uptimeify_sso_oidc

Single sign-on of the organization with an OpenID Connect identity provider (PUT /api/organization/sso). One per organization; needs an organization admin token. Saving runs the issuer's discovery, so the issuer must be reachable over HTTPS from Uptimeify.

Register the client at your identity provider with redirect_uri and the scopes (both known before the first apply, see GET /api/organization/sso). Prove the domain with the DNS TXT record verification_record and uptimeify_sso_domain_verification. A new domain or issuer resets the verification, the first login and enforce_sso.

Destroying it removes SSO. A SAML configuration is not managed here: it reads as gone, and an apply replaces it with OIDC. Import with the id sso.

BeispielAnkerlink kopieren

variable "oidc_client_secret" {
  type      = string
  sensitive = true
}

# Register the client at your identity provider first, with
# uptimeify_sso_oidc.corp.redirect_uri and the scopes openid, email, profile.
resource "uptimeify_sso_oidc" "corp" {
  issuer                   = "https://login.example.com/realms/corp"
  client_id                = "uptimeify"
  client_secret_wo         = var.oidc_client_secret
  client_secret_wo_version = 1
  domain                   = "example.com"
  default_role             = "editor"
  # enforce_sso = true  # only after the domain is verified and one SSO login worked
}

SchemaAnkerlink kopieren

PflichtfelderAnkerlink kopieren

• client_id (String)
• domain (String) Lowercase email domain of the users who sign in with SSO, e.g. example.com. One organization per domain.
• issuer (String) Issuer URL, https://, without trailing slash (the discovery document's issuer must match).

OptionalAnkerlink kopieren

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

• client_secret_wo (String, Sensitive, Write-only) Write-only client secret; required for the first save. Sent with create and whenever client_secret_wo_version changes; never stored in state. Removing it keeps the stored secret.
• client_secret_wo_version (Number) Change to resend client_secret_wo.
• default_role (String) Role of users created by their first SSO login: readonly, editor, responder or admin. Defaults to readonly.
• enforce_sso (Boolean) Only SSO (no password login) for users of domain. Needs a verified domain and one completed SSO login (can_enforce), else the apply fails with 409 ssoEnforceNotAllowed. Defaults to false.

Nur lesbarAnkerlink kopieren

• can_enforce (Boolean) Whether enforce_sso may be switched on: domain verified and one SSO login done.
• domain_verified (Boolean) Whether the TXT record was verified (see uptimeify_sso_domain_verification).
• id (String) Always sso.
• redirect_uri (String) Redirect (callback) URI to register at the identity provider.
• scopes (List of String) Scopes Uptimeify requests at login (fixed: openid, email, profile).
• verification_record (Attributes) DNS TXT record that proves control of domain; publish it with your DNS provider. (siehe verschachteltes Schema)

Verschachteltes Schema für verification_recordAnkerlink kopieren

Read-Only:

• name (String) Name of the TXT record, _uptimeify-sso.<domain>.
• value (String) Value of the TXT record.

ImportAnkerlink kopieren

Import geht so:

Mit tofu import bzw. terraform import, zum Beispiel:

# Always the id sso (one SSO configuration per organization)
terraform import uptimeify_sso_oidc.corp sso