Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. config
  6. UiDefaultAuth
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.config.UiDefaultAuth

vault logo vault logo
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages the UI default authentication configuration for the Vault GUI login form. This resource configures which authentication method is displayed by default on the Vault UI login page, along with optional backup authentication methods that appear in the “Sign in with other methods” tab.

    Important This feature is available only with Vault Enterprise 1.20.0 or later.

    Example Usage

    Basic Configuration

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const example = new vault.config.UiDefaultAuth("example", {
    name: "my-auth-config",
    defaultAuthType: "ldap",
});

    import pulumi
import pulumi_vault as vault

example = vault.config.UiDefaultAuth("example",
    name="my-auth-config",
    default_auth_type="ldap")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := config.NewUiDefaultAuth(ctx, "example", &config.UiDefaultAuthArgs{
			Name:            pulumi.String("my-auth-config"),
			DefaultAuthType: pulumi.String("ldap"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var example = new Vault.Config.UiDefaultAuth("example", new()
    {
        Name = "my-auth-config",
        DefaultAuthType = "ldap",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.config.UiDefaultAuth;
import com.pulumi.vault.config.UiDefaultAuthArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new UiDefaultAuth("example", UiDefaultAuthArgs.builder()
            .name("my-auth-config")
            .defaultAuthType("ldap")
            .build());

    }
}

    resources:
  example:
    type: vault:config:UiDefaultAuth
    properties:
      name: my-auth-config
      defaultAuthType: ldap

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_config_uidefaultauth" "example" {
  name              = "my-auth-config"
  default_auth_type = "ldap"
}

    Configuration with Backup Methods

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const example = new vault.config.UiDefaultAuth("example", {
    name: "my-auth-config",
    defaultAuthType: "oidc",
    backupAuthTypes: [
        "ldap",
        "userpass",
        "token",
    ],
});

    import pulumi
import pulumi_vault as vault

example = vault.config.UiDefaultAuth("example",
    name="my-auth-config",
    default_auth_type="oidc",
    backup_auth_types=[
        "ldap",
        "userpass",
        "token",
    ])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := config.NewUiDefaultAuth(ctx, "example", &config.UiDefaultAuthArgs{
			Name:            pulumi.String("my-auth-config"),
			DefaultAuthType: pulumi.String("oidc"),
			BackupAuthTypes: pulumi.StringArray{
				pulumi.String("ldap"),
				pulumi.String("userpass"),
				pulumi.String("token"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var example = new Vault.Config.UiDefaultAuth("example", new()
    {
        Name = "my-auth-config",
        DefaultAuthType = "oidc",
        BackupAuthTypes = new[]
        {
            "ldap",
            "userpass",
            "token",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.config.UiDefaultAuth;
import com.pulumi.vault.config.UiDefaultAuthArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new UiDefaultAuth("example", UiDefaultAuthArgs.builder()
            .name("my-auth-config")
            .defaultAuthType("oidc")
            .backupAuthTypes(            
                "ldap",
                "userpass",
                "token")
            .build());

    }
}

    resources:
  example:
    type: vault:config:UiDefaultAuth
    properties:
      name: my-auth-config
      defaultAuthType: oidc
      backupAuthTypes:
        - ldap
        - userpass
        - token

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_config_uidefaultauth" "example" {
  name              = "my-auth-config"
  default_auth_type = "oidc"
  backup_auth_types = ["ldap", "userpass", "token"]
}

    Configuration for Specific Namespace

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const adminConfig = new vault.config.UiDefaultAuth("admin_config", {
    name: "admin-auth-config",
    namespacePath: "admin",
    defaultAuthType: "ldap",
    backupAuthTypes: ["token"],
});

    import pulumi
import pulumi_vault as vault

admin_config = vault.config.UiDefaultAuth("admin_config",
    name="admin-auth-config",
    namespace_path="admin",
    default_auth_type="ldap",
    backup_auth_types=["token"])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := config.NewUiDefaultAuth(ctx, "admin_config", &config.UiDefaultAuthArgs{
			Name:            pulumi.String("admin-auth-config"),
			NamespacePath:   pulumi.String("admin"),
			DefaultAuthType: pulumi.String("ldap"),
			BackupAuthTypes: pulumi.StringArray{
				pulumi.String("token"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var adminConfig = new Vault.Config.UiDefaultAuth("admin_config", new()
    {
        Name = "admin-auth-config",
        NamespacePath = "admin",
        DefaultAuthType = "ldap",
        BackupAuthTypes = new[]
        {
            "token",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.config.UiDefaultAuth;
import com.pulumi.vault.config.UiDefaultAuthArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var adminConfig = new UiDefaultAuth("adminConfig", UiDefaultAuthArgs.builder()
            .name("admin-auth-config")
            .namespacePath("admin")
            .defaultAuthType("ldap")
            .backupAuthTypes("token")
            .build());

