1. Registry
  2. Packages
  3. Lxd Provider
  4. API Docs
  5. getAuthIdentity
Viewing docs for lxd 3.1.1
published on Thursday, Oct 1, 2026 by terraform-lxd
lxd
Viewing docs for lxd 3.1.1
published on Thursday, Oct 1, 2026 by terraform-lxd

    # lxd.AuthIdentity

    Provides information about an existing LXD identity.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
    import * as lxd from "@pulumi/lxd";
    
    const id = lxd.getAuthIdentity({
        type: "bearer",
        name: "my-identity",
    });
    
    import pulumi
    import pulumi_lxd as lxd
    
    id = lxd.get_auth_identity(type="bearer",
        name="my-identity")
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-terraform-provider/sdks/go/lxd/v3/lxd"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		_, err := lxd.LookupAuthIdentity(ctx, &lxd.LookupAuthIdentityArgs{
    			Type: pulumi.StringRef("bearer"),
    			Name: "my-identity",
    		}, nil)
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Lxd = Pulumi.Lxd;
    
    return await Deployment.RunAsync(() => 
    {
        var id = Lxd.GetAuthIdentity.Invoke(new()
        {
            Type = "bearer",
            Name = "my-identity",
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.lxd.LxdFunctions;
    import com.pulumi.lxd.inputs.GetAuthIdentityArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            final var id = LxdFunctions.getAuthIdentity(GetAuthIdentityArgs.builder()
                .type("bearer")
                .name("my-identity")
                .build());
    
        }
    }
    
    variables:
      id:
        fn::invoke:
          function: lxd:getAuthIdentity
          arguments:
            type: bearer
            name: my-identity
    
    Example coming soon!
    

    Note on auth_method

    The auth_method represents the authentication method and type represents the type of identity. Before argument type was introduced, the auth_method was a required field. A single auth_method, such as bearer, represents multiple identity types.

    To prevent breaking changes, the shift from auth_method to type was handled gracefully allowing any of the two values to be provided. However, in the future releases, the auth_method will become a computed field and type required.

    Using getAuthIdentity

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getAuthIdentity(args: GetAuthIdentityArgs, opts?: InvokeOptions): Promise<GetAuthIdentityResult>
    function getAuthIdentityOutput(args: GetAuthIdentityOutputArgs, opts?: InvokeOutputOptions): Output<GetAuthIdentityResult>
    def get_auth_identity(auth_method: Optional[str] = None,
                          name: Optional[str] = None,
                          remote: Optional[str] = None,
                          type: Optional[str] = None,
                          opts: Optional[InvokeOptions] = None) -> GetAuthIdentityResult
    def get_auth_identity_output(auth_method: pulumi.Input[Optional[str]] = None,
                          name: pulumi.Input[Optional[str]] = None,
                          remote: pulumi.Input[Optional[str]] = None,
                          type: pulumi.Input[Optional[str]] = None,
                          opts: Optional[InvokeOutputOptions] = None) -> Output[GetAuthIdentityResult]
    func LookupAuthIdentity(ctx *Context, args *LookupAuthIdentityArgs, opts ...InvokeOption) (*LookupAuthIdentityResult, error)
    func LookupAuthIdentityOutput(ctx *Context, args *LookupAuthIdentityOutputArgs, opts ...InvokeOption) LookupAuthIdentityResultOutput

    > Note: This function is named LookupAuthIdentity in the Go SDK.

    public static class GetAuthIdentity 
    {
        public static Task<GetAuthIdentityResult> InvokeAsync(GetAuthIdentityArgs args, InvokeOptions? opts = null)
        public static Output<GetAuthIdentityResult> Invoke(GetAuthIdentityInvokeArgs args, InvokeOptions? opts = null)
        public static Output<GetAuthIdentityResult> Invoke(GetAuthIdentityInvokeArgs args, InvokeOutputOptions opts)
    }
    public static CompletableFuture<GetAuthIdentityResult> getAuthIdentity(GetAuthIdentityArgs args, InvokeOptions options)
    public static Output<GetAuthIdentityResult> getAuthIdentity(GetAuthIdentityArgs args, InvokeOptions options)
    public static Output<GetAuthIdentityResult> getAuthIdentity(GetAuthIdentityArgs args, InvokeOutputOptions options)
    
    fn::invoke:
      function: lxd:index/getAuthIdentity:getAuthIdentity
      arguments:
        # arguments dictionary
    data "lxd_get_auth_identity" "name" {
        # arguments
    }

    The following arguments are supported:

    Name string
    Required - Name of the identity.
    AuthMethod string
    Authentication method of the identity, can be tls, bearer, or oidc.
    Remote string
    Optional - The remote from which the identity is retrieved. If not provided, the provider's default remote is used.
    Type string
    Required - Identity type, can be tls, bearer, devlxd, or oidc. See Note on auth_method.
    Name string
    Required - Name of the identity.
    AuthMethod string
    Authentication method of the identity, can be tls, bearer, or oidc.
    Remote string
    Optional - The remote from which the identity is retrieved. If not provided, the provider's default remote is used.
    Type string
    Required - Identity type, can be tls, bearer, devlxd, or oidc. See Note on auth_method.
    name string
    Required - Name of the identity.
    auth_method string
    Authentication method of the identity, can be tls, bearer, or oidc.
    remote string
    Optional - The remote from which the identity is retrieved. If not provided, the provider's default remote is used.
    type string
    Required - Identity type, can be tls, bearer, devlxd, or oidc. See Note on auth_method.
    name String
    Required - Name of the identity.
    authMethod String
    Authentication method of the identity, can be tls, bearer, or oidc.
    remote String
    Optional - The remote from which the identity is retrieved. If not provided, the provider's default remote is used.
    type String
    Required - Identity type, can be tls, bearer, devlxd, or oidc. See Note on auth_method.
    name string
    Required - Name of the identity.
    authMethod string
    Authentication method of the identity, can be tls, bearer, or oidc.
    remote string
    Optional - The remote from which the identity is retrieved. If not provided, the provider's default remote is used.
    type string
    Required - Identity type, can be tls, bearer, devlxd, or oidc. See Note on auth_method.
    name str
    Required - Name of the identity.
    auth_method str
    Authentication method of the identity, can be tls, bearer, or oidc.
    remote str
    Optional - The remote from which the identity is retrieved. If not provided, the provider's default remote is used.
    type str
    Required - Identity type, can be tls, bearer, devlxd, or oidc. See Note on auth_method.
    name String
    Required - Name of the identity.
    authMethod String
    Authentication method of the identity, can be tls, bearer, or oidc.
    remote String
    Optional - The remote from which the identity is retrieved. If not provided, the provider's default remote is used.
    type String
    Required - Identity type, can be tls, bearer, devlxd, or oidc. See Note on auth_method.

    getAuthIdentity Result

    The following output properties are available:

    AuthMethod string
    Authentication method of the identity, can be tls, bearer, or oidc.
    ExpiresAt string
    Expiry of the identity's credential, in RFC3339 format. For bearer identities this is the expiry of the token that the identity currently bears, and it is empty once the identity bears no token. Requires the access_management_expiry API extension.
    Groups List<string>
    List of group names the identity is part of.
    Id string
    The provider-assigned unique ID for this managed resource.
    Identifier string
    Identity ID. For a pending TLS identity this is a UUID, which LXD replaces with the certificate fingerprint once the trust token is redeemed. Use name instead if you need a value that is stable across that transition.
    Name string
    Pending bool
    Whether no credential is issued for the identity. A TLS identity is pending until its trust token is redeemed. An identity with authentication method bearer is pending until a token is issued for it. If the server does not have the access_management_bearer_pending API extension, the pending state is unknown and reported as null for a bearer identity.
    TlsCertificate string
    PEM encoded x509 certificate. Populated only for TLS identities. It is empty for a pending TLS identity that has not yet redeemed its trust token.
    Type string
    Remote string
    AuthMethod string
    Authentication method of the identity, can be tls, bearer, or oidc.
    ExpiresAt string
    Expiry of the identity's credential, in RFC3339 format. For bearer identities this is the expiry of the token that the identity currently bears, and it is empty once the identity bears no token. Requires the access_management_expiry API extension.
    Groups []string
    List of group names the identity is part of.
    Id string
    The provider-assigned unique ID for this managed resource.
    Identifier string
    Identity ID. For a pending TLS identity this is a UUID, which LXD replaces with the certificate fingerprint once the trust token is redeemed. Use name instead if you need a value that is stable across that transition.
    Name string
    Pending bool
    Whether no credential is issued for the identity. A TLS identity is pending until its trust token is redeemed. An identity with authentication method bearer is pending until a token is issued for it. If the server does not have the access_management_bearer_pending API extension, the pending state is unknown and reported as null for a bearer identity.
    TlsCertificate string
    PEM encoded x509 certificate. Populated only for TLS identities. It is empty for a pending TLS identity that has not yet redeemed its trust token.
    Type string
    Remote string
    auth_method string
    Authentication method of the identity, can be tls, bearer, or oidc.
    expires_at string
    Expiry of the identity's credential, in RFC3339 format. For bearer identities this is the expiry of the token that the identity currently bears, and it is empty once the identity bears no token. Requires the access_management_expiry API extension.
    groups list(string)
    List of group names the identity is part of.
    id string
    The provider-assigned unique ID for this managed resource.
    identifier string
    Identity ID. For a pending TLS identity this is a UUID, which LXD replaces with the certificate fingerprint once the trust token is redeemed. Use name instead if you need a value that is stable across that transition.
    name string
    pending bool
    Whether no credential is issued for the identity. A TLS identity is pending until its trust token is redeemed. An identity with authentication method bearer is pending until a token is issued for it. If the server does not have the access_management_bearer_pending API extension, the pending state is unknown and reported as null for a bearer identity.
    tls_certificate string
    PEM encoded x509 certificate. Populated only for TLS identities. It is empty for a pending TLS identity that has not yet redeemed its trust token.
    type string
    remote string
    authMethod String
    Authentication method of the identity, can be tls, bearer, or oidc.
    expiresAt String
    Expiry of the identity's credential, in RFC3339 format. For bearer identities this is the expiry of the token that the identity currently bears, and it is empty once the identity bears no token. Requires the access_management_expiry API extension.
    groups List<String>
    List of group names the identity is part of.
    id String
    The provider-assigned unique ID for this managed resource.
    identifier String
    Identity ID. For a pending TLS identity this is a UUID, which LXD replaces with the certificate fingerprint once the trust token is redeemed. Use name instead if you need a value that is stable across that transition.
    name String
    pending Boolean
    Whether no credential is issued for the identity. A TLS identity is pending until its trust token is redeemed. An identity with authentication method bearer is pending until a token is issued for it. If the server does not have the access_management_bearer_pending API extension, the pending state is unknown and reported as null for a bearer identity.
    tlsCertificate String
    PEM encoded x509 certificate. Populated only for TLS identities. It is empty for a pending TLS identity that has not yet redeemed its trust token.
    type String
    remote String
    authMethod string
    Authentication method of the identity, can be tls, bearer, or oidc.
    expiresAt string
    Expiry of the identity's credential, in RFC3339 format. For bearer identities this is the expiry of the token that the identity currently bears, and it is empty once the identity bears no token. Requires the access_management_expiry API extension.
    groups string[]
    List of group names the identity is part of.
    id string
    The provider-assigned unique ID for this managed resource.
    identifier string
    Identity ID. For a pending TLS identity this is a UUID, which LXD replaces with the certificate fingerprint once the trust token is redeemed. Use name instead if you need a value that is stable across that transition.
    name string
    pending boolean
    Whether no credential is issued for the identity. A TLS identity is pending until its trust token is redeemed. An identity with authentication method bearer is pending until a token is issued for it. If the server does not have the access_management_bearer_pending API extension, the pending state is unknown and reported as null for a bearer identity.
    tlsCertificate string
    PEM encoded x509 certificate. Populated only for TLS identities. It is empty for a pending TLS identity that has not yet redeemed its trust token.
    type string
    remote string
    auth_method str
    Authentication method of the identity, can be tls, bearer, or oidc.
    expires_at str
    Expiry of the identity's credential, in RFC3339 format. For bearer identities this is the expiry of the token that the identity currently bears, and it is empty once the identity bears no token. Requires the access_management_expiry API extension.
    groups Sequence[str]
    List of group names the identity is part of.
    id str
    The provider-assigned unique ID for this managed resource.
    identifier str
    Identity ID. For a pending TLS identity this is a UUID, which LXD replaces with the certificate fingerprint once the trust token is redeemed. Use name instead if you need a value that is stable across that transition.
    name str
    pending bool
    Whether no credential is issued for the identity. A TLS identity is pending until its trust token is redeemed. An identity with authentication method bearer is pending until a token is issued for it. If the server does not have the access_management_bearer_pending API extension, the pending state is unknown and reported as null for a bearer identity.
    tls_certificate str
    PEM encoded x509 certificate. Populated only for TLS identities. It is empty for a pending TLS identity that has not yet redeemed its trust token.
    type str
    remote str
    authMethod String
    Authentication method of the identity, can be tls, bearer, or oidc.
    expiresAt String
    Expiry of the identity's credential, in RFC3339 format. For bearer identities this is the expiry of the token that the identity currently bears, and it is empty once the identity bears no token. Requires the access_management_expiry API extension.
    groups List<String>
    List of group names the identity is part of.
    id String
    The provider-assigned unique ID for this managed resource.
    identifier String
    Identity ID. For a pending TLS identity this is a UUID, which LXD replaces with the certificate fingerprint once the trust token is redeemed. Use name instead if you need a value that is stable across that transition.
    name String
    pending Boolean
    Whether no credential is issued for the identity. A TLS identity is pending until its trust token is redeemed. An identity with authentication method bearer is pending until a token is issued for it. If the server does not have the access_management_bearer_pending API extension, the pending state is unknown and reported as null for a bearer identity.
    tlsCertificate String
    PEM encoded x509 certificate. Populated only for TLS identities. It is empty for a pending TLS identity that has not yet redeemed its trust token.
    type String
    remote String

    Package Details

    Repository
    lxd terraform-lxd/terraform-provider-lxd
    License
    Notes
    This Pulumi package is based on the lxd Terraform Provider.
    lxd
    Viewing docs for lxd 3.1.1
    published on Thursday, Oct 1, 2026 by terraform-lxd

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial