Skip to content

OidcIdentityProviderConfigRequest

Used by
Source code in docs_src/capo_eks/types/oidc_identity_provider_config_request.py 
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
class OidcIdentityProviderConfigRequest(TypedDict, closed=True):
    identity_provider_config_name: "capo_eks.types.string.String"
    """<p>The name of the OIDC provider configuration.</p>"""
    issuer_url: "capo_eks.types.string.String"
    """<p>The URL of the OIDC identity provider that allows the API server to discover public signing keys for verifying tokens. The URL must begin with <code>https://</code> and should correspond to the <code>iss</code> claim in the provider's OIDC ID tokens. Based on the OIDC standard, path components are allowed but query parameters are not. Typically the URL consists of only a hostname, like <code>https://server.example.org</code> or <code>https://example.com</code>. This URL should point to the level below <code>.well-known/openid-configuration</code> and must be publicly accessible over the internet.</p>"""
    client_id: "capo_eks.types.string.String"
    """<p>This is also known as <i>audience</i>. The ID for the client application that makes authentication requests to the OIDC identity provider.</p>"""
    username_claim: NotRequired["capo_eks.types.string.String"]
    """<p>The JSON Web Token (JWT) claim to use as the username. The default is <code>sub</code>, which is expected to be a unique identifier of the end user. You can choose other claims, such as <code>email</code> or <code>name</code>, depending on the OIDC identity provider. Claims other than <code>email</code> are prefixed with the issuer URL to prevent naming clashes with other plug-ins.</p>"""
    username_prefix: NotRequired["capo_eks.types.string.String"]
    """<p>The prefix that is prepended to username claims to prevent clashes with existing names. If you do not provide this field, and <code>username</code> is a value other than <code>email</code>, the prefix defaults to <code>issuerurl#</code>. You can use the value <code>-</code> to disable all prefixing.</p>"""
    groups_claim: NotRequired["capo_eks.types.string.String"]
    """<p>The JWT claim that the provider uses to return your groups.</p>"""
    groups_prefix: NotRequired["capo_eks.types.string.String"]
    """<p>The prefix that is prepended to group claims to prevent clashes with existing names (such as <code>system:</code> groups). For example, the value<code> oidc:</code> will create group names like <code>oidc:engineering</code> and <code>oidc:infra</code>.</p>"""
    required_claims: NotRequired["capo_eks.types.required_claims_map.requiredClaimsMap"]
    """<p>The key value pairs that describe required claims in the identity token. If set, each claim is verified to be present in the token with a matching value. For the maximum number of claims that you can require, see <a href="https://docs.aws.amazon.com/eks/latest/userguide/service-quotas.html">Amazon EKS service quotas</a> in the <i>Amazon EKS User Guide</i>.</p>"""

client_id instance-attribute 

client_id: String

This is also known as audience. The ID for the client application that makes authentication requests to the OIDC identity provider.

groups_claim instance-attribute 

groups_claim: NotRequired[String]

The JWT claim that the provider uses to return your groups.

groups_prefix instance-attribute 

groups_prefix: NotRequired[String]

The prefix that is prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.

identity_provider_config_name instance-attribute 

identity_provider_config_name: String

The name of the OIDC provider configuration.

issuer_url instance-attribute 

issuer_url: String

The URL of the OIDC identity provider that allows the API server to discover public signing keys for verifying tokens. The URL must begin with https:// and should correspond to the iss claim in the provider's OIDC ID tokens. Based on the OIDC standard, path components are allowed but query parameters are not. Typically the URL consists of only a hostname, like https://server.example.org or https://example.com. This URL should point to the level below .well-known/openid-configuration and must be publicly accessible over the internet.

required_claims instance-attribute 

required_claims: NotRequired[requiredClaimsMap]

The key value pairs that describe required claims in the identity token. If set, each claim is verified to be present in the token with a matching value. For the maximum number of claims that you can require, see Amazon EKS service quotas in the Amazon EKS User Guide.

username_claim instance-attribute 

username_claim: NotRequired[String]

The JSON Web Token (JWT) claim to use as the username. The default is sub, which is expected to be a unique identifier of the end user. You can choose other claims, such as email or name, depending on the OIDC identity provider. Claims other than email are prefixed with the issuer URL to prevent naming clashes with other plug-ins.

username_prefix instance-attribute 

username_prefix: NotRequired[String]

The prefix that is prepended to username claims to prevent clashes with existing names. If you do not provide this field, and username is a value other than email, the prefix defaults to issuerurl#. You can use the value - to disable all prefixing.