redirect string[]Uris - Where to redirect the client when unexpected errors happen with the requests.
- upstream
Access stringToken Header - The upstream access token header. Default: "authorization:bearer"
- upstream
Access stringToken Jwk Header - The upstream access token JWK header.
- upstream
Headers AiGateway Auth Strategy Openid Connect Config Upstream Header[] - The upstream claim to header mappings.
- upstream
Headers string[]Claims - The upstream header claims. Only top level claims are supported.
- upstream
Headers string[]Names - The upstream header names for the claim values.
- upstream
Id stringToken Header - The upstream id token header.
- upstream
Id stringToken Jwk Header - The upstream id token JWK header.
- upstream
Introspection stringHeader - The upstream introspection header.
- upstream
Introspection stringJwt Header - The upstream introspection JWT header.
- upstream
Refresh stringToken Header - The upstream refresh token header.
- upstream
Session stringId Header - The upstream session id header.
- upstream
User stringInfo Header - The upstream user info header.
- upstream
User stringInfo Jwt Header - The upstream user info JWT header (in case the user info returns a JWT response).
- userinfo
Accept string - The value of
Acceptheader for user info requests: -application/json: user info response as JSON -application/jwt: user info response as JWT (from the obsolete IETF draft document). possible known values include one of ["application/json", "application/jwt"]; Default: "application/json" - userinfo
Endpoint string - The user info endpoint. If set it overrides the value in
userinfo_endpointreturned by the discovery endpoint. - userinfo
Headers string[]Clients - Extra headers passed from the client to the user info endpoint.
- userinfo
Headers string[]Names - Extra header names passed to the user info endpoint.
- userinfo
Headers string[]Values - Extra header values passed to the user info endpoint.
- userinfo
Query string[]Args Clients - Extra query arguments passed from the client to the user info endpoint.
- userinfo
Query string[]Args Names - Extra query argument names passed to the user info endpoint.
- userinfo
Query string[]Args Values - Extra query argument values passed to the user info endpoint.
- using
Pseudo booleanIssuer - If the plugin uses a pseudo issuer. When set to true, the plugin will not discover the configuration from the issuer URL specified with
config.issuer. Default: false - verify
Claims boolean - Verify tokens for standard claims. Default: true
- verify
Nonce boolean - Verify nonce on authorization code flow. Default: true
- verify
Parameters boolean - Verify plugin configuration against discovery. Default: false
- verify
Signature boolean - Verify signature of tokens. Default: true
- anonymous str
- An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a
4xxHTTP status code. This value must refer to the consumeridorusernameattribute, and not itscustom_id. - audience_
claims Sequence[str] - The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["aud"]
- audience_
requireds Sequence[str] - The audiences (
audience_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - audiences Sequence[str]
- The audience passed to the authorization endpoint.
- auth_
methods Sequence[str] - Types of credentials/grants to enable. Default: ["authorizationcode","bearer","clientcredentials","introspection","kongoauth2","password","refreshtoken","session","userinfo"]
- authenticated_
groups_ Sequence[str]claims - The claim that contains authenticated groups. This setting can be used together with ACL plugin, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload.
- str
- The authorization cookie Domain flag.
- bool
- Forbids JavaScript from accessing the cookie, for example, through the
Document.cookieproperty. Default: true - str
- The authorization cookie name. Default: "authorization"
- str
- The authorization cookie Path flag. Default: "/"
- str
- Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks. possible known values include one of ["Default", "Lax", "None", "Strict"]; Default: "Default"
- bool
- Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
- str
- The authorization endpoint. If set it overrides the value in
authorization_endpointreturned by the discovery endpoint. - Sequence[str]
- Extra query arguments passed from the client to the authorization endpoint.
- Sequence[str]
- Extra query argument names passed to the authorization endpoint.
- Sequence[str]
- Extra query argument values passed to the authorization endpoint.
- float
- Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling. Default: 600
- str
- The name of the cookie in which the bearer token is passed.
- bearer_
token_ Sequence[str]param_ types - Where to look for the bearer token: -
header: search theAuthorization,access-token, andx-access-tokenHTTP headers -query: search the URL's query string -body: search the HTTP request body -cookie: search the HTTP request cookies specified withconfig.bearer_token_cookie_name. Default: ["body","header","query"] - by_
username_ boolignore_ case - If
consumer_byis set tousername, specify whetherusernamecan match consumers case-insensitively. Default: false - cache_
introspection bool - Cache the introspection endpoint requests. Default: true
- cache_
token_ boolexchange - Cache the legacy token exchange endpoint requests. Default: true
- cache_
tokens bool - Cache the token endpoint requests. Default: true
- cache_
tokens_ strsalt - Salt used for generating the cache key that is used for caching the token endpoint requests.
- cache_
ttl float - The default cache ttl in seconds that is used in case the cached object does not specify the expiry. Default: 3600
- cache_
ttl_ floatmax - The maximum cache ttl in seconds (enforced).
- cache_
ttl_ floatmin - The minimum cache ttl in seconds (enforced).
- cache_
ttl_ floatneg - The negative cache ttl in seconds.
- cache_
ttl_ floatresurrect - The resurrection ttl in seconds.
- cache_
user_ boolinfo - Cache the user info requests. Default: true
- claims_
forbiddens Sequence[str] - If given, these claims are forbidden in the token payload.
- client_
algs Sequence[str] - The algorithm to use for clientsecretjwt (only HS***) or private*key*jwt authentication.
- client_
arg str - The client to use for this request (the selection is made with a request parameter with the same name). Default: "client_id"
- client_
auths Sequence[str] - The default OpenID Connect client authentication method is 'clientsecretbasic' (using 'Authorization: Basic' header), 'clientsecretpost' (credentials in body), 'clientsecretjwt' (signed client assertion in body), 'privatekeyjwt' (private key-signed assertion), 'tlsclientauth' (client certificate), 'selfsignedtlsclientauth' (self-signed client certificate), and 'none' (no authentication).
- client_
credentials_ Sequence[str]param_ types - Where to look for the client credentials: -
header: search the HTTP headers -query: search the URL's query string -body: search from the HTTP request body. Default: ["body","header","query"] - client_
ids Sequence[str] - The client id(s) that the plugin uses when it calls authenticated endpoints on the identity provider.
- client_
jwks Sequence[AiGateway Auth Strategy Openid Connect Config Client Jwk] - The JWK used for the privatekeyjwt authentication.
- client_
secrets Sequence[str] - The client secret.
- cluster_
cache_ Airedis Gateway Auth Strategy Openid Connect Config Cluster Cache Redis - cluster_
cache_ strstrategy - The strategy to use for the cluster cache. If set, the plugin will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared. possible known values include one of ["off", "redis"]; Default: "off"
- consumer_
bies Sequence[str] - Consumer fields used for mapping: -
id: try to find the matching Consumer byid-username: try to find the matching Consumer byusername-custom_id: try to find the matching Consumer bycustom_id. Default: ["custom_id","username"] - consumer_
claims Sequence[Sequence[str]] - The claims used for consumer mapping. Each entry represents a claim path inside the token payload. The paths are evaluated in order, and the first matching claim is used.
- consumer_
groups_ Sequence[str]claims - The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload.
- consumer_
groups_ booloptional - Do not terminate the request if consumer groups mapping fails. Default: false
- consumer_
optional bool - Do not terminate the request if consumer mapping fails. Default: false
- credential_
claims Sequence[str] - The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting plugin), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["sub"]
- disable_
sessions Sequence[str] - Disable issuing the session cookie with the specified grants.
- discovery_
headers_ Sequence[str]names - Extra header names passed to the discovery endpoint.
- discovery_
headers_ Sequence[str]values - Extra header values passed to the discovery endpoint.
- display_
errors bool - Display errors on failure responses. Default: false
- domains Sequence[str]
- The allowed values for the
hdclaim. - downstream_
access_ strtoken_ header - The downstream access token header.
- downstream_
access_ strtoken_ jwk_ header - The downstream access token JWK header.
- downstream_
headers Sequence[AiGateway Auth Strategy Openid Connect Config Downstream Header] - The downstream claim to header mappings.
- downstream_
headers_ Sequence[str]claims - The downstream header claims. Only top level claims are supported.
- downstream_
headers_ Sequence[str]names - The downstream header names for the claim values.
- downstream_
id_ strtoken_ header - The downstream id token header.
- downstream_
id_ strtoken_ jwk_ header - The downstream id token JWK header.
- downstream_
introspection_ strheader - The downstream introspection header.
- downstream_
introspection_ strjwt_ header - The downstream introspection JWT header.
- downstream_
refresh_ strtoken_ header - The downstream refresh token header.
- downstream_
session_ strid_ header - The downstream session id header.
- downstream_
user_ strinfo_ header - The downstream user info header.
- downstream_
user_ strinfo_ jwt_ header - The downstream user info JWT header (in case the user info returns a JWT response).
- dpop_
proof_ floatlifetime - Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise. Default: 300
- dpop_
use_ boolnonce - Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime. Default: false
- enable_
hs_ boolsignatures - Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted). Default: false
- end_
session_ strendpoint - The end session endpoint. If set it overrides the value in
end_session_endpointreturned by the discovery endpoint. - expose_
error_ boolcode - Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to
falseto disable. Default: true - extra_
jwks_ Sequence[str]uris - JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery).
- forbidden_
destroy_ boolsession - Destroy any active session for the forbidden requests. Default: true
- forbidden_
error_ strmessage - The error message for the forbidden requests (when not using the redirection). Default: "Forbidden"
- forbidden_
redirect_ Sequence[str]uris - Where to redirect the client on forbidden requests.
- groups_
claims Sequence[str] - The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["groups"]
- groups_
requireds Sequence[str] - The groups (
groups_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - hide_
credentials bool - Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the plugin will remove those that were used for successful authentication. Default: true
- http_
proxy str - The HTTP proxy.
- str
- The HTTP proxy authorization.
- http_
version float - The HTTP version used for the requests by this plugin: -
1.1: HTTP 1.1 (the default) -1.0: HTTP 1.0. - https_
proxy str - The HTTPS proxy.
- str
- The HTTPS proxy authorization.
- id_
token_ strparam_ name - The name of the parameter used to pass the id token.
- id_
token_ Sequence[str]param_ types - Where to look for the id token: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - ignore_
signatures Sequence[str] - Skip the token signature verification on certain grants. This is insecure and logs a warning; use it only for providers that publish no verification key. Grants: -
password: OAuth password grant -client_credentials: OAuth client credentials grant -authorization_code: authorization code flow -refresh_token: OAuth refresh token grant -session: session cookie authentication -introspection: OAuth introspection -userinfo: OpenID Connect user info endpoint authentication. Default: [] - introspect_
jwt_ booltokens - Specifies whether to introspect the JWT access tokens (can be used to check for revocations). Default: false
- introspection_
accept str - The value of
Acceptheader for introspection requests: -application/json: introspection response as JSON -application/token-introspection+jwt: introspection response as JWT (from the current IETF draft document) -application/jwt: introspection response as JWT (from the obsolete IETF draft document). possible known values include one of ["application/json", "application/jwt", "application/token-introspection+jwt"]; Default: "application/json" - introspection_
check_ boolactive - Check that the introspection response has an
activeclaim with a value oftrue. Default: true - introspection_
endpoint str - The introspection endpoint. If set it overrides the value in
introspection_endpointreturned by the discovery endpoint. - introspection_
endpoint_ strauth_ method - The introspection endpoint authentication method: :
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["clientsecretbasic", "clientsecretjwt", "clientsecretpost", "none", "privatekeyjwt", "selfsignedtlsclientauth", "tlsclientauth"] - introspection_
headers_ Sequence[str]clients - Extra headers passed from the client to the introspection endpoint.
- introspection_
headers_ Sequence[str]names - Extra header names passed to the introspection endpoint.
- introspection_
headers_ Sequence[str]values - Extra header values passed to the introspection endpoint.
- introspection_
hint str - Introspection hint parameter value passed to the introspection endpoint. Default: "access_token"
- introspection_
post_ Sequence[str]args_ client_ headers - Extra post arguments passed from the client headers to the introspection endpoint.
- introspection_
post_ Sequence[str]args_ clients - Extra post arguments passed from the client to the introspection endpoint.
- introspection_
post_ Sequence[str]args_ names - Extra post argument names passed to the introspection endpoint.
- introspection_
post_ Sequence[str]args_ values - Extra post argument values passed to the introspection endpoint.
- introspection_
token_ strparam_ name - Designate token's parameter name for introspection. Default: "token"
- issuer str
- The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure
config.using_pseudo_issuer=true. Not Null - issuers_
alloweds Sequence[str] - The issuers allowed to be present in the tokens (
issclaim). - jwks_
endpoint str - Overrides the
jwks_urireturned by discovery. Use when the IdP exposes a non-standard JWKS endpoint. - jwt_
session_ strclaim - The claim to match against the JWT session cookie. Default: "sid"
- str
- The name of the JWT session cookie.
- keepalive bool
- Use keepalive with the HTTP client. Default: true
- leeway float
- Defines leeway time (in seconds) for
auth_time,exp,iat, andnbfclaims. Default: 0 - login_
action str - What to do after successful login: -
upstream: proxy request to upstream service -response: terminate request with a response -redirect: redirect to a different location. possible known values include one of ["redirect", "response", "upstream"]; Default: "upstream" - login_
methods Sequence[str] - Enable login functionality with specified grants. Default: ["authorization_code"]
- login_
redirect_ strmode - Where to place
login_tokenswhen usingredirectlogin_action: -query: place tokens in query string -fragment: place tokens in url fragment (not readable by servers). possible known values include one of ["fragment", "query"]; Default: "fragment" - login_
redirect_ Sequence[str]uris - Where to redirect the client when
login_actionis set toredirect. - login_
tokens Sequence[str] - What tokens to include in
responsebody orredirectquery string or fragment: -id_token: include id token -access_token: include access token -refresh_token: include refresh token -tokens: include the full token endpoint response -introspection: include introspection response. Default: ["id_token"] - logout_
methods Sequence[str] - The request methods that can activate the logout: -
POST: HTTP POST method -GET: HTTP GET method -DELETE: HTTP DELETE method. Default: ["DELETE","POST"] - logout_
post_ strarg - The request body argument that activates the logout.
- logout_
query_ strarg - The request query argument that activates the logout.
- logout_
redirect_ Sequence[str]uris - Where to redirect the client after the logout.
- logout_
revoke bool - Revoke tokens as part of the logout.
- logout_
revoke_ boolaccess_ token - Revoke the access token as part of the logout. Requires
logout_revoketo be set totrue. Default: true - logout_
revoke_ boolrefresh_ token - Revoke the refresh token as part of the logout. Requires
logout_revoketo be set totrue. Default: true - logout_
uri_ strsuffix - The request URI suffix that activates the logout.
- max_
age float - The maximum age (in seconds) compared to the
auth_timeclaim. - mtls_
introspection_ strendpoint - Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - mtls_
revocation_ strendpoint - Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - mtls_
token_ strendpoint - Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - no_
proxy str - Do not use proxy with these hosts.
- password_
param_ Sequence[str]types - Where to look for the username and password: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - preserve_
query_ boolargs - With this parameter, you can preserve request query arguments even when doing authorization code flow. Default: false
- principals
Ai
Gateway Auth Strategy Openid Connect Config Principals - Configuration for Kong Identity principal hydration after token verification.
- proof_
of_ boolpossession_ auth_ methods_ validation - If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP. Default: true
- proof_
of_ strpossession_ dpop - Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof. possible known values include one of ["off", "optional", "strict"]; Default: "off"
- proof_
of_ strpossession_ mtls - Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401. possible known values include one of ["off", "optional", "strict"]; Default: "off"
- str
- The pushed authorization endpoint. If set it overrides the value in
pushed_authorization_request_endpointreturned by the discovery endpoint. - str
- The pushed authorization request endpoint authentication method:
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - redirect_
uris Sequence[str] - The redirect URI passed to the authorization and token endpoints.
- redis
Ai
Gateway Auth Strategy Openid Connect Config Redis - rediscovery_
lifetime float - Specifies how long (in seconds) the plugin waits between discovery attempts. Discovery is still triggered on an as-needed basis. Default: 30
- refresh_
token_ strparam_ name - The name of the parameter used to pass the refresh token.
- refresh_
token_ Sequence[str]param_ types - Where to look for the refresh token: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - refresh_
tokens bool - Specifies whether the plugin should try to refresh (soon to be) expired access tokens if the plugin has a
refresh_tokenavailable. Default: true - require_
proof_ boolkey_ for_ code_ exchange - Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of
code_challenge_methods_supported, and enabled automatically (in case thecode_challenge_methods_supportedis missing, the PKCE will not be enabled). - bool
- Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of
require_pushed_authorization_requests(which defaults tofalse). - require_
signed_ boolrequest_ object - Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of
require_signed_request_object, and enabled automatically (in case therequire_signed_request_objectis missing, the feature will not be enabled). - resolve_
distributed_ boolclaims - Distributed claims are represented by the
_claim_namesand_claim_sourcesmembers of the JSON object containing the claims. If this parameter is set totrue, the plugin explicitly resolves these distributed claims. Default: false - response_
mode str - Response mode passed to the authorization endpoint: -
query: for parameters in query string -form_post: for parameters in request body -fragment: for parameters in uri fragment (rarely useful as the plugin itself cannot read it) -query.jwt,form_post.jwt,fragment.jwt: similar toquery,form_postandfragmentbut the parameters are encoded in a JWT -jwt: shortcut that indicates the default encoding for the requested response type. possible known values include one of ["form_post", "form_post.jwt", "fragment", "fragment.jwt", "jwt", "query", "query.jwt"]; Default: "query" - response_
types Sequence[str] - The response type passed to the authorization endpoint. Default: ["code"]
- reverify bool
- Specifies whether to always verify tokens stored in the session. Default: false
- revocation_
endpoint str - The revocation endpoint. If set it overrides the value in
revocation_endpointreturned by the discovery endpoint. - revocation_
endpoint_ strauth_ method - The revocation endpoint authentication method: :
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - revocation_
token_ strparam_ name - Designate token's parameter name for revocation. Default: "token"
- roles_
claims Sequence[str] - The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["roles"]
- roles_
requireds Sequence[str] - The roles (
roles_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - run_
on_ boolpreflight - Specifies whether to run this plugin on pre-flight (
OPTIONS) requests. Default: true - scopes Sequence[str]
- The scopes passed to the authorization and token endpoints. Default: ["openid"]
- scopes_
claims Sequence[str] - The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["scope"]
- scopes_
requireds Sequence[str] - The scopes (
scopes_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - search_
user_ boolinfo - Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers. Default: false
- session_
absolute_ floattimeout - Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks. Default: 86400
- session_
audience str - The session audience, which is the intended target application. For example
"my-application". Default: "default" - session_
binds Sequence[str] - Bind the session to data acquired from the HTTP request or connection.
- str
- The session cookie Domain flag.
- bool
- Forbids JavaScript from accessing the cookie, for example, through the
Document.cookieproperty. Default: true - str
- The session cookie name. Default: "session"
- str
- The session cookie Path flag. Default: "/"
- str
- Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks. possible known values include one of ["Default", "Lax", "None", "Strict"]; Default: "Lax"
- bool
- Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
- session_
enforce_ boolsame_ subject - When set to
true, audiences are forced to share the same subject. Default: false - session_
hash_ boolstorage_ key - When set to
true, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie. Default: false - session_
hash_ boolsubject - When set to
true, the value of subject is hashed before being stored. Only applies whensession_store_metadatais enabled. Default: false - session_
idling_ floattimeout - Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching. Default: 900
- session_
memcached_ strhost - The memcached host. Default: "127.0.0.1"
- session_
memcached_ floatport - The memcached port. Default: 11211
- session_
memcached_ strprefix - The memcached session key prefix.
- session_
memcached_ strsocket - The memcached unix socket path.
- session_
memcached_ boolssl - If set to true, uses SSL to connect to memcached
- session_
memcached_ boolssl_ verify - If set to true, verifies the validity of the memcached server SSL certificate. Default: true
- session_
remember bool - Enables or disables persistent sessions. Default: false
- session_
remember_ floatabsolute_ timeout - Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks. Default: 2592000
- str
- Persistent session cookie name. Use with the
rememberconfiguration parameter. Default: "remember" - session_
remember_ floatrolling_ timeout - Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling. Default: 604800
- session_
request_ Sequence[str]headers - Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g.
[ "id", "timeout" ]will set Session-Id and Session-Timeout request headers. - session_
response_ Sequence[str]headers - Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g.
[ "id", "timeout" ]will set Session-Id and Session-Timeout response headers. - session_
rolling_ floattimeout - Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling. Default: 3600
- session_
secret str - The session secret.
- session_
storage str - The session storage for session data: -
cookie: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) -memcache: stores session data in memcached -redis: stores session data in Redis. possible known values include one of ["cookie", "memcache", "memcached", "redis"]; Default: "cookie" - session_
store_ boolmetadata - Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject. Default: false
- ssl_
verify bool - Verify identity provider server certificate. If set to
true, the plugin uses the CA certificate set in thekong.confconfig parameterlua_ssl_trusted_certificate. Default: true - timeout float
- Network IO timeout in milliseconds. Default: 10000
- tls_
client_ strauth_ cert_ id - ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server.
- tls_
client_ boolauth_ ssl_ verify - Verify identity provider server certificate during mTLS client authentication. Default: true
- token_
cache_ boolkey_ include_ scope - Include the scope in the token cache key, so token with different scopes are considered diffrent tokens. Default: false
- token_
endpoint str - The token endpoint. If set it overrides the value in
token_endpointreturned by the discovery endpoint. - token_
endpoint_ strauth_ method - The token endpoint authentication method:
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - token_
exchange AiGateway Auth Strategy Openid Connect Config Token Exchange - Details on how to accept tokens from other identity providers.
- token_
exchange_ strendpoint - Endpoint used to perform the legacy token exchange.
- token_
headers_ Sequence[str]clients - Extra headers passed from the client to the token endpoint.
- token_
headers_ Sequence[str]grants - Enable the sending of the token endpoint response headers only with certain grants: -
password: with OAuth password grant -client_credentials: with OAuth client credentials grant -authorization_code: with authorization code flow -refresh_tokenwith refresh token grant. - token_
headers_ Sequence[str]names - Extra header names passed to the token endpoint.
- token_
headers_ strprefix - Add a prefix to the token endpoint response headers before forwarding them to the downstream client.
- token_
headers_ Sequence[str]replays - The names of token endpoint response headers to forward to the downstream client.
- token_
headers_ Sequence[str]values - Extra header values passed to the token endpoint.
- token_
post_ Sequence[str]args_ clients - Pass extra arguments from the client to the OpenID-Connect plugin. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header This parameter can be used with
scopevalues, like this:config.token_post_args_client=scopeIn this case, the token would take thescopevalue from the query parameter or from the request body or from the header and send it to the token endpoint. - token_
post_ Sequence[str]args_ names - Extra post argument names passed to the token endpoint.
- token_
post_ Sequence[str]args_ values - Extra post argument values passed to the token endpoint.
- bool
- Destroy any active session for the unauthorized requests. Default: true
- str
- The error message for the unauthorized requests (when not using the redirection). Default: "Unauthorized"
- Sequence[str]
- Where to redirect the client on unauthorized requests.
- unexpected_
redirect_ Sequence[str]uris - Where to redirect the client when unexpected errors happen with the requests.
- upstream_
access_ strtoken_ header - The upstream access token header. Default: "authorization:bearer"
- upstream_
access_ strtoken_ jwk_ header - The upstream access token JWK header.
- upstream_
headers Sequence[AiGateway Auth Strategy Openid Connect Config Upstream Header] - The upstream claim to header mappings.
- upstream_
headers_ Sequence[str]claims - The upstream header claims. Only top level claims are supported.
- upstream_
headers_ Sequence[str]names - The upstream header names for the claim values.
- upstream_
id_ strtoken_ header - The upstream id token header.
- upstream_
id_ strtoken_ jwk_ header - The upstream id token JWK header.
- upstream_
introspection_ strheader - The upstream introspection header.
- upstream_
introspection_ strjwt_ header - The upstream introspection JWT header.
- upstream_
refresh_ strtoken_ header - The upstream refresh token header.
- upstream_
session_ strid_ header - The upstream session id header.
- upstream_
user_ strinfo_ header - The upstream user info header.
- upstream_
user_ strinfo_ jwt_ header - The upstream user info JWT header (in case the user info returns a JWT response).
- userinfo_
accept str - The value of
Acceptheader for user info requests: -application/json: user info response as JSON -application/jwt: user info response as JWT (from the obsolete IETF draft document). possible known values include one of ["application/json", "application/jwt"]; Default: "application/json" - userinfo_
endpoint str - The user info endpoint. If set it overrides the value in
userinfo_endpointreturned by the discovery endpoint. - userinfo_
headers_ Sequence[str]clients - Extra headers passed from the client to the user info endpoint.
- userinfo_
headers_ Sequence[str]names - Extra header names passed to the user info endpoint.
- userinfo_
headers_ Sequence[str]values - Extra header values passed to the user info endpoint.
- userinfo_
query_ Sequence[str]args_ clients - Extra query arguments passed from the client to the user info endpoint.
- userinfo_
query_ Sequence[str]args_ names - Extra query argument names passed to the user info endpoint.
- userinfo_
query_ Sequence[str]args_ values - Extra query argument values passed to the user info endpoint.
- using_
pseudo_ boolissuer - If the plugin uses a pseudo issuer. When set to true, the plugin will not discover the configuration from the issuer URL specified with
config.issuer. Default: false - verify_
claims bool - Verify tokens for standard claims. Default: true
- verify_
nonce bool - Verify nonce on authorization code flow. Default: true
- verify_
parameters bool - Verify plugin configuration against discovery. Default: false
- verify_
signature bool - Verify signature of tokens. Default: true
- anonymous String
- An optional string (consumer UUID or username) value that functions as an “anonymous” consumer if authentication fails. If empty (default null), requests that fail authentication will return a
4xxHTTP status code. This value must refer to the consumeridorusernameattribute, and not itscustom_id. - audience
Claims List<String> - The claim that contains the audience. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["aud"]
- audience
Requireds List<String> - The audiences (
audience_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - audiences List<String>
- The audience passed to the authorization endpoint.
- auth
Methods List<String> - Types of credentials/grants to enable. Default: ["authorizationcode","bearer","clientcredentials","introspection","kongoauth2","password","refreshtoken","session","userinfo"]
- authenticated
Groups List<String>Claims - The claim that contains authenticated groups. This setting can be used together with ACL plugin, but it also enables IdP managed groups with other applications and integrations. If multiple values are set, it means the claim is inside a nested object of the token payload.
- String
- The authorization cookie Domain flag.
- Boolean
- Forbids JavaScript from accessing the cookie, for example, through the
Document.cookieproperty. Default: true - String
- The authorization cookie name. Default: "authorization"
- String
- The authorization cookie Path flag. Default: "/"
- String
- Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks. possible known values include one of ["Default", "Lax", "None", "Strict"]; Default: "Default"
- Boolean
- Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
- String
- The authorization endpoint. If set it overrides the value in
authorization_endpointreturned by the discovery endpoint. - List<String>
- Extra query arguments passed from the client to the authorization endpoint.
- List<String>
- Extra query argument names passed to the authorization endpoint.
- List<String>
- Extra query argument values passed to the authorization endpoint.
- Number
- Specifies how long the session used for the authorization code flow can be used in seconds until it needs to be renewed. 0 disables the checks and rolling. Default: 600
- String
- The name of the cookie in which the bearer token is passed.
- bearer
Token List<String>Param Types - Where to look for the bearer token: -
header: search theAuthorization,access-token, andx-access-tokenHTTP headers -query: search the URL's query string -body: search the HTTP request body -cookie: search the HTTP request cookies specified withconfig.bearer_token_cookie_name. Default: ["body","header","query"] - by
Username BooleanIgnore Case - If
consumer_byis set tousername, specify whetherusernamecan match consumers case-insensitively. Default: false - cache
Introspection Boolean - Cache the introspection endpoint requests. Default: true
- cache
Token BooleanExchange - Cache the legacy token exchange endpoint requests. Default: true
- cache
Tokens Boolean - Cache the token endpoint requests. Default: true
- cache
Tokens StringSalt - Salt used for generating the cache key that is used for caching the token endpoint requests.
- cache
Ttl Number - The default cache ttl in seconds that is used in case the cached object does not specify the expiry. Default: 3600
- cache
Ttl NumberMax - The maximum cache ttl in seconds (enforced).
- cache
Ttl NumberMin - The minimum cache ttl in seconds (enforced).
- cache
Ttl NumberNeg - The negative cache ttl in seconds.
- cache
Ttl NumberResurrect - The resurrection ttl in seconds.
- cache
User BooleanInfo - Cache the user info requests. Default: true
- claims
Forbiddens List<String> - If given, these claims are forbidden in the token payload.
- client
Algs List<String> - The algorithm to use for clientsecretjwt (only HS***) or private*key*jwt authentication.
- client
Arg String - The client to use for this request (the selection is made with a request parameter with the same name). Default: "client_id"
- client
Auths List<String> - The default OpenID Connect client authentication method is 'clientsecretbasic' (using 'Authorization: Basic' header), 'clientsecretpost' (credentials in body), 'clientsecretjwt' (signed client assertion in body), 'privatekeyjwt' (private key-signed assertion), 'tlsclientauth' (client certificate), 'selfsignedtlsclientauth' (self-signed client certificate), and 'none' (no authentication).
- client
Credentials List<String>Param Types - Where to look for the client credentials: -
header: search the HTTP headers -query: search the URL's query string -body: search from the HTTP request body. Default: ["body","header","query"] - client
Ids List<String> - The client id(s) that the plugin uses when it calls authenticated endpoints on the identity provider.
- client
Jwks List<Property Map> - The JWK used for the privatekeyjwt authentication.
- client
Secrets List<String> - The client secret.
- cluster
Cache Property MapRedis - cluster
Cache StringStrategy - The strategy to use for the cluster cache. If set, the plugin will share cache with nodes configured with the same strategy backend. Currentlly only introspection cache is shared. possible known values include one of ["off", "redis"]; Default: "off"
- consumer
Bies List<String> - Consumer fields used for mapping: -
id: try to find the matching Consumer byid-username: try to find the matching Consumer byusername-custom_id: try to find the matching Consumer bycustom_id. Default: ["custom_id","username"] - consumer
Claims List<List<String>> - The claims used for consumer mapping. Each entry represents a claim path inside the token payload. The paths are evaluated in order, and the first matching claim is used.
- consumer
Groups List<String>Claims - The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload.
- consumer
Groups BooleanOptional - Do not terminate the request if consumer groups mapping fails. Default: false
- consumer
Optional Boolean - Do not terminate the request if consumer mapping fails. Default: false
- credential
Claims List<String> - The claim used to derive virtual credentials (e.g. to be consumed by the rate-limiting plugin), in case the consumer mapping is not used. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["sub"]
- disable
Sessions List<String> - Disable issuing the session cookie with the specified grants.
- discovery
Headers List<String>Names - Extra header names passed to the discovery endpoint.
- discovery
Headers List<String>Values - Extra header values passed to the discovery endpoint.
- display
Errors Boolean - Display errors on failure responses. Default: false
- domains List<String>
- The allowed values for the
hdclaim. - downstream
Access StringToken Header - The downstream access token header.
- downstream
Access StringToken Jwk Header - The downstream access token JWK header.
- downstream
Headers List<Property Map> - The downstream claim to header mappings.
- downstream
Headers List<String>Claims - The downstream header claims. Only top level claims are supported.
- downstream
Headers List<String>Names - The downstream header names for the claim values.
- downstream
Id StringToken Header - The downstream id token header.
- downstream
Id StringToken Jwk Header - The downstream id token JWK header.
- downstream
Introspection StringHeader - The downstream introspection header.
- downstream
Introspection StringJwt Header - The downstream introspection JWT header.
- downstream
Refresh StringToken Header - The downstream refresh token header.
- downstream
Session StringId Header - The downstream session id header.
- downstream
User StringInfo Header - The downstream user info header.
- downstream
User StringInfo Jwt Header - The downstream user info JWT header (in case the user info returns a JWT response).
- dpop
Proof NumberLifetime - Specifies the lifetime in seconds of the DPoP proof. It determines how long the same proof can be used after creation. The creation time is determined by the nonce creation time if a nonce is used, and the iat claim otherwise. Default: 300
- dpop
Use BooleanNonce - Specifies whether to challenge the client with a nonce value for DPoP proof. When enabled it will also be used to calculate the DPoP proof lifetime. Default: false
- enable
Hs BooleanSignatures - Enable shared secret, for example, HS256, signatures (when disabled they will not be accepted). Default: false
- end
Session StringEndpoint - The end session endpoint. If set it overrides the value in
end_session_endpointreturned by the discovery endpoint. - expose
Error BooleanCode - Specifies whether to expose the error code header, as defined in RFC 6750. If an authorization request fails, this header is sent in the response. Set to
falseto disable. Default: true - extra
Jwks List<String>Uris - JWKS URIs whose public keys are trusted (in addition to the keys found with the discovery).
- forbidden
Destroy BooleanSession - Destroy any active session for the forbidden requests. Default: true
- forbidden
Error StringMessage - The error message for the forbidden requests (when not using the redirection). Default: "Forbidden"
- forbidden
Redirect List<String>Uris - Where to redirect the client on forbidden requests.
- groups
Claims List<String> - The claim that contains the groups. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["groups"]
- groups
Requireds List<String> - The groups (
groups_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - hide
Credentials Boolean - Remove the credentials used for authentication from the request. If multiple credentials are sent with the same request, the plugin will remove those that were used for successful authentication. Default: true
- http
Proxy String - The HTTP proxy.
- String
- The HTTP proxy authorization.
- http
Version Number - The HTTP version used for the requests by this plugin: -
1.1: HTTP 1.1 (the default) -1.0: HTTP 1.0. - https
Proxy String - The HTTPS proxy.
- String
- The HTTPS proxy authorization.
- id
Token StringParam Name - The name of the parameter used to pass the id token.
- id
Token List<String>Param Types - Where to look for the id token: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - ignore
Signatures List<String> - Skip the token signature verification on certain grants. This is insecure and logs a warning; use it only for providers that publish no verification key. Grants: -
password: OAuth password grant -client_credentials: OAuth client credentials grant -authorization_code: authorization code flow -refresh_token: OAuth refresh token grant -session: session cookie authentication -introspection: OAuth introspection -userinfo: OpenID Connect user info endpoint authentication. Default: [] - introspect
Jwt BooleanTokens - Specifies whether to introspect the JWT access tokens (can be used to check for revocations). Default: false
- introspection
Accept String - The value of
Acceptheader for introspection requests: -application/json: introspection response as JSON -application/token-introspection+jwt: introspection response as JWT (from the current IETF draft document) -application/jwt: introspection response as JWT (from the obsolete IETF draft document). possible known values include one of ["application/json", "application/jwt", "application/token-introspection+jwt"]; Default: "application/json" - introspection
Check BooleanActive - Check that the introspection response has an
activeclaim with a value oftrue. Default: true - introspection
Endpoint String - The introspection endpoint. If set it overrides the value in
introspection_endpointreturned by the discovery endpoint. - introspection
Endpoint StringAuth Method - The introspection endpoint authentication method: :
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["clientsecretbasic", "clientsecretjwt", "clientsecretpost", "none", "privatekeyjwt", "selfsignedtlsclientauth", "tlsclientauth"] - introspection
Headers List<String>Clients - Extra headers passed from the client to the introspection endpoint.
- introspection
Headers List<String>Names - Extra header names passed to the introspection endpoint.
- introspection
Headers List<String>Values - Extra header values passed to the introspection endpoint.
- introspection
Hint String - Introspection hint parameter value passed to the introspection endpoint. Default: "access_token"
- introspection
Post List<String>Args Client Headers - Extra post arguments passed from the client headers to the introspection endpoint.
- introspection
Post List<String>Args Clients - Extra post arguments passed from the client to the introspection endpoint.
- introspection
Post List<String>Args Names - Extra post argument names passed to the introspection endpoint.
- introspection
Post List<String>Args Values - Extra post argument values passed to the introspection endpoint.
- introspection
Token StringParam Name - Designate token's parameter name for introspection. Default: "token"
- issuer String
- The discovery endpoint (or the issuer identifier). When there is no discovery endpoint, please also configure
config.using_pseudo_issuer=true. Not Null - issuers
Alloweds List<String> - The issuers allowed to be present in the tokens (
issclaim). - jwks
Endpoint String - Overrides the
jwks_urireturned by discovery. Use when the IdP exposes a non-standard JWKS endpoint. - jwt
Session StringClaim - The claim to match against the JWT session cookie. Default: "sid"
- String
- The name of the JWT session cookie.
- keepalive Boolean
- Use keepalive with the HTTP client. Default: true
- leeway Number
- Defines leeway time (in seconds) for
auth_time,exp,iat, andnbfclaims. Default: 0 - login
Action String - What to do after successful login: -
upstream: proxy request to upstream service -response: terminate request with a response -redirect: redirect to a different location. possible known values include one of ["redirect", "response", "upstream"]; Default: "upstream" - login
Methods List<String> - Enable login functionality with specified grants. Default: ["authorization_code"]
- login
Redirect StringMode - Where to place
login_tokenswhen usingredirectlogin_action: -query: place tokens in query string -fragment: place tokens in url fragment (not readable by servers). possible known values include one of ["fragment", "query"]; Default: "fragment" - login
Redirect List<String>Uris - Where to redirect the client when
login_actionis set toredirect. - login
Tokens List<String> - What tokens to include in
responsebody orredirectquery string or fragment: -id_token: include id token -access_token: include access token -refresh_token: include refresh token -tokens: include the full token endpoint response -introspection: include introspection response. Default: ["id_token"] - logout
Methods List<String> - The request methods that can activate the logout: -
POST: HTTP POST method -GET: HTTP GET method -DELETE: HTTP DELETE method. Default: ["DELETE","POST"] - logout
Post StringArg - The request body argument that activates the logout.
- logout
Query StringArg - The request query argument that activates the logout.
- logout
Redirect List<String>Uris - Where to redirect the client after the logout.
- logout
Revoke Boolean - Revoke tokens as part of the logout.
- logout
Revoke BooleanAccess Token - Revoke the access token as part of the logout. Requires
logout_revoketo be set totrue. Default: true - logout
Revoke BooleanRefresh Token - Revoke the refresh token as part of the logout. Requires
logout_revoketo be set totrue. Default: true - logout
Uri StringSuffix - The request URI suffix that activates the logout.