    }
}

    resources:
  adminConfig:
    type: vault:config:UiDefaultAuth
    name: admin_config
    properties:
      name: admin-auth-config
      namespacePath: admin
      defaultAuthType: ldap
      backupAuthTypes:
        - token

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_config_uidefaultauth" "admin_config" {
  name              = "admin-auth-config"
  namespace_path    = "admin"
  default_auth_type = "ldap"
  backup_auth_types = ["token"]
}

    Configuration with Inheritance Disabled

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const parentConfig = new vault.config.UiDefaultAuth("parent_config", {
    name: "parent-auth-config",
    namespacePath: "parent",
    defaultAuthType: "oidc",
    backupAuthTypes: [
        "github",
        "token",
    ],
    disableInheritance: true,
});

    import pulumi
import pulumi_vault as vault

parent_config = vault.config.UiDefaultAuth("parent_config",
    name="parent-auth-config",
    namespace_path="parent",
    default_auth_type="oidc",
    backup_auth_types=[
        "github",
        "token",
    ],
    disable_inheritance=True)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := config.NewUiDefaultAuth(ctx, "parent_config", &config.UiDefaultAuthArgs{
			Name:            pulumi.String("parent-auth-config"),
			NamespacePath:   pulumi.String("parent"),
			DefaultAuthType: pulumi.String("oidc"),
			BackupAuthTypes: pulumi.StringArray{
				pulumi.String("github"),
				pulumi.String("token"),
			},
			DisableInheritance: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var parentConfig = new Vault.Config.UiDefaultAuth("parent_config", new()
    {
        Name = "parent-auth-config",
        NamespacePath = "parent",
        DefaultAuthType = "oidc",
        BackupAuthTypes = new[]
        {
            "github",
            "token",
        },
        DisableInheritance = true,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.config.UiDefaultAuth;
import com.pulumi.vault.config.UiDefaultAuthArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var parentConfig = new UiDefaultAuth("parentConfig", UiDefaultAuthArgs.builder()
            .name("parent-auth-config")
            .namespacePath("parent")
            .defaultAuthType("oidc")
            .backupAuthTypes(            
                "github",
                "token")
            .disableInheritance(true)
            .build());

    }
}

    resources:
  parentConfig:
    type: vault:config:UiDefaultAuth
    name: parent_config
    properties:
      name: parent-auth-config
      namespacePath: parent
      defaultAuthType: oidc
      backupAuthTypes:
        - github
        - token
      disableInheritance: true

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_config_uidefaultauth" "parent_config" {
  name                = "parent-auth-config"
  namespace_path      = "parent"
  default_auth_type   = "oidc"
  backup_auth_types   = ["github", "token"]
  disable_inheritance = true
}

    Complete Configuration Example

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const complete = new vault.config.UiDefaultAuth("complete", {
    name: "complete-auth-config",
    namespacePath: "engineering",
    defaultAuthType: "oidc",
    backupAuthTypes: [
        "ldap",
        "userpass",
        "token",
    ],
    disableInheritance: true,
});

    import pulumi
import pulumi_vault as vault

complete = vault.config.UiDefaultAuth("complete",
    name="complete-auth-config",
    namespace_path="engineering",
    default_auth_type="oidc",
    backup_auth_types=[
        "ldap",
        "userpass",
        "token",
    ],
    disable_inheritance=True)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := config.NewUiDefaultAuth(ctx, "complete", &config.UiDefaultAuthArgs{
			Name:            pulumi.String("complete-auth-config"),
			NamespacePath:   pulumi.String("engineering"),
			DefaultAuthType: pulumi.String("oidc"),
			BackupAuthTypes: pulumi.StringArray{
				pulumi.String("ldap"),
				pulumi.String("userpass"),
				pulumi.String("token"),
			},
			DisableInheritance: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var complete = new Vault.Config.UiDefaultAuth("complete", new()
    {
        Name = "complete-auth-config",
        NamespacePath = "engineering",
        DefaultAuthType = "oidc",
        BackupAuthTypes = new[]
        {
            "ldap",
            "userpass",
            "token",
        },
        DisableInheritance = true,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.config.UiDefaultAuth;
import com.pulumi.vault.config.UiDefaultAuthArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var complete = new UiDefaultAuth("complete", UiDefaultAuthArgs.builder()
            .name("complete-auth-config")
            .namespacePath("engineering")
            .defaultAuthType("oidc")
            .backupAuthTypes(            
                "ldap",
                "userpass",
                "token")
            .disableInheritance(true)
            .build());

    }
}

    resources:
  complete:
    type: vault:config:UiDefaultAuth
    properties:
      name: complete-auth-config
      namespacePath: engineering
      defaultAuthType: oidc
      backupAuthTypes:
        - ldap
        - userpass
        - token
      disableInheritance: true

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_config_uidefaultauth" "complete" {
  name                = "complete-auth-config"
  namespace_path      = "engineering"
  default_auth_type   = "oidc"
  backup_auth_types   = ["ldap", "userpass", "token"]
  disable_inheritance = true
}

    Notes

    • Enterprise Only: This resource requires Vault Enterprise 1.20.0 or later.

    • Authentication Methods: The authentication methods specified in defaultAuthType and backupAuthTypes must be enabled in Vault before they can be used in the UI configuration. The resource validates that only supported auth types are used.

    • Root Namespace: When namespacePath is empty, omitted, or set to "root" or "root/", the configuration applies to the root namespace. All these values are treated equivalently.

    • Order Preservation: The order of methods in backupAuthTypes is preserved and determines the display order in the Vault UI’s “Sign in with other methods” tab.

    • Supported Auth Types: The following authentication types are supported: github, jwt, ldap, oidc, okta, radius, saml, token, and userpass. These correspond to Vault’s authentication methods.

    API Documentation

    For more details on the underlying Vault API, see the Vault UI Default Auth API documentation.

    Create UiDefaultAuth Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new UiDefaultAuth(name: string, args: UiDefaultAuthArgs, opts?: CustomResourceOptions);
    @overload
def UiDefaultAuth(resource_name: str,
                  args: UiDefaultAuthArgs,
                  opts: Optional[ResourceOptions] = None)

@overload
def UiDefaultAuth(resource_name: str,
                  opts: Optional[ResourceOptions] = None,
                  default_auth_type: Optional[str] = None,
                  backup_auth_types: Optional[Sequence[str]] = None,
                  disable_inheritance: Optional[bool] = None,
                  name: Optional[str] = None,
                  namespace: Optional[str] = None,
                  namespace_path: Optional[str] = None)
    func NewUiDefaultAuth(ctx *Context, name string, args UiDefaultAuthArgs, opts ...ResourceOption) (*UiDefaultAuth, error)
    public UiDefaultAuth(string name, UiDefaultAuthArgs args, CustomResourceOptions? opts = null)
    public UiDefaultAuth(String name, UiDefaultAuthArgs args)
public UiDefaultAuth(String name, UiDefaultAuthArgs args, CustomResourceOptions options)

    type: vault:config:UiDefaultAuth
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_config_ui_default_auth" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args UiDefaultAuthArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args UiDefaultAuthArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args UiDefaultAuthArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args UiDefaultAuthArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args UiDefaultAuthArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var uiDefaultAuthResource = new Vault.Config.UiDefaultAuth("uiDefaultAuthResource", new()
{
    DefaultAuthType = "string",
    BackupAuthTypes = new[]
    {
        "string",
    },
    DisableInheritance = false,
    Name = "string",
    Namespace = "string",
    NamespacePath = "string",
});

    example, err := config.NewUiDefaultAuth(ctx, "uiDefaultAuthResource", &config.UiDefaultAuthArgs{
	DefaultAuthType: pulumi.String("string"),
	BackupAuthTypes: pulumi.StringArray{
		pulumi.String("string"),
	},
	DisableInheritance: pulumi.Bool(false),
	Name:               pulumi.String("string"),
	Namespace:          pulumi.String("string"),
	NamespacePath:      pulumi.String("string"),
})

    resource "vault_config_ui_default_auth" "uiDefaultAuthResource" {
  lifecycle {
    create_before_destroy = true
  }
  default_auth_type   = "string"
  backup_auth_types   = ["string"]
  disable_inheritance = false
  name                = "string"
  namespace           = "string"
  namespace_path      = "string"
}

    var uiDefaultAuthResource = new UiDefaultAuth("uiDefaultAuthResource", UiDefaultAuthArgs.builder()
    .defaultAuthType("string")
    .backupAuthTypes("string")
    .disableInheritance(false)
    .name("string")
    .namespace("string")
    .namespacePath("string")
    .build());

    ui_default_auth_resource = vault.config.UiDefaultAuth("uiDefaultAuthResource",
    default_auth_type="string",
    backup_auth_types=["string"],
    disable_inheritance=False,
    name="string",
    namespace="string",
    namespace_path="string")

    const uiDefaultAuthResource = new vault.config.UiDefaultAuth("uiDefaultAuthResource", {
    defaultAuthType: "string",
    backupAuthTypes: ["string"],
    disableInheritance: false,
    name: "string",
    namespace: "string",
    namespacePath: "string",
});

    type: vault:config:UiDefaultAuth
properties:
    backupAuthTypes:
        - string
    defaultAuthType: string
    disableInheritance: false
    name: string
    namespace: string
    namespacePath: string

    UiDefaultAuth Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The UiDefaultAuth resource accepts the following input properties:

    DefaultAuthType string
    The default authentication method displayed on the Vault UI login page. Must be one of: github, jwt, ldap, oidc, okta, radius, saml, token, or userpass.
    BackupAuthTypes List<string>
    List of backup authentication methods displayed in the "Sign in with other methods" tab in the Vault UI. Each value must be a valid authentication type from the same list as defaultAuthType. The order of methods is preserved as specified.
    DisableInheritance bool
    If true, child namespaces will not inherit the defaultAuthType and backupAuthTypes from this configuration. Defaults to false.
    Name string
    Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.
    Namespace string
    Target namespace. (requires Enterprise)
    NamespacePath string
    Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values "", "root", and "root/" are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.
    DefaultAuthType string
    The default authentication method displayed on the Vault UI login page. Must be one of: github, jwt, ldap, oidc, okta, radius, saml, token, or userpass.
    BackupAuthTypes []string
    List of backup authentication methods displayed in the "Sign in with other methods" tab in the Vault UI. Each value must be a valid authentication type from the same list as defaultAuthType. The order of methods is preserved as specified.
    DisableInheritance bool
    If true, child namespaces will not inherit the defaultAuthType and backupAuthTypes from this configuration. Defaults to false.
    Name string
    Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.
    Namespace string
    Target namespace. (requires Enterprise)
    NamespacePath string
    Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values "", "root", and "root/" are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.
    default_auth_type string
    The default authentication method displayed on the Vault UI login page. Must be one of: github, jwt, ldap, oidc, okta, radius, saml, token, or userpass.
    backup_auth_types list(string)
    List of backup authentication methods displayed in the "Sign in with other methods" tab in the Vault UI. Each value must be a valid authentication type from the same list as defaultAuthType. The order of methods is preserved as specified.
    disable_inheritance bool
    If true, child namespaces will not inherit the defaultAuthType and backupAuthTypes from this configuration. Defaults to false.
    name string
    Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.
    namespace string
    Target namespace. (requires Enterprise)
    namespace_path string
    Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values "", "root", and "root/" are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.
    defaultAuthType String
    The default authentication method displayed on the Vault UI login page. Must be one of: github, jwt, ldap, oidc, okta, radius, saml, token, or userpass.
    backupAuthTypes List<String>
    List of backup authentication methods displayed in the "Sign in with other methods" tab in the Vault UI. Each value must be a valid authentication type from the same list as defaultAuthType. The order of methods is preserved as specified.
    disableInheritance Boolean
    If true, child namespaces will not inherit the defaultAuthType and backupAuthTypes from this configuration. Defaults to false.
    name String
    Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.
    namespace String
    Target namespace. (requires Enterprise)
    namespacePath String
    Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values "", "root", and "root/" are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.
    defaultAuthType string
    The default authentication method displayed on the Vault UI login page. Must be one of: github, jwt, ldap, oidc, okta, radius, saml, token, or userpass.
    backupAuthTypes string[]
    List of backup authentication methods displayed in the "Sign in with other methods" tab in the Vault UI. Each value must be a valid authentication type from the same list as defaultAuthType. The order of methods is preserved as specified.
    disableInheritance boolean
    If true, child namespaces will not inherit the defaultAuthType and backupAuthTypes from this configuration. Defaults to false.
    name string
    Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.
    namespace string
    Target namespace. (requires Enterprise)
    namespacePath string
    Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values "", "root", and "root/" are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.
    default_auth_type str
    The default authentication method displayed on the Vault UI login page. Must be one of: github, jwt, ldap, oidc, okta, radius, saml, token, or userpass.
    backup_auth_types Sequence[str]
    List of backup authentication methods displayed in the "Sign in with other methods" tab in the Vault UI. Each value must be a valid authentication type from the same list as defaultAuthType. The order of methods is preserved as specified.
    disable_inheritance bool
    If true, child namespaces will not inherit the defaultAuthType and backupAuthTypes from this configuration. Defaults to false.
    name str
    Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.
    namespace str
    Target namespace. (requires Enterprise)
    namespace_path str
    Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values "", "root", and "root/" are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.
    defaultAuthType String
    The default authentication method displayed on the Vault UI login page. Must be one of: github, jwt, ldap, oidc, okta, radius, saml, token, or userpass.
    backupAuthTypes List<String>
    List of backup authentication methods displayed in the "Sign in with other methods" tab in the Vault UI. Each value must be a valid authentication type from the same list as defaultAuthType. The order of methods is preserved as specified.
    disableInheritance Boolean
    If true, child namespaces will not inherit the defaultAuthType and backupAuthTypes from this configuration. Defaults to false.
    name String
    Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.
    namespace String
    Target namespace. (requires Enterprise)
    namespacePath String
    Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values "", "root", and "root/" are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the UiDefaultAuth resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing UiDefaultAuth Resource

    Get an existing UiDefaultAuth resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: UiDefaultAuthState, opts?: CustomResourceOptions): UiDefaultAuth
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        backup_auth_types: Optional[Sequence[str]] = None,
        default_auth_type: Optional[str] = None,
        disable_inheritance: Optional[bool] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        namespace_path: Optional[str] = None) -> UiDefaultAuth
    func GetUiDefaultAuth(ctx *Context, name string, id IDInput, state *UiDefaultAuthState, opts ...ResourceOption) (*UiDefaultAuth, error)
    public static UiDefaultAuth Get(string name, Input<string> id, UiDefaultAuthState? state, CustomResourceOptions? opts = null)
    public static UiDefaultAuth get(String name, Output<String> id, UiDefaultAuthState state, CustomResourceOptions options)
    resources:  _:    type: vault:config:UiDefaultAuth    get:      id: ${id}
    import {
  to = vault_config_ui_default_auth.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    BackupAuthTypes List<string>
    List of backup authentication methods displayed in the "Sign in with other methods" tab in the Vault UI. Each value must be a valid authentication type from the same list as defaultAuthType. The order of methods is preserved as specified.
    DefaultAuthType string
    The default authentication method displayed on the Vault UI login page. Must be one of: github, jwt, ldap, oidc, okta, radius, saml, token, or userpass.
    DisableInheritance bool
    If true, child namespaces will not inherit the defaultAuthType and backupAuthTypes from this configuration. Defaults to false.
    Name string
    Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.
    Namespace string
    Target namespace. (requires Enterprise)
    NamespacePath string
    Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values "", "root", and "root/" are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.
    BackupAuthTypes []string
    List of backup authentication methods displayed in the "Sign in with other methods" tab in the Vault UI. Each value must be a valid authentication type from the same list as defaultAuthType. The order of methods is preserved as specified.
    DefaultAuthType string
    The default authentication method displayed on the Vault UI login page. Must be one of: github, jwt, ldap, oidc, okta, radius, saml, token, or userpass.
    DisableInheritance bool
    If true, child namespaces will not inherit the defaultAuthType and backupAuthTypes from this configuration. Defaults to false.
    Name string
    Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.
    Namespace string
    Target namespace. (requires Enterprise)
    NamespacePath string
    Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values "", "root", and "root/" are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.
    backup_auth_types list(string)
    List of backup authentication methods displayed in the "Sign in with other methods" tab in the Vault UI. Each value must be a valid authentication type from the same list as defaultAuthType. The order of methods is preserved as specified.
    default_auth_type string
    The default authentication method displayed on the Vault UI login page. Must be one of: github, jwt, ldap, oidc, okta, radius, saml, token, or userpass.
    disable_inheritance bool
    If true, child namespaces will not inherit the defaultAuthType and backupAuthTypes from this configuration. Defaults to false.
    name string
    Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.
    namespace string
    Target namespace. (requires Enterprise)
    namespace_path string
    Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values "", "root", and "root/" are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.
    backupAuthTypes List<String>
    List of backup authentication methods displayed in the "Sign in with other methods" tab in the Vault UI. Each value must be a valid authentication type from the same list as defaultAuthType. The order of methods is preserved as specified.
    defaultAuthType String
    The default authentication method displayed on the Vault UI login page. Must be one of: github, jwt, ldap, oidc, okta, radius, saml, token, or userpass.
    disableInheritance Boolean
    If true, child namespaces will not inherit the defaultAuthType and backupAuthTypes from this configuration. Defaults to false.
    name String
    Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.
    namespace String
    Target namespace. (requires Enterprise)
    namespacePath String
    Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values "", "root", and "root/" are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.
    backupAuthTypes string[]
    List of backup authentication methods displayed in the "Sign in with other methods" tab in the Vault UI. Each value must be a valid authentication type from the same list as defaultAuthType. The order of methods is preserved as specified.
    defaultAuthType string
    The default authentication method displayed on the Vault UI login page. Must be one of: github, jwt, ldap, oidc, okta, radius, saml, token, or userpass.
    disableInheritance boolean
    If true, child namespaces will not inherit the defaultAuthType and backupAuthTypes from this configuration. Defaults to false.
    name string
    Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.
    namespace string
    Target namespace. (requires Enterprise)
    namespacePath string
    Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values "", "root", and "root/" are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.
    backup_auth_types Sequence[str]
    List of backup authentication methods displayed in the "Sign in with other methods" tab in the Vault UI. Each value must be a valid authentication type from the same list as defaultAuthType. The order of methods is preserved as specified.
    default_auth_type str
    The default authentication method displayed on the Vault UI login page. Must be one of: github, jwt, ldap, oidc, okta, radius, saml, token, or userpass.
    disable_inheritance bool
    If true, child namespaces will not inherit the defaultAuthType and backupAuthTypes from this configuration. Defaults to false.
    name str
    Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.
    namespace str
    Target namespace. (requires Enterprise)
    namespace_path str
    Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values "", "root", and "root/" are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.
    backupAuthTypes List<String>
    List of backup authentication methods displayed in the "Sign in with other methods" tab in the Vault UI. Each value must be a valid authentication type from the same list as defaultAuthType. The order of methods is preserved as specified.
    defaultAuthType String
    The default authentication method displayed on the Vault UI login page. Must be one of: github, jwt, ldap, oidc, okta, radius, saml, token, or userpass.
    disableInheritance Boolean
    If true, child namespaces will not inherit the defaultAuthType and backupAuthTypes from this configuration. Defaults to false.
    name String
    Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.
    namespace String
    Target namespace. (requires Enterprise)
    namespacePath String
    Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values "", "root", and "root/" are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.

    Import

    UI default authentication configurations can be imported using the name, e.g.

    $ pulumi import vault:config/uiDefaultAuth:UiDefaultAuth example my-auth-config

    Importing with Namespaces

    When importing a configuration that exists in a specific namespace, you must set the TERRAFORM_VAULT_NAMESPACE_IMPORT environment variable to ensure proper resource management:

    $ export TERRAFORM_VAULT_NAMESPACE_IMPORT=admin
$ pulumi import vault:config/uiDefaultAuth:UiDefaultAuth example my-auth-config

    Without setting the namespace during import, subsequent operations (update/delete) may target the wrong namespace and fail.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.11.0
    published on Wednesday, Jul 22, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial