WorkforcePoolProviderScimTenant class

Represents a SCIM tenant configuration for a Workforce Pool Provider. The SCIM tenant configuration allows for the synchronization of user/group identities from external identity provider into Google Cloud using the System for Cross-domain Identity Management (SCIM) protocol.

To get more information about WorkforcePoolProviderScimTenant, see:

• API documentation
• How-to Guides
• Configure a SCIM Tenant

Example Usage

Iam Workforce Pool Provider Scim Tenant Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const pool = new gcp.iam.WorkforcePool("pool", {
    workforcePoolId: "example-pool",
    parent: "organizations/123456789",
    location: "global",
});
const provider = new gcp.iam.WorkforcePoolProvider("provider", {
    location: "global",
    workforcePoolId: pool.workforcePoolId,
    providerId: "example-prvdr",
    attributeMapping: {
        "google.subject": "assertion.sub",
    },
    oidc: {
        issuerUri: "https://accounts.thirdparty.com",
        clientId: "client-id",
        clientSecret: {
            value: {
                plainText: "client-secret",
            },
        },
        webSsoConfig: {
            responseType: "CODE",
            assertionClaimsBehavior: "MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS",
            additionalScopes: [
                "groups",
                "roles",
            ],
        },
    },
    displayName: "Display name",
    description: "A sample OIDC workforce pool provider.",
    disabled: false,
    attributeCondition: "true",
});
const example = new gcp.iam.WorkforcePoolProviderScimTenant("example", {
    location: "global",
    workforcePoolId: pool.workforcePoolId,
    providerId: provider.providerId,
    scimTenantId: "example-scim-tenant",
    displayName: "Example SCIM Tenant",
    description: "A basic SCIM tenant for IAM Workforce Pool Provider",
    claimMapping: {
        "google.subject": "user.externalId",
        "google.group": "group.externalId",
    },
    hardDelete: true,
});

import pulumi
import pulumi_gcp as gcp

pool = gcp.iam.WorkforcePool("pool",
    workforce_pool_id="example-pool",
    parent="organizations/123456789",
    location="global")
provider = gcp.iam.WorkforcePoolProvider("provider",
    location="global",
    workforce_pool_id=pool.workforce_pool_id,
    provider_id="example-prvdr",
    attribute_mapping={
        "google.subject": "assertion.sub",
    },
    oidc={
        "issuer_uri": "https://accounts.thirdparty.com",
        "client_id": "client-id",
        "client_secret": {
            "value": {
                "plain_text": "client-secret",
            },
        },
        "web_sso_config": {
            "response_type": "CODE",
            "assertion_claims_behavior": "MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS",
            "additional_scopes": [
                "groups",
                "roles",
            ],
        },
    },
    display_name="Display name",
    description="A sample OIDC workforce pool provider.",
    disabled=False,
    attribute_condition="true")
example = gcp.iam.WorkforcePoolProviderScimTenant("example",
    location="global",
    workforce_pool_id=pool.workforce_pool_id,
    provider_id=provider.provider_id,
    scim_tenant_id="example-scim-tenant",
    display_name="Example SCIM Tenant",
    description="A basic SCIM tenant for IAM Workforce Pool Provider",
    claim_mapping={
        "google.subject": "user.externalId",
        "google.group": "group.externalId",
    },
    hard_delete=True)

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var pool = new Gcp.Iam.WorkforcePool("pool", new()
    {
        WorkforcePoolId = "example-pool",
        Parent = "organizations/123456789",
        Location = "global",
    });

    var provider = new Gcp.Iam.WorkforcePoolProvider("provider", new()
    {
        Location = "global",
        WorkforcePoolId = pool.WorkforcePoolId,
        ProviderId = "example-prvdr",
        AttributeMapping =
        {
            { "google.subject", "assertion.sub" },
        },
        Oidc = new Gcp.Iam.Inputs.WorkforcePoolProviderOidcArgs
        {
            IssuerUri = "https://accounts.thirdparty.com",
            ClientId = "client-id",
            ClientSecret = new Gcp.Iam.Inputs.WorkforcePoolProviderOidcClientSecretArgs
            {
                Value = new Gcp.Iam.Inputs.WorkforcePoolProviderOidcClientSecretValueArgs
                {
                    PlainText = "client-secret",
                },
            },
            WebSsoConfig = new Gcp.Iam.Inputs.WorkforcePoolProviderOidcWebSsoConfigArgs
            {
                ResponseType = "CODE",
                AssertionClaimsBehavior = "MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS",
                AdditionalScopes = new[]
                {
                    "groups",
                    "roles",
                },
            },
        },
        DisplayName = "Display name",
        Description = "A sample OIDC workforce pool provider.",
        Disabled = false,
        AttributeCondition = "true",
    });

    var example = new Gcp.Iam.WorkforcePoolProviderScimTenant("example", new()
    {
        Location = "global",
        WorkforcePoolId = pool.WorkforcePoolId,
        ProviderId = provider.ProviderId,
        ScimTenantId = "example-scim-tenant",
        DisplayName = "Example SCIM Tenant",
        Description = "A basic SCIM tenant for IAM Workforce Pool Provider",
        ClaimMapping =
        {
            { "google.subject", "user.externalId" },
            { "google.group", "group.externalId" },
        },
        HardDelete = true,
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iam"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pool, err := iam.NewWorkforcePool(ctx, "pool", &iam.WorkforcePoolArgs{
			WorkforcePoolId: pulumi.String("example-pool"),
			Parent:          pulumi.String("organizations/123456789"),
			Location:        pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		provider, err := iam.NewWorkforcePoolProvider(ctx, "provider", &iam.WorkforcePoolProviderArgs{
			Location:        pulumi.String("global"),
			WorkforcePoolId: pool.WorkforcePoolId,
			ProviderId:      pulumi.String("example-prvdr"),
			AttributeMapping: pulumi.StringMap{
				"google.subject": pulumi.String("assertion.sub"),
			},
			Oidc: &iam.WorkforcePoolProviderOidcArgs{
				IssuerUri: pulumi.String("https://accounts.thirdparty.com"),
				ClientId:  pulumi.String("client-id"),
				ClientSecret: &iam.WorkforcePoolProviderOidcClientSecretArgs{
					Value: &iam.WorkforcePoolProviderOidcClientSecretValueArgs{
						PlainText: pulumi.String("client-secret"),
					},
				},
				WebSsoConfig: &iam.WorkforcePoolProviderOidcWebSsoConfigArgs{
					ResponseType:            pulumi.String("CODE"),
					AssertionClaimsBehavior: pulumi.String("MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS"),
					AdditionalScopes: pulumi.StringArray{
						pulumi.String("groups"),
						pulumi.String("roles"),
					},
				},
			},
			DisplayName:        pulumi.String("Display name"),
			Description:        pulumi.String("A sample OIDC workforce pool provider."),
			Disabled:           pulumi.Bool(false),
			AttributeCondition: pulumi.String("true"),
		})
		if err != nil {
			return err
		}
		_, err = iam.NewWorkforcePoolProviderScimTenant(ctx, "example", &iam.WorkforcePoolProviderScimTenantArgs{
			Location:        pulumi.String("global"),
			WorkforcePoolId: pool.WorkforcePoolId,
			ProviderId:      provider.ProviderId,
			ScimTenantId:    pulumi.String("example-scim-tenant"),
			DisplayName:     pulumi.String("Example SCIM Tenant"),
			Description:     pulumi.String("A basic SCIM tenant for IAM Workforce Pool Provider"),
			ClaimMapping: pulumi.StringMap{
				"google.subject": pulumi.String("user.externalId"),
				"google.group":   pulumi.String("group.externalId"),
			},
			HardDelete: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_iam_workforcepool" "pool" {
  workforce_pool_id = "example-pool"
  parent            = "organizations/123456789"
  location          = "global"
}
resource "gcp_iam_workforcepoolprovider" "provider" {
  location          = "global"
  workforce_pool_id = gcp_iam_workforcepool.pool.workforce_pool_id
  provider_id       = "example-prvdr"
  attribute_mapping = {
    "google.subject" = "assertion.sub"
  }
  oidc = {
    issuer_uri = "https://accounts.thirdparty.com"
    client_id  = "client-id"
    client_secret = {
      value = {
        plain_text = "client-secret"
      }
    }
    web_sso_config = {
      response_type             = "CODE"
      assertion_claims_behavior = "MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS"
      additional_scopes         = ["groups", "roles"]
    }
  }
  display_name        = "Display name"
  description         = "A sample OIDC workforce pool provider."
  disabled            = false
  attribute_condition = "true"
}
resource "gcp_iam_workforcepoolproviderscimtenant" "example" {
  location          = "global"
  workforce_pool_id = gcp_iam_workforcepool.pool.workforce_pool_id
  provider_id       = gcp_iam_workforcepoolprovider.provider.provider_id
  scim_tenant_id    = "example-scim-tenant"
  display_name      = "Example SCIM Tenant"
  description       = "A basic SCIM tenant for IAM Workforce Pool Provider"
  claim_mapping = {
    "google.subject" = "user.externalId"
    "google.group"   = "group.externalId"
  }
  hard_delete = true
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkforcePool;
import com.pulumi.gcp.iam.WorkforcePoolArgs;
import com.pulumi.gcp.iam.WorkforcePoolProvider;
import com.pulumi.gcp.iam.WorkforcePoolProviderArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcClientSecretArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcClientSecretValueArgs;
import com.pulumi.gcp.iam.inputs.WorkforcePoolProviderOidcWebSsoConfigArgs;
import com.pulumi.gcp.iam.WorkforcePoolProviderScimTenant;
import com.pulumi.gcp.iam.WorkforcePoolProviderScimTenantArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pool = new WorkforcePool("pool", WorkforcePoolArgs.builder()
            .workforcePoolId("example-pool")
            .parent("organizations/123456789")
            .location("global")
            .build());

        var provider = new WorkforcePoolProvider("provider", WorkforcePoolProviderArgs.builder()
            .location("global")
            .workforcePoolId(pool.workforcePoolId())
            .providerId("example-prvdr")
            .attributeMapping(Map.of("google.subject", "assertion.sub"))
            .oidc(WorkforcePoolProviderOidcArgs.builder()
                .issuerUri("https://accounts.thirdparty.com")
                .clientId("client-id")
                .clientSecret(WorkforcePoolProviderOidcClientSecretArgs.builder()
                    .value(WorkforcePoolProviderOidcClientSecretValueArgs.builder()
                        .plainText("client-secret")
                        .build())
                    .build())
                .webSsoConfig(WorkforcePoolProviderOidcWebSsoConfigArgs.builder()
                    .responseType("CODE")
                    .assertionClaimsBehavior("MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS")
                    .additionalScopes(
                        "groups",
                        "roles")
                    .build())
                .build())
            .displayName("Display name")
            .description("A sample OIDC workforce pool provider.")
            .disabled(false)
            .attributeCondition("true")
            .build());

        var example = new WorkforcePoolProviderScimTenant("example", WorkforcePoolProviderScimTenantArgs.builder()
            .location("global")
            .workforcePoolId(pool.workforcePoolId())
            .providerId(provider.providerId())
            .scimTenantId("example-scim-tenant")
            .displayName("Example SCIM Tenant")
            .description("A basic SCIM tenant for IAM Workforce Pool Provider")
            .claimMapping(Map.ofEntries(
                Map.entry("google.subject", "user.externalId"),
                Map.entry("google.group", "group.externalId")
            ))
            .hardDelete(true)
            .build());

    }
}

resources:
  pool:
    type: gcp:iam:WorkforcePool
    properties:
      workforcePoolId: example-pool
      parent: organizations/123456789
      location: global
  provider:
    type: gcp:iam:WorkforcePoolProvider
    properties:
      location: global
      workforcePoolId: ${pool.workforcePoolId}
      providerId: example-prvdr
      attributeMapping:
        google.subject: assertion.sub
      oidc:
        issuerUri: https://accounts.thirdparty.com
        clientId: client-id
        clientSecret:
          value:
            plainText: client-secret
        webSsoConfig:
          responseType: CODE
          assertionClaimsBehavior: MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS
          additionalScopes:
            - groups
            - roles
      displayName: Display name
      description: A sample OIDC workforce pool provider.
      disabled: false
      attributeCondition: 'true'
  example:
    type: gcp:iam:WorkforcePoolProviderScimTenant
    properties:
      location: global
      workforcePoolId: ${pool.workforcePoolId}
      providerId: ${provider.providerId}
      scimTenantId: example-scim-tenant
      displayName: Example SCIM Tenant
      description: A basic SCIM tenant for IAM Workforce Pool Provider
      claimMapping:
        google.subject: user.externalId
        google.group: group.externalId
      hardDelete: true # state, base_uri, purge_time and service_agent are output only, not settable

Import

WorkforcePoolProviderScimTenant can be imported using any of these accepted formats:

• locations/{{location}}/workforcePools/{{workforce_pool_id}}/providers/{{provider_id}}/scimTenants/{{scim_tenant_id}}
• {{location}}/{{workforce_pool_id}}/{{provider_id}}/{{scim_tenant_id}}

When using the pulumi import command, WorkforcePoolProviderScimTenant can be imported using one of the formats above. For example:

$ pulumi import gcp:iam/workforcePoolProviderScimTenant:WorkforcePoolProviderScimTenant default locations/{{location}}/workforcePools/{{workforce_pool_id}}/providers/{{provider_id}}/scimTenants/{{scim_tenant_id}}
$ pulumi import gcp:iam/workforcePoolProviderScimTenant:WorkforcePoolProviderScimTenant default {{location}}/{{workforce_pool_id}}/{{provider_id}}/{{scim_tenant_id}}

Constructors

WorkforcePoolProviderScimTenant(String name, {WorkforcePoolProviderScimTenantArgs? args, CustomResourceOptions? options})

Creates a new WorkforcePoolProviderScimTenant. name The Pulumi resource name. args Arguments used to configure this WorkforcePoolProviderScimTenant. The set of arguments for WorkforcePoolProviderScimTenant. options Resource options controlling this resource's behavior.

WorkforcePoolProviderScimTenant.reference(String urn)

Creates a typed reference to an existing WorkforcePoolProviderScimTenant resource.

Properties

baseUri ↔ Output<String>

Represents the base URI as defined in RFC 7644, Section 1.3. Clients must use this as the root address for managing resources under the tenant. Format: https://iamscim.googleapis.com/{version}/{tenant_id}/

late, final

childResources → Set<Resource>

final, inherited

claimMapping ↔ Output<Map<String, String>?>

Maps BYOID claims to SCIM claims. This is a required field for new SCIM Tenants being created.

late, final

completionSources ↔ Map<String, IOutputCompletionSource>

late, final, inherited

deletionPolicy ↔ Output<String>

Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.

late, final

description ↔ Output<String?>

A user-specified description of the provider. Cannot exceed 256 characters.

late, final

displayName ↔ Output<String?>

A user-specified display name for the scim tenant. Cannot exceed 32 characters.

late, final

hardDelete ↔ Output<bool?>

Deletes the SCIM tenant immediately. This operation cannot be undone.

late, final

hashCode → int

The hash code for this object.

no setter, inherited

id ↔ Output<String>

getter/setter pair, inherited

isCustom → bool

Returns whether this resource is provider-managed.

no setter, inherited

isProtected → bool

Returns whether this resource is protected from deletion.

no setter, inherited

isRemote → bool

Whether this resource is registered as remote.

no setter, inherited

isResourceReference → bool

Whether this instance represents a resource value returned over RPC.

final, inherited

location ↔ Output<String>

The location for the resource.

late, final

name ↔ Output<String>

Identifier. The resource name of the scim tenant. Format: `locations/{location}/workforcePools/{workforce_pool}/providers/{workforce_pool_provider}/scimTenants/{scim_tenant_id}

late, final

providerId ↔ Output<String>

The ID of the provider.

late, final

purgeTime ↔ Output<String>

The timestamp that represents the time when the SCIM tenant is purged.

late, final

resourceTransforms → List<ResourceTransform>

Inherited/explicit async transforms.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

scimTenantId ↔ Output<String>

The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters a-z0-9-.

late, final

serviceAgent ↔ Output<String>

Service Agent created by SCIM Tenant API. SCIM tokens created under this tenant will be attached to this service agent.

late, final

state ↔ Output<String>

The current state of the scim tenant.

late, final

transformations → List<ResourceTransformation>

Inherited/explicit legacy transformations.

no setter, inherited

urn ↔ Output<String>

late, final, inherited

workforcePoolId ↔ Output<String>

The ID of the workforce pool.

late, final

Methods

failId(Object error) → void

Completes this resource ID with an error when registration fails.

inherited

failOutputs(Object error) → void

Completes all output properties with error.

inherited

failUrn(Object error) → void

Completes this resource URN with an error when registration fails.

inherited

getProvider(String moduleMember) → ProviderResource?

Returns provider for moduleMember's package, if configured.

inherited

getResourceName() → String

Returns this resource's logical name.

inherited

getResourceType() → String

Returns this resource's Pulumi type token.

inherited

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

registerOutput<T>(String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output<T>

Registers a dynamic output property for this resource.

inherited

resolveId(String? value, {required bool isKnown}) → void

Resolves the provider-assigned ID for this resource.

inherited

resolveOutputs(Struct outputs) → void

Resolves all output properties from a monitor response payload.

inherited

resolveUrn(String value) → void

Resolves this resource's URN once assigned by the engine.

inherited

serializeProperties(Map<String, dynamic> properties) → Future<Struct>

Serializes resource properties for RPC transmission.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

get(String name, Input<String> id, {WorkforcePoolProviderScimTenantState? state, CustomResourceOptions? options}) → WorkforcePoolProviderScimTenant

Gets an existing WorkforcePoolProviderScimTenant resource's state with the given name and id.