- max
Age Number - The maximum age (in seconds) compared to the
auth_timeclaim. - mtls
Introspection StringEndpoint - Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - mtls
Revocation StringEndpoint - Alias for the introspection endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - mtls
Token StringEndpoint - Alias for the token endpoint to be used for mTLS client authentication. If set it overrides the value in
mtls_endpoint_aliasesreturned by the discovery endpoint. - no
Proxy String - Do not use proxy with these hosts.
- password
Param List<String>Types - Where to look for the username and password: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - preserve
Query BooleanArgs - With this parameter, you can preserve request query arguments even when doing authorization code flow. Default: false
- principals Property Map
- Configuration for Kong Identity principal hydration after token verification.
- proof
Of BooleanPossession Auth Methods Validation - If set to true, only the auth_methods that are compatible with Proof of Possession (PoP) can be configured when PoP is enabled. If set to false, all auth_methods will be configurable and PoP checks will be silently skipped for those auth_methods that are not compatible with PoP. Default: true
- proof
Of StringPossession Dpop - Enable Demonstrating Proof-of-Possession (DPoP). If set to strict, all request are verified despite the presence of the DPoP key claim (cnf.jkt). If set to optional, only tokens bound with DPoP's key are verified with the proof. possible known values include one of ["off", "optional", "strict"]; Default: "off"
- proof
Of StringPossession Mtls - Enable mtls proof of possession. If set to strict, all tokens (from supported auth_methods: bearer, introspection, and session granted with bearer or introspection) are verified, if set to optional, only tokens that contain the certificate hash claim are verified. If the verification fails, the request will be rejected with 401. possible known values include one of ["off", "optional", "strict"]; Default: "off"
- String
- The pushed authorization endpoint. If set it overrides the value in
pushed_authorization_request_endpointreturned by the discovery endpoint. - String
- The pushed authorization request endpoint authentication method:
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - redirect
Uris List<String> - The redirect URI passed to the authorization and token endpoints.
- redis Property Map
- rediscovery
Lifetime Number - Specifies how long (in seconds) the plugin waits between discovery attempts. Discovery is still triggered on an as-needed basis. Default: 30
- refresh
Token StringParam Name - The name of the parameter used to pass the refresh token.
- refresh
Token List<String>Param Types - Where to look for the refresh token: -
header: search the HTTP headers -query: search the URL's query string -body: search the HTTP request body. Default: ["body","header","query"] - refresh
Tokens Boolean - Specifies whether the plugin should try to refresh (soon to be) expired access tokens if the plugin has a
refresh_tokenavailable. Default: true - require
Proof BooleanKey For Code Exchange - Forcibly enable or disable the proof key for code exchange. When not set the value is determined through the discovery using the value of
code_challenge_methods_supported, and enabled automatically (in case thecode_challenge_methods_supportedis missing, the PKCE will not be enabled). - Boolean
- Forcibly enable or disable the pushed authorization requests. When not set the value is determined through the discovery using the value of
require_pushed_authorization_requests(which defaults tofalse). - require
Signed BooleanRequest Object - Forcibly enable or disable the usage of signed request object on authorization or pushed authorization endpoint. When not set the value is determined through the discovery using the value of
require_signed_request_object, and enabled automatically (in case therequire_signed_request_objectis missing, the feature will not be enabled). - resolve
Distributed BooleanClaims - Distributed claims are represented by the
_claim_namesand_claim_sourcesmembers of the JSON object containing the claims. If this parameter is set totrue, the plugin explicitly resolves these distributed claims. Default: false - response
Mode String - Response mode passed to the authorization endpoint: -
query: for parameters in query string -form_post: for parameters in request body -fragment: for parameters in uri fragment (rarely useful as the plugin itself cannot read it) -query.jwt,form_post.jwt,fragment.jwt: similar toquery,form_postandfragmentbut the parameters are encoded in a JWT -jwt: shortcut that indicates the default encoding for the requested response type. possible known values include one of ["form_post", "form_post.jwt", "fragment", "fragment.jwt", "jwt", "query", "query.jwt"]; Default: "query" - response
Types List<String> - The response type passed to the authorization endpoint. Default: ["code"]
- reverify Boolean
- Specifies whether to always verify tokens stored in the session. Default: false
- revocation
Endpoint String - The revocation endpoint. If set it overrides the value in
revocation_endpointreturned by the discovery endpoint. - revocation
Endpoint StringAuth Method - The revocation endpoint authentication method: :
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - revocation
Token StringParam Name - Designate token's parameter name for revocation. Default: "token"
- roles
Claims List<String> - The claim that contains the roles. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["roles"]
- roles
Requireds List<String> - The roles (
roles_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - run
On BooleanPreflight - Specifies whether to run this plugin on pre-flight (
OPTIONS) requests. Default: true - scopes List<String>
- The scopes passed to the authorization and token endpoints. Default: ["openid"]
- scopes
Claims List<String> - The claim that contains the scopes. If multiple values are set, it means the claim is inside a nested object of the token payload. Default: ["scope"]
- scopes
Requireds List<String> - The scopes (
scopes_claimclaim) required to be present in the access token (or introspection results) for successful authorization. This config parameter works in both AND / OR cases. - search
User BooleanInfo - Specify whether to use the user info endpoint to get additional claims for consumer mapping, credential mapping, authenticated groups, and upstream and downstream headers. Default: false
- session
Absolute NumberTimeout - Limits how long the session can be renewed in seconds, until re-authentication is required. 0 disables the checks. Default: 86400
- session
Audience String - The session audience, which is the intended target application. For example
"my-application". Default: "default" - session
Binds List<String> - Bind the session to data acquired from the HTTP request or connection.
- String
- The session cookie Domain flag.
- Boolean
- Forbids JavaScript from accessing the cookie, for example, through the
Document.cookieproperty. Default: true - String
- The session cookie name. Default: "session"
- String
- The session cookie Path flag. Default: "/"
- String
- Controls whether a cookie is sent with cross-origin requests, providing some protection against cross-site request forgery attacks. possible known values include one of ["Default", "Lax", "None", "Strict"]; Default: "Lax"
- Boolean
- Cookie is only sent to the server when a request is made with the https: scheme (except on localhost), and therefore is more resistant to man-in-the-middle attacks.
- session
Enforce BooleanSame Subject - When set to
true, audiences are forced to share the same subject. Default: false - session
Hash BooleanStorage Key - When set to
true, the storage key (session ID) is hashed for extra security. Hashing the storage key means it is impossible to decrypt data from the storage without a cookie. Default: false - session
Hash BooleanSubject - When set to
true, the value of subject is hashed before being stored. Only applies whensession_store_metadatais enabled. Default: false - session
Idling NumberTimeout - Specifies how long the session can be inactive until it is considered invalid in seconds. 0 disables the checks and touching. Default: 900
- session
Memcached StringHost - The memcached host. Default: "127.0.0.1"
- session
Memcached NumberPort - The memcached port. Default: 11211
- session
Memcached StringPrefix - The memcached session key prefix.
- session
Memcached StringSocket - The memcached unix socket path.
- session
Memcached BooleanSsl - If set to true, uses SSL to connect to memcached
- session
Memcached BooleanSsl Verify - If set to true, verifies the validity of the memcached server SSL certificate. Default: true
- session
Remember Boolean - Enables or disables persistent sessions. Default: false
- session
Remember NumberAbsolute Timeout - Limits how long the persistent session can be renewed in seconds, until re-authentication is required. 0 disables the checks. Default: 2592000
- String
- Persistent session cookie name. Use with the
rememberconfiguration parameter. Default: "remember" - session
Remember NumberRolling Timeout - Specifies how long the persistent session is considered valid in seconds. 0 disables the checks and rolling. Default: 604800
- session
Request List<String>Headers - Set of headers to send to upstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g.
[ "id", "timeout" ]will set Session-Id and Session-Timeout request headers. - session
Response List<String>Headers - Set of headers to send to downstream, use id, audience, subject, timeout, idling-timeout, rolling-timeout, absolute-timeout. E.g.
[ "id", "timeout" ]will set Session-Id and Session-Timeout response headers. - session
Rolling NumberTimeout - Specifies how long the session can be used in seconds until it needs to be renewed. 0 disables the checks and rolling. Default: 3600
- session
Secret String - The session secret.
- session
Storage String - The session storage for session data: -
cookie: stores session data with the session cookie (the session cannot be invalidated or revoked without changing session secret, but is stateless, and doesn't require a database) -memcache: stores session data in memcached -redis: stores session data in Redis. possible known values include one of ["cookie", "memcache", "memcached", "redis"]; Default: "cookie" - session
Store BooleanMetadata - Configures whether or not session metadata should be stored. This metadata includes information about the active sessions for a specific audience belonging to a specific subject. Default: false
- ssl
Verify Boolean - Verify identity provider server certificate. If set to
true, the plugin uses the CA certificate set in thekong.confconfig parameterlua_ssl_trusted_certificate. Default: true - timeout Number
- Network IO timeout in milliseconds. Default: 10000
- tls
Client StringAuth Cert Id - ID of the Certificate entity representing the client certificate to use for mTLS client authentication for connections between Kong and the Auth Server.
- tls
Client BooleanAuth Ssl Verify - Verify identity provider server certificate during mTLS client authentication. Default: true
- token
Cache BooleanKey Include Scope - Include the scope in the token cache key, so token with different scopes are considered diffrent tokens. Default: false
- token
Endpoint String - The token endpoint. If set it overrides the value in
token_endpointreturned by the discovery endpoint. - token
Endpoint StringAuth Method - The token endpoint authentication method:
client_secret_basic,client_secret_post,client_secret_jwt,private_key_jwt,tls_client_auth,self_signed_tls_client_auth, ornone: do not authenticate. possible known values include one of ["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"] - token
Exchange Property Map - Details on how to accept tokens from other identity providers.
- token
Exchange StringEndpoint - Endpoint used to perform the legacy token exchange.
- token
Headers List<String>Clients - Extra headers passed from the client to the token endpoint.
- token
Headers List<String>Grants - Enable the sending of the token endpoint response headers only with certain grants: -
password: with OAuth password grant -client_credentials: with OAuth client credentials grant -authorization_code: with authorization code flow -refresh_tokenwith refresh token grant. - token
Headers List<String>Names - Extra header names passed to the token endpoint.
- token
Headers StringPrefix - Add a prefix to the token endpoint response headers before forwarding them to the downstream client.
- token
Headers List<String>Replays - The names of token endpoint response headers to forward to the downstream client.
- token
Headers List<String>Values - Extra header values passed to the token endpoint.
- token
Post List<String>Args Clients - Pass extra arguments from the client to the OpenID-Connect plugin. If arguments exist, the client can pass them using: - Query parameters - Request Body - Request Header This parameter can be used with
scopevalues, like this:config.token_post_args_client=scopeIn this case, the token would take thescopevalue from the query parameter or from the request body or from the header and send it to the token endpoint. - token
Post List<String>Args Names - Extra post argument names passed to the token endpoint.
- token
Post List<String>Args Values - Extra post argument values passed to the token endpoint.
- Boolean
- Destroy any active session for the unauthorized requests. Default: true
- String
- The error message for the unauthorized requests (when not using the redirection). Default: "Unauthorized"
- List<String>
- Where to redirect the client on unauthorized requests.
- unexpected
Redirect List<String>Uris - Where to redirect the client when unexpected errors happen with the requests.
- upstream
Access StringToken Header - The upstream access token header. Default: "authorization:bearer"
- upstream
Access StringToken Jwk Header - The upstream access token JWK header.
- upstream
Headers List<Property Map> - The upstream claim to header mappings.
- upstream
Headers List<String>Claims - The upstream header claims. Only top level claims are supported.
- upstream
Headers List<String>Names - The upstream header names for the claim values.
- upstream
Id StringToken Header - The upstream id token header.
- upstream
Id StringToken Jwk Header - The upstream id token JWK header.
- upstream
Introspection StringHeader - The upstream introspection header.
- upstream
Introspection StringJwt Header - The upstream introspection JWT header.
- upstream
Refresh StringToken Header - The upstream refresh token header.
- upstream
Session StringId Header - The upstream session id header.
- upstream
User StringInfo Header - The upstream user info header.
- upstream
User StringInfo Jwt Header - The upstream user info JWT header (in case the user info returns a JWT response).
- userinfo
Accept String - The value of
Acceptheader for user info requests: -application/json: user info response as JSON -application/jwt: user info response as JWT (from the obsolete IETF draft document). possible known values include one of ["application/json", "application/jwt"]; Default: "application/json" - userinfo
Endpoint String - The user info endpoint. If set it overrides the value in
userinfo_endpointreturned by the discovery endpoint. - userinfo
Headers List<String>Clients - Extra headers passed from the client to the user info endpoint.
- userinfo
Headers List<String>Names - Extra header names passed to the user info endpoint.
- userinfo
Headers List<String>Values - Extra header values passed to the user info endpoint.
- userinfo
Query List<String>Args Clients - Extra query arguments passed from the client to the user info endpoint.
- userinfo
Query List<String>Args Names - Extra query argument names passed to the user info endpoint.
- userinfo
Query List<String>Args Values - Extra query argument values passed to the user info endpoint.
- using
Pseudo BooleanIssuer - If the plugin uses a pseudo issuer. When set to true, the plugin will not discover the configuration from the issuer URL specified with
config.issuer. Default: false - verify
Claims Boolean - Verify tokens for standard claims. Default: true
- verify
Nonce Boolean - Verify nonce on authorization code flow. Default: true
- verify
Parameters Boolean - Verify plugin configuration against discovery. Default: false
- verify
Signature Boolean - Verify signature of tokens. Default: true
AiGatewayAuthStrategyOpenidConnectConfigClientJwk, AiGatewayAuthStrategyOpenidConnectConfigClientJwkArgs
AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedis, AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisArgs
- Cloud
Authentication AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Cloud Authentication - Cloud auth related configs for connecting to a Cloud Provider's Redis instance.
- Cluster
Max doubleRedirections - Maximum retry attempts for redirection. Default: 5
- Cluster
Nodes List<AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. - Connect
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. Default: "127.0.0.1"
- Keepalive
Backlog double - Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size. - Keepalive
Pool doubleSize - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_sizenorkeepalive_backlogis specified, no pool is created. Ifkeepalive_pool_sizeisn't specified butkeepalive_backlogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256 - Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. Default: "6379"
- Read
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Master string - Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Sentinel
Nodes List<AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Sentinel
Password string - Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
- Sentinel
Role string - Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Sentinel
Username string - Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
- Server
Name string - A string representing an SNI (server name indication) value for TLS.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: false
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default.
- Cloud
Authentication AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Cloud Authentication - Cloud auth related configs for connecting to a Cloud Provider's Redis instance.
- Cluster
Max float64Redirections - Maximum retry attempts for redirection. Default: 5
- Cluster
Nodes []AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Cluster Node - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. - Connect
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database float64
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. Default: "127.0.0.1"
- Keepalive
Backlog float64 - Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size. - Keepalive
Pool float64Size - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_sizenorkeepalive_backlogis specified, no pool is created. Ifkeepalive_pool_sizeisn't specified butkeepalive_backlogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256 - Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. Default: "6379"
- Read
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Master string - Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Sentinel
Nodes []AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Sentinel Node - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Sentinel
Password string - Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
- Sentinel
Role string - Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Sentinel
Username string - Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
- Server
Name string - A string representing an SNI (server name indication) value for TLS.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: false
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default.
- cloud_
authentication object - Cloud auth related configs for connecting to a Cloud Provider's Redis instance.
- cluster_
max_ numberredirections - Maximum retry attempts for redirection. Default: 5
- cluster_
nodes list(object) - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. - connect_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. Default: "127.0.0.1"
- keepalive_
backlog number - Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size. - keepalive_
pool_ numbersize - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_sizenorkeepalive_backlogis specified, no pool is created. Ifkeepalive_pool_sizeisn't specified butkeepalive_backlogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256 - password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
- port string
- An integer representing a port number between 0 and 65535, inclusive. Default: "6379"
- read_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel_
master string - Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- sentinel_
nodes list(object) - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - sentinel_
password string - Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
- sentinel_
role string - Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - sentinel_
username string - Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
- server_
name string - A string representing an SNI (server name indication) value for TLS.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: false
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default.
- cloud
Authentication AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Cloud Authentication - Cloud auth related configs for connecting to a Cloud Provider's Redis instance.
- cluster
Max DoubleRedirections - Maximum retry attempts for redirection. Default: 5
- cluster
Nodes List<AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. - connect
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. Default: "127.0.0.1"
- keepalive
Backlog Double - Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size. - keepalive
Pool DoubleSize - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_sizenorkeepalive_backlogis specified, no pool is created. Ifkeepalive_pool_sizeisn't specified butkeepalive_backlogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256 - password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
- port String
- An integer representing a port number between 0 and 65535, inclusive. Default: "6379"
- read
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Master String - Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- sentinel
Nodes List<AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - sentinel
Password String - Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
- sentinel
Role String - Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - sentinel
Username String - Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
- server
Name String - A string representing an SNI (server name indication) value for TLS.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: false
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default.
- cloud
Authentication AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Cloud Authentication - Cloud auth related configs for connecting to a Cloud Provider's Redis instance.
- cluster
Max numberRedirections - Maximum retry attempts for redirection. Default: 5
- cluster
Nodes AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Cluster Node[] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. - connect
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is booleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. Default: "127.0.0.1"
- keepalive
Backlog number - Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size. - keepalive
Pool numberSize - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_sizenorkeepalive_backlogis specified, no pool is created. Ifkeepalive_pool_sizeisn't specified butkeepalive_backlogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256 - password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
- port string
- An integer representing a port number between 0 and 65535, inclusive. Default: "6379"
- read
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Master string - Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- sentinel
Nodes AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Sentinel Node[] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - sentinel
Password string - Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
- sentinel
Role string - Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - sentinel
Username string - Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
- server
Name string - A string representing an SNI (server name indication) value for TLS.
- ssl boolean
- If set to true, uses SSL to connect to Redis. Default: false
- ssl
Verify boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default.
- cloud_
authentication AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Cloud Authentication - Cloud auth related configs for connecting to a Cloud Provider's Redis instance.
- cluster_
max_ floatredirections - Maximum retry attempts for redirection. Default: 5
- cluster_
nodes Sequence[AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Cluster Node] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. - connect_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database float
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host str
- A string representing a host name, such as example.com. Default: "127.0.0.1"
- keepalive_
backlog float - Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size. - keepalive_
pool_ floatsize - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_sizenorkeepalive_backlogis specified, no pool is created. Ifkeepalive_pool_sizeisn't specified butkeepalive_backlogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256 - password str
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
- port str
- An integer representing a port number between 0 and 65535, inclusive. Default: "6379"
- read_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel_
master str - Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- sentinel_
nodes Sequence[AiGateway Auth Strategy Openid Connect Config Cluster Cache Redis Sentinel Node] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - sentinel_
password str - Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
- sentinel_
role str - Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - sentinel_
username str - Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
- server_
name str - A string representing an SNI (server name indication) value for TLS.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: false
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username str
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default.
- cloud
Authentication Property Map - Cloud auth related configs for connecting to a Cloud Provider's Redis instance.
- cluster
Max NumberRedirections - Maximum retry attempts for redirection. Default: 5
- cluster
Nodes List<Property Map> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. - connect
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. Default: "127.0.0.1"
- keepalive
Backlog Number - Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size. - keepalive
Pool NumberSize - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_sizenorkeepalive_backlogis specified, no pool is created. Ifkeepalive_pool_sizeisn't specified butkeepalive_backlogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256 - password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
- port String
- An integer representing a port number between 0 and 65535, inclusive. Default: "6379"
- read
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Master String - Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- sentinel
Nodes List<Property Map> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - sentinel
Password String - Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
- sentinel
Role String - Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - sentinel
Username String - Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
- server
Name String - A string representing an SNI (server name indication) value for TLS.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: false
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default.
AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisCloudAuthentication, AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisCloudAuthenticationArgs
- Auth
Provider string - Auth providers to be used to authenticate to a Cloud Provider's Redis instance. possible known values include one of ["aws", "azure", "gcp"]
- Aws
Access stringKey Id - AWS Access Key ID to be used for authentication when
auth_provideris set toaws. - Aws
Assume stringRole Arn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.
- Aws
Cache stringName - The name of the AWS Elasticache cluster when
auth_provideris set toaws. - Aws
Is boolServerless - This flag specifies whether the cluster is serverless when auth_provider is set to
aws. Default: true - Aws
Region string - The region of the AWS ElastiCache cluster when
auth_provideris set toaws. - Aws
Role stringSession Name - The session name for the temporary credentials when assuming the IAM role.
- Aws
Secret stringAccess Key - AWS Secret Access Key to be used for authentication when
auth_provideris set toaws. - Azure
Client stringId - Azure Client ID to be used for authentication when
auth_provideris set toazure. - Azure
Client stringSecret - Azure Client Secret to be used for authentication when
auth_provideris set toazure. - Azure
Tenant stringId - Azure Tenant ID to be used for authentication when
auth_provideris set toazure. - Gcp
Service stringAccount Json - GCP Service Account JSON to be used for authentication when
auth_provideris set togcp.
- Auth
Provider string - Auth providers to be used to authenticate to a Cloud Provider's Redis instance. possible known values include one of ["aws", "azure", "gcp"]
- Aws
Access stringKey Id - AWS Access Key ID to be used for authentication when
auth_provideris set toaws. - Aws
Assume stringRole Arn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.
- Aws
Cache stringName - The name of the AWS Elasticache cluster when
auth_provideris set toaws. - Aws
Is boolServerless - This flag specifies whether the cluster is serverless when auth_provider is set to
aws. Default: true - Aws
Region string - The region of the AWS ElastiCache cluster when
auth_provideris set toaws. - Aws
Role stringSession Name - The session name for the temporary credentials when assuming the IAM role.
- Aws
Secret stringAccess Key - AWS Secret Access Key to be used for authentication when
auth_provideris set toaws. - Azure
Client stringId - Azure Client ID to be used for authentication when
auth_provideris set toazure. - Azure
Client stringSecret - Azure Client Secret to be used for authentication when
auth_provideris set toazure. - Azure
Tenant stringId - Azure Tenant ID to be used for authentication when
auth_provideris set toazure. - Gcp
Service stringAccount Json - GCP Service Account JSON to be used for authentication when
auth_provideris set togcp.
- auth_
provider string - Auth providers to be used to authenticate to a Cloud Provider's Redis instance. possible known values include one of ["aws", "azure", "gcp"]
- aws_
access_ stringkey_ id - AWS Access Key ID to be used for authentication when
auth_provideris set toaws. - aws_
assume_ stringrole_ arn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.
- aws_
cache_ stringname - The name of the AWS Elasticache cluster when
auth_provideris set toaws. - aws_
is_ boolserverless - This flag specifies whether the cluster is serverless when auth_provider is set to
aws. Default: true - aws_
region string - The region of the AWS ElastiCache cluster when
auth_provideris set toaws. - aws_
role_ stringsession_ name - The session name for the temporary credentials when assuming the IAM role.
- aws_
secret_ stringaccess_ key - AWS Secret Access Key to be used for authentication when
auth_provideris set toaws. - azure_
client_ stringid - Azure Client ID to be used for authentication when
auth_provideris set toazure. - azure_
client_ stringsecret - Azure Client Secret to be used for authentication when
auth_provideris set toazure. - azure_
tenant_ stringid - Azure Tenant ID to be used for authentication when
auth_provideris set toazure. - gcp_
service_ stringaccount_ json - GCP Service Account JSON to be used for authentication when
auth_provideris set togcp.
- auth
Provider String - Auth providers to be used to authenticate to a Cloud Provider's Redis instance. possible known values include one of ["aws", "azure", "gcp"]
- aws
Access StringKey Id - AWS Access Key ID to be used for authentication when
auth_provideris set toaws. - aws
Assume StringRole Arn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.
- aws
Cache StringName - The name of the AWS Elasticache cluster when
auth_provideris set toaws. - aws
Is BooleanServerless - This flag specifies whether the cluster is serverless when auth_provider is set to
aws. Default: true - aws
Region String - The region of the AWS ElastiCache cluster when
auth_provideris set toaws. - aws
Role StringSession Name - The session name for the temporary credentials when assuming the IAM role.
- aws
Secret StringAccess Key - AWS Secret Access Key to be used for authentication when
auth_provideris set toaws. - azure
Client StringId - Azure Client ID to be used for authentication when
auth_provideris set toazure. - azure
Client StringSecret - Azure Client Secret to be used for authentication when
auth_provideris set toazure. - azure
Tenant StringId - Azure Tenant ID to be used for authentication when
auth_provideris set toazure. - gcp
Service StringAccount Json - GCP Service Account JSON to be used for authentication when
auth_provideris set togcp.
- auth
Provider string - Auth providers to be used to authenticate to a Cloud Provider's Redis instance. possible known values include one of ["aws", "azure", "gcp"]
- aws
Access stringKey Id - AWS Access Key ID to be used for authentication when
auth_provideris set toaws. - aws
Assume stringRole Arn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.
- aws
Cache stringName - The name of the AWS Elasticache cluster when
auth_provideris set toaws. - aws
Is booleanServerless - This flag specifies whether the cluster is serverless when auth_provider is set to
aws. Default: true - aws
Region string - The region of the AWS ElastiCache cluster when
auth_provideris set toaws. - aws
Role stringSession Name - The session name for the temporary credentials when assuming the IAM role.
- aws
Secret stringAccess Key - AWS Secret Access Key to be used for authentication when
auth_provideris set toaws. - azure
Client stringId - Azure Client ID to be used for authentication when
auth_provideris set toazure. - azure
Client stringSecret - Azure Client Secret to be used for authentication when
auth_provideris set toazure. - azure
Tenant stringId - Azure Tenant ID to be used for authentication when
auth_provideris set toazure. - gcp
Service stringAccount Json - GCP Service Account JSON to be used for authentication when
auth_provideris set togcp.
- auth_
provider str - Auth providers to be used to authenticate to a Cloud Provider's Redis instance. possible known values include one of ["aws", "azure", "gcp"]
- aws_
access_ strkey_ id - AWS Access Key ID to be used for authentication when
auth_provideris set toaws. - aws_
assume_ strrole_ arn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.
- aws_
cache_ strname - The name of the AWS Elasticache cluster when
auth_provideris set toaws. - aws_
is_ boolserverless - This flag specifies whether the cluster is serverless when auth_provider is set to
aws. Default: true - aws_
region str - The region of the AWS ElastiCache cluster when
auth_provideris set toaws. - aws_
role_ strsession_ name - The session name for the temporary credentials when assuming the IAM role.
- aws_
secret_ straccess_ key - AWS Secret Access Key to be used for authentication when
auth_provideris set toaws. - azure_
client_ strid - Azure Client ID to be used for authentication when
auth_provideris set toazure. - azure_
client_ strsecret - Azure Client Secret to be used for authentication when
auth_provideris set toazure. - azure_
tenant_ strid - Azure Tenant ID to be used for authentication when
auth_provideris set toazure. - gcp_
service_ straccount_ json - GCP Service Account JSON to be used for authentication when
auth_provideris set togcp.
- auth
Provider String - Auth providers to be used to authenticate to a Cloud Provider's Redis instance. possible known values include one of ["aws", "azure", "gcp"]
- aws
Access StringKey Id - AWS Access Key ID to be used for authentication when
auth_provideris set toaws. - aws
Assume StringRole Arn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.
- aws
Cache StringName - The name of the AWS Elasticache cluster when
auth_provideris set toaws. - aws
Is BooleanServerless - This flag specifies whether the cluster is serverless when auth_provider is set to
aws. Default: true - aws
Region String - The region of the AWS ElastiCache cluster when
auth_provideris set toaws. - aws
Role StringSession Name - The session name for the temporary credentials when assuming the IAM role.
- aws
Secret StringAccess Key - AWS Secret Access Key to be used for authentication when
auth_provideris set toaws. - azure
Client StringId - Azure Client ID to be used for authentication when
auth_provideris set toazure. - azure
Client StringSecret - Azure Client Secret to be used for authentication when
auth_provideris set toazure. - azure
Tenant StringId - Azure Tenant ID to be used for authentication when
auth_provideris set toazure. - gcp
Service StringAccount Json - GCP Service Account JSON to be used for authentication when
auth_provideris set togcp.
AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisClusterNode, AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisClusterNodeArgs
AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisSentinelNode, AiGatewayAuthStrategyOpenidConnectConfigClusterCacheRedisSentinelNodeArgs
AiGatewayAuthStrategyOpenidConnectConfigDownstreamHeader, AiGatewayAuthStrategyOpenidConnectConfigDownstreamHeaderArgs
AiGatewayAuthStrategyOpenidConnectConfigPrincipals, AiGatewayAuthStrategyOpenidConnectConfigPrincipalsArgs
- Directory string
- The Kong Identity directory instance to look up against. Default: "default"
- Enabled bool
- When true, query Kong Identity to map a Principal after token verification. Default: false
- Error
On boolMiss - When true (default), return 401 if fail to match a Principal in Kong Identity after token verification. When false, the request continues without authenticated_principal set. Default: true
- Match
Consumer bool - If a Consumer is attached to the matched Principal in Kong Identity, load it and set it in the request context, overriding consumer_by. Default: true
- Match
Consumer boolGroups - If Consumer Groups are attached to the matched Principal in Kong Identity, load them, overriding consumergroupsclaim. Default: true
- Principal
By string - Custom identity name for a type=custom Kong Identity lookup. When absent and principalclaim is set, an OIDC lookup is performed using principalclaim as the claim name instead of 'sub'.
- Principal
Claims List<string> - Token claim to use for the Kong Identity lookup. If multiple values are set, it means the claim is inside a nested object of the token payload. When principal_by is also set, performs a custom identity lookup (type=custom). When set alone, performs an OIDC lookup using this claim name instead of the default 'sub'.
- Directory string
- The Kong Identity directory instance to look up against. Default: "default"
- Enabled bool
- When true, query Kong Identity to map a Principal after token verification. Default: false
- Error
On boolMiss - When true (default), return 401 if fail to match a Principal in Kong Identity after token verification. When false, the request continues without authenticated_principal set. Default: true
- Match
Consumer bool - If a Consumer is attached to the matched Principal in Kong Identity, load it and set it in the request context, overriding consumer_by. Default: true
- Match
Consumer boolGroups - If Consumer Groups are attached to the matched Principal in Kong Identity, load them, overriding consumergroupsclaim. Default: true
- Principal
By string - Custom identity name for a type=custom Kong Identity lookup. When absent and principalclaim is set, an OIDC lookup is performed using principalclaim as the claim name instead of 'sub'.
- Principal
Claims []string - Token claim to use for the Kong Identity lookup. If multiple values are set, it means the claim is inside a nested object of the token payload. When principal_by is also set, performs a custom identity lookup (type=custom). When set alone, performs an OIDC lookup using this claim name instead of the default 'sub'.
- directory string
- The Kong Identity directory instance to look up against. Default: "default"
- enabled bool
- When true, query Kong Identity to map a Principal after token verification. Default: false
- error_
on_ boolmiss - When true (default), return 401 if fail to match a Principal in Kong Identity after token verification. When false, the request continues without authenticated_principal set. Default: true
- match_
consumer bool - If a Consumer is attached to the matched Principal in Kong Identity, load it and set it in the request context, overriding consumer_by. Default: true
- match_
consumer_ boolgroups - If Consumer Groups are attached to the matched Principal in Kong Identity, load them, overriding consumergroupsclaim. Default: true
- principal_
by string - Custom identity name for a type=custom Kong Identity lookup. When absent and principalclaim is set, an OIDC lookup is performed using principalclaim as the claim name instead of 'sub'.
- principal_
claims list(string) - Token claim to use for the Kong Identity lookup. If multiple values are set, it means the claim is inside a nested object of the token payload. When principal_by is also set, performs a custom identity lookup (type=custom). When set alone, performs an OIDC lookup using this claim name instead of the default 'sub'.
- directory String
- The Kong Identity directory instance to look up against. Default: "default"
- enabled Boolean
- When true, query Kong Identity to map a Principal after token verification. Default: false
- error
On BooleanMiss - When true (default), return 401 if fail to match a Principal in Kong Identity after token verification. When false, the request continues without authenticated_principal set. Default: true
- match
Consumer Boolean - If a Consumer is attached to the matched Principal in Kong Identity, load it and set it in the request context, overriding consumer_by. Default: true
- match
Consumer BooleanGroups - If Consumer Groups are attached to the matched Principal in Kong Identity, load them, overriding consumergroupsclaim. Default: true
- principal
By String - Custom identity name for a type=custom Kong Identity lookup. When absent and principalclaim is set, an OIDC lookup is performed using principalclaim as the claim name instead of 'sub'.
- principal
Claims List<String> - Token claim to use for the Kong Identity lookup. If multiple values are set, it means the claim is inside a nested object of the token payload. When principal_by is also set, performs a custom identity lookup (type=custom). When set alone, performs an OIDC lookup using this claim name instead of the default 'sub'.
- directory string
- The Kong Identity directory instance to look up against. Default: "default"
- enabled boolean
- When true, query Kong Identity to map a Principal after token verification. Default: false
- error
On booleanMiss - When true (default), return 401 if fail to match a Principal in Kong Identity after token verification. When false, the request continues without authenticated_principal set. Default: true
- match
Consumer boolean - If a Consumer is attached to the matched Principal in Kong Identity, load it and set it in the request context, overriding consumer_by. Default: true
- match
Consumer booleanGroups - If Consumer Groups are attached to the matched Principal in Kong Identity, load them, overriding consumergroupsclaim. Default: true
- principal
By string - Custom identity name for a type=custom Kong Identity lookup. When absent and principalclaim is set, an OIDC lookup is performed using principalclaim as the claim name instead of 'sub'.
- principal
Claims string[] - Token claim to use for the Kong Identity lookup. If multiple values are set, it means the claim is inside a nested object of the token payload. When principal_by is also set, performs a custom identity lookup (type=custom). When set alone, performs an OIDC lookup using this claim name instead of the default 'sub'.
- directory str
- The Kong Identity directory instance to look up against. Default: "default"
- enabled bool
- When true, query Kong Identity to map a Principal after token verification. Default: false
- error_
on_ boolmiss - When true (default), return 401 if fail to match a Principal in Kong Identity after token verification. When false, the request continues without authenticated_principal set. Default: true
- match_
consumer bool - If a Consumer is attached to the matched Principal in Kong Identity, load it and set it in the request context, overriding consumer_by. Default: true
- match_
consumer_ boolgroups - If Consumer Groups are attached to the matched Principal in Kong Identity, load them, overriding consumergroupsclaim. Default: true
- principal_
by str - Custom identity name for a type=custom Kong Identity lookup. When absent and principalclaim is set, an OIDC lookup is performed using principalclaim as the claim name instead of 'sub'.
- principal_
claims Sequence[str] - Token claim to use for the Kong Identity lookup. If multiple values are set, it means the claim is inside a nested object of the token payload. When principal_by is also set, performs a custom identity lookup (type=custom). When set alone, performs an OIDC lookup using this claim name instead of the default 'sub'.
- directory String
- The Kong Identity directory instance to look up against. Default: "default"
- enabled Boolean
- When true, query Kong Identity to map a Principal after token verification. Default: false
- error
On BooleanMiss - When true (default), return 401 if fail to match a Principal in Kong Identity after token verification. When false, the request continues without authenticated_principal set. Default: true
- match
Consumer Boolean - If a Consumer is attached to the matched Principal in Kong Identity, load it and set it in the request context, overriding consumer_by. Default: true
- match
Consumer BooleanGroups - If Consumer Groups are attached to the matched Principal in Kong Identity, load them, overriding consumergroupsclaim. Default: true
- principal
By String - Custom identity name for a type=custom Kong Identity lookup. When absent and principalclaim is set, an OIDC lookup is performed using principalclaim as the claim name instead of 'sub'.
- principal
Claims List<String> - Token claim to use for the Kong Identity lookup. If multiple values are set, it means the claim is inside a nested object of the token payload. When principal_by is also set, performs a custom identity lookup (type=custom). When set alone, performs an OIDC lookup using this claim name instead of the default 'sub'.
AiGatewayAuthStrategyOpenidConnectConfigRedis, AiGatewayAuthStrategyOpenidConnectConfigRedisArgs
- Cloud
Authentication AiGateway Auth Strategy Openid Connect Config Redis Cloud Authentication - Cloud auth related configs for connecting to a Cloud Provider's Redis instance.
- Cluster
Max doubleRedirections - Maximum retry attempts for redirection. Default: 5
- Cluster
Nodes List<AiGateway Auth Strategy Openid Connect Config Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. - Connect
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. Default: "127.0.0.1"
- Keepalive
Backlog double - Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size. - Keepalive
Pool doubleSize - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_sizenorkeepalive_backlogis specified, no pool is created. Ifkeepalive_pool_sizeisn't specified butkeepalive_backlogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256 - Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. Default: "6379"
- Prefix string
- The Redis session key prefix.
- Read
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Master string - Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Sentinel
Nodes List<AiGateway Auth Strategy Openid Connect Config Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Sentinel
Password string - Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
- Sentinel
Role string - Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Sentinel
Username string - Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
- Server
Name string - A string representing an SNI (server name indication) value for TLS.
- Socket string
- The Redis unix socket path.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: false
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default.
- Cloud
Authentication AiGateway Auth Strategy Openid Connect Config Redis Cloud Authentication - Cloud auth related configs for connecting to a Cloud Provider's Redis instance.
- Cluster
Max float64Redirections - Maximum retry attempts for redirection. Default: 5
- Cluster
Nodes []AiGateway Auth Strategy Openid Connect Config Redis Cluster Node - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. - Connect
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Connection
Is boolProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - Database float64
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - Host string
- A string representing a host name, such as example.com. Default: "127.0.0.1"
- Keepalive
Backlog float64 - Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size. - Keepalive
Pool float64Size - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_sizenorkeepalive_backlogis specified, no pool is created. Ifkeepalive_pool_sizeisn't specified butkeepalive_backlogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256 - Password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
- Port string
- An integer representing a port number between 0 and 65535, inclusive. Default: "6379"
- Prefix string
- The Redis session key prefix.
- Read
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Send
Timeout float64 - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- Sentinel
Master string - Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- Sentinel
Nodes []AiGateway Auth Strategy Openid Connect Config Redis Sentinel Node - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - Sentinel
Password string - Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
- Sentinel
Role string - Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - Sentinel
Username string - Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
- Server
Name string - A string representing an SNI (server name indication) value for TLS.
- Socket string
- The Redis unix socket path.
- Ssl bool
- If set to true, uses SSL to connect to Redis. Default: false
- Ssl
Verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - Username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default.
- cloud_
authentication object - Cloud auth related configs for connecting to a Cloud Provider's Redis instance.
- cluster_
max_ numberredirections - Maximum retry attempts for redirection. Default: 5
- cluster_
nodes list(object) - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. - connect_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. Default: "127.0.0.1"
- keepalive_
backlog number - Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size. - keepalive_
pool_ numbersize - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_sizenorkeepalive_backlogis specified, no pool is created. Ifkeepalive_pool_sizeisn't specified butkeepalive_backlogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256 - password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
- port string
- An integer representing a port number between 0 and 65535, inclusive. Default: "6379"
- prefix string
- The Redis session key prefix.
- read_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel_
master string - Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- sentinel_
nodes list(object) - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - sentinel_
password string - Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
- sentinel_
role string - Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - sentinel_
username string - Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
- server_
name string - A string representing an SNI (server name indication) value for TLS.
- socket string
- The Redis unix socket path.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: false
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default.
- cloud
Authentication AiGateway Auth Strategy Openid Connect Config Redis Cloud Authentication - Cloud auth related configs for connecting to a Cloud Provider's Redis instance.
- cluster
Max DoubleRedirections - Maximum retry attempts for redirection. Default: 5
- cluster
Nodes List<AiGateway Auth Strategy Openid Connect Config Redis Cluster Node> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. - connect
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Double
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. Default: "127.0.0.1"
- keepalive
Backlog Double - Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size. - keepalive
Pool DoubleSize - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_sizenorkeepalive_backlogis specified, no pool is created. Ifkeepalive_pool_sizeisn't specified butkeepalive_backlogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256 - password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
- port String
- An integer representing a port number between 0 and 65535, inclusive. Default: "6379"
- prefix String
- The Redis session key prefix.
- read
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Double - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Master String - Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- sentinel
Nodes List<AiGateway Auth Strategy Openid Connect Config Redis Sentinel Node> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - sentinel
Password String - Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
- sentinel
Role String - Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - sentinel
Username String - Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
- server
Name String - A string representing an SNI (server name indication) value for TLS.
- socket String
- The Redis unix socket path.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: false
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default.
- cloud
Authentication AiGateway Auth Strategy Openid Connect Config Redis Cloud Authentication - Cloud auth related configs for connecting to a Cloud Provider's Redis instance.
- cluster
Max numberRedirections - Maximum retry attempts for redirection. Default: 5
- cluster
Nodes AiGateway Auth Strategy Openid Connect Config Redis Cluster Node[] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. - connect
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is booleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host string
- A string representing a host name, such as example.com. Default: "127.0.0.1"
- keepalive
Backlog number - Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size. - keepalive
Pool numberSize - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_sizenorkeepalive_backlogis specified, no pool is created. Ifkeepalive_pool_sizeisn't specified butkeepalive_backlogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256 - password string
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
- port string
- An integer representing a port number between 0 and 65535, inclusive. Default: "6379"
- prefix string
- The Redis session key prefix.
- read
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Master string - Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- sentinel
Nodes AiGateway Auth Strategy Openid Connect Config Redis Sentinel Node[] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - sentinel
Password string - Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
- sentinel
Role string - Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - sentinel
Username string - Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
- server
Name string - A string representing an SNI (server name indication) value for TLS.
- socket string
- The Redis unix socket path.
- ssl boolean
- If set to true, uses SSL to connect to Redis. Default: false
- ssl
Verify boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username string
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default.
- cloud_
authentication AiGateway Auth Strategy Openid Connect Config Redis Cloud Authentication - Cloud auth related configs for connecting to a Cloud Provider's Redis instance.
- cluster_
max_ floatredirections - Maximum retry attempts for redirection. Default: 5
- cluster_
nodes Sequence[AiGateway Auth Strategy Openid Connect Config Redis Cluster Node] - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. - connect_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection_
is_ boolproxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database float
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host str
- A string representing a host name, such as example.com. Default: "127.0.0.1"
- keepalive_
backlog float - Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size. - keepalive_
pool_ floatsize - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_sizenorkeepalive_backlogis specified, no pool is created. Ifkeepalive_pool_sizeisn't specified butkeepalive_backlogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256 - password str
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
- port str
- An integer representing a port number between 0 and 65535, inclusive. Default: "6379"
- prefix str
- The Redis session key prefix.
- read_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send_
timeout float - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel_
master str - Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- sentinel_
nodes Sequence[AiGateway Auth Strategy Openid Connect Config Redis Sentinel Node] - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - sentinel_
password str - Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
- sentinel_
role str - Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - sentinel_
username str - Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
- server_
name str - A string representing an SNI (server name indication) value for TLS.
- socket str
- The Redis unix socket path.
- ssl bool
- If set to true, uses SSL to connect to Redis. Default: false
- ssl_
verify bool - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username str
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default.
- cloud
Authentication Property Map - Cloud auth related configs for connecting to a Cloud Provider's Redis instance.
- cluster
Max NumberRedirections - Maximum retry attempts for redirection. Default: 5
- cluster
Nodes List<Property Map> - Cluster addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Cluster. The minimum length of the array is 1 element. - connect
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- connection
Is BooleanProxied - If the connection to Redis is proxied (e.g. Envoy), set it
true. Set thehostandportto point to the proxy address. Default: false - database Number
- Database to use for the Redis connection when using the
redisstrategy. Default: 0 - host String
- A string representing a host name, such as example.com. Default: "127.0.0.1"
- keepalive
Backlog Number - Limits the total number of opened connections for a pool. If the connection pool is full, connection queues above the limit go into the backlog queue. If the backlog queue is full, subsequent connect operations fail and return
nil. Queued operations (subject to set timeouts) resume once the number of connections in the pool is less thankeepalive_pool_size. If latency is high or throughput is low, try increasing this value. Empirically, this value is larger thankeepalive_pool_size. - keepalive
Pool NumberSize - The size limit for every cosocket connection pool associated with every remote server, per worker process. If neither
keepalive_pool_sizenorkeepalive_backlogis specified, no pool is created. Ifkeepalive_pool_sizeisn't specified butkeepalive_backlogis specified, then the pool uses the default value. Try to increase (e.g. 512) this value if latency is high or throughput is low. Default: 256 - password String
- Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.
- port String
- An integer representing a port number between 0 and 65535, inclusive. Default: "6379"
- prefix String
- The Redis session key prefix.
- read
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- send
Timeout Number - An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2. Default: 2000
- sentinel
Master String - Sentinel master to use for Redis connections. Defining this value implies using Redis Sentinel.
- sentinel
Nodes List<Property Map> - Sentinel node addresses to use for Redis connections when the
redisstrategy is defined. Defining this field implies using a Redis Sentinel. The minimum length of the array is 1 element. - sentinel
Password String - Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.
- sentinel
Role String - Sentinel role to use for Redis connections when the
redisstrategy is defined. Defining this value implies using Redis Sentinel. possible known values include one of ["any", "master", "slave"] - sentinel
Username String - Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication won't be performed. This requires Redis v6.2.0+.
- server
Name String - A string representing an SNI (server name indication) value for TLS.
- socket String
- The Redis unix socket path.
- ssl Boolean
- If set to true, uses SSL to connect to Redis. Default: false
- ssl
Verify Boolean - If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure
lua_ssl_trusted_certificateinkong.confto specify the CA (or server) certificate used by your Redis server. You may also need to configurelua_ssl_verify_depthaccordingly. Default: true - username String
- Username to use for Redis connections. If undefined, ACL authentication won't be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to
default.
AiGatewayAuthStrategyOpenidConnectConfigRedisCloudAuthentication, AiGatewayAuthStrategyOpenidConnectConfigRedisCloudAuthenticationArgs
- Auth
Provider string - Auth providers to be used to authenticate to a Cloud Provider's Redis instance. possible known values include one of ["aws", "azure", "gcp"]
- Aws
Access stringKey Id - AWS Access Key ID to be used for authentication when
auth_provideris set toaws. - Aws
Assume stringRole Arn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.
- Aws
Cache stringName - The name of the AWS Elasticache cluster when
auth_provideris set toaws. - Aws
Is boolServerless - This flag specifies whether the cluster is serverless when auth_provider is set to
aws. Default: true - Aws
Region string - The region of the AWS ElastiCache cluster when
auth_provideris set toaws. - Aws
Role stringSession Name - The session name for the temporary credentials when assuming the IAM role.
- Aws
Secret stringAccess Key - AWS Secret Access Key to be used for authentication when
auth_provideris set toaws. - Azure
Client stringId - Azure Client ID to be used for authentication when
auth_provideris set toazure. - Azure
Client stringSecret - Azure Client Secret to be used for authentication when
auth_provideris set toazure. - Azure
Tenant stringId - Azure Tenant ID to be used for authentication when
auth_provideris set toazure. - Gcp
Service stringAccount Json - GCP Service Account JSON to be used for authentication when
auth_provideris set togcp.
- Auth
Provider string - Auth providers to be used to authenticate to a Cloud Provider's Redis instance. possible known values include one of ["aws", "azure", "gcp"]
- Aws
Access stringKey Id - AWS Access Key ID to be used for authentication when
auth_provideris set toaws. - Aws
Assume stringRole Arn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.
- Aws
Cache stringName - The name of the AWS Elasticache cluster when
auth_provideris set toaws. - Aws
Is boolServerless - This flag specifies whether the cluster is serverless when auth_provider is set to
aws. Default: true - Aws
Region string - The region of the AWS ElastiCache cluster when
auth_provideris set toaws. - Aws
Role stringSession Name - The session name for the temporary credentials when assuming the IAM role.
- Aws
Secret stringAccess Key - AWS Secret Access Key to be used for authentication when
auth_provideris set toaws. - Azure
Client stringId - Azure Client ID to be used for authentication when
auth_provideris set toazure. - Azure
Client stringSecret - Azure Client Secret to be used for authentication when
auth_provideris set toazure. - Azure
Tenant stringId - Azure Tenant ID to be used for authentication when
auth_provideris set toazure. - Gcp
Service stringAccount Json - GCP Service Account JSON to be used for authentication when
auth_provideris set togcp.
- auth_
provider string - Auth providers to be used to authenticate to a Cloud Provider's Redis instance. possible known values include one of ["aws", "azure", "gcp"]
- aws_
access_ stringkey_ id - AWS Access Key ID to be used for authentication when
auth_provideris set toaws. - aws_
assume_ stringrole_ arn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.
- aws_
cache_ stringname - The name of the AWS Elasticache cluster when
auth_provideris set toaws. - aws_
is_ boolserverless - This flag specifies whether the cluster is serverless when auth_provider is set to
aws. Default: true - aws_
region string - The region of the AWS ElastiCache cluster when
auth_provideris set toaws. - aws_
role_ stringsession_ name - The session name for the temporary credentials when assuming the IAM role.
- aws_
secret_ stringaccess_ key - AWS Secret Access Key to be used for authentication when
auth_provideris set toaws. - azure_
client_ stringid - Azure Client ID to be used for authentication when
auth_provideris set toazure. - azure_
client_ stringsecret - Azure Client Secret to be used for authentication when
auth_provideris set toazure. - azure_
tenant_ stringid - Azure Tenant ID to be used for authentication when
auth_provideris set toazure. - gcp_
service_ stringaccount_ json - GCP Service Account JSON to be used for authentication when
auth_provideris set togcp.
- auth
Provider String - Auth providers to be used to authenticate to a Cloud Provider's Redis instance. possible known values include one of ["aws", "azure", "gcp"]
- aws
Access StringKey Id - AWS Access Key ID to be used for authentication when
auth_provideris set toaws. - aws
Assume StringRole Arn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.
- aws
Cache StringName - The name of the AWS Elasticache cluster when
auth_provideris set toaws. - aws
Is BooleanServerless - This flag specifies whether the cluster is serverless when auth_provider is set to
aws. Default: true - aws
Region String - The region of the AWS ElastiCache cluster when
auth_provideris set toaws. - aws
Role StringSession Name - The session name for the temporary credentials when assuming the IAM role.
- aws
Secret StringAccess Key - AWS Secret Access Key to be used for authentication when
auth_provideris set toaws. - azure
Client StringId - Azure Client ID to be used for authentication when
auth_provideris set toazure. - azure
Client StringSecret - Azure Client Secret to be used for authentication when
auth_provideris set toazure. - azure
Tenant StringId - Azure Tenant ID to be used for authentication when
auth_provideris set toazure. - gcp
Service StringAccount Json - GCP Service Account JSON to be used for authentication when
auth_provideris set togcp.
- auth
Provider string - Auth providers to be used to authenticate to a Cloud Provider's Redis instance. possible known values include one of ["aws", "azure", "gcp"]
- aws
Access stringKey Id - AWS Access Key ID to be used for authentication when
auth_provideris set toaws. - aws
Assume stringRole Arn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.
- aws
Cache stringName - The name of the AWS Elasticache cluster when
auth_provideris set toaws. - aws
Is booleanServerless - This flag specifies whether the cluster is serverless when auth_provider is set to
aws. Default: true - aws
Region string - The region of the AWS ElastiCache cluster when
auth_provideris set toaws. - aws
Role stringSession Name - The session name for the temporary credentials when assuming the IAM role.
- aws
Secret stringAccess Key - AWS Secret Access Key to be used for authentication when
auth_provideris set toaws. - azure
Client stringId - Azure Client ID to be used for authentication when
auth_provideris set toazure. - azure
Client stringSecret - Azure Client Secret to be used for authentication when
auth_provideris set toazure. - azure
Tenant stringId - Azure Tenant ID to be used for authentication when
auth_provideris set toazure. - gcp
Service stringAccount Json - GCP Service Account JSON to be used for authentication when
auth_provideris set togcp.
- auth_
provider str - Auth providers to be used to authenticate to a Cloud Provider's Redis instance. possible known values include one of ["aws", "azure", "gcp"]
- aws_
access_ strkey_ id - AWS Access Key ID to be used for authentication when
auth_provideris set toaws. - aws_
assume_ strrole_ arn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.
- aws_
cache_ strname - The name of the AWS Elasticache cluster when
auth_provideris set toaws. - aws_
is_ boolserverless - This flag specifies whether the cluster is serverless when auth_provider is set to
aws. Default: true - aws_
region str - The region of the AWS ElastiCache cluster when
auth_provideris set toaws. - aws_
role_ strsession_ name - The session name for the temporary credentials when assuming the IAM role.
- aws_
secret_ straccess_ key - AWS Secret Access Key to be used for authentication when
auth_provideris set toaws. - azure_
client_ strid - Azure Client ID to be used for authentication when
auth_provideris set toazure. - azure_
client_ strsecret - Azure Client Secret to be used for authentication when
auth_provideris set toazure. - azure_
tenant_ strid - Azure Tenant ID to be used for authentication when
auth_provideris set toazure. - gcp_
service_ straccount_ json - GCP Service Account JSON to be used for authentication when
auth_provideris set togcp.
- auth
Provider String - Auth providers to be used to authenticate to a Cloud Provider's Redis instance. possible known values include one of ["aws", "azure", "gcp"]
- aws
Access StringKey Id - AWS Access Key ID to be used for authentication when
auth_provideris set toaws. - aws
Assume StringRole Arn - The ARN of the IAM role to assume for generating ElastiCache IAM authentication tokens.
- aws
Cache StringName - The name of the AWS Elasticache cluster when
auth_provideris set toaws. - aws
Is BooleanServerless - This flag specifies whether the cluster is serverless when auth_provider is set to
aws. Default: true - aws
Region String - The region of the AWS ElastiCache cluster when
auth_provideris set toaws. - aws
Role StringSession Name - The session name for the temporary credentials when assuming the IAM role.
- aws
Secret StringAccess Key - AWS Secret Access Key to be used for authentication when
auth_provideris set toaws. - azure
Client StringId - Azure Client ID to be used for authentication when
auth_provideris set toazure. - azure
Client StringSecret - Azure Client Secret to be used for authentication when
auth_provideris set toazure. - azure
Tenant StringId - Azure Tenant ID to be used for authentication when
auth_provideris set toazure. - gcp
Service StringAccount Json - GCP Service Account JSON to be used for authentication when
auth_provideris set togcp.
AiGatewayAuthStrategyOpenidConnectConfigRedisClusterNode, AiGatewayAuthStrategyOpenidConnectConfigRedisClusterNodeArgs
AiGatewayAuthStrategyOpenidConnectConfigRedisSentinelNode, AiGatewayAuthStrategyOpenidConnectConfigRedisSentinelNodeArgs
AiGatewayAuthStrategyOpenidConnectConfigTokenExchange, AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeArgs
- Cache
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Cache - Cache support for token exchange
- Request
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Request - Parameters used in the token exchange request.
- Subject
Token List<AiIssuers Gateway Auth Strategy Openid Connect Config Token Exchange Subject Token Issuer> - Trusted token issuers from which the upstream may accept tokens to be exchanged. If a JWT bearer matches all the conditions of a subject token issuer item, the token will be exchanged. Not Null
- Cache
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Cache - Cache support for token exchange
- Request
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Request - Parameters used in the token exchange request.
- Subject
Token []AiIssuers Gateway Auth Strategy Openid Connect Config Token Exchange Subject Token Issuer - Trusted token issuers from which the upstream may accept tokens to be exchanged. If a JWT bearer matches all the conditions of a subject token issuer item, the token will be exchanged. Not Null
- cache object
- Cache support for token exchange
- request object
- Parameters used in the token exchange request.
- subject_
token_ list(object)issuers - Trusted token issuers from which the upstream may accept tokens to be exchanged. If a JWT bearer matches all the conditions of a subject token issuer item, the token will be exchanged. Not Null
- cache
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Cache - Cache support for token exchange
- request
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Request - Parameters used in the token exchange request.
- subject
Token List<AiIssuers Gateway Auth Strategy Openid Connect Config Token Exchange Subject Token Issuer> - Trusted token issuers from which the upstream may accept tokens to be exchanged. If a JWT bearer matches all the conditions of a subject token issuer item, the token will be exchanged. Not Null
- cache
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Cache - Cache support for token exchange
- request
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Request - Parameters used in the token exchange request.
- subject
Token AiIssuers Gateway Auth Strategy Openid Connect Config Token Exchange Subject Token Issuer[] - Trusted token issuers from which the upstream may accept tokens to be exchanged. If a JWT bearer matches all the conditions of a subject token issuer item, the token will be exchanged. Not Null
- cache
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Cache - Cache support for token exchange
- request
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Request - Parameters used in the token exchange request.
- subject_
token_ Sequence[Aiissuers Gateway Auth Strategy Openid Connect Config Token Exchange Subject Token Issuer] - Trusted token issuers from which the upstream may accept tokens to be exchanged. If a JWT bearer matches all the conditions of a subject token issuer item, the token will be exchanged. Not Null
- cache Property Map
- Cache support for token exchange
- request Property Map
- Parameters used in the token exchange request.
- subject
Token List<Property Map>Issuers - Trusted token issuers from which the upstream may accept tokens to be exchanged. If a JWT bearer matches all the conditions of a subject token issuer item, the token will be exchanged. Not Null
AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeCache, AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeCacheArgs
AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeRequest, AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeRequestArgs
- Audiences List<string>
- Audiences used in the token exchange request. Values defined here override those defined in
config.audience. - Empty
Audience bool - Use empty audiences. Use this field to override audiences defined in
config.audience. Default: false - Empty
Scopes bool - Use empty scopes. Use this field to override scopes defined in
config.scopes. Default: false - Scopes List<string>
- Scopes used in the token exchange request. Values defined here override those defined in
config.scopes.
- Audiences []string
- Audiences used in the token exchange request. Values defined here override those defined in
config.audience. - Empty
Audience bool - Use empty audiences. Use this field to override audiences defined in
config.audience. Default: false - Empty
Scopes bool - Use empty scopes. Use this field to override scopes defined in
config.scopes. Default: false - Scopes []string
- Scopes used in the token exchange request. Values defined here override those defined in
config.scopes.
- audiences list(string)
- Audiences used in the token exchange request. Values defined here override those defined in
config.audience. - empty_
audience bool - Use empty audiences. Use this field to override audiences defined in
config.audience. Default: false - empty_
scopes bool - Use empty scopes. Use this field to override scopes defined in
config.scopes. Default: false - scopes list(string)
- Scopes used in the token exchange request. Values defined here override those defined in
config.scopes.
- audiences List<String>
- Audiences used in the token exchange request. Values defined here override those defined in
config.audience. - empty
Audience Boolean - Use empty audiences. Use this field to override audiences defined in
config.audience. Default: false - empty
Scopes Boolean - Use empty scopes. Use this field to override scopes defined in
config.scopes. Default: false - scopes List<String>
- Scopes used in the token exchange request. Values defined here override those defined in
config.scopes.
- audiences string[]
- Audiences used in the token exchange request. Values defined here override those defined in
config.audience. - empty
Audience boolean - Use empty audiences. Use this field to override audiences defined in
config.audience. Default: false - empty
Scopes boolean - Use empty scopes. Use this field to override scopes defined in
config.scopes. Default: false - scopes string[]
- Scopes used in the token exchange request. Values defined here override those defined in
config.scopes.
- audiences Sequence[str]
- Audiences used in the token exchange request. Values defined here override those defined in
config.audience. - empty_
audience bool - Use empty audiences. Use this field to override audiences defined in
config.audience. Default: false - empty_
scopes bool - Use empty scopes. Use this field to override scopes defined in
config.scopes. Default: false - scopes Sequence[str]
- Scopes used in the token exchange request. Values defined here override those defined in
config.scopes.
- audiences List<String>
- Audiences used in the token exchange request. Values defined here override those defined in
config.audience. - empty
Audience Boolean - Use empty audiences. Use this field to override audiences defined in
config.audience. Default: false - empty
Scopes Boolean - Use empty scopes. Use this field to override scopes defined in
config.scopes. Default: false - scopes List<String>
- Scopes used in the token exchange request. Values defined here override those defined in
config.scopes.
AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeSubjectTokenIssuer, AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeSubjectTokenIssuerArgs
- Conditions
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Subject Token Issuer Conditions - A tokens will only be exchange when it matches all these criteria. To exchanging tokens issued from a different issuer, conditions must not be defined; On the contrary, to exchange tokens issued from the target issuer itself, conditions must be defined.
- Issuer string
- Tokens of whose iss claim matches this value will be exchanged. Not Null
- Conditions
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Subject Token Issuer Conditions - A tokens will only be exchange when it matches all these criteria. To exchanging tokens issued from a different issuer, conditions must not be defined; On the contrary, to exchange tokens issued from the target issuer itself, conditions must be defined.
- Issuer string
- Tokens of whose iss claim matches this value will be exchanged. Not Null
- conditions object
- A tokens will only be exchange when it matches all these criteria. To exchanging tokens issued from a different issuer, conditions must not be defined; On the contrary, to exchange tokens issued from the target issuer itself, conditions must be defined.
- issuer string
- Tokens of whose iss claim matches this value will be exchanged. Not Null
- conditions
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Subject Token Issuer Conditions - A tokens will only be exchange when it matches all these criteria. To exchanging tokens issued from a different issuer, conditions must not be defined; On the contrary, to exchange tokens issued from the target issuer itself, conditions must be defined.
- issuer String
- Tokens of whose iss claim matches this value will be exchanged. Not Null
- conditions
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Subject Token Issuer Conditions - A tokens will only be exchange when it matches all these criteria. To exchanging tokens issued from a different issuer, conditions must not be defined; On the contrary, to exchange tokens issued from the target issuer itself, conditions must be defined.
- issuer string
- Tokens of whose iss claim matches this value will be exchanged. Not Null
- conditions
Ai
Gateway Auth Strategy Openid Connect Config Token Exchange Subject Token Issuer Conditions - A tokens will only be exchange when it matches all these criteria. To exchanging tokens issued from a different issuer, conditions must not be defined; On the contrary, to exchange tokens issued from the target issuer itself, conditions must be defined.
- issuer str
- Tokens of whose iss claim matches this value will be exchanged. Not Null
- conditions Property Map
- A tokens will only be exchange when it matches all these criteria. To exchanging tokens issued from a different issuer, conditions must not be defined; On the contrary, to exchange tokens issued from the target issuer itself, conditions must be defined.
- issuer String
- Tokens of whose iss claim matches this value will be exchanged. Not Null
AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeSubjectTokenIssuerConditions, AiGatewayAuthStrategyOpenidConnectConfigTokenExchangeSubjectTokenIssuerConditionsArgs
- Has
Audiences List<string> - Has
Scopes List<string> - Missing
Audiences List<string> - Missing
Scopes List<string>
- Has
Audiences []string - Has
Scopes []string - Missing
Audiences []string - Missing
Scopes []string
- has_
audiences list(string) - has_
scopes list(string) - missing_
audiences list(string) - missing_
scopes list(string)
- has
Audiences List<String> - has
Scopes List<String> - missing
Audiences List<String> - missing
Scopes List<String>
- has
Audiences string[] - has
Scopes string[] - missing
Audiences string[] - missing
Scopes string[]
- has_
audiences Sequence[str] - has_
scopes Sequence[str] - missing_
audiences Sequence[str] - missing_
scopes Sequence[str]
- has
Audiences List<String> - has
Scopes List<String> - missing
Audiences List<String> - missing
Scopes List<String>
AiGatewayAuthStrategyOpenidConnectConfigUpstreamHeader, AiGatewayAuthStrategyOpenidConnectConfigUpstreamHeaderArgs
Import
In Terraform v1.5.0 and later, the import block can be used with the id attribute, for example:
terraform
import {
to = konnect_ai_gateway_auth_strategy.my_konnect_ai_gateway_auth_strategy
id = jsonencode({
gateway_id = "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"
id = "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"
})
}
The pulumi import command can be used, for example:
$ pulumi import konnect:index/aiGatewayAuthStrategy:AiGatewayAuthStrategy my_konnect_ai_gateway_auth_strategy '{"gateway_id": "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7", "id": "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"}'
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- konnect kong/terraform-provider-konnect
- License
- Notes
- This Pulumi package is based on the
konnectTerraform Provider.
Viewing docs for konnect 3.23.0
published on Friday, Sep 18, 2026 by kong
published on Friday, Sep 18, 2026 by kong