Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. KerberosAuthBackendLdapConfig
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.KerberosAuthBackendLdapConfig

vault logo vault logo
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages LDAP configuration for the Kerberos authentication method in Vault.

    This resource configures LDAP integration for the Kerberos auth method, allowing Vault to query LDAP for user and group information after successful Kerberos authentication. This enables group-based policy assignment and additional user metadata retrieval.

    For more information, see the Vault Kerberos Auth Method documentation.

    Important The certificate field is marked as sensitive and will be stored in state files (but masked in output). Write-only fields (bindpassWo, clientTlsCertWo, clientTlsKeyWo) are not stored in state and are only sent to Vault during configuration. Protect state files accordingly. See the main provider documentation for more details.

    Note Vault does not support deleting auth backend LDAP configurations via the API. When this resource is destroyed or replaced (e.g., when changing the mount), it is only removed from Terraform state. The configuration remains in Vault until the auth mount itself is deleted.

    Example Usage

    Basic Configuration

    import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const kerberos = new vault.AuthBackend("kerberos", {
    type: "kerberos",
    path: "kerberos",
});
const kerberosKerberosAuthBackendConfig = new vault.KerberosAuthBackendConfig("kerberos", {
    mount: kerberos.path,
    keytabWo: std.filebase64({
        input: "/path/to/vault.keytab",
    }).then(invoke => invoke.result),
    keytabWoVersion: 1,
    serviceAccount: "vault/localhost@EXAMPLE.COM",
});
const config = new vault.KerberosAuthBackendLdapConfig("config", {
    mount: kerberos.path,
    url: "ldap://ldap.example.com",
    binddn: "cn=vault,ou=Users,dc=example,dc=com",
    userdn: "ou=People,dc=example,dc=org",
});

    import pulumi
import pulumi_std as std
import pulumi_vault as vault

kerberos = vault.AuthBackend("kerberos",
    type="kerberos",
    path="kerberos")
kerberos_kerberos_auth_backend_config = vault.KerberosAuthBackendConfig("kerberos",
    mount=kerberos.path,
    keytab_wo=std.filebase64(input="/path/to/vault.keytab").result,
    keytab_wo_version=1,
    service_account="vault/localhost@EXAMPLE.COM")
config = vault.KerberosAuthBackendLdapConfig("config",
    mount=kerberos.path,
    url="ldap://ldap.example.com",
    binddn="cn=vault,ou=Users,dc=example,dc=com",
    userdn="ou=People,dc=example,dc=org")

    package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		kerberos, err := vault.NewAuthBackend(ctx, "kerberos", &vault.AuthBackendArgs{
			Type: pulumi.String("kerberos"),
			Path: pulumi.String("kerberos"),
		})
		if err != nil {
			return err
		}
		invokeFilebase64, err := std.Filebase64(ctx, &std.Filebase64Args{
			Input: "/path/to/vault.keytab",
		}, nil)
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendConfig(ctx, "kerberos", &vault.KerberosAuthBackendConfigArgs{
			Mount:           kerberos.Path,
			KeytabWo:        pulumi.String(invokeFilebase64.Result),
			KeytabWoVersion: pulumi.Int(1),
			ServiceAccount:  pulumi.String("vault/localhost@EXAMPLE.COM"),
		})
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendLdapConfig(ctx, "config", &vault.KerberosAuthBackendLdapConfigArgs{
			Mount:  kerberos.Path,
			Url:    pulumi.String("ldap://ldap.example.com"),
			Binddn: pulumi.String("cn=vault,ou=Users,dc=example,dc=com"),
			Userdn: pulumi.String("ou=People,dc=example,dc=org"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var kerberos = new Vault.AuthBackend("kerberos", new()
    {
        Type = "kerberos",
        Path = "kerberos",
    });

    var kerberosKerberosAuthBackendConfig = new Vault.KerberosAuthBackendConfig("kerberos", new()
    {
        Mount = kerberos.Path,
        KeytabWo = Std.Filebase64.Invoke(new()
        {
            Input = "/path/to/vault.keytab",
        }).Apply(invoke => invoke.Result),
        KeytabWoVersion = 1,
        ServiceAccount = "vault/localhost@EXAMPLE.COM",
    });

    var config = new Vault.KerberosAuthBackendLdapConfig("config", new()
    {
        Mount = kerberos.Path,
        Url = "ldap://ldap.example.com",
        Binddn = "cn=vault,ou=Users,dc=example,dc=com",
        Userdn = "ou=People,dc=example,dc=org",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.KerberosAuthBackendConfig;
import com.pulumi.vault.KerberosAuthBackendConfigArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.Filebase64Args;
import com.pulumi.vault.KerberosAuthBackendLdapConfig;
import com.pulumi.vault.KerberosAuthBackendLdapConfigArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var kerberos = new AuthBackend("kerberos", AuthBackendArgs.builder()
            .type("kerberos")
            .path("kerberos")
            .build());

        var kerberosKerberosAuthBackendConfig = new KerberosAuthBackendConfig("kerberosKerberosAuthBackendConfig", KerberosAuthBackendConfigArgs.builder()
            .mount(kerberos.path())
            .keytabWo(StdFunctions.filebase64(Filebase64Args.builder()
                .input("/path/to/vault.keytab")
                .build()).result())
            .keytabWoVersion(1)
            .serviceAccount("vault/localhost@EXAMPLE.COM")
            .build());

        var config = new KerberosAuthBackendLdapConfig("config", KerberosAuthBackendLdapConfigArgs.builder()
            .mount(kerberos.path())
            .url("ldap://ldap.example.com")
            .binddn("cn=vault,ou=Users,dc=example,dc=com")
            .userdn("ou=People,dc=example,dc=org")
            .build());

    }
}

    resources:
  kerberos:
    type: vault:AuthBackend
    properties:
      type: kerberos
      path: kerberos
  kerberosKerberosAuthBackendConfig:
    type: vault:KerberosAuthBackendConfig
    name: kerberos
    properties:
      mount: ${kerberos.path}
      keytabWo:
        fn::invoke:
          function: std:filebase64
          arguments:
            input: /path/to/vault.keytab
          return: result
      keytabWoVersion: 1
      serviceAccount: vault/localhost@EXAMPLE.COM
  config:
    type: vault:KerberosAuthBackendLdapConfig
    properties:
      mount: ${kerberos.path}
      url: ldap://ldap.example.com
      binddn: cn=vault,ou=Users,dc=example,dc=com
      userdn: ou=People,dc=example,dc=org

    pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_authbackend" "kerberos" {
  type = "kerberos"
  path = "kerberos"
}
resource "vault_kerberosauthbackendconfig" "kerberos" {
  mount             = vault_authbackend.kerberos.path
  keytab_wo         = filebase64("/path/to/vault.keytab")
  keytab_wo_version = 1
  service_account   = "vault/localhost@EXAMPLE.COM"
}
resource "vault_kerberosauthbackendldapconfig" "config" {
  mount  = vault_authbackend.kerberos.path
  url    = "ldap://ldap.example.com"
  binddn = "cn=vault,ou=Users,dc=example,dc=com"
  userdn = "ou=People,dc=example,dc=org"
}

    Configuration with Bind Password

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const kerberos = new vault.AuthBackend("kerberos", {
    type: "kerberos",
    path: "kerberos",
});
const config = new vault.KerberosAuthBackendLdapConfig("config", {
    mount: kerberos.path,
    url: "ldap://ldap.example.com",
    binddn: "cn=vault,ou=Users,dc=example,dc=com",
    bindpassWo: ldapBindPassword,
    bindpassWoVersion: 1,
    userdn: "ou=People,dc=example,dc=org",
});

    import pulumi
import pulumi_vault as vault

kerberos = vault.AuthBackend("kerberos",
    type="kerberos",
    path="kerberos")
config = vault.KerberosAuthBackendLdapConfig("config",
    mount=kerberos.path,
    url="ldap://ldap.example.com",
    binddn="cn=vault,ou=Users,dc=example,dc=com",
    bindpass_wo=ldap_bind_password,
    bindpass_wo_version=1,
    userdn="ou=People,dc=example,dc=org")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		kerberos, err := vault.NewAuthBackend(ctx, "kerberos", &vault.AuthBackendArgs{
			Type: pulumi.String("kerberos"),
			Path: pulumi.String("kerberos"),
		})
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendLdapConfig(ctx, "config", &vault.KerberosAuthBackendLdapConfigArgs{
			Mount:             kerberos.Path,
			Url:               pulumi.String("ldap://ldap.example.com"),
			Binddn:            pulumi.String("cn=vault,ou=Users,dc=example,dc=com"),
			BindpassWo:        pulumi.Any(ldapBindPassword),
			BindpassWoVersion: pulumi.Int(1),
			Userdn:            pulumi.String("ou=People,dc=example,dc=org"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var kerberos = new Vault.AuthBackend("kerberos", new()
    {
        Type = "kerberos",
        Path = "kerberos",
    });

    var config = new Vault.KerberosAuthBackendLdapConfig("config", new()
    {
        Mount = kerberos.Path,
        Url = "ldap://ldap.example.com",
        Binddn = "cn=vault,ou=Users,dc=example,dc=com",
        BindpassWo = ldapBindPassword,
        BindpassWoVersion = 1,
        Userdn = "ou=People,dc=example,dc=org",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.KerberosAuthBackendLdapConfig;
import com.pulumi.vault.KerberosAuthBackendLdapConfigArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var kerberos = new AuthBackend("kerberos", AuthBackendArgs.builder()
            .type("kerberos")
            .path("kerberos")
            .build());

        var config = new KerberosAuthBackendLdapConfig("config", KerberosAuthBackendLdapConfigArgs.builder()
            .mount(kerberos.path())
            .url("ldap://ldap.example.com")
            .binddn("cn=vault,ou=Users,dc=example,dc=com")
            .bindpassWo(ldapBindPassword)
            .bindpassWoVersion(1)
            .userdn("ou=People,dc=example,dc=org")
            .build());

    }
}

    resources:
  kerberos:
    type: vault:AuthBackend
    properties:
      type: kerberos
      path: kerberos
  config:
    type: vault:KerberosAuthBackendLdapConfig
    properties:
      mount: ${kerberos.path}
      url: ldap://ldap.example.com
      binddn: cn=vault,ou=Users,dc=example,dc=com
      bindpassWo: ${ldapBindPassword}
      bindpassWoVersion: 1
      userdn: ou=People,dc=example,dc=org

