authentik 2025.2.0, Mar 24 25

authentik 2025.2.0 published on Monday, Mar 24, 2025 by goauthentik

goauthentik/terraform-provider-authentik

authentik.ProviderOauth2

Explore with Pulumi AI

authentik 2025.2.0 published on Monday, Mar 24, 2025 by goauthentik

goauthentik/terraform-provider-authentik

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as authentik from "@pulumi/authentik";

// Create an OAuth2 Provider
const nameProviderOauth2 = new authentik.ProviderOauth2("nameProviderOauth2", {
    clientId: "grafana",
    allowedRedirectUris: [{
        matching_mode: "strict",
        url: "http://localhost",
    }],
});
const nameApplication = new authentik.Application("nameApplication", {
    slug: "test-app",
    protocolProvider: nameProviderOauth2.providerOauth2Id,
});

import pulumi
import pulumi_authentik as authentik

# Create an OAuth2 Provider
name_provider_oauth2 = authentik.ProviderOauth2("nameProviderOauth2",
    client_id="grafana",
    allowed_redirect_uris=[{
        "matching_mode": "strict",
        "url": "http://localhost",
    }])
name_application = authentik.Application("nameApplication",
    slug="test-app",
    protocol_provider=name_provider_oauth2.provider_oauth2_id)

package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/authentik/v2025/authentik"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Create an OAuth2 Provider
		nameProviderOauth2, err := authentik.NewProviderOauth2(ctx, "nameProviderOauth2", &authentik.ProviderOauth2Args{
			ClientId: pulumi.String("grafana"),
			AllowedRedirectUris: pulumi.StringMapArray{
				pulumi.StringMap{
					"matching_mode": pulumi.String("strict"),
					"url":           pulumi.String("http://localhost"),
				},
			},
		})
		if err != nil {
			return err
		}
		_, err = authentik.NewApplication(ctx, "nameApplication", &authentik.ApplicationArgs{
			Slug:             pulumi.String("test-app"),
			ProtocolProvider: nameProviderOauth2.ProviderOauth2Id,
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Authentik = Pulumi.Authentik;

return await Deployment.RunAsync(() => 
{
    // Create an OAuth2 Provider
    var nameProviderOauth2 = new Authentik.ProviderOauth2("nameProviderOauth2", new()
    {
        ClientId = "grafana",
        AllowedRedirectUris = new[]
        {
            
            {
                { "matching_mode", "strict" },
                { "url", "http://localhost" },
            },
        },
    });

    var nameApplication = new Authentik.Application("nameApplication", new()
    {
        Slug = "test-app",
        ProtocolProvider = nameProviderOauth2.ProviderOauth2Id,
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.authentik.ProviderOauth2;
import com.pulumi.authentik.ProviderOauth2Args;
import com.pulumi.authentik.Application;
import com.pulumi.authentik.ApplicationArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Create an OAuth2 Provider
        var nameProviderOauth2 = new ProviderOauth2("nameProviderOauth2", ProviderOauth2Args.builder()
            .clientId("grafana")
            .allowedRedirectUris(Map.ofEntries(
                Map.entry("matching_mode", "strict"),
                Map.entry("url", "http://localhost")
            ))
            .build());

        var nameApplication = new Application("nameApplication", ApplicationArgs.builder()
            .slug("test-app")
            .protocolProvider(nameProviderOauth2.providerOauth2Id())
            .build());

    }
}

resources:
  # Create an OAuth2 Provider
  nameProviderOauth2:
    type: authentik:ProviderOauth2
    properties:
      clientId: grafana
      allowedRedirectUris:
        - matching_mode: strict
          url: http://localhost
  nameApplication:
    type: authentik:Application
    properties:
      slug: test-app
      protocolProvider: ${nameProviderOauth2.providerOauth2Id}

Create ProviderOauth2 Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new ProviderOauth2(name: string, args: ProviderOauth2Args, opts?: CustomResourceOptions);

@overload
def ProviderOauth2(resource_name: str,
                   args: ProviderOauth2Args,
                   opts: Optional[ResourceOptions] = None)

@overload
def ProviderOauth2(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   invalidation_flow: Optional[str] = None,
                   client_id: Optional[str] = None,
                   authorization_flow: Optional[str] = None,
                   client_secret: Optional[str] = None,
                   authentication_flow: Optional[str] = None,
                   jwks_sources: Optional[Sequence[str]] = None,
                   access_token_validity: Optional[str] = None,
                   client_type: Optional[str] = None,
                   encryption_key: Optional[str] = None,
                   include_claims_in_id_token: Optional[bool] = None,
                   allowed_redirect_uris: Optional[Sequence[Mapping[str, str]]] = None,
                   access_code_validity: Optional[str] = None,
                   issuer_mode: Optional[str] = None,
                   jwt_federation_providers: Optional[Sequence[float]] = None,
                   jwt_federation_sources: Optional[Sequence[str]] = None,
                   name: Optional[str] = None,
                   property_mappings: Optional[Sequence[str]] = None,
                   provider_oauth2_id: Optional[str] = None,
                   refresh_token_validity: Optional[str] = None,
                   signing_key: Optional[str] = None,
                   sub_mode: Optional[str] = None)

func NewProviderOauth2(ctx *Context, name string, args ProviderOauth2Args, opts ...ResourceOption) (*ProviderOauth2, error)

public ProviderOauth2(string name, ProviderOauth2Args args, CustomResourceOptions? opts = null)

public ProviderOauth2(String name, ProviderOauth2Args args)
public ProviderOauth2(String name, ProviderOauth2Args args, CustomResourceOptions options)

type: authentik:ProviderOauth2
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args ProviderOauth2Args: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args ProviderOauth2Args: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args ProviderOauth2Args: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args ProviderOauth2Args: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args ProviderOauth2Args: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var providerOauth2Resource = new Authentik.ProviderOauth2("providerOauth2Resource", new()
{
    InvalidationFlow = "string",
    ClientId = "string",
    AuthorizationFlow = "string",
    ClientSecret = "string",
    AuthenticationFlow = "string",
    JwksSources = new[]
    {
        "string",
    },
    AccessTokenValidity = "string",
    ClientType = "string",
    EncryptionKey = "string",
    IncludeClaimsInIdToken = false,
    AllowedRedirectUris = new[]
    {
        
        {
            { "string", "string" },
        },
    },
    AccessCodeValidity = "string",
    IssuerMode = "string",
    JwtFederationProviders = new[]
    {
        0,
    },
    JwtFederationSources = new[]
    {
        "string",
    },
    Name = "string",
    PropertyMappings = new[]
    {
        "string",
    },
    ProviderOauth2Id = "string",
    RefreshTokenValidity = "string",
    SigningKey = "string",
    SubMode = "string",
});

example, err := authentik.NewProviderOauth2(ctx, "providerOauth2Resource", &authentik.ProviderOauth2Args{
	InvalidationFlow:   pulumi.String("string"),
	ClientId:           pulumi.String("string"),
	AuthorizationFlow:  pulumi.String("string"),
	ClientSecret:       pulumi.String("string"),
	AuthenticationFlow: pulumi.String("string"),
	JwksSources: pulumi.StringArray{
		pulumi.String("string"),
	},
	AccessTokenValidity:    pulumi.String("string"),
	ClientType:             pulumi.String("string"),
	EncryptionKey:          pulumi.String("string"),
	IncludeClaimsInIdToken: pulumi.Bool(false),
	AllowedRedirectUris: pulumi.StringMapArray{
		pulumi.StringMap{
			"string": pulumi.String("string"),
		},
	},
	AccessCodeValidity: pulumi.String("string"),
	IssuerMode:         pulumi.String("string"),
	JwtFederationProviders: pulumi.Float64Array{
		pulumi.Float64(0),
	},
	JwtFederationSources: pulumi.StringArray{
		pulumi.String("string"),
	},
	Name: pulumi.String("string"),
	PropertyMappings: pulumi.StringArray{
		pulumi.String("string"),
	},
	ProviderOauth2Id:     pulumi.String("string"),
	RefreshTokenValidity: pulumi.String("string"),
	SigningKey:           pulumi.String("string"),
	SubMode:              pulumi.String("string"),
})

var providerOauth2Resource = new ProviderOauth2("providerOauth2Resource", ProviderOauth2Args.builder()
    .invalidationFlow("string")
    .clientId("string")
    .authorizationFlow("string")
    .clientSecret("string")
    .authenticationFlow("string")
    .jwksSources("string")
    .accessTokenValidity("string")
    .clientType("string")
    .encryptionKey("string")
    .includeClaimsInIdToken(false)
    .allowedRedirectUris(Map.of("string", "string"))
    .accessCodeValidity("string")
    .issuerMode("string")
    .jwtFederationProviders(0)
    .jwtFederationSources("string")
    .name("string")
    .propertyMappings("string")
    .providerOauth2Id("string")
    .refreshTokenValidity("string")
    .signingKey("string")
    .subMode("string")
    .build());

provider_oauth2_resource = authentik.ProviderOauth2("providerOauth2Resource",
    invalidation_flow="string",
    client_id="string",
    authorization_flow="string",
    client_secret="string",
    authentication_flow="string",
    jwks_sources=["string"],
    access_token_validity="string",
    client_type="string",
    encryption_key="string",
    include_claims_in_id_token=False,
    allowed_redirect_uris=[{
        "string": "string",
    }],
    access_code_validity="string",
    issuer_mode="string",
    jwt_federation_providers=[0],
    jwt_federation_sources=["string"],
    name="string",
    property_mappings=["string"],
    provider_oauth2_id="string",
    refresh_token_validity="string",
    signing_key="string",
    sub_mode="string")

const providerOauth2Resource = new authentik.ProviderOauth2("providerOauth2Resource", {
    invalidationFlow: "string",
    clientId: "string",
    authorizationFlow: "string",
    clientSecret: "string",
    authenticationFlow: "string",
    jwksSources: ["string"],
    accessTokenValidity: "string",
    clientType: "string",
    encryptionKey: "string",
    includeClaimsInIdToken: false,
    allowedRedirectUris: [{
        string: "string",
    }],
    accessCodeValidity: "string",
    issuerMode: "string",
    jwtFederationProviders: [0],
    jwtFederationSources: ["string"],
    name: "string",
    propertyMappings: ["string"],
    providerOauth2Id: "string",
    refreshTokenValidity: "string",
    signingKey: "string",
    subMode: "string",
});

type: authentik:ProviderOauth2
properties:
    accessCodeValidity: string
    accessTokenValidity: string
    allowedRedirectUris:
        - string: string
    authenticationFlow: string
    authorizationFlow: string
    clientId: string
    clientSecret: string
    clientType: string
    encryptionKey: string
    includeClaimsInIdToken: false
    invalidationFlow: string
    issuerMode: string
    jwksSources:
        - string
    jwtFederationProviders:
        - 0
    jwtFederationSources:
        - string
    name: string
    propertyMappings:
        - string
    providerOauth2Id: string
    refreshTokenValidity: string
    signingKey: string
    subMode: string

ProviderOauth2 Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The ProviderOauth2 resource accepts the following input properties:

AuthorizationFlow string
ClientId string
InvalidationFlow string
AccessCodeValidity string: Defaults to minutes=1.
AccessTokenValidity string: Defaults to minutes=10.
AllowedRedirectUris List<ImmutableDictionary<string, string>>
AuthenticationFlow string
ClientSecret string: Generated.
ClientType string: Allowed values: - confidential - public Defaults to confidential.
EncryptionKey string
IncludeClaimsInIdToken bool: Defaults to true.
IssuerMode string: Allowed values: - global - per_provider Defaults to per_provider.
JwksSources List<string>: Deprecated. Use jwt_federation_sources instead.
JwtFederationProviders List<double>: JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
JwtFederationSources List<string>: JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
Name string
PropertyMappings List<string>
ProviderOauth2Id string
RefreshTokenValidity string: Defaults to days=30.
SigningKey string
SubMode string: Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.

AuthorizationFlow string
ClientId string
InvalidationFlow string
AccessCodeValidity string: Defaults to minutes=1.
AccessTokenValidity string: Defaults to minutes=10.
AllowedRedirectUris []map[string]string
AuthenticationFlow string
ClientSecret string: Generated.
ClientType string: Allowed values: - confidential - public Defaults to confidential.
EncryptionKey string
IncludeClaimsInIdToken bool: Defaults to true.
IssuerMode string: Allowed values: - global - per_provider Defaults to per_provider.
JwksSources []string: Deprecated. Use jwt_federation_sources instead.
JwtFederationProviders []float64: JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
JwtFederationSources []string: JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
Name string
PropertyMappings []string
ProviderOauth2Id string
RefreshTokenValidity string: Defaults to days=30.
SigningKey string
SubMode string: Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.

authorizationFlow String
clientId String
invalidationFlow String
accessCodeValidity String: Defaults to minutes=1.
accessTokenValidity String: Defaults to minutes=10.
allowedRedirectUris List<Map<String,String>>
authenticationFlow String
clientSecret String: Generated.
clientType String: Allowed values: - confidential - public Defaults to confidential.
encryptionKey String
includeClaimsInIdToken Boolean: Defaults to true.
issuerMode String: Allowed values: - global - per_provider Defaults to per_provider.
jwksSources List<String>: Deprecated. Use jwt_federation_sources instead.
jwtFederationProviders List<Double>: JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwtFederationSources List<String>: JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name String
propertyMappings List<String>
providerOauth2Id String
refreshTokenValidity String: Defaults to days=30.
signingKey String
subMode String: Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.

authorizationFlow string
clientId string
invalidationFlow string
accessCodeValidity string: Defaults to minutes=1.
accessTokenValidity string: Defaults to minutes=10.
allowedRedirectUris {[key: string]: string}[]
authenticationFlow string
clientSecret string: Generated.
clientType string: Allowed values: - confidential - public Defaults to confidential.
encryptionKey string
includeClaimsInIdToken boolean: Defaults to true.
issuerMode string: Allowed values: - global - per_provider Defaults to per_provider.
jwksSources string[]: Deprecated. Use jwt_federation_sources instead.
jwtFederationProviders number[]: JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwtFederationSources string[]: JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name string
propertyMappings string[]
providerOauth2Id string
refreshTokenValidity string: Defaults to days=30.
signingKey string
subMode string: Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.

authorization_flow str
client_id str
invalidation_flow str
access_code_validity str: Defaults to minutes=1.
access_token_validity str: Defaults to minutes=10.
allowed_redirect_uris Sequence[Mapping[str, str]]
authentication_flow str
client_secret str: Generated.
client_type str: Allowed values: - confidential - public Defaults to confidential.
encryption_key str
include_claims_in_id_token bool: Defaults to true.
issuer_mode str: Allowed values: - global - per_provider Defaults to per_provider.
jwks_sources Sequence[str]: Deprecated. Use jwt_federation_sources instead.
jwt_federation_providers Sequence[float]: JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwt_federation_sources Sequence[str]: JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name str
property_mappings Sequence[str]
provider_oauth2_id str
refresh_token_validity str: Defaults to days=30.
signing_key str
sub_mode str: Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.

authorizationFlow String
clientId String
invalidationFlow String
accessCodeValidity String: Defaults to minutes=1.
accessTokenValidity String: Defaults to minutes=10.
allowedRedirectUris List<Map<String>>
authenticationFlow String
clientSecret String: Generated.
clientType String: Allowed values: - confidential - public Defaults to confidential.
encryptionKey String
includeClaimsInIdToken Boolean: Defaults to true.
issuerMode String: Allowed values: - global - per_provider Defaults to per_provider.
jwksSources List<String>: Deprecated. Use jwt_federation_sources instead.
jwtFederationProviders List<Number>: JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwtFederationSources List<String>: JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name String
propertyMappings List<String>
providerOauth2Id String
refreshTokenValidity String: Defaults to days=30.
signingKey String
subMode String: Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.

Outputs

All input properties are implicitly available as output properties. Additionally, the ProviderOauth2 resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

Look up Existing ProviderOauth2 Resource

Get an existing ProviderOauth2 resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: ProviderOauth2State, opts?: CustomResourceOptions): ProviderOauth2

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        access_code_validity: Optional[str] = None,
        access_token_validity: Optional[str] = None,
        allowed_redirect_uris: Optional[Sequence[Mapping[str, str]]] = None,
        authentication_flow: Optional[str] = None,
        authorization_flow: Optional[str] = None,
        client_id: Optional[str] = None,
        client_secret: Optional[str] = None,
        client_type: Optional[str] = None,
        encryption_key: Optional[str] = None,
        include_claims_in_id_token: Optional[bool] = None,
        invalidation_flow: Optional[str] = None,
        issuer_mode: Optional[str] = None,
        jwks_sources: Optional[Sequence[str]] = None,
        jwt_federation_providers: Optional[Sequence[float]] = None,
        jwt_federation_sources: Optional[Sequence[str]] = None,
        name: Optional[str] = None,
        property_mappings: Optional[Sequence[str]] = None,
        provider_oauth2_id: Optional[str] = None,
        refresh_token_validity: Optional[str] = None,
        signing_key: Optional[str] = None,
        sub_mode: Optional[str] = None) -> ProviderOauth2

func GetProviderOauth2(ctx *Context, name string, id IDInput, state *ProviderOauth2State, opts ...ResourceOption) (*ProviderOauth2, error)

public static ProviderOauth2 Get(string name, Input<string> id, ProviderOauth2State? state, CustomResourceOptions? opts = null)

public static ProviderOauth2 get(String name, Output<String> id, ProviderOauth2State state, CustomResourceOptions options)

resources:  _:    type: authentik:ProviderOauth2    get:      id: ${id}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AccessCodeValidity string: Defaults to minutes=1.
AccessTokenValidity string: Defaults to minutes=10.
AllowedRedirectUris List<ImmutableDictionary<string, string>>
AuthenticationFlow string
AuthorizationFlow string
ClientId string
ClientSecret string: Generated.
ClientType string: Allowed values: - confidential - public Defaults to confidential.
EncryptionKey string
IncludeClaimsInIdToken bool: Defaults to true.
InvalidationFlow string
IssuerMode string: Allowed values: - global - per_provider Defaults to per_provider.
JwksSources List<string>: Deprecated. Use jwt_federation_sources instead.
JwtFederationProviders List<double>: JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
JwtFederationSources List<string>: JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
Name string
PropertyMappings List<string>
ProviderOauth2Id string
RefreshTokenValidity string: Defaults to days=30.
SigningKey string
SubMode string: Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.

AccessCodeValidity string: Defaults to minutes=1.
AccessTokenValidity string: Defaults to minutes=10.
AllowedRedirectUris []map[string]string
AuthenticationFlow string
AuthorizationFlow string
ClientId string
ClientSecret string: Generated.
ClientType string: Allowed values: - confidential - public Defaults to confidential.
EncryptionKey string
IncludeClaimsInIdToken bool: Defaults to true.
InvalidationFlow string
IssuerMode string: Allowed values: - global - per_provider Defaults to per_provider.
JwksSources []string: Deprecated. Use jwt_federation_sources instead.
JwtFederationProviders []float64: JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
JwtFederationSources []string: JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
Name string
PropertyMappings []string
ProviderOauth2Id string
RefreshTokenValidity string: Defaults to days=30.
SigningKey string
SubMode string: Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.

accessCodeValidity String: Defaults to minutes=1.
accessTokenValidity String: Defaults to minutes=10.
allowedRedirectUris List<Map<String,String>>
authenticationFlow String
authorizationFlow String
clientId String
clientSecret String: Generated.
clientType String: Allowed values: - confidential - public Defaults to confidential.
encryptionKey String
includeClaimsInIdToken Boolean: Defaults to true.
invalidationFlow String
issuerMode String: Allowed values: - global - per_provider Defaults to per_provider.
jwksSources List<String>: Deprecated. Use jwt_federation_sources instead.
jwtFederationProviders List<Double>: JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwtFederationSources List<String>: JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name String
propertyMappings List<String>
providerOauth2Id String
refreshTokenValidity String: Defaults to days=30.
signingKey String
subMode String: Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.

accessCodeValidity string: Defaults to minutes=1.
accessTokenValidity string: Defaults to minutes=10.
allowedRedirectUris {[key: string]: string}[]
authenticationFlow string
authorizationFlow string
clientId string
clientSecret string: Generated.
clientType string: Allowed values: - confidential - public Defaults to confidential.
encryptionKey string
includeClaimsInIdToken boolean: Defaults to true.
invalidationFlow string
issuerMode string: Allowed values: - global - per_provider Defaults to per_provider.
jwksSources string[]: Deprecated. Use jwt_federation_sources instead.
jwtFederationProviders number[]: JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwtFederationSources string[]: JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name string
propertyMappings string[]
providerOauth2Id string
refreshTokenValidity string: Defaults to days=30.
signingKey string
subMode string: Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.

access_code_validity str: Defaults to minutes=1.
access_token_validity str: Defaults to minutes=10.
allowed_redirect_uris Sequence[Mapping[str, str]]
authentication_flow str
authorization_flow str
client_id str
client_secret str: Generated.
client_type str: Allowed values: - confidential - public Defaults to confidential.
encryption_key str
include_claims_in_id_token bool: Defaults to true.
invalidation_flow str
issuer_mode str: Allowed values: - global - per_provider Defaults to per_provider.
jwks_sources Sequence[str]: Deprecated. Use jwt_federation_sources instead.
jwt_federation_providers Sequence[float]: JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwt_federation_sources Sequence[str]: JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name str
property_mappings Sequence[str]
provider_oauth2_id str
refresh_token_validity str: Defaults to days=30.
signing_key str
sub_mode str: Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.

accessCodeValidity String: Defaults to minutes=1.
accessTokenValidity String: Defaults to minutes=10.
allowedRedirectUris List<Map<String>>
authenticationFlow String
authorizationFlow String
clientId String
clientSecret String: Generated.
clientType String: Allowed values: - confidential - public Defaults to confidential.
encryptionKey String
includeClaimsInIdToken Boolean: Defaults to true.
invalidationFlow String
issuerMode String: Allowed values: - global - per_provider Defaults to per_provider.
jwksSources List<String>: Deprecated. Use jwt_federation_sources instead.
jwtFederationProviders List<Number>: JWTs issued by any of the configured providers can be used to authenticate on behalf of this provider.
jwtFederationSources List<String>: JWTs issued by keys configured in any of the selected sources can be used to authenticate on behalf of this provider.
name String
propertyMappings List<String>
providerOauth2Id String
refreshTokenValidity String: Defaults to days=30.
signingKey String
subMode String: Allowed values: - hashed_user_id - user_id - user_uuid - user_username - user_email - user_upn Defaults to hashed_user_id.

Package Details

Repository: authentik goauthentik/terraform-provider-authentik
License
Notes: This Pulumi package is based on the authentik Terraform Provider.

authentik 2025.2.0 published on Monday, Mar 24, 2025 by goauthentik

goauthentik/terraform-provider-authentik

authentik.ProviderOauth2

On this page

On this page

Example Usage

Create ProviderOauth2 Resource

Constructor syntax

Parameters

Constructor example

ProviderOauth2 Resource Properties

Inputs

Outputs

Look up Existing ProviderOauth2 Resource

Package Details

On this page

On this page