published on Thursday, Oct 1, 2026 by terraform-lxd
published on Thursday, Oct 1, 2026 by terraform-lxd
# lxd.AuthIdentity
Provides information about an existing LXD identity.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as lxd from "@pulumi/lxd";
const id = lxd.getAuthIdentity({
type: "bearer",
name: "my-identity",
});
import pulumi
import pulumi_lxd as lxd
id = lxd.get_auth_identity(type="bearer",
name="my-identity")
package main
import (
"github.com/pulumi/pulumi-terraform-provider/sdks/go/lxd/v3/lxd"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := lxd.LookupAuthIdentity(ctx, &lxd.LookupAuthIdentityArgs{
Type: pulumi.StringRef("bearer"),
Name: "my-identity",
}, nil)
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Lxd = Pulumi.Lxd;
return await Deployment.RunAsync(() =>
{
var id = Lxd.GetAuthIdentity.Invoke(new()
{
Type = "bearer",
Name = "my-identity",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.lxd.LxdFunctions;
import com.pulumi.lxd.inputs.GetAuthIdentityArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var id = LxdFunctions.getAuthIdentity(GetAuthIdentityArgs.builder()
.type("bearer")
.name("my-identity")
.build());
}
}
variables:
id:
fn::invoke:
function: lxd:getAuthIdentity
arguments:
type: bearer
name: my-identity
Example coming soon!
Note on auth_method
The auth_method represents the authentication method and type represents the type of identity.
Before argument type was introduced, the auth_method was a required field.
A single auth_method, such as bearer, represents multiple identity types.
To prevent breaking changes, the shift from auth_method to type was handled gracefully allowing
any of the two values to be provided. However, in the future releases, the auth_method will become
a computed field and type required.
Using getAuthIdentity
Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.
function getAuthIdentity(args: GetAuthIdentityArgs, opts?: InvokeOptions): Promise<GetAuthIdentityResult>
function getAuthIdentityOutput(args: GetAuthIdentityOutputArgs, opts?: InvokeOutputOptions): Output<GetAuthIdentityResult>def get_auth_identity(auth_method: Optional[str] = None,
name: Optional[str] = None,
remote: Optional[str] = None,
type: Optional[str] = None,
opts: Optional[InvokeOptions] = None) -> GetAuthIdentityResult
def get_auth_identity_output(auth_method: pulumi.Input[Optional[str]] = None,
name: pulumi.Input[Optional[str]] = None,
remote: pulumi.Input[Optional[str]] = None,
type: pulumi.Input[Optional[str]] = None,
opts: Optional[InvokeOutputOptions] = None) -> Output[GetAuthIdentityResult]func LookupAuthIdentity(ctx *Context, args *LookupAuthIdentityArgs, opts ...InvokeOption) (*LookupAuthIdentityResult, error)
func LookupAuthIdentityOutput(ctx *Context, args *LookupAuthIdentityOutputArgs, opts ...InvokeOption) LookupAuthIdentityResultOutput> Note: This function is named LookupAuthIdentity in the Go SDK.
public static class GetAuthIdentity
{
public static Task<GetAuthIdentityResult> InvokeAsync(GetAuthIdentityArgs args, InvokeOptions? opts = null)
public static Output<GetAuthIdentityResult> Invoke(GetAuthIdentityInvokeArgs args, InvokeOptions? opts = null)
public static Output<GetAuthIdentityResult> Invoke(GetAuthIdentityInvokeArgs args, InvokeOutputOptions opts)
}public static CompletableFuture<GetAuthIdentityResult> getAuthIdentity(GetAuthIdentityArgs args, InvokeOptions options)
public static Output<GetAuthIdentityResult> getAuthIdentity(GetAuthIdentityArgs args, InvokeOptions options)
public static Output<GetAuthIdentityResult> getAuthIdentity(GetAuthIdentityArgs args, InvokeOutputOptions options)
fn::invoke:
function: lxd:index/getAuthIdentity:getAuthIdentity
arguments:
# arguments dictionarydata "lxd_get_auth_identity" "name" {
# arguments
}The following arguments are supported:
- Name string
- Required - Name of the identity.
- Auth
Method string - Authentication method of the identity, can be
tls,bearer, oroidc. - Remote string
- Optional - The remote from which the identity is retrieved. If not provided, the provider's default remote is used.
- Type string
- Required - Identity type, can be
tls,bearer,devlxd, oroidc. See Note onauth_method.
- Name string
- Required - Name of the identity.
- Auth
Method string - Authentication method of the identity, can be
tls,bearer, oroidc. - Remote string
- Optional - The remote from which the identity is retrieved. If not provided, the provider's default remote is used.
- Type string
- Required - Identity type, can be
tls,bearer,devlxd, oroidc. See Note onauth_method.
- name string
- Required - Name of the identity.
- auth_
method string - Authentication method of the identity, can be
tls,bearer, oroidc. - remote string
- Optional - The remote from which the identity is retrieved. If not provided, the provider's default remote is used.
- type string
- Required - Identity type, can be
tls,bearer,devlxd, oroidc. See Note onauth_method.
- name String
- Required - Name of the identity.
- auth
Method String - Authentication method of the identity, can be
tls,bearer, oroidc. - remote String
- Optional - The remote from which the identity is retrieved. If not provided, the provider's default remote is used.
- type String
- Required - Identity type, can be
tls,bearer,devlxd, oroidc. See Note onauth_method.
- name string
- Required - Name of the identity.
- auth
Method string - Authentication method of the identity, can be
tls,bearer, oroidc. - remote string
- Optional - The remote from which the identity is retrieved. If not provided, the provider's default remote is used.
- type string
- Required - Identity type, can be
tls,bearer,devlxd, oroidc. See Note onauth_method.
- name str
- Required - Name of the identity.
- auth_
method str - Authentication method of the identity, can be
tls,bearer, oroidc. - remote str
- Optional - The remote from which the identity is retrieved. If not provided, the provider's default remote is used.
- type str
- Required - Identity type, can be
tls,bearer,devlxd, oroidc. See Note onauth_method.
- name String
- Required - Name of the identity.
- auth
Method String - Authentication method of the identity, can be
tls,bearer, oroidc. - remote String
- Optional - The remote from which the identity is retrieved. If not provided, the provider's default remote is used.
- type String
- Required - Identity type, can be
tls,bearer,devlxd, oroidc. See Note onauth_method.
getAuthIdentity Result
The following output properties are available:
- Auth
Method string - Authentication method of the identity, can be
tls,bearer, oroidc. - Expires
At string - Expiry of the identity's credential, in RFC3339 format. For bearer
identities this is the expiry of the token that the identity currently bears, and
it is empty once the identity bears no token. Requires the
access_management_expiryAPI extension. - Groups List<string>
- List of group names the identity is part of.
- Id string
- The provider-assigned unique ID for this managed resource.
- Identifier string
- Identity ID. For a pending TLS identity this is a UUID, which LXD replaces
with the certificate fingerprint once the trust token is redeemed. Use
nameinstead if you need a value that is stable across that transition. - Name string
- Pending bool
- Whether no credential is issued for the identity. A TLS identity is pending
until its trust token is redeemed. An identity with authentication method
beareris pending until a token is issued for it. If the server does not have theaccess_management_bearer_pendingAPI extension, thependingstate is unknown and reported as null for a bearer identity. - Tls
Certificate string - PEM encoded x509 certificate. Populated only for TLS identities. It is empty for a pending TLS identity that has not yet redeemed its trust token.
- Type string
- Remote string
- Auth
Method string - Authentication method of the identity, can be
tls,bearer, oroidc. - Expires
At string - Expiry of the identity's credential, in RFC3339 format. For bearer
identities this is the expiry of the token that the identity currently bears, and
it is empty once the identity bears no token. Requires the
access_management_expiryAPI extension. - Groups []string
- List of group names the identity is part of.
- Id string
- The provider-assigned unique ID for this managed resource.
- Identifier string
- Identity ID. For a pending TLS identity this is a UUID, which LXD replaces
with the certificate fingerprint once the trust token is redeemed. Use
nameinstead if you need a value that is stable across that transition. - Name string
- Pending bool
- Whether no credential is issued for the identity. A TLS identity is pending
until its trust token is redeemed. An identity with authentication method
beareris pending until a token is issued for it. If the server does not have theaccess_management_bearer_pendingAPI extension, thependingstate is unknown and reported as null for a bearer identity. - Tls
Certificate string - PEM encoded x509 certificate. Populated only for TLS identities. It is empty for a pending TLS identity that has not yet redeemed its trust token.
- Type string
- Remote string
- auth_
method string - Authentication method of the identity, can be
tls,bearer, oroidc. - expires_
at string - Expiry of the identity's credential, in RFC3339 format. For bearer
identities this is the expiry of the token that the identity currently bears, and
it is empty once the identity bears no token. Requires the
access_management_expiryAPI extension. - groups list(string)
- List of group names the identity is part of.
- id string
- The provider-assigned unique ID for this managed resource.
- identifier string
- Identity ID. For a pending TLS identity this is a UUID, which LXD replaces
with the certificate fingerprint once the trust token is redeemed. Use
nameinstead if you need a value that is stable across that transition. - name string
- pending bool
- Whether no credential is issued for the identity. A TLS identity is pending
until its trust token is redeemed. An identity with authentication method
beareris pending until a token is issued for it. If the server does not have theaccess_management_bearer_pendingAPI extension, thependingstate is unknown and reported as null for a bearer identity. - tls_
certificate string - PEM encoded x509 certificate. Populated only for TLS identities. It is empty for a pending TLS identity that has not yet redeemed its trust token.
- type string
- remote string
- auth
Method String - Authentication method of the identity, can be
tls,bearer, oroidc. - expires
At String - Expiry of the identity's credential, in RFC3339 format. For bearer
identities this is the expiry of the token that the identity currently bears, and
it is empty once the identity bears no token. Requires the
access_management_expiryAPI extension. - groups List<String>
- List of group names the identity is part of.
- id String
- The provider-assigned unique ID for this managed resource.
- identifier String
- Identity ID. For a pending TLS identity this is a UUID, which LXD replaces
with the certificate fingerprint once the trust token is redeemed. Use
nameinstead if you need a value that is stable across that transition. - name String
- pending Boolean
- Whether no credential is issued for the identity. A TLS identity is pending
until its trust token is redeemed. An identity with authentication method
beareris pending until a token is issued for it. If the server does not have theaccess_management_bearer_pendingAPI extension, thependingstate is unknown and reported as null for a bearer identity. - tls
Certificate String - PEM encoded x509 certificate. Populated only for TLS identities. It is empty for a pending TLS identity that has not yet redeemed its trust token.
- type String
- remote String
- auth
Method string - Authentication method of the identity, can be
tls,bearer, oroidc. - expires
At string - Expiry of the identity's credential, in RFC3339 format. For bearer
identities this is the expiry of the token that the identity currently bears, and
it is empty once the identity bears no token. Requires the
access_management_expiryAPI extension. - groups string[]
- List of group names the identity is part of.
- id string
- The provider-assigned unique ID for this managed resource.
- identifier string
- Identity ID. For a pending TLS identity this is a UUID, which LXD replaces
with the certificate fingerprint once the trust token is redeemed. Use
nameinstead if you need a value that is stable across that transition. - name string
- pending boolean
- Whether no credential is issued for the identity. A TLS identity is pending
until its trust token is redeemed. An identity with authentication method
beareris pending until a token is issued for it. If the server does not have theaccess_management_bearer_pendingAPI extension, thependingstate is unknown and reported as null for a bearer identity. - tls
Certificate string - PEM encoded x509 certificate. Populated only for TLS identities. It is empty for a pending TLS identity that has not yet redeemed its trust token.
- type string
- remote string
- auth_
method str - Authentication method of the identity, can be
tls,bearer, oroidc. - expires_
at str - Expiry of the identity's credential, in RFC3339 format. For bearer
identities this is the expiry of the token that the identity currently bears, and
it is empty once the identity bears no token. Requires the
access_management_expiryAPI extension. - groups Sequence[str]
- List of group names the identity is part of.
- id str
- The provider-assigned unique ID for this managed resource.
- identifier str
- Identity ID. For a pending TLS identity this is a UUID, which LXD replaces
with the certificate fingerprint once the trust token is redeemed. Use
nameinstead if you need a value that is stable across that transition. - name str
- pending bool
- Whether no credential is issued for the identity. A TLS identity is pending
until its trust token is redeemed. An identity with authentication method
beareris pending until a token is issued for it. If the server does not have theaccess_management_bearer_pendingAPI extension, thependingstate is unknown and reported as null for a bearer identity. - tls_
certificate str - PEM encoded x509 certificate. Populated only for TLS identities. It is empty for a pending TLS identity that has not yet redeemed its trust token.
- type str
- remote str
- auth
Method String - Authentication method of the identity, can be
tls,bearer, oroidc. - expires
At String - Expiry of the identity's credential, in RFC3339 format. For bearer
identities this is the expiry of the token that the identity currently bears, and
it is empty once the identity bears no token. Requires the
access_management_expiryAPI extension. - groups List<String>
- List of group names the identity is part of.
- id String
- The provider-assigned unique ID for this managed resource.
- identifier String
- Identity ID. For a pending TLS identity this is a UUID, which LXD replaces
with the certificate fingerprint once the trust token is redeemed. Use
nameinstead if you need a value that is stable across that transition. - name String
- pending Boolean
- Whether no credential is issued for the identity. A TLS identity is pending
until its trust token is redeemed. An identity with authentication method
beareris pending until a token is issued for it. If the server does not have theaccess_management_bearer_pendingAPI extension, thependingstate is unknown and reported as null for a bearer identity. - tls
Certificate String - PEM encoded x509 certificate. Populated only for TLS identities. It is empty for a pending TLS identity that has not yet redeemed its trust token.
- type String
- remote String
Package Details
- Repository
- lxd terraform-lxd/terraform-provider-lxd
- License
- Notes
- This Pulumi package is based on the
lxdTerraform Provider.
published on Thursday, Oct 1, 2026 by terraform-lxd