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_authbackend" "kerberos" {
  type = "kerberos"
  path = "kerberos"
}
resource "vault_kerberosauthbackendldapconfig" "config" {
  mount               = vault_authbackend.kerberos.path
  url                 = "ldap://ldap.example.com"
  binddn              = "cn=vault,ou=Users,dc=example,dc=com"
  bindpass_wo         = ldapBindPassword
  bindpass_wo_version = 1
  userdn              = "ou=People,dc=example,dc=org"
}

    Full Configuration with TLS and Groups

    import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const kerberos = new vault.AuthBackend("kerberos", {
    type: "kerberos",
    path: "kerberos",
});
const config = new vault.KerberosAuthBackendLdapConfig("config", {
    mount: kerberos.path,
    url: "ldaps://ldap.example.com:636",
    binddn: "cn=vault,ou=Users,dc=example,dc=com",
    bindpassWo: ldapBindPassword,
    bindpassWoVersion: 1,
    userdn: "ou=People,dc=example,dc=org",
    userattr: "samaccountname",
    groupdn: "ou=Groups,dc=example,dc=org",
    groupfilter: "(objectClass=group)",
    groupattr: "cn",
    useTokenGroups: true,
    tlsMinVersion: "tls12",
    tlsMaxVersion: "tls13",
    certificate: std.file({
        input: "/path/to/ca-cert.pem",
    }).then(invoke => invoke.result),
    denyNullBind: true,
    tokenTtl: 1800,
    tokenMaxTtl: 3600,
    tokenPolicies: [
        "default",
        "dev",
    ],
    tokenType: "service",
});

    import pulumi
import pulumi_std as std
import pulumi_vault as vault

kerberos = vault.AuthBackend("kerberos",
    type="kerberos",
    path="kerberos")
config = vault.KerberosAuthBackendLdapConfig("config",
    mount=kerberos.path,
    url="ldaps://ldap.example.com:636",
    binddn="cn=vault,ou=Users,dc=example,dc=com",
    bindpass_wo=ldap_bind_password,
    bindpass_wo_version=1,
    userdn="ou=People,dc=example,dc=org",
    userattr="samaccountname",
    groupdn="ou=Groups,dc=example,dc=org",
    groupfilter="(objectClass=group)",
    groupattr="cn",
    use_token_groups=True,
    tls_min_version="tls12",
    tls_max_version="tls13",
    certificate=std.file(input="/path/to/ca-cert.pem").result,
    deny_null_bind=True,
    token_ttl=1800,
    token_max_ttl=3600,
    token_policies=[
        "default",
        "dev",
    ],
    token_type="service")

    package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		kerberos, err := vault.NewAuthBackend(ctx, "kerberos", &vault.AuthBackendArgs{
			Type: pulumi.String("kerberos"),
			Path: pulumi.String("kerberos"),
		})
		if err != nil {
			return err
		}
		invokeFile, err := std.File(ctx, &std.FileArgs{
			Input: "/path/to/ca-cert.pem",
		}, nil)
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendLdapConfig(ctx, "config", &vault.KerberosAuthBackendLdapConfigArgs{
			Mount:             kerberos.Path,
			Url:               pulumi.String("ldaps://ldap.example.com:636"),
			Binddn:            pulumi.String("cn=vault,ou=Users,dc=example,dc=com"),
			BindpassWo:        pulumi.Any(ldapBindPassword),
			BindpassWoVersion: pulumi.Int(1),
			Userdn:            pulumi.String("ou=People,dc=example,dc=org"),
			Userattr:          pulumi.String("samaccountname"),
			Groupdn:           pulumi.String("ou=Groups,dc=example,dc=org"),
			Groupfilter:       pulumi.String("(objectClass=group)"),
			Groupattr:         pulumi.String("cn"),
			UseTokenGroups:    pulumi.Bool(true),
			TlsMinVersion:     pulumi.String("tls12"),
			TlsMaxVersion:     pulumi.String("tls13"),
			Certificate:       pulumi.String(invokeFile.Result),
			DenyNullBind:      pulumi.Bool(true),
			TokenTtl:          pulumi.Int(1800),
			TokenMaxTtl:       pulumi.Int(3600),
			TokenPolicies: pulumi.StringArray{
				pulumi.String("default"),
				pulumi.String("dev"),
			},
			TokenType: pulumi.String("service"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var kerberos = new Vault.AuthBackend("kerberos", new()
    {
        Type = "kerberos",
        Path = "kerberos",
    });

    var config = new Vault.KerberosAuthBackendLdapConfig("config", new()
    {
        Mount = kerberos.Path,
        Url = "ldaps://ldap.example.com:636",
        Binddn = "cn=vault,ou=Users,dc=example,dc=com",
        BindpassWo = ldapBindPassword,
        BindpassWoVersion = 1,
        Userdn = "ou=People,dc=example,dc=org",
        Userattr = "samaccountname",
        Groupdn = "ou=Groups,dc=example,dc=org",
        Groupfilter = "(objectClass=group)",
        Groupattr = "cn",
        UseTokenGroups = true,
        TlsMinVersion = "tls12",
        TlsMaxVersion = "tls13",
        Certificate = Std.File.Invoke(new()
        {
            Input = "/path/to/ca-cert.pem",
        }).Apply(invoke => invoke.Result),
        DenyNullBind = true,
        TokenTtl = 1800,
        TokenMaxTtl = 3600,
        TokenPolicies = new[]
        {
            "default",
            "dev",
        },
        TokenType = "service",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.KerberosAuthBackendLdapConfig;
import com.pulumi.vault.KerberosAuthBackendLdapConfigArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var kerberos = new AuthBackend("kerberos", AuthBackendArgs.builder()
            .type("kerberos")
            .path("kerberos")
            .build());

        var config = new KerberosAuthBackendLdapConfig("config", KerberosAuthBackendLdapConfigArgs.builder()
            .mount(kerberos.path())
            .url("ldaps://ldap.example.com:636")
            .binddn("cn=vault,ou=Users,dc=example,dc=com")
            .bindpassWo(ldapBindPassword)
            .bindpassWoVersion(1)
            .userdn("ou=People,dc=example,dc=org")
            .userattr("samaccountname")
            .groupdn("ou=Groups,dc=example,dc=org")
            .groupfilter("(objectClass=group)")
            .groupattr("cn")
            .useTokenGroups(true)
            .tlsMinVersion("tls12")
            .tlsMaxVersion("tls13")
            .certificate(StdFunctions.file(FileArgs.builder()
                .input("/path/to/ca-cert.pem")
                .build()).result())
            .denyNullBind(true)
            .tokenTtl(1800)
            .tokenMaxTtl(3600)
            .tokenPolicies(            
                "default",
                "dev")
            .tokenType("service")
            .build());

    }
}

    resources:
  kerberos:
    type: vault:AuthBackend
    properties:
      type: kerberos
      path: kerberos
  config:
    type: vault:KerberosAuthBackendLdapConfig
    properties:
      mount: ${kerberos.path}
      url: ldaps://ldap.example.com:636
      binddn: cn=vault,ou=Users,dc=example,dc=com
      bindpassWo: ${ldapBindPassword}
      bindpassWoVersion: 1
      userdn: ou=People,dc=example,dc=org
      userattr: samaccountname
      groupdn: ou=Groups,dc=example,dc=org
      groupfilter: (objectClass=group)
      groupattr: cn
      useTokenGroups: true
      tlsMinVersion: tls12
      tlsMaxVersion: tls13
      certificate:
        fn::invoke:
          function: std:file
          arguments:
            input: /path/to/ca-cert.pem
          return: result
      denyNullBind: true # Token configuration
      tokenTtl: 1800
      tokenMaxTtl: 3600
      tokenPolicies:
        - default
        - dev
      tokenType: service

    pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_authbackend" "kerberos" {
  type = "kerberos"
  path = "kerberos"
}
resource "vault_kerberosauthbackendldapconfig" "config" {
  mount               = vault_authbackend.kerberos.path
  url                 = "ldaps://ldap.example.com:636"
  binddn              = "cn=vault,ou=Users,dc=example,dc=com"
  bindpass_wo         = ldapBindPassword
  bindpass_wo_version = 1
  userdn              = "ou=People,dc=example,dc=org"
  userattr            = "samaccountname"
  groupdn             = "ou=Groups,dc=example,dc=org"
  groupfilter         = "(objectClass=group)"
  groupattr           = "cn"
  use_token_groups    = true
  tls_min_version     = "tls12"
  tls_max_version     = "tls13"
  certificate         = file("/path/to/ca-cert.pem")
  deny_null_bind      = true
  # Token configuration
  token_ttl      = 1800
  token_max_ttl  = 3600
  token_policies = ["default", "dev"]
  token_type     = "service"
}

    Configuration with Client TLS Certificates

    import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const kerberos = new vault.AuthBackend("kerberos", {
    type: "kerberos",
    path: "kerberos",
});
const config = new vault.KerberosAuthBackendLdapConfig("config", {
    mount: kerberos.path,
    url: "ldaps://ldap.example.com:636",
    binddn: "cn=vault,ou=Users,dc=example,dc=com",
    userdn: "ou=People,dc=example,dc=org",
    certificate: std.file({
        input: "/path/to/ca-cert.pem",
    }).then(invoke => invoke.result),
    clientTlsCertWo: std.file({
        input: "/path/to/client-cert.pem",
    }).then(invoke => invoke.result),
    clientTlsCertWoVersion: 1,
    clientTlsKeyWo: std.file({
        input: "/path/to/client-key.pem",
    }).then(invoke => invoke.result),
    clientTlsKeyWoVersion: 1,
});

    import pulumi
import pulumi_std as std
import pulumi_vault as vault

kerberos = vault.AuthBackend("kerberos",
    type="kerberos",
    path="kerberos")
config = vault.KerberosAuthBackendLdapConfig("config",
    mount=kerberos.path,
    url="ldaps://ldap.example.com:636",
    binddn="cn=vault,ou=Users,dc=example,dc=com",
    userdn="ou=People,dc=example,dc=org",
    certificate=std.file(input="/path/to/ca-cert.pem").result,
    client_tls_cert_wo=std.file(input="/path/to/client-cert.pem").result,
    client_tls_cert_wo_version=1,
    client_tls_key_wo=std.file(input="/path/to/client-key.pem").result,
    client_tls_key_wo_version=1)

    package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		kerberos, err := vault.NewAuthBackend(ctx, "kerberos", &vault.AuthBackendArgs{
			Type: pulumi.String("kerberos"),
			Path: pulumi.String("kerberos"),
		})
		if err != nil {
			return err
		}
		invokeFile, err := std.File(ctx, &std.FileArgs{
			Input: "/path/to/ca-cert.pem",
		}, nil)
		if err != nil {
			return err
		}
		invokeFile1, err := std.File(ctx, &std.FileArgs{
			Input: "/path/to/client-cert.pem",
		}, nil)
		if err != nil {
			return err
		}
		invokeFile2, err := std.File(ctx, &std.FileArgs{
			Input: "/path/to/client-key.pem",
		}, nil)
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendLdapConfig(ctx, "config", &vault.KerberosAuthBackendLdapConfigArgs{
			Mount:                  kerberos.Path,
			Url:                    pulumi.String("ldaps://ldap.example.com:636"),
			Binddn:                 pulumi.String("cn=vault,ou=Users,dc=example,dc=com"),
			Userdn:                 pulumi.String("ou=People,dc=example,dc=org"),
			Certificate:            pulumi.String(invokeFile.Result),
			ClientTlsCertWo:        pulumi.String(invokeFile1.Result),
			ClientTlsCertWoVersion: pulumi.Int(1),
			ClientTlsKeyWo:         pulumi.String(invokeFile2.Result),
			ClientTlsKeyWoVersion:  pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var kerberos = new Vault.AuthBackend("kerberos", new()
    {
        Type = "kerberos",
        Path = "kerberos",
    });

    var config = new Vault.KerberosAuthBackendLdapConfig("config", new()
    {
        Mount = kerberos.Path,
        Url = "ldaps://ldap.example.com:636",
        Binddn = "cn=vault,ou=Users,dc=example,dc=com",
        Userdn = "ou=People,dc=example,dc=org",
        Certificate = Std.File.Invoke(new()
        {
            Input = "/path/to/ca-cert.pem",
        }).Apply(invoke => invoke.Result),
        ClientTlsCertWo = Std.File.Invoke(new()
        {
            Input = "/path/to/client-cert.pem",
        }).Apply(invoke => invoke.Result),
        ClientTlsCertWoVersion = 1,
        ClientTlsKeyWo = Std.File.Invoke(new()
        {
            Input = "/path/to/client-key.pem",
        }).Apply(invoke => invoke.Result),
        ClientTlsKeyWoVersion = 1,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.KerberosAuthBackendLdapConfig;
import com.pulumi.vault.KerberosAuthBackendLdapConfigArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var kerberos = new AuthBackend("kerberos", AuthBackendArgs.builder()
            .type("kerberos")
            .path("kerberos")
            .build());

        var config = new KerberosAuthBackendLdapConfig("config", KerberosAuthBackendLdapConfigArgs.builder()
            .mount(kerberos.path())
            .url("ldaps://ldap.example.com:636")
            .binddn("cn=vault,ou=Users,dc=example,dc=com")
            .userdn("ou=People,dc=example,dc=org")
            .certificate(StdFunctions.file(FileArgs.builder()
                .input("/path/to/ca-cert.pem")
                .build()).result())
            .clientTlsCertWo(StdFunctions.file(FileArgs.builder()
                .input("/path/to/client-cert.pem")
                .build()).result())
            .clientTlsCertWoVersion(1)
            .clientTlsKeyWo(StdFunctions.file(FileArgs.builder()
                .input("/path/to/client-key.pem")
                .build()).result())
            .clientTlsKeyWoVersion(1)
            .build());

    }
}

    resources:
  kerberos:
    type: vault:AuthBackend
    properties:
      type: kerberos
      path: kerberos
  config:
    type: vault:KerberosAuthBackendLdapConfig
    properties:
      mount: ${kerberos.path}
      url: ldaps://ldap.example.com:636
      binddn: cn=vault,ou=Users,dc=example,dc=com
      userdn: ou=People,dc=example,dc=org
      certificate:
        fn::invoke:
          function: std:file
          arguments:
            input: /path/to/ca-cert.pem
          return: result
      clientTlsCertWo:
        fn::invoke:
          function: std:file
          arguments:
            input: /path/to/client-cert.pem
          return: result
      clientTlsCertWoVersion: 1
      clientTlsKeyWo:
        fn::invoke:
          function: std:file
          arguments:
            input: /path/to/client-key.pem
          return: result
      clientTlsKeyWoVersion: 1

    pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_authbackend" "kerberos" {
  type = "kerberos"
  path = "kerberos"
}
resource "vault_kerberosauthbackendldapconfig" "config" {
  mount                      = vault_authbackend.kerberos.path
  url                        = "ldaps://ldap.example.com:636"
  binddn                     = "cn=vault,ou=Users,dc=example,dc=com"
  userdn                     = "ou=People,dc=example,dc=org"
  certificate                = file("/path/to/ca-cert.pem")
  client_tls_cert_wo         = file("/path/to/client-cert.pem")
  client_tls_cert_wo_version = 1
  client_tls_key_wo          = file("/path/to/client-key.pem")
  client_tls_key_wo_version  = 1
}

    Using Namespace (Vault Enterprise)

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const example = new vault.Namespace("example", {path: "example-namespace"});
const kerberos = new vault.AuthBackend("kerberos", {
    namespace: example.path,
    type: "kerberos",
    path: "kerberos",
});
const config = new vault.KerberosAuthBackendLdapConfig("config", {
    namespace: example.path,
    mount: kerberos.path,
    url: "ldap://ldap.example.com",
    binddn: "cn=vault,ou=Users,dc=example,dc=com",
    userdn: "ou=People,dc=example,dc=org",
});

    import pulumi
import pulumi_vault as vault

example = vault.Namespace("example", path="example-namespace")
kerberos = vault.AuthBackend("kerberos",
    namespace=example.path,
    type="kerberos",
    path="kerberos")
config = vault.KerberosAuthBackendLdapConfig("config",
    namespace=example.path,
    mount=kerberos.path,
    url="ldap://ldap.example.com",
    binddn="cn=vault,ou=Users,dc=example,dc=com",
    userdn="ou=People,dc=example,dc=org")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := vault.NewNamespace(ctx, "example", &vault.NamespaceArgs{
			Path: pulumi.String("example-namespace"),
		})
		if err != nil {
			return err
		}
		kerberos, err := vault.NewAuthBackend(ctx, "kerberos", &vault.AuthBackendArgs{
			Namespace: example.Path,
			Type:      pulumi.String("kerberos"),
			Path:      pulumi.String("kerberos"),
		})
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendLdapConfig(ctx, "config", &vault.KerberosAuthBackendLdapConfigArgs{
			Namespace: example.Path,
			Mount:     kerberos.Path,
			Url:       pulumi.String("ldap://ldap.example.com"),
			Binddn:    pulumi.String("cn=vault,ou=Users,dc=example,dc=com"),
			Userdn:    pulumi.String("ou=People,dc=example,dc=org"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var example = new Vault.Namespace("example", new()
    {
        Path = "example-namespace",
    });

    var kerberos = new Vault.AuthBackend("kerberos", new()
    {
        Namespace = example.Path,
        Type = "kerberos",
        Path = "kerberos",
    });

    var config = new Vault.KerberosAuthBackendLdapConfig("config", new()
    {
        Namespace = example.Path,
        Mount = kerberos.Path,
        Url = "ldap://ldap.example.com",
        Binddn = "cn=vault,ou=Users,dc=example,dc=com",
        Userdn = "ou=People,dc=example,dc=org",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Namespace;
import com.pulumi.vault.NamespaceArgs;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.KerberosAuthBackendLdapConfig;
import com.pulumi.vault.KerberosAuthBackendLdapConfigArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Namespace("example", NamespaceArgs.builder()
            .path("example-namespace")
            .build());

        var kerberos = new AuthBackend("kerberos", AuthBackendArgs.builder()
            .namespace(example.path())
            .type("kerberos")
            .path("kerberos")
            .build());

        var config = new KerberosAuthBackendLdapConfig("config", KerberosAuthBackendLdapConfigArgs.builder()
            .namespace(example.path())
            .mount(kerberos.path())
            .url("ldap://ldap.example.com")
            .binddn("cn=vault,ou=Users,dc=example,dc=com")
            .userdn("ou=People,dc=example,dc=org")
            .build());

    }
}

    resources:
  example:
    type: vault:Namespace
    properties:
      path: example-namespace
  kerberos:
    type: vault:AuthBackend
    properties:
      namespace: ${example.path}
      type: kerberos
      path: kerberos
  config:
    type: vault:KerberosAuthBackendLdapConfig
    properties:
      namespace: ${example.path}
      mount: ${kerberos.path}
      url: ldap://ldap.example.com
      binddn: cn=vault,ou=Users,dc=example,dc=com
      userdn: ou=People,dc=example,dc=org

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_namespace" "example" {
  path = "example-namespace"
}
resource "vault_authbackend" "kerberos" {
  namespace = vault_namespace.example.path
  type      = "kerberos"
  path      = "kerberos"
}
resource "vault_kerberosauthbackendldapconfig" "config" {
  namespace = vault_namespace.example.path
  mount     = vault_authbackend.kerberos.path
  url       = "ldap://ldap.example.com"
  binddn    = "cn=vault,ou=Users,dc=example,dc=com"
  userdn    = "ou=People,dc=example,dc=org"
}

    Create KerberosAuthBackendLdapConfig Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new KerberosAuthBackendLdapConfig(name: string, args: KerberosAuthBackendLdapConfigArgs, opts?: CustomResourceOptions);
    @overload
def KerberosAuthBackendLdapConfig(resource_name: str,
                                  args: KerberosAuthBackendLdapConfigArgs,
                                  opts: Optional[ResourceOptions] = None)

@overload
def KerberosAuthBackendLdapConfig(resource_name: str,
                                  opts: Optional[ResourceOptions] = None,
                                  mount: Optional[str] = None,
                                  max_page_size: Optional[int] = None,
                                  namespace: Optional[str] = None,
                                  request_timeout: Optional[int] = None,
                                  bindpass_wo_version: Optional[int] = None,
                                  case_sensitive_names: Optional[bool] = None,
                                  certificate: Optional[str] = None,
                                  client_tls_cert_wo: Optional[str] = None,
                                  client_tls_cert_wo_version: Optional[int] = None,
                                  client_tls_key_wo: Optional[str] = None,
                                  client_tls_key_wo_version: Optional[int] = None,
                                  connection_timeout: Optional[int] = None,
                                  deny_null_bind: Optional[bool] = None,
                                  dereference_aliases: Optional[str] = None,
                                  discoverdn: Optional[bool] = None,
                                  enable_samaccountname_login: Optional[bool] = None,
                                  groupattr: Optional[str] = None,
                                  groupdn: Optional[str] = None,
                                  groupfilter: Optional[str] = None,
                                  insecure_tls: Optional[bool] = None,
                                  alias_metadata: Optional[Mapping[str, str]] = None,
                                  binddn: Optional[str] = None,
                                  anonymous_group_search: Optional[bool] = None,
                                  bindpass_wo: Optional[str] = None,
                                  starttls: Optional[bool] = None,
                                  tls_max_version: Optional[str] = None,
                                  tls_min_version: Optional[str] = None,
                                  token_bound_cidrs: Optional[Sequence[str]] = None,
                                  token_explicit_max_ttl: Optional[int] = None,
                                  token_max_ttl: Optional[int] = None,
                                  token_no_default_policy: Optional[bool] = None,
                                  token_num_uses: Optional[int] = None,
                                  token_period: Optional[int] = None,
                                  token_policies: Optional[Sequence[str]] = None,
                                  token_ttl: Optional[int] = None,
                                  token_type: Optional[str] = None,
                                  upndomain: Optional[str] = None,
                                  url: Optional[str] = None,
                                  use_token_groups: Optional[bool] = None,
                                  userattr: Optional[str] = None,
                                  userdn: Optional[str] = None,
                                  userfilter: Optional[str] = None,
                                  username_as_alias: Optional[bool] = None)
    func NewKerberosAuthBackendLdapConfig(ctx *Context, name string, args KerberosAuthBackendLdapConfigArgs, opts ...ResourceOption) (*KerberosAuthBackendLdapConfig, error)
    public KerberosAuthBackendLdapConfig(string name, KerberosAuthBackendLdapConfigArgs args, CustomResourceOptions? opts = null)
    public KerberosAuthBackendLdapConfig(String name, KerberosAuthBackendLdapConfigArgs args)
public KerberosAuthBackendLdapConfig(String name, KerberosAuthBackendLdapConfigArgs args, CustomResourceOptions options)

    type: vault:KerberosAuthBackendLdapConfig
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_kerberos_auth_backend_ldap_config" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args KerberosAuthBackendLdapConfigArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args KerberosAuthBackendLdapConfigArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args KerberosAuthBackendLdapConfigArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args KerberosAuthBackendLdapConfigArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args KerberosAuthBackendLdapConfigArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var kerberosAuthBackendLdapConfigResource = new Vault.KerberosAuthBackendLdapConfig("kerberosAuthBackendLdapConfigResource", new()
{
    Mount = "string",
    MaxPageSize = 0,
    Namespace = "string",
    RequestTimeout = 0,
    BindpassWoVersion = 0,
    CaseSensitiveNames = false,
    Certificate = "string",
    ClientTlsCertWo = "string",
    ClientTlsCertWoVersion = 0,
    ClientTlsKeyWo = "string",
    ClientTlsKeyWoVersion = 0,
    ConnectionTimeout = 0,
    DenyNullBind = false,
    DereferenceAliases = "string",
    Discoverdn = false,
    EnableSamaccountnameLogin = false,
    Groupattr = "string",
    Groupdn = "string",
    Groupfilter = "string",
    InsecureTls = false,
    AliasMetadata = 
    {
        { "string", "string" },
    },
    Binddn = "string",
    AnonymousGroupSearch = false,
    BindpassWo = "string",
    Starttls = false,
    TlsMaxVersion = "string",
    TlsMinVersion = "string",
    TokenBoundCidrs = new[]
    {
        "string",
    },
    TokenExplicitMaxTtl = 0,
    TokenMaxTtl = 0,
    TokenNoDefaultPolicy = false,
    TokenNumUses = 0,
    TokenPeriod = 0,
    TokenPolicies = new[]
    {
        "string",
    },
    TokenTtl = 0,
    TokenType = "string",
    Upndomain = "string",
    Url = "string",
    UseTokenGroups = false,
    Userattr = "string",
    Userdn = "string",
    Userfilter = "string",
    UsernameAsAlias = false,
});

    example, err := vault.NewKerberosAuthBackendLdapConfig(ctx, "kerberosAuthBackendLdapConfigResource", &vault.KerberosAuthBackendLdapConfigArgs{
	Mount:                     pulumi.String("string"),
	MaxPageSize:               pulumi.Int(0),
	Namespace:                 pulumi.String("string"),
	RequestTimeout:            pulumi.Int(0),
	BindpassWoVersion:         pulumi.Int(0),
	CaseSensitiveNames:        pulumi.Bool(false),
	Certificate:               pulumi.String("string"),
	ClientTlsCertWo:           pulumi.String("string"),
	ClientTlsCertWoVersion:    pulumi.Int(0),
	ClientTlsKeyWo:            pulumi.String("string"),
	ClientTlsKeyWoVersion:     pulumi.Int(0),
	ConnectionTimeout:         pulumi.Int(0),
	DenyNullBind:              pulumi.Bool(false),
	DereferenceAliases:        pulumi.String("string"),
	Discoverdn:                pulumi.Bool(false),
	EnableSamaccountnameLogin: pulumi.Bool(false),
	Groupattr:                 pulumi.String("string"),
	Groupdn:                   pulumi.String("string"),
	Groupfilter:               pulumi.String("string"),
	InsecureTls:               pulumi.Bool(false),
	AliasMetadata: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	Binddn:               pulumi.String("string"),
	AnonymousGroupSearch: pulumi.Bool(false),
	BindpassWo:           pulumi.String("string"),
	Starttls:             pulumi.Bool(false),
	TlsMaxVersion:        pulumi.String("string"),
	TlsMinVersion:        pulumi.String("string"),
	TokenBoundCidrs: pulumi.StringArray{
		pulumi.String("string"),
	},
	TokenExplicitMaxTtl:  pulumi.Int(0),
	TokenMaxTtl:          pulumi.Int(0),
	TokenNoDefaultPolicy: pulumi.Bool(false),
	TokenNumUses:         pulumi.Int(0),
	TokenPeriod:          pulumi.Int(0),
	TokenPolicies: pulumi.StringArray{
		pulumi.String("string"),
	},
	TokenTtl:        pulumi.Int(0),
	TokenType:       pulumi.String("string"),
	Upndomain:       pulumi.String("string"),
	Url:             pulumi.String("string"),
	UseTokenGroups:  pulumi.Bool(false),
	Userattr:        pulumi.String("string"),
	Userdn:          pulumi.String("string"),
	Userfilter:      pulumi.String("string"),
	UsernameAsAlias: pulumi.Bool(false),
})

    resource "vault_kerberos_auth_backend_ldap_config" "kerberosAuthBackendLdapConfigResource" {
  lifecycle {
    create_before_destroy = true
  }
  mount                       = "string"
  max_page_size               = 0
  namespace                   = "string"
  request_timeout             = 0
  bindpass_wo_version         = 0
  case_sensitive_names        = false
  certificate                 = "string"
  client_tls_cert_wo          = "string"
  client_tls_cert_wo_version  = 0
  client_tls_key_wo           = "string"
  client_tls_key_wo_version   = 0
  connection_timeout          = 0
  deny_null_bind              = false
  dereference_aliases         = "string"
  discoverdn                  = false
  enable_samaccountname_login = false
  groupattr                   = "string"
  groupdn                     = "string"
  groupfilter                 = "string"
  insecure_tls                = false
  alias_metadata = {
    "string" = "string"
  }
  binddn                  = "string"
  anonymous_group_search  = false
  bindpass_wo             = "string"
  starttls                = false
  tls_max_version         = "string"
  tls_min_version         = "string"
  token_bound_cidrs       = ["string"]
  token_explicit_max_ttl  = 0
  token_max_ttl           = 0
  token_no_default_policy = false
  token_num_uses          = 0
  token_period            = 0
  token_policies          = ["string"]
  token_ttl               = 0
  token_type              = "string"
  upndomain               = "string"
  url                     = "string"
  use_token_groups        = false
  userattr                = "string"
  userdn                  = "string"
  userfilter              = "string"
  username_as_alias       = false
}

    var kerberosAuthBackendLdapConfigResource = new KerberosAuthBackendLdapConfig("kerberosAuthBackendLdapConfigResource", KerberosAuthBackendLdapConfigArgs.builder()
    .mount("string")
    .maxPageSize(0)
    .namespace("string")
    .requestTimeout(0)
    .bindpassWoVersion(0)
    .caseSensitiveNames(false)
    .certificate("string")
    .clientTlsCertWo("string")
    .clientTlsCertWoVersion(0)
    .clientTlsKeyWo("string")
    .clientTlsKeyWoVersion(0)
    .connectionTimeout(0)
    .denyNullBind(false)
    .dereferenceAliases("string")
    .discoverdn(false)
    .enableSamaccountnameLogin(false)
    .groupattr("string")
    .groupdn("string")
    .groupfilter("string")
    .insecureTls(false)
    .aliasMetadata(Map.of("string", "string"))
    .binddn("string")
    .anonymousGroupSearch(false)
    .bindpassWo("string")
    .starttls(false)
    .tlsMaxVersion("string")
    .tlsMinVersion("string")
    .tokenBoundCidrs("string")
    .tokenExplicitMaxTtl(0)
    .tokenMaxTtl(0)
    .tokenNoDefaultPolicy(false)
    .tokenNumUses(0)
    .tokenPeriod(0)
    .tokenPolicies("string")
    .tokenTtl(0)
    .tokenType("string")
    .upndomain("string")
    .url("string")
    .useTokenGroups(false)
    .userattr("string")
    .userdn("string")
    .userfilter("string")
    .usernameAsAlias(false)
    .build());

    kerberos_auth_backend_ldap_config_resource = vault.KerberosAuthBackendLdapConfig("kerberosAuthBackendLdapConfigResource",
    mount="string",
    max_page_size=0,
    namespace="string",
    request_timeout=0,
    bindpass_wo_version=0,
    case_sensitive_names=False,
    certificate="string",
    client_tls_cert_wo="string",
    client_tls_cert_wo_version=0,
    client_tls_key_wo="string",
    client_tls_key_wo_version=0,
    connection_timeout=0,
    deny_null_bind=False,
    dereference_aliases="string",
    discoverdn=False,
    enable_samaccountname_login=False,
    groupattr="string",
    groupdn="string",
    groupfilter="string",
    insecure_tls=False,
    alias_metadata={
        "string": "string",
    },
    binddn="string",
    anonymous_group_search=False,
    bindpass_wo="string",
    starttls=False,
    tls_max_version="string",
    tls_min_version="string",
    token_bound_cidrs=["string"],
    token_explicit_max_ttl=0,
    token_max_ttl=0,
    token_no_default_policy=False,
    token_num_uses=0,
    token_period=0,
    token_policies=["string"],
    token_ttl=0,
    token_type="string",
    upndomain="string",
    url="string",
    use_token_groups=False,
    userattr="string",
    userdn="string",
    userfilter="string",
    username_as_alias=False)

    const kerberosAuthBackendLdapConfigResource = new vault.KerberosAuthBackendLdapConfig("kerberosAuthBackendLdapConfigResource", {
    mount: "string",
    maxPageSize: 0,
    namespace: "string",
    requestTimeout: 0,
    bindpassWoVersion: 0,
    caseSensitiveNames: false,
    certificate: "string",
    clientTlsCertWo: "string",
    clientTlsCertWoVersion: 0,
    clientTlsKeyWo: "string",
    clientTlsKeyWoVersion: 0,
    connectionTimeout: 0,
    denyNullBind: false,
    dereferenceAliases: "string",
    discoverdn: false,
    enableSamaccountnameLogin: false,
    groupattr: "string",
    groupdn: "string",
    groupfilter: "string",
    insecureTls: false,
    aliasMetadata: {
        string: "string",
    },
    binddn: "string",
    anonymousGroupSearch: false,
    bindpassWo: "string",
    starttls: false,
    tlsMaxVersion: "string",
    tlsMinVersion: "string",
    tokenBoundCidrs: ["string"],
    tokenExplicitMaxTtl: 0,
    tokenMaxTtl: 0,
    tokenNoDefaultPolicy: false,
    tokenNumUses: 0,
    tokenPeriod: 0,
    tokenPolicies: ["string"],
    tokenTtl: 0,
    tokenType: "string",
    upndomain: "string",
    url: "string",
    useTokenGroups: false,
    userattr: "string",
    userdn: "string",
    userfilter: "string",
    usernameAsAlias: false,
});

    type: vault:KerberosAuthBackendLdapConfig
properties:
    aliasMetadata:
        string: string
    anonymousGroupSearch: false
    binddn: string
    bindpassWo: string
    bindpassWoVersion: 0
    caseSensitiveNames: false
    certificate: string
    clientTlsCertWo: string
    clientTlsCertWoVersion: 0
    clientTlsKeyWo: string
    clientTlsKeyWoVersion: 0
    connectionTimeout: 0
    denyNullBind: false
    dereferenceAliases: string
    discoverdn: false
    enableSamaccountnameLogin: false
    groupattr: string
    groupdn: string
    groupfilter: string
    insecureTls: false
    maxPageSize: 0
    mount: string
    namespace: string
    requestTimeout: 0
    starttls: false
    tlsMaxVersion: string
    tlsMinVersion: string
    tokenBoundCidrs:
        - string
    tokenExplicitMaxTtl: 0
    tokenMaxTtl: 0
    tokenNoDefaultPolicy: false
    tokenNumUses: 0
    tokenPeriod: 0
    tokenPolicies:
        - string
    tokenTtl: 0
    tokenType: string
    upndomain: string
    url: string
    useTokenGroups: false
    userattr: string
    userdn: string
    userfilter: string
    usernameAsAlias: false

    KerberosAuthBackendLdapConfig Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The KerberosAuthBackendLdapConfig resource accepts the following input properties:

    Mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    AliasMetadata Dictionary<string, string>
    A map of string to string that will be set as metadata on the identity alias
    AnonymousGroupSearch bool
    Use anonymous binds when performing LDAP group searches. Default: false.
    Binddn string
    Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com').
    BindpassWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. LDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.
    BindpassWoVersion int
    Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo.
    CaseSensitiveNames bool
    If true, usernames and group names are case sensitive. Default: false.
    Certificate string
    CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
    ClientTlsCertWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.
    ClientTlsCertWoVersion int
    Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo.
    ClientTlsKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.
    ClientTlsKeyWoVersion int
    Version identifier for client TLS key updates. Must be used together with client_tls_key_wo.
    ConnectionTimeout int
    Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30.
    DenyNullBind bool
    Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true.
    DereferenceAliases string
    When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'
    Discoverdn bool
    Use anonymous bind to discover bind DN of a user. Default: false.
    EnableSamaccountnameLogin bool
    If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. Note: Requires Vault 1.19.0+
    Groupattr string
    LDAP attribute to follow for group membership. Default: 'cn'
    Groupdn string
    LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org).
    Groupfilter string
    Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'
    InsecureTls bool
    Skip TLS certificate verification. Not recommended for production. Default: false.
    MaxPageSize int
    If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    RequestTimeout int
    Timeout, in seconds, for the connection when making requests against the server. Default: 90.
    Starttls bool
    Issue a StartTLS command after establishing an unencrypted connection. Default: false.
    TlsMaxVersion string
    Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    TlsMinVersion string
    Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    TokenBoundCidrs List<string>
    Specifies the blocks of IP addresses which are allowed to use the generated token
    TokenExplicitMaxTtl int
    Generated Token's Explicit Maximum TTL in seconds
    TokenMaxTtl int
    The maximum lifetime of the generated token
    TokenNoDefaultPolicy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    TokenNumUses int
    The maximum number of times a token may be used, a value of zero means unlimited
    TokenPeriod int
    Generated Token's Period
    TokenPolicies List<string>
    Generated Token's Policies
    TokenTtl int
    The initial ttl of the token to generate in seconds
    TokenType string
    The type of token to generate, service or batch
    Upndomain string
    Enables userPrincipalDomain login with [username]@UPNDomain.
    Url string
    LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1
    UseTokenGroups bool
    If true, use the Active Directory tokenGroups constructed attribute. Default: false.
    Userattr string
    Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'
    Userdn string
    LDAP domain to use for users (e.g., ou=People,dc=example,dc=org).
    Userfilter string
    Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'
    UsernameAsAlias bool
    Use username as alias name. Default: false.
    Mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    AliasMetadata map[string]string
    A map of string to string that will be set as metadata on the identity alias
    AnonymousGroupSearch bool
    Use anonymous binds when performing LDAP group searches. Default: false.
    Binddn string
    Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com').
    BindpassWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. LDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.
    BindpassWoVersion int
    Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo.
    CaseSensitiveNames bool
    If true, usernames and group names are case sensitive. Default: false.
    Certificate string
    CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
    ClientTlsCertWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.
    ClientTlsCertWoVersion int
    Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo.
    ClientTlsKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.
    ClientTlsKeyWoVersion int
    Version identifier for client TLS key updates. Must be used together with client_tls_key_wo.
    ConnectionTimeout int
    Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30.
    DenyNullBind bool
    Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true.
    DereferenceAliases string
    When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'
    Discoverdn bool
    Use anonymous bind to discover bind DN of a user. Default: false.
    EnableSamaccountnameLogin bool
    If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. Note: Requires Vault 1.19.0+
    Groupattr string
    LDAP attribute to follow for group membership. Default: 'cn'
    Groupdn string
    LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org).
    Groupfilter string
    Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'
    InsecureTls bool
    Skip TLS certificate verification. Not recommended for production. Default: false.
    MaxPageSize int
    If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    RequestTimeout int
    Timeout, in seconds, for the connection when making requests against the server. Default: 90.
    Starttls bool
    Issue a StartTLS command after establishing an unencrypted connection. Default: false.
    TlsMaxVersion string
    Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    TlsMinVersion string
    Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    TokenBoundCidrs []string
    Specifies the blocks of IP addresses which are allowed to use the generated token
    TokenExplicitMaxTtl int
    Generated Token's Explicit Maximum TTL in seconds
    TokenMaxTtl int
    The maximum lifetime of the generated token
    TokenNoDefaultPolicy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    TokenNumUses int
    The maximum number of times a token may be used, a value of zero means unlimited
    TokenPeriod int
    Generated Token's Period
    TokenPolicies []string
    Generated Token's Policies
    TokenTtl int
    The initial ttl of the token to generate in seconds
    TokenType string
    The type of token to generate, service or batch
    Upndomain string
    Enables userPrincipalDomain login with [username]@UPNDomain.
    Url string
    LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1
    UseTokenGroups bool
    If true, use the Active Directory tokenGroups constructed attribute. Default: false.
    Userattr string
    Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'
    Userdn string
    LDAP domain to use for users (e.g., ou=People,dc=example,dc=org).
    Userfilter string
    Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'
    UsernameAsAlias bool
    Use username as alias name. Default: false.
    mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    alias_metadata map(string)
    A map of string to string that will be set as metadata on the identity alias
    anonymous_group_search bool
    Use anonymous binds when performing LDAP group searches. Default: false.
    binddn string
    Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com').
    bindpass_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. LDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.
    bindpass_wo_version number
    Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo.
    case_sensitive_names bool
    If true, usernames and group names are case sensitive. Default: false.
    certificate string
    CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
    client_tls_cert_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.
    client_tls_cert_wo_version number
    Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo.
    client_tls_key_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.
    client_tls_key_wo_version number
    Version identifier for client TLS key updates. Must be used together with client_tls_key_wo.
    connection_timeout number
    Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30.
    deny_null_bind bool
    Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true.
    dereference_aliases string
    When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'
    discoverdn bool
    Use anonymous bind to discover bind DN of a user. Default: false.
    enable_samaccountname_login bool
    If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. Note: Requires Vault 1.19.0+
    groupattr string
    LDAP attribute to follow for group membership. Default: 'cn'
    groupdn string
    LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org).
    groupfilter string
    Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'
    insecure_tls bool
    Skip TLS certificate verification. Not recommended for production. Default: false.
    max_page_size number
    If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    request_timeout number
    Timeout, in seconds, for the connection when making requests against the server. Default: 90.
    starttls bool
    Issue a StartTLS command after establishing an unencrypted connection. Default: false.
    tls_max_version string
    Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tls_min_version string
    Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    token_bound_cidrs list(string)
    Specifies the blocks of IP addresses which are allowed to use the generated token
    token_explicit_max_ttl number
    Generated Token's Explicit Maximum TTL in seconds
    token_max_ttl number
    The maximum lifetime of the generated token
    token_no_default_policy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    token_num_uses number
    The maximum number of times a token may be used, a value of zero means unlimited
    token_period number
    Generated Token's Period
    token_policies list(string)
    Generated Token's Policies
    token_ttl number
    The initial ttl of the token to generate in seconds
    token_type string
    The type of token to generate, service or batch
    upndomain string
    Enables userPrincipalDomain login with [username]@UPNDomain.
    url string
    LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1
    use_token_groups bool
    If true, use the Active Directory tokenGroups constructed attribute. Default: false.
    userattr string
    Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'
    userdn string
    LDAP domain to use for users (e.g., ou=People,dc=example,dc=org).
    userfilter string
    Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'
    username_as_alias bool
    Use username as alias name. Default: false.
    mount String
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    aliasMetadata Map<String,String>
    A map of string to string that will be set as metadata on the identity alias
    anonymousGroupSearch Boolean
    Use anonymous binds when performing LDAP group searches. Default: false.
    binddn String
    Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com').
    bindpassWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. LDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.
    bindpassWoVersion Integer
    Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo.
    caseSensitiveNames Boolean
    If true, usernames and group names are case sensitive. Default: false.
    certificate String
    CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
    clientTlsCertWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.
    clientTlsCertWoVersion Integer
    Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo.
    clientTlsKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.
    clientTlsKeyWoVersion Integer
    Version identifier for client TLS key updates. Must be used together with client_tls_key_wo.
    connectionTimeout Integer
    Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30.
    denyNullBind Boolean
    Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true.
    dereferenceAliases String
    When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'
    discoverdn Boolean
    Use anonymous bind to discover bind DN of a user. Default: false.
    enableSamaccountnameLogin Boolean
    If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. Note: Requires Vault 1.19.0+
    groupattr String
    LDAP attribute to follow for group membership. Default: 'cn'
    groupdn String
    LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org).
    groupfilter String
    Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'
    insecureTls Boolean
    Skip TLS certificate verification. Not recommended for production. Default: false.
    maxPageSize Integer
    If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    requestTimeout Integer
    Timeout, in seconds, for the connection when making requests against the server. Default: 90.
    starttls Boolean
    Issue a StartTLS command after establishing an unencrypted connection. Default: false.
    tlsMaxVersion String
    Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tlsMinVersion String
    Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tokenBoundCidrs List<String>
    Specifies the blocks of IP addresses which are allowed to use the generated token
    tokenExplicitMaxTtl Integer
    Generated Token's Explicit Maximum TTL in seconds
    tokenMaxTtl Integer
    The maximum lifetime of the generated token
    tokenNoDefaultPolicy Boolean
    If true, the 'default' policy will not automatically be added to generated tokens
    tokenNumUses Integer
    The maximum number of times a token may be used, a value of zero means unlimited
    tokenPeriod Integer
    Generated Token's Period
    tokenPolicies List<String>
    Generated Token's Policies
    tokenTtl Integer
    The initial ttl of the token to generate in seconds
    tokenType String
    The type of token to generate, service or batch
    upndomain String
    Enables userPrincipalDomain login with [username]@UPNDomain.
    url String
    LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1
    useTokenGroups Boolean
    If true, use the Active Directory tokenGroups constructed attribute. Default: false.
    userattr String
    Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'
    userdn String
    LDAP domain to use for users (e.g., ou=People,dc=example,dc=org).
    userfilter String
    Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'
    usernameAsAlias Boolean
    Use username as alias name. Default: false.
    mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    aliasMetadata {[key: string]: string}
    A map of string to string that will be set as metadata on the identity alias
    anonymousGroupSearch boolean
    Use anonymous binds when performing LDAP group searches. Default: false.
    binddn string
    Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com').
    bindpassWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. LDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.
    bindpassWoVersion number
    Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo.
    caseSensitiveNames boolean
    If true, usernames and group names are case sensitive. Default: false.
    certificate string
    CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
    clientTlsCertWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.
    clientTlsCertWoVersion number
    Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo.
    clientTlsKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.
    clientTlsKeyWoVersion number
    Version identifier for client TLS key updates. Must be used together with client_tls_key_wo.
    connectionTimeout number
    Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30.
    denyNullBind boolean
    Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true.
    dereferenceAliases string
    When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'
    discoverdn boolean
    Use anonymous bind to discover bind DN of a user. Default: false.
    enableSamaccountnameLogin boolean
    If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. Note: Requires Vault 1.19.0+
    groupattr string
    LDAP attribute to follow for group membership. Default: 'cn'
    groupdn string
    LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org).
    groupfilter string
    Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'
    insecureTls boolean
    Skip TLS certificate verification. Not recommended for production. Default: false.
    maxPageSize number
    If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    requestTimeout number
    Timeout, in seconds, for the connection when making requests against the server. Default: 90.
    starttls boolean
    Issue a StartTLS command after establishing an unencrypted connection. Default: false.
    tlsMaxVersion string
    Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tlsMinVersion string
    Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tokenBoundCidrs string[]
    Specifies the blocks of IP addresses which are allowed to use the generated token
    tokenExplicitMaxTtl number
    Generated Token's Explicit Maximum TTL in seconds
    tokenMaxTtl number
    The maximum lifetime of the generated token
    tokenNoDefaultPolicy boolean
    If true, the 'default' policy will not automatically be added to generated tokens
    tokenNumUses number
    The maximum number of times a token may be used, a value of zero means unlimited
    tokenPeriod number
    Generated Token's Period
    tokenPolicies string[]
    Generated Token's Policies
    tokenTtl number
    The initial ttl of the token to generate in seconds
    tokenType string
    The type of token to generate, service or batch
    upndomain string
    Enables userPrincipalDomain login with [username]@UPNDomain.
    url string
    LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1
    useTokenGroups boolean
    If true, use the Active Directory tokenGroups constructed attribute. Default: false.
    userattr string
    Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'
    userdn string
    LDAP domain to use for users (e.g., ou=People,dc=example,dc=org).
    userfilter string
    Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'
    usernameAsAlias boolean
    Use username as alias name. Default: false.
    mount str
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    alias_metadata Mapping[str, str]
    A map of string to string that will be set as metadata on the identity alias
    anonymous_group_search bool
    Use anonymous binds when performing LDAP group searches. Default: false.
    binddn str
    Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com').
    bindpass_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. LDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.
    bindpass_wo_version int
    Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo.
    case_sensitive_names bool
    If true, usernames and group names are case sensitive. Default: false.
    certificate str
    CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
    client_tls_cert_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.
    client_tls_cert_wo_version int
    Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo.
    client_tls_key_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.
    client_tls_key_wo_version int
    Version identifier for client TLS key updates. Must be used together with client_tls_key_wo.
    connection_timeout int
    Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30.
    deny_null_bind bool
    Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true.
    dereference_aliases str
    When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'
    discoverdn bool
    Use anonymous bind to discover bind DN of a user. Default: false.
    enable_samaccountname_login bool
    If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. Note: Requires Vault 1.19.0+
    groupattr str
    LDAP attribute to follow for group membership. Default: 'cn'
    groupdn str
    LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org).
    groupfilter str
    Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'
    insecure_tls bool
    Skip TLS certificate verification. Not recommended for production. Default: false.
    max_page_size int
    If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    request_timeout int
    Timeout, in seconds, for the connection when making requests against the server. Default: 90.
    starttls bool
    Issue a StartTLS command after establishing an unencrypted connection. Default: false.
    tls_max_version str
    Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tls_min_version str
    Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    token_bound_cidrs Sequence[str]
    Specifies the blocks of IP addresses which are allowed to use the generated token
    token_explicit_max_ttl int
    Generated Token's Explicit Maximum TTL in seconds
    token_max_ttl int
    The maximum lifetime of the generated token
    token_no_default_policy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    token_num_uses int
    The maximum number of times a token may be used, a value of zero means unlimited
    token_period int
    Generated Token's Period
    token_policies Sequence[str]
    Generated Token's Policies
    token_ttl int
    The initial ttl of the token to generate in seconds
    token_type str
    The type of token to generate, service or batch
    upndomain str
    Enables userPrincipalDomain login with [username]@UPNDomain.
    url str
    LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1
    use_token_groups bool
    If true, use the Active Directory tokenGroups constructed attribute. Default: false.
    userattr str
    Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'
    userdn str
    LDAP domain to use for users (e.g., ou=People,dc=example,dc=org).
    userfilter str
    Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'
    username_as_alias bool
    Use username as alias name. Default: false.
    mount String
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    aliasMetadata Map<String>
    A map of string to string that will be set as metadata on the identity alias
    anonymousGroupSearch Boolean
    Use anonymous binds when performing LDAP group searches. Default: false.
    binddn String
    Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com').
    bindpassWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. LDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.
    bindpassWoVersion Number
    Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo.
    caseSensitiveNames Boolean
    If true, usernames and group names are case sensitive. Default: false.
    certificate String
    CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
    clientTlsCertWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.
    clientTlsCertWoVersion Number
    Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo.
    clientTlsKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.
    clientTlsKeyWoVersion Number
    Version identifier for client TLS key updates. Must be used together with client_tls_key_wo.
    connectionTimeout Number
    Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30.
    denyNullBind Boolean
    Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true.
    dereferenceAliases String
    When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'
    discoverdn Boolean
    Use anonymous bind to discover bind DN of a user. Default: false.
    enableSamaccountnameLogin Boolean
    If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. Note: Requires Vault 1.19.0+
    groupattr String
    LDAP attribute to follow for group membership. Default: 'cn'
    groupdn String
    LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org).
    groupfilter String
    Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'
    insecureTls Boolean
    Skip TLS certificate verification. Not recommended for production. Default: false.
    maxPageSize Number
    If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    requestTimeout Number
    Timeout, in seconds, for the connection when making requests against the server. Default: 90.
    starttls Boolean
    Issue a StartTLS command after establishing an unencrypted connection. Default: false.
    tlsMaxVersion String
    Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tlsMinVersion String
    Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tokenBoundCidrs List<String>
    Specifies the blocks of IP addresses which are allowed to use the generated token
    tokenExplicitMaxTtl Number
    Generated Token's Explicit Maximum TTL in seconds
    tokenMaxTtl Number
    The maximum lifetime of the generated token
    tokenNoDefaultPolicy Boolean
    If true, the 'default' policy will not automatically be added to generated tokens
    tokenNumUses Number
    The maximum number of times a token may be used, a value of zero means unlimited
    tokenPeriod Number
    Generated Token's Period
    tokenPolicies List<String>
    Generated Token's Policies
    tokenTtl Number
    The initial ttl of the token to generate in seconds
    tokenType String
    The type of token to generate, service or batch
    upndomain String
    Enables userPrincipalDomain login with [username]@UPNDomain.
    url String
    LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1
    useTokenGroups Boolean
    If true, use the Active Directory tokenGroups constructed attribute. Default: false.
    userattr String
    Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'
    userdn String
    LDAP domain to use for users (e.g., ou=People,dc=example,dc=org).
    userfilter String
    Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'
    usernameAsAlias Boolean
    Use username as alias name. Default: false.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the KerberosAuthBackendLdapConfig resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing KerberosAuthBackendLdapConfig Resource

    Get an existing KerberosAuthBackendLdapConfig resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: KerberosAuthBackendLdapConfigState, opts?: CustomResourceOptions): KerberosAuthBackendLdapConfig
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        alias_metadata: Optional[Mapping[str, str]] = None,
        anonymous_group_search: Optional[bool] = None,
        binddn: Optional[str] = None,
        bindpass_wo: Optional[str] = None,
        bindpass_wo_version: Optional[int] = None,
        case_sensitive_names: Optional[bool] = None,
        certificate: Optional[str] = None,
        client_tls_cert_wo: Optional[str] = None,
        client_tls_cert_wo_version: Optional[int] = None,
        client_tls_key_wo: Optional[str] = None,
        client_tls_key_wo_version: Optional[int] = None,
        connection_timeout: Optional[int] = None,
        deny_null_bind: Optional[bool] = None,
        dereference_aliases: Optional[str] = None,
        discoverdn: Optional[bool] = None,
        enable_samaccountname_login: Optional[bool] = None,
        groupattr: Optional[str] = None,
        groupdn: Optional[str] = None,
        groupfilter: Optional[str] = None,
        insecure_tls: Optional[bool] = None,
        max_page_size: Optional[int] = None,
        mount: Optional[str] = None,
        namespace: Optional[str] = None,
        request_timeout: Optional[int] = None,
        starttls: Optional[bool] = None,
        tls_max_version: Optional[str] = None,
        tls_min_version: Optional[str] = None,
        token_bound_cidrs: Optional[Sequence[str]] = None,
        token_explicit_max_ttl: Optional[int] = None,
        token_max_ttl: Optional[int] = None,
        token_no_default_policy: Optional[bool] = None,
        token_num_uses: Optional[int] = None,
        token_period: Optional[int] = None,
        token_policies: Optional[Sequence[str]] = None,
        token_ttl: Optional[int] = None,
        token_type: Optional[str] = None,
        upndomain: Optional[str] = None,
        url: Optional[str] = None,
        use_token_groups: Optional[bool] = None,
        userattr: Optional[str] = None,
        userdn: Optional[str] = None,
        userfilter: Optional[str] = None,
        username_as_alias: Optional[bool] = None) -> KerberosAuthBackendLdapConfig
    func GetKerberosAuthBackendLdapConfig(ctx *Context, name string, id IDInput, state *KerberosAuthBackendLdapConfigState, opts ...ResourceOption) (*KerberosAuthBackendLdapConfig, error)
    public static KerberosAuthBackendLdapConfig Get(string name, Input<string> id, KerberosAuthBackendLdapConfigState? state, CustomResourceOptions? opts = null)
    public static KerberosAuthBackendLdapConfig get(String name, Output<String> id, KerberosAuthBackendLdapConfigState state, CustomResourceOptions options)
    resources:  _:    type: vault:KerberosAuthBackendLdapConfig    get:      id: ${id}
    import {
  to = vault_kerberos_auth_backend_ldap_config.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AliasMetadata Dictionary<string, string>
    A map of string to string that will be set as metadata on the identity alias
    AnonymousGroupSearch bool
    Use anonymous binds when performing LDAP group searches. Default: false.
    Binddn string
    Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com').
    BindpassWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. LDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.
    BindpassWoVersion int
    Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo.
    CaseSensitiveNames bool
    If true, usernames and group names are case sensitive. Default: false.
    Certificate string
    CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
    ClientTlsCertWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.
    ClientTlsCertWoVersion int
    Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo.
    ClientTlsKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.
    ClientTlsKeyWoVersion int
    Version identifier for client TLS key updates. Must be used together with client_tls_key_wo.
    ConnectionTimeout int
    Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30.
    DenyNullBind bool
    Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true.
    DereferenceAliases string
    When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'
    Discoverdn bool
    Use anonymous bind to discover bind DN of a user. Default: false.
    EnableSamaccountnameLogin bool
    If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. Note: Requires Vault 1.19.0+
    Groupattr string
    LDAP attribute to follow for group membership. Default: 'cn'
    Groupdn string
    LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org).
    Groupfilter string
    Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'
    InsecureTls bool
    Skip TLS certificate verification. Not recommended for production. Default: false.
    MaxPageSize int
    If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0.
    Mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    RequestTimeout int
    Timeout, in seconds, for the connection when making requests against the server. Default: 90.
    Starttls bool
    Issue a StartTLS command after establishing an unencrypted connection. Default: false.
    TlsMaxVersion string
    Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    TlsMinVersion string
    Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    TokenBoundCidrs List<string>
    Specifies the blocks of IP addresses which are allowed to use the generated token
    TokenExplicitMaxTtl int
    Generated Token's Explicit Maximum TTL in seconds
    TokenMaxTtl int
    The maximum lifetime of the generated token
    TokenNoDefaultPolicy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    TokenNumUses int
    The maximum number of times a token may be used, a value of zero means unlimited
    TokenPeriod int
    Generated Token's Period
    TokenPolicies List<string>
    Generated Token's Policies
    TokenTtl int
    The initial ttl of the token to generate in seconds
    TokenType string
    The type of token to generate, service or batch
    Upndomain string
    Enables userPrincipalDomain login with [username]@UPNDomain.
    Url string
    LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1
    UseTokenGroups bool
    If true, use the Active Directory tokenGroups constructed attribute. Default: false.
    Userattr string
    Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'
    Userdn string
    LDAP domain to use for users (e.g., ou=People,dc=example,dc=org).
    Userfilter string
    Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'
    UsernameAsAlias bool
    Use username as alias name. Default: false.
    AliasMetadata map[string]string
    A map of string to string that will be set as metadata on the identity alias
    AnonymousGroupSearch bool
    Use anonymous binds when performing LDAP group searches. Default: false.
    Binddn string
    Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com').
    BindpassWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. LDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.
    BindpassWoVersion int
    Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo.
    CaseSensitiveNames bool
    If true, usernames and group names are case sensitive. Default: false.
    Certificate string
    CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
    ClientTlsCertWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.
    ClientTlsCertWoVersion int
    Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo.
    ClientTlsKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.
    ClientTlsKeyWoVersion int
    Version identifier for client TLS key updates. Must be used together with client_tls_key_wo.
    ConnectionTimeout int
    Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30.
    DenyNullBind bool
    Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true.
    DereferenceAliases string
    When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'
    Discoverdn bool
    Use anonymous bind to discover bind DN of a user. Default: false.
    EnableSamaccountnameLogin bool
    If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. Note: Requires Vault 1.19.0+
    Groupattr string
    LDAP attribute to follow for group membership. Default: 'cn'
    Groupdn string
    LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org).
    Groupfilter string
    Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'
    InsecureTls bool
    Skip TLS certificate verification. Not recommended for production. Default: false.
    MaxPageSize int
    If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0.
    Mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    RequestTimeout int
    Timeout, in seconds, for the connection when making requests against the server. Default: 90.
    Starttls bool
    Issue a StartTLS command after establishing an unencrypted connection. Default: false.
    TlsMaxVersion string
    Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    TlsMinVersion string
    Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    TokenBoundCidrs []string
    Specifies the blocks of IP addresses which are allowed to use the generated token
    TokenExplicitMaxTtl int
    Generated Token's Explicit Maximum TTL in seconds
    TokenMaxTtl int
    The maximum lifetime of the generated token
    TokenNoDefaultPolicy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    TokenNumUses int
    The maximum number of times a token may be used, a value of zero means unlimited
    TokenPeriod int
    Generated Token's Period
    TokenPolicies []string
    Generated Token's Policies
    TokenTtl int
    The initial ttl of the token to generate in seconds
    TokenType string
    The type of token to generate, service or batch
    Upndomain string
    Enables userPrincipalDomain login with [username]@UPNDomain.
    Url string
    LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1
    UseTokenGroups bool
    If true, use the Active Directory tokenGroups constructed attribute. Default: false.
    Userattr string
    Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'
    Userdn string
    LDAP domain to use for users (e.g., ou=People,dc=example,dc=org).
    Userfilter string
    Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'
    UsernameAsAlias bool
    Use username as alias name. Default: false.
    alias_metadata map(string)
    A map of string to string that will be set as metadata on the identity alias
    anonymous_group_search bool
    Use anonymous binds when performing LDAP group searches. Default: false.
    binddn string
    Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com').
    bindpass_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. LDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.
    bindpass_wo_version number
    Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo.
    case_sensitive_names bool
    If true, usernames and group names are case sensitive. Default: false.
    certificate string
    CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
    client_tls_cert_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.
    client_tls_cert_wo_version number
    Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo.
    client_tls_key_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.
    client_tls_key_wo_version number
    Version identifier for client TLS key updates. Must be used together with client_tls_key_wo.
    connection_timeout number
    Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30.
    deny_null_bind bool
    Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true.
    dereference_aliases string
    When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'
    discoverdn bool
    Use anonymous bind to discover bind DN of a user. Default: false.
    enable_samaccountname_login bool
    If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. Note: Requires Vault 1.19.0+
    groupattr string
    LDAP attribute to follow for group membership. Default: 'cn'
    groupdn string
    LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org).
    groupfilter string
    Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'
    insecure_tls bool
    Skip TLS certificate verification. Not recommended for production. Default: false.
    max_page_size number
    If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0.
    mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    request_timeout number
    Timeout, in seconds, for the connection when making requests against the server. Default: 90.
    starttls bool
    Issue a StartTLS command after establishing an unencrypted connection. Default: false.
    tls_max_version string
    Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tls_min_version string
    Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    token_bound_cidrs list(string)
    Specifies the blocks of IP addresses which are allowed to use the generated token
    token_explicit_max_ttl number
    Generated Token's Explicit Maximum TTL in seconds
    token_max_ttl number
    The maximum lifetime of the generated token
    token_no_default_policy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    token_num_uses number
    The maximum number of times a token may be used, a value of zero means unlimited
    token_period number
    Generated Token's Period
    token_policies list(string)
    Generated Token's Policies
    token_ttl number
    The initial ttl of the token to generate in seconds
    token_type string
    The type of token to generate, service or batch
    upndomain string
    Enables userPrincipalDomain login with [username]@UPNDomain.
    url string
    LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1
    use_token_groups bool
    If true, use the Active Directory tokenGroups constructed attribute. Default: false.
    userattr string
    Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'
    userdn string
    LDAP domain to use for users (e.g., ou=People,dc=example,dc=org).
    userfilter string
    Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'
    username_as_alias bool
    Use username as alias name. Default: false.
    aliasMetadata Map<String,String>
    A map of string to string that will be set as metadata on the identity alias
    anonymousGroupSearch Boolean
    Use anonymous binds when performing LDAP group searches. Default: false.
    binddn String
    Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com').
    bindpassWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. LDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.
    bindpassWoVersion Integer
    Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo.
    caseSensitiveNames Boolean
    If true, usernames and group names are case sensitive. Default: false.
    certificate String
    CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
    clientTlsCertWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.
    clientTlsCertWoVersion Integer
    Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo.
    clientTlsKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.
    clientTlsKeyWoVersion Integer
    Version identifier for client TLS key updates. Must be used together with client_tls_key_wo.
    connectionTimeout Integer
    Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30.
    denyNullBind Boolean
    Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true.
    dereferenceAliases String
    When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'
    discoverdn Boolean
    Use anonymous bind to discover bind DN of a user. Default: false.
    enableSamaccountnameLogin Boolean
    If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. Note: Requires Vault 1.19.0+
    groupattr String
    LDAP attribute to follow for group membership. Default: 'cn'
    groupdn String
    LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org).
    groupfilter String
    Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'
    insecureTls Boolean
    Skip TLS certificate verification. Not recommended for production. Default: false.
    maxPageSize Integer
    If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0.
    mount String
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    requestTimeout Integer
    Timeout, in seconds, for the connection when making requests against the server. Default: 90.
    starttls Boolean
    Issue a StartTLS command after establishing an unencrypted connection. Default: false.
    tlsMaxVersion String
    Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tlsMinVersion String
    Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tokenBoundCidrs List<String>
    Specifies the blocks of IP addresses which are allowed to use the generated token
    tokenExplicitMaxTtl Integer
    Generated Token's Explicit Maximum TTL in seconds
    tokenMaxTtl Integer
    The maximum lifetime of the generated token
    tokenNoDefaultPolicy Boolean
    If true, the 'default' policy will not automatically be added to generated tokens
    tokenNumUses Integer
    The maximum number of times a token may be used, a value of zero means unlimited
    tokenPeriod Integer
    Generated Token's Period
    tokenPolicies List<String>
    Generated Token's Policies
    tokenTtl Integer
    The initial ttl of the token to generate in seconds
    tokenType String
    The type of token to generate, service or batch
    upndomain String
    Enables userPrincipalDomain login with [username]@UPNDomain.
    url String
    LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1
    useTokenGroups Boolean
    If true, use the Active Directory tokenGroups constructed attribute. Default: false.
    userattr String
    Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'
    userdn String
    LDAP domain to use for users (e.g., ou=People,dc=example,dc=org).
    userfilter String
    Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'
    usernameAsAlias Boolean
    Use username as alias name. Default: false.
    aliasMetadata {[key: string]: string}
    A map of string to string that will be set as metadata on the identity alias
    anonymousGroupSearch boolean
    Use anonymous binds when performing LDAP group searches. Default: false.
    binddn string
    Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com').
    bindpassWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. LDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.
    bindpassWoVersion number
    Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo.
    caseSensitiveNames boolean
    If true, usernames and group names are case sensitive. Default: false.
    certificate string
    CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
    clientTlsCertWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.
    clientTlsCertWoVersion number
    Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo.
    clientTlsKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.
    clientTlsKeyWoVersion number
    Version identifier for client TLS key updates. Must be used together with client_tls_key_wo.
    connectionTimeout number
    Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30.
    denyNullBind boolean
    Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true.
    dereferenceAliases string
    When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'
    discoverdn boolean
    Use anonymous bind to discover bind DN of a user. Default: false.
    enableSamaccountnameLogin boolean
    If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. Note: Requires Vault 1.19.0+
    groupattr string
    LDAP attribute to follow for group membership. Default: 'cn'
    groupdn string
    LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org).
    groupfilter string
    Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'
    insecureTls boolean
    Skip TLS certificate verification. Not recommended for production. Default: false.
    maxPageSize number
    If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0.
    mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    requestTimeout number
    Timeout, in seconds, for the connection when making requests against the server. Default: 90.
    starttls boolean
    Issue a StartTLS command after establishing an unencrypted connection. Default: false.
    tlsMaxVersion string
    Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tlsMinVersion string
    Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tokenBoundCidrs string[]
    Specifies the blocks of IP addresses which are allowed to use the generated token
    tokenExplicitMaxTtl number
    Generated Token's Explicit Maximum TTL in seconds
    tokenMaxTtl number
    The maximum lifetime of the generated token
    tokenNoDefaultPolicy boolean
    If true, the 'default' policy will not automatically be added to generated tokens
    tokenNumUses number
    The maximum number of times a token may be used, a value of zero means unlimited
    tokenPeriod number
    Generated Token's Period
    tokenPolicies string[]
    Generated Token's Policies
    tokenTtl number
    The initial ttl of the token to generate in seconds
    tokenType string
    The type of token to generate, service or batch
    upndomain string
    Enables userPrincipalDomain login with [username]@UPNDomain.
    url string
    LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1
    useTokenGroups boolean
    If true, use the Active Directory tokenGroups constructed attribute. Default: false.
    userattr string
    Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'
    userdn string
    LDAP domain to use for users (e.g., ou=People,dc=example,dc=org).
    userfilter string
    Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'
    usernameAsAlias boolean
    Use username as alias name. Default: false.
    alias_metadata Mapping[str, str]
    A map of string to string that will be set as metadata on the identity alias
    anonymous_group_search bool
    Use anonymous binds when performing LDAP group searches. Default: false.
    binddn str
    Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com').
    bindpass_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. LDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.
    bindpass_wo_version int
    Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo.
    case_sensitive_names bool
    If true, usernames and group names are case sensitive. Default: false.
    certificate str
    CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
    client_tls_cert_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.
    client_tls_cert_wo_version int
    Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo.
    client_tls_key_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.
    client_tls_key_wo_version int
    Version identifier for client TLS key updates. Must be used together with client_tls_key_wo.
    connection_timeout int
    Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30.
    deny_null_bind bool
    Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true.
    dereference_aliases str
    When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'
    discoverdn bool
    Use anonymous bind to discover bind DN of a user. Default: false.
    enable_samaccountname_login bool
    If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. Note: Requires Vault 1.19.0+
    groupattr str
    LDAP attribute to follow for group membership. Default: 'cn'
    groupdn str
    LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org).
    groupfilter str
    Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'
    insecure_tls bool
    Skip TLS certificate verification. Not recommended for production. Default: false.
    max_page_size int
    If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0.
    mount str
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    request_timeout int
    Timeout, in seconds, for the connection when making requests against the server. Default: 90.
    starttls bool
    Issue a StartTLS command after establishing an unencrypted connection. Default: false.
    tls_max_version str
    Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tls_min_version str
    Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    token_bound_cidrs Sequence[str]
    Specifies the blocks of IP addresses which are allowed to use the generated token
    token_explicit_max_ttl int
    Generated Token's Explicit Maximum TTL in seconds
    token_max_ttl int
    The maximum lifetime of the generated token
    token_no_default_policy bool
    If true, the 'default' policy will not automatically be added to generated tokens
    token_num_uses int
    The maximum number of times a token may be used, a value of zero means unlimited
    token_period int
    Generated Token's Period
    token_policies Sequence[str]
    Generated Token's Policies
    token_ttl int
    The initial ttl of the token to generate in seconds
    token_type str
    The type of token to generate, service or batch
    upndomain str
    Enables userPrincipalDomain login with [username]@UPNDomain.
    url str
    LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1
    use_token_groups bool
    If true, use the Active Directory tokenGroups constructed attribute. Default: false.
    userattr str
    Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'
    userdn str
    LDAP domain to use for users (e.g., ou=People,dc=example,dc=org).
    userfilter str
    Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'
    username_as_alias bool
    Use username as alias name. Default: false.
    aliasMetadata Map<String>
    A map of string to string that will be set as metadata on the identity alias
    anonymousGroupSearch Boolean
    Use anonymous binds when performing LDAP group searches. Default: false.
    binddn String
    Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com').
    bindpassWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. LDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.
    bindpassWoVersion Number
    Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo.
    caseSensitiveNames Boolean
    If true, usernames and group names are case sensitive. Default: false.
    certificate String
    CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
    clientTlsCertWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.
    clientTlsCertWoVersion Number
    Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo.
    clientTlsKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Client certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.
    clientTlsKeyWoVersion Number
    Version identifier for client TLS key updates. Must be used together with client_tls_key_wo.
    connectionTimeout Number
    Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30.
    denyNullBind Boolean
    Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true.
    dereferenceAliases String
    When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'
    discoverdn Boolean
    Use anonymous bind to discover bind DN of a user. Default: false.
    enableSamaccountnameLogin Boolean
    If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. Note: Requires Vault 1.19.0+
    groupattr String
    LDAP attribute to follow for group membership. Default: 'cn'
    groupdn String
    LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org).
    groupfilter String
    Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'
    insecureTls Boolean
    Skip TLS certificate verification. Not recommended for production. Default: false.
    maxPageSize Number
    If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0.
    mount String
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    requestTimeout Number
    Timeout, in seconds, for the connection when making requests against the server. Default: 90.
    starttls Boolean
    Issue a StartTLS command after establishing an unencrypted connection. Default: false.
    tlsMaxVersion String
    Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tlsMinVersion String
    Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'.
    tokenBoundCidrs List<String>
    Specifies the blocks of IP addresses which are allowed to use the generated token
    tokenExplicitMaxTtl Number
    Generated Token's Explicit Maximum TTL in seconds
    tokenMaxTtl Number
    The maximum lifetime of the generated token
    tokenNoDefaultPolicy Boolean
    If true, the 'default' policy will not automatically be added to generated tokens
    tokenNumUses Number
    The maximum number of times a token may be used, a value of zero means unlimited
    tokenPeriod Number
    Generated Token's Period
    tokenPolicies List<String>
    Generated Token's Policies
    tokenTtl Number
    The initial ttl of the token to generate in seconds
    tokenType String
    The type of token to generate, service or batch
    upndomain String
    Enables userPrincipalDomain login with [username]@UPNDomain.
    url String
    LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1
    useTokenGroups Boolean
    If true, use the Active Directory tokenGroups constructed attribute. Default: false.
    userattr String
    Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'
    userdn String
    LDAP domain to use for users (e.g., ou=People,dc=example,dc=org).
    userfilter String
    Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'
    usernameAsAlias Boolean
    Use username as alias name. Default: false.

    Import

    Kerberos auth backend LDAP configurations can be imported using the auth/{mount}/config/ldap path, e.g.

    $ pulumi import vault:index/kerberosAuthBackendLdapConfig:KerberosAuthBackendLdapConfig config auth/kerberos/config/ldap

    Note Write-only fields (bindpassWo, clientTlsCertWo, clientTlsKeyWo) and their version fields cannot be imported. You will need to ignore changes to these fields or provide them in your configuration after import.

    Importing with Namespace (Vault Enterprise)

    For Vault Enterprise with namespaces, set the TERRAFORM_VAULT_NAMESPACE_IMPORT environment variable before importing:

    $ export TERRAFORM_VAULT_NAMESPACE_IMPORT=example-namespace
$ terraform import vault_kerberos_auth_backend_ldap_config.config auth/kerberos/config/ldap

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.12.0
    published on Saturday, Aug 15, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial