terraform-provider/docs/resources/identity_oidc_auth.md

page_title, subcategory, description

page_title	subcategory	description
kms_identity_oidc_auth Resource - terraform-provider	Identities	Create and manage identity oidc auth in Hanzo KMS.

kms_identity_oidc_auth (Resource)

Create and manage identity oidc auth in Hanzo KMS.

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_identity" "machine-identity-1" {
  name   = "machine-identity-1"
  role   = "admin"
  org_id = "<>"
}

resource "kms_identity_oidc_auth" "oidc-auth" {
  identity_id        = kms_identity.machine-identity-1.id
  oidc_discovery_url = "<>"
  bound_issuer       = "<>"
  bound_audiences    = ["sample-audience"]
  bound_subject      = "<>"
}

Schema

Required

• bound_issuer (String) The unique identifier of the identity provider issuing the OIDC tokens.
• identity_id (String) The ID of the identity to attach the configuration onto.
• oidc_discovery_url (String) The URL used to retrieve the OpenID Connect configuration from the identity provider.

Optional

• access_token_max_ttl (Number) The maximum lifetime for an access token in seconds. This value will be referenced at renewal time. Default: 2592000
• access_token_num_uses_limit (Number) The maximum number of times that an access token can be used; a value of 0 implies infinite number of uses. Default:0
• access_token_trusted_ips (Attributes List) A list of IPs or CIDR ranges that access tokens can be used from. You can use 0.0.0.0/0, to allow usage from any network address... (see below for nested schema)
• access_token_ttl (Number) The lifetime for an access token in seconds. This value will be referenced at renewal time. Default: 2592000
• bound_audiences (List of String) The comma-separated list of intended recipients.
• bound_claims (Map of String) The attributes that should be present in the JWT for it to be valid. The provided values can be a glob pattern.
• bound_subject (String) The expected principal that is the subject of the JWT.
• claim_metadata_mapping (Map of String) Map OIDC token claims to metadata fields. Example: {"role": "token.groups"}, this would become identity.metadata.oidc.claims.role
• oidc_ca_certificate (String) The PEM-encoded CA cert for establishing secure communication with the Identity Provider endpoints

Read-Only

• id (String) The ID of the oidc auth.

Nested Schema for access_token_trusted_ips

Optional:

• ip_address (String)