Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Lxd Provider
  4. API Docs
  5. AuthIdentity
Viewing docs for lxd 3.1.1
published on Thursday, Oct 1, 2026 by terraform-lxd
Schema (JSON)
terraform-lxd/terraform-provider-lxd

lxd.AuthIdentity

lxd
Viewing docs for lxd 3.1.1
published on Thursday, Oct 1, 2026 by terraform-lxd
Schema (JSON)
terraform-lxd/terraform-provider-lxd

    Create AuthIdentity Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AuthIdentity(name: string, args?: AuthIdentityArgs, opts?: CustomResourceOptions);
    @overload
def AuthIdentity(resource_name: str,
                 args: Optional[AuthIdentityArgs] = None,
                 opts: Optional[ResourceOptions] = None)

@overload
def AuthIdentity(resource_name: str,
                 opts: Optional[ResourceOptions] = None,
                 auth_method: Optional[str] = None,
                 groups: Optional[Sequence[str]] = None,
                 name: Optional[str] = None,
                 remote: Optional[str] = None,
                 tls_certificate: Optional[str] = None,
                 type: Optional[str] = None)
    func NewAuthIdentity(ctx *Context, name string, args *AuthIdentityArgs, opts ...ResourceOption) (*AuthIdentity, error)
    public AuthIdentity(string name, AuthIdentityArgs? args = null, CustomResourceOptions? opts = null)
    public AuthIdentity(String name, AuthIdentityArgs args)
public AuthIdentity(String name, AuthIdentityArgs args, CustomResourceOptions options)

    type: lxd:AuthIdentity
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "lxd_auth_identity" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args AuthIdentityArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AuthIdentityArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AuthIdentityArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AuthIdentityArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AuthIdentityArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var authIdentityResource = new Lxd.AuthIdentity("authIdentityResource", new()
{
    AuthMethod = "string",
    Groups = new[]
    {
        "string",
    },
    Name = "string",
    Remote = "string",
    TlsCertificate = "string",
    Type = "string",
});

    example, err := lxd.NewAuthIdentity(ctx, "authIdentityResource", &lxd.AuthIdentityArgs{
	AuthMethod: pulumi.String("string"),
	Groups: pulumi.StringArray{
		pulumi.String("string"),
	},
	Name:           pulumi.String("string"),
	Remote:         pulumi.String("string"),
	TlsCertificate: pulumi.String("string"),
	Type:           pulumi.String("string"),
})

    resource "lxd_auth_identity" "authIdentityResource" {
  lifecycle {
    create_before_destroy = true
  }
  auth_method     = "string"
  groups          = ["string"]
  name            = "string"
  remote          = "string"
  tls_certificate = "string"
  type            = "string"
}

    var authIdentityResource = new AuthIdentity("authIdentityResource", AuthIdentityArgs.builder()
    .authMethod("string")
    .groups("string")
    .name("string")
    .remote("string")
    .tlsCertificate("string")
    .type("string")
    .build());

    auth_identity_resource = lxd.AuthIdentity("authIdentityResource",
    auth_method="string",
    groups=["string"],
    name="string",
    remote="string",
    tls_certificate="string",
    type="string")

    const authIdentityResource = new lxd.AuthIdentity("authIdentityResource", {
    authMethod: "string",
    groups: ["string"],
    name: "string",
    remote: "string",
    tlsCertificate: "string",
    type: "string",
});

    type: lxd:AuthIdentity
properties:
    authMethod: string
    groups:
        - string
    name: string
    remote: string
    tlsCertificate: string
    type: string

    AuthIdentity Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AuthIdentity resource accepts the following input properties:

    AuthMethod string
    Authentication method of the identity, either tls or bearer.
    Groups List<string>
    Optional - List of group names to add this identity to.
    Name string
    Required - Name of the identity.
    Remote string
    Optional - The remote in which the resource will be created. If not provided, the provider's default remote will be used.
    TlsCertificate string
    Optional - PEM encoded x509 certificate. Applicable only when the authentication method is tls. If omitted, a pending TLS identity is created and a trust token is issued instead. Once a TLS identity is created, removing this attribute from the configuration leaves the certificate intact.
    Type string
    Required - Identity type, can be tls, bearer, or devlxd. See Note on auth_method.
    AuthMethod string
    Authentication method of the identity, either tls or bearer.
    Groups []string
    Optional - List of group names to add this identity to.
    Name string
    Required - Name of the identity.
    Remote string
    Optional - The remote in which the resource will be created. If not provided, the provider's default remote will be used.
    TlsCertificate string
    Optional - PEM encoded x509 certificate. Applicable only when the authentication method is tls. If omitted, a pending TLS identity is created and a trust token is issued instead. Once a TLS identity is created, removing this attribute from the configuration leaves the certificate intact.
    Type string
    Required - Identity type, can be tls, bearer, or devlxd. See Note on auth_method.
    auth_method string
    Authentication method of the identity, either tls or bearer.
    groups list(string)
    Optional - List of group names to add this identity to.
    name string
    Required - Name of the identity.
    remote string
    Optional - The remote in which the resource will be created. If not provided, the provider's default remote will be used.
    tls_certificate string
    Optional - PEM encoded x509 certificate. Applicable only when the authentication method is tls. If omitted, a pending TLS identity is created and a trust token is issued instead. Once a TLS identity is created, removing this attribute from the configuration leaves the certificate intact.
    type string
    Required - Identity type, can be tls, bearer, or devlxd. See Note on auth_method.
    authMethod String
    Authentication method of the identity, either tls or bearer.
    groups List<String>
    Optional - List of group names to add this identity to.
    name String
    Required - Name of the identity.
    remote String
    Optional - The remote in which the resource will be created. If not provided, the provider's default remote will be used.
    tlsCertificate String
    Optional - PEM encoded x509 certificate. Applicable only when the authentication method is tls. If omitted, a pending TLS identity is created and a trust token is issued instead. Once a TLS identity is created, removing this attribute from the configuration leaves the certificate intact.
    type String
    Required - Identity type, can be tls, bearer, or devlxd. See Note on auth_method.
    authMethod string
    Authentication method of the identity, either tls or bearer.
    groups string[]
    Optional - List of group names to add this identity to.
    name string
    Required - Name of the identity.
    remote string
    Optional - The remote in which the resource will be created. If not provided, the provider's default remote will be used.
    tlsCertificate string
    Optional - PEM encoded x509 certificate. Applicable only when the authentication method is tls. If omitted, a pending TLS identity is created and a trust token is issued instead. Once a TLS identity is created, removing this attribute from the configuration leaves the certificate intact.
    type string
    Required - Identity type, can be tls, bearer, or devlxd. See Note on auth_method.
    auth_method str
    Authentication method of the identity, either tls or bearer.
    groups Sequence[str]
    Optional - List of group names to add this identity to.
    name str
    Required - Name of the identity.
    remote str
    Optional - The remote in which the resource will be created. If not provided, the provider's default remote will be used.
    tls_certificate str
    Optional - PEM encoded x509 certificate. Applicable only when the authentication method is tls. If omitted, a pending TLS identity is created and a trust token is issued instead. Once a TLS identity is created, removing this attribute from the configuration leaves the certificate intact.
    type str
    Required - Identity type, can be tls, bearer, or devlxd. See Note on auth_method.
    authMethod String
    Authentication method of the identity, either tls or bearer.
    groups List<String>
    Optional - List of group names to add this identity to.
    name String
    Required - Name of the identity.
    remote String
    Optional - The remote in which the resource will be created. If not provided, the provider's default remote will be used.
    tlsCertificate String
    Optional - PEM encoded x509 certificate. Applicable only when the authentication method is tls. If omitted, a pending TLS identity is created and a trust token is issued instead. Once a TLS identity is created, removing this attribute from the configuration leaves the certificate intact.
    type String
    Required - Identity type, can be tls, bearer, or devlxd. See Note on auth_method.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AuthIdentity resource produces the following output properties:

    ExpiresAt string
    Time at which the trust token expires, in RFC 3339 format and UTC. It is null when the server config core.remote_token_expiry is not set, which means the token does not expire.
    Id string
    The provider-assigned unique ID for this managed resource.
    TrustToken string
    Trust token that an untrusted client uses to enroll its certificate. It is set only for a pending TLS identity, and is cleared once the token has been redeemed.
    ExpiresAt string
    Time at which the trust token expires, in RFC 3339 format and UTC. It is null when the server config core.remote_token_expiry is not set, which means the token does not expire.
    Id string
    The provider-assigned unique ID for this managed resource.
    TrustToken string
    Trust token that an untrusted client uses to enroll its certificate. It is set only for a pending TLS identity, and is cleared once the token has been redeemed.
    expires_at string
    Time at which the trust token expires, in RFC 3339 format and UTC. It is null when the server config core.remote_token_expiry is not set, which means the token does not expire.
    id string
    The provider-assigned unique ID for this managed resource.
    trust_token string
    Trust token that an untrusted client uses to enroll its certificate. It is set only for a pending TLS identity, and is cleared once the token has been redeemed.
    expiresAt String
    Time at which the trust token expires, in RFC 3339 format and UTC. It is null when the server config core.remote_token_expiry is not set, which means the token does not expire.
    id String
    The provider-assigned unique ID for this managed resource.
    trustToken String
    Trust token that an untrusted client uses to enroll its certificate. It is set only for a pending TLS identity, and is cleared once the token has been redeemed.
    expiresAt string
    Time at which the trust token expires, in RFC 3339 format and UTC. It is null when the server config core.remote_token_expiry is not set, which means the token does not expire.
    id string
    The provider-assigned unique ID for this managed resource.
    trustToken string
    Trust token that an untrusted client uses to enroll its certificate. It is set only for a pending TLS identity, and is cleared once the token has been redeemed.
    expires_at str
    Time at which the trust token expires, in RFC 3339 format and UTC. It is null when the server config core.remote_token_expiry is not set, which means the token does not expire.
    id str
    The provider-assigned unique ID for this managed resource.
    trust_token str
    Trust token that an untrusted client uses to enroll its certificate. It is set only for a pending TLS identity, and is cleared once the token has been redeemed.
    expiresAt String
    Time at which the trust token expires, in RFC 3339 format and UTC. It is null when the server config core.remote_token_expiry is not set, which means the token does not expire.
    id String
    The provider-assigned unique ID for this managed resource.
    trustToken String
    Trust token that an untrusted client uses to enroll its certificate. It is set only for a pending TLS identity, and is cleared once the token has been redeemed.

    Look up Existing AuthIdentity Resource

    Get an existing AuthIdentity resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AuthIdentityState, opts?: CustomResourceOptions): AuthIdentity
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        auth_method: Optional[str] = None,
        expires_at: Optional[str] = None,
        groups: Optional[Sequence[str]] = None,
        name: Optional[str] = None,
        remote: Optional[str] = None,
        tls_certificate: Optional[str] = None,
        trust_token: Optional[str] = None,
        type: Optional[str] = None) -> AuthIdentity
    func GetAuthIdentity(ctx *Context, name string, id IDInput, state *AuthIdentityState, opts ...ResourceOption) (*AuthIdentity, error)
    public static AuthIdentity Get(string name, Input<string> id, AuthIdentityState? state, CustomResourceOptions? opts = null)
    public static AuthIdentity get(String name, Output<String> id, AuthIdentityState state, CustomResourceOptions options)
    resources:  _:    type: lxd:AuthIdentity    get:      id: ${id}
    import {
  to = lxd_auth_identity.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AuthMethod string
    Authentication method of the identity, either tls or bearer.
    ExpiresAt string
    Time at which the trust token expires, in RFC 3339 format and UTC. It is null when the server config core.remote_token_expiry is not set, which means the token does not expire.
    Groups List<string>
    Optional - List of group names to add this identity to.
    Name string
    Required - Name of the identity.
    Remote string
    Optional - The remote in which the resource will be created. If not provided, the provider's default remote will be used.
    TlsCertificate string
    Optional - PEM encoded x509 certificate. Applicable only when the authentication method is tls. If omitted, a pending TLS identity is created and a trust token is issued instead. Once a TLS identity is created, removing this attribute from the configuration leaves the certificate intact.
    TrustToken string
    Trust token that an untrusted client uses to enroll its certificate. It is set only for a pending TLS identity, and is cleared once the token has been redeemed.
    Type string
    Required - Identity type, can be tls, bearer, or devlxd. See Note on auth_method.
    AuthMethod string
    Authentication method of the identity, either tls or bearer.
    ExpiresAt string
    Time at which the trust token expires, in RFC 3339 format and UTC. It is null when the server config core.remote_token_expiry is not set, which means the token does not expire.
    Groups []string
    Optional - List of group names to add this identity to.
    Name string
    Required - Name of the identity.
    Remote string
    Optional - The remote in which the resource will be created. If not provided, the provider's default remote will be used.
    TlsCertificate string
    Optional - PEM encoded x509 certificate. Applicable only when the authentication method is tls. If omitted, a pending TLS identity is created and a trust token is issued instead. Once a TLS identity is created, removing this attribute from the configuration leaves the certificate intact.
    TrustToken string
    Trust token that an untrusted client uses to enroll its certificate. It is set only for a pending TLS identity, and is cleared once the token has been redeemed.
    Type string
    Required - Identity type, can be tls, bearer, or devlxd. See Note on auth_method.
    auth_method string
    Authentication method of the identity, either tls or bearer.
    expires_at string
    Time at which the trust token expires, in RFC 3339 format and UTC. It is null when the server config core.remote_token_expiry is not set, which means the token does not expire.
    groups list(string)
    Optional - List of group names to add this identity to.
    name string
    Required - Name of the identity.
    remote string
    Optional - The remote in which the resource will be created. If not provided, the provider's default remote will be used.
    tls_certificate string
    Optional - PEM encoded x509 certificate. Applicable only when the authentication method is tls. If omitted, a pending TLS identity is created and a trust token is issued instead. Once a TLS identity is created, removing this attribute from the configuration leaves the certificate intact.
    trust_token string
    Trust token that an untrusted client uses to enroll its certificate. It is set only for a pending TLS identity, and is cleared once the token has been redeemed.
    type string
    Required - Identity type, can be tls, bearer, or devlxd. See Note on auth_method.
    authMethod String
    Authentication method of the identity, either tls or bearer.
    expiresAt String
    Time at which the trust token expires, in RFC 3339 format and UTC. It is null when the server config core.remote_token_expiry is not set, which means the token does not expire.
    groups List<String>
    Optional - List of group names to add this identity to.
    name String
    Required - Name of the identity.
    remote String
    Optional - The remote in which the resource will be created. If not provided, the provider's default remote will be used.
    tlsCertificate String
    Optional - PEM encoded x509 certificate. Applicable only when the authentication method is tls. If omitted, a pending TLS identity is created and a trust token is issued instead. Once a TLS identity is created, removing this attribute from the configuration leaves the certificate intact.
    trustToken String
    Trust token that an untrusted client uses to enroll its certificate. It is set only for a pending TLS identity, and is cleared once the token has been redeemed.
    type String
    Required - Identity type, can be tls, bearer, or devlxd. See Note on auth_method.
    authMethod string
    Authentication method of the identity, either tls or bearer.
    expiresAt string
    Time at which the trust token expires, in RFC 3339 format and UTC. It is null when the server config core.remote_token_expiry is not set, which means the token does not expire.
    groups string[]
    Optional - List of group names to add this identity to.
    name string
    Required - Name of the identity.
    remote string
    Optional - The remote in which the resource will be created. If not provided, the provider's default remote will be used.
    tlsCertificate string
    Optional - PEM encoded x509 certificate. Applicable only when the authentication method is tls. If omitted, a pending TLS identity is created and a trust token is issued instead. Once a TLS identity is created, removing this attribute from the configuration leaves the certificate intact.
    trustToken string
    Trust token that an untrusted client uses to enroll its certificate. It is set only for a pending TLS identity, and is cleared once the token has been redeemed.
    type string
    Required - Identity type, can be tls, bearer, or devlxd. See Note on auth_method.
    auth_method str
    Authentication method of the identity, either tls or bearer.
    expires_at str
    Time at which the trust token expires, in RFC 3339 format and UTC. It is null when the server config core.remote_token_expiry is not set, which means the token does not expire.
    groups Sequence[str]
    Optional - List of group names to add this identity to.
    name str
    Required - Name of the identity.
    remote str
    Optional - The remote in which the resource will be created. If not provided, the provider's default remote will be used.
    tls_certificate str
    Optional - PEM encoded x509 certificate. Applicable only when the authentication method is tls. If omitted, a pending TLS identity is created and a trust token is issued instead. Once a TLS identity is created, removing this attribute from the configuration leaves the certificate intact.
    trust_token str
    Trust token that an untrusted client uses to enroll its certificate. It is set only for a pending TLS identity, and is cleared once the token has been redeemed.
    type str
    Required - Identity type, can be tls, bearer, or devlxd. See Note on auth_method.
    authMethod String
    Authentication method of the identity, either tls or bearer.
    expiresAt String
    Time at which the trust token expires, in RFC 3339 format and UTC. It is null when the server config core.remote_token_expiry is not set, which means the token does not expire.
    groups List<String>
    Optional - List of group names to add this identity to.
    name String
    Required - Name of the identity.
    remote String
    Optional - The remote in which the resource will be created. If not provided, the provider's default remote will be used.
    tlsCertificate String
    Optional - PEM encoded x509 certificate. Applicable only when the authentication method is tls. If omitted, a pending TLS identity is created and a trust token is issued instead. Once a TLS identity is created, removing this attribute from the configuration leaves the certificate intact.
    trustToken String
    Trust token that an untrusted client uses to enroll its certificate. It is set only for a pending TLS identity, and is cleared once the token has been redeemed.
    type String
    Required - Identity type, can be tls, bearer, or devlxd. See Note on auth_method.

    Package Details

    Repository
    lxd terraform-lxd/terraform-provider-lxd
    License
    Notes
    This Pulumi package is based on the lxd Terraform Provider.
    lxd
    Viewing docs for lxd 3.1.1
    published on Thursday, Oct 1, 2026 by terraform-lxd
    Schema (JSON)
    terraform-lxd/terraform-provider-lxd

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial