platform 2.2.1, Mar 7 25

platform 2.2.1 published on Friday, Mar 7, 2025 by jfrog

platform.OidcIdentityMapping

Explore with Pulumi AI

platform 2.2.1 published on Friday, Mar 7, 2025 by jfrog

Example Usage

Coming soon!

Coming soon!

Coming soon!

Coming soon!

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.platform.OidcIdentityMapping;
import com.pulumi.platform.OidcIdentityMappingArgs;
import com.pulumi.platform.inputs.OidcIdentityMappingTokenSpecArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var my_github_oidc_user_identity_mapping = new OidcIdentityMapping("my-github-oidc-user-identity-mapping", OidcIdentityMappingArgs.builder()
            .description("My GitHub OIDC user identity mapping")
            .providerName("my-github-oidc-configuration")
            .priority(1)
            .claimsJson(serializeJson(
                jsonObject(
                    jsonProperty("sub", "repo:humpty/access-oidc-poc:ref:refs/heads/main"),
                    jsonProperty("workflow_ref", "humpty/access-oidc-poc/.github/workflows/job.yaml@refs/heads/main")
                )))
            .tokenSpec(OidcIdentityMappingTokenSpecArgs.builder()
                .username("my-user")
                .scope("applied-permissions/user")
                .audience("*@*")
                .expires_in(7200)
                .build())
            .build());

        var my_github_oidc_group_identity_mapping = new OidcIdentityMapping("my-github-oidc-group-identity-mapping", OidcIdentityMappingArgs.builder()
            .description("My GitHub OIDC group identity mapping")
            .providerName("my-github-oidc-configuration")
            .priority(1)
            .claimsJson(serializeJson(
                jsonObject(
                    jsonProperty("sub", "repo:humpty/access-oidc-poc:ref:refs/heads/main"),
                    jsonProperty("workflow_ref", "humpty/access-oidc-poc/.github/workflows/job.yaml@refs/heads/main")
                )))
            .tokenSpec(OidcIdentityMappingTokenSpecArgs.builder()
                .scope("applied-permissions/groups:\"readers\",\"my-group\"")
                .audience("jfrt@* jfac@* jfmc@* jfmd@* jfevt@* jfxfer@* jflnk@* jfint@* jfwks@*")
                .expires_in(7200)
                .build())
            .build());

        var my_github_oidc_project_roles_identity_mapping = new OidcIdentityMapping("my-github-oidc-project-roles-identity-mapping", OidcIdentityMappingArgs.builder()
            .description("My GitHub OIDC Project role identity mapping")
            .providerName("my-github-oidc-configuration")
            .priority(1)
            .claimsJson(serializeJson(
                jsonObject(
                    jsonProperty("sub", "repo:humpty/access-oidc-poc:ref:refs/heads/main"),
                    jsonProperty("workflow_ref", "humpty/access-oidc-poc/.github/workflows/job.yaml@refs/heads/main")
                )))
            .tokenSpec(OidcIdentityMappingTokenSpecArgs.builder()
                .scope("applied-permissions/roles:my-project:\"Project Admin\",\"Developer\"")
                .audience("jfrt@* jfac@* jfmc@* jfmd@* jfevt@* jfxfer@* jflnk@* jfint@* jfwks@*")
                .expires_in(7200)
                .build())
            .projectKey("my-project")
            .build());

        var my_github_oidc_username_pattern_identity_mapping = new OidcIdentityMapping("my-github-oidc-username-pattern-identity-mapping", OidcIdentityMappingArgs.builder()
            .description("My GitHub OIDC username pattern identity mapping")
            .providerName("my-github-oidc-configuration")
            .priority(1)
            .claimsJson(serializeJson(
                jsonObject(
                    jsonProperty("sub", "repo:humpty/access-oidc-poc:ref:refs/heads/main"),
                    jsonProperty("workflow_ref", "humpty/access-oidc-poc/.github/workflows/job.yaml@refs/heads/main")
                )))
            .tokenSpec(OidcIdentityMappingTokenSpecArgs.builder()
                .username_pattern("{{user}}")
                .audience("*@*")
                .expires_in(7200)
                .build())
            .build());

        var my_github_oidc_groups_pattern_identity_mapping = new OidcIdentityMapping("my-github-oidc-groups-pattern-identity-mapping", OidcIdentityMappingArgs.builder()
            .description("My GitHub OIDC groups pattern identity mapping")
            .providerName("my-github-oidc-configuration")
            .priority(1)
            .claimsJson(serializeJson(
                jsonObject(
                    jsonProperty("sub", "repo:humpty/access-oidc-poc:ref:refs/heads/main"),
                    jsonProperty("workflow_ref", "humpty/access-oidc-poc/.github/workflows/job.yaml@refs/heads/main")
                )))
            .tokenSpec(OidcIdentityMappingTokenSpecArgs.builder()
                .groups_pattern("{{group}}")
                .audience("*@*")
                .expires_in(7200)
                .build())
            .build());

    }
}

resources:
  my-github-oidc-user-identity-mapping:
    type: platform:OidcIdentityMapping
    properties:
      description: My GitHub OIDC user identity mapping
      providerName: my-github-oidc-configuration
      priority: 1
      claimsJson:
        fn::toJSON:
          sub: repo:humpty/access-oidc-poc:ref:refs/heads/main
          workflow_ref: humpty/access-oidc-poc/.github/workflows/job.yaml@refs/heads/main
      tokenSpec:
        username: my-user
        scope: applied-permissions/user
        audience: '*@*'
        expires_in: 7200
  my-github-oidc-group-identity-mapping:
    type: platform:OidcIdentityMapping
    properties:
      description: My GitHub OIDC group identity mapping
      providerName: my-github-oidc-configuration
      priority: 1
      claimsJson:
        fn::toJSON:
          sub: repo:humpty/access-oidc-poc:ref:refs/heads/main
          workflow_ref: humpty/access-oidc-poc/.github/workflows/job.yaml@refs/heads/main
      tokenSpec:
        scope: applied-permissions/groups:"readers","my-group"
        audience: jfrt@* jfac@* jfmc@* jfmd@* jfevt@* jfxfer@* jflnk@* jfint@* jfwks@*
        expires_in: 7200
  my-github-oidc-project-roles-identity-mapping:
    type: platform:OidcIdentityMapping
    properties:
      description: My GitHub OIDC Project role identity mapping
      providerName: my-github-oidc-configuration
      priority: 1
      claimsJson:
        fn::toJSON:
          sub: repo:humpty/access-oidc-poc:ref:refs/heads/main
          workflow_ref: humpty/access-oidc-poc/.github/workflows/job.yaml@refs/heads/main
      tokenSpec:
        scope: applied-permissions/roles:my-project:"Project Admin","Developer"
        audience: jfrt@* jfac@* jfmc@* jfmd@* jfevt@* jfxfer@* jflnk@* jfint@* jfwks@*
        expires_in: 7200
      projectKey: my-project
  my-github-oidc-username-pattern-identity-mapping:
    type: platform:OidcIdentityMapping
    properties:
      description: My GitHub OIDC username pattern identity mapping
      providerName: my-github-oidc-configuration
      priority: 1
      claimsJson:
        fn::toJSON:
          sub: repo:humpty/access-oidc-poc:ref:refs/heads/main
          workflow_ref: humpty/access-oidc-poc/.github/workflows/job.yaml@refs/heads/main
      tokenSpec:
        username_pattern: '{{user}}'
        audience: '*@*'
        expires_in: 7200
  my-github-oidc-groups-pattern-identity-mapping:
    type: platform:OidcIdentityMapping
    properties:
      description: My GitHub OIDC groups pattern identity mapping
      providerName: my-github-oidc-configuration
      priority: 1
      claimsJson:
        fn::toJSON:
          sub: repo:humpty/access-oidc-poc:ref:refs/heads/main
          workflow_ref: humpty/access-oidc-poc/.github/workflows/job.yaml@refs/heads/main
      tokenSpec:
        groups_pattern: '{{group}}'
        audience: '*@*'
        expires_in: 7200

Create OidcIdentityMapping Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new OidcIdentityMapping(name: string, args: OidcIdentityMappingArgs, opts?: CustomResourceOptions);

@overload
def OidcIdentityMapping(resource_name: str,
                        args: OidcIdentityMappingArgs,
                        opts: Optional[ResourceOptions] = None)

@overload
def OidcIdentityMapping(resource_name: str,
                        opts: Optional[ResourceOptions] = None,
                        claims_json: Optional[str] = None,
                        priority: Optional[float] = None,
                        provider_name: Optional[str] = None,
                        token_spec: Optional[OidcIdentityMappingTokenSpecArgs] = None,
                        description: Optional[str] = None,
                        name: Optional[str] = None,
                        project_key: Optional[str] = None)

func NewOidcIdentityMapping(ctx *Context, name string, args OidcIdentityMappingArgs, opts ...ResourceOption) (*OidcIdentityMapping, error)

public OidcIdentityMapping(string name, OidcIdentityMappingArgs args, CustomResourceOptions? opts = null)

public OidcIdentityMapping(String name, OidcIdentityMappingArgs args)
public OidcIdentityMapping(String name, OidcIdentityMappingArgs args, CustomResourceOptions options)

type: platform:OidcIdentityMapping
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args OidcIdentityMappingArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args OidcIdentityMappingArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args OidcIdentityMappingArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args OidcIdentityMappingArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args OidcIdentityMappingArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var oidcIdentityMappingResource = new Platform.OidcIdentityMapping("oidcIdentityMappingResource", new()
{
    ClaimsJson = "string",
    Priority = 0,
    ProviderName = "string",
    TokenSpec = new Platform.Inputs.OidcIdentityMappingTokenSpecArgs
    {
        Audience = "string",
        ExpiresIn = 0,
        GroupsPattern = "string",
        Scope = "string",
        Username = "string",
        UsernamePattern = "string",
    },
    Description = "string",
    Name = "string",
    ProjectKey = "string",
});

example, err := platform.NewOidcIdentityMapping(ctx, "oidcIdentityMappingResource", &platform.OidcIdentityMappingArgs{
ClaimsJson: pulumi.String("string"),
Priority: pulumi.Float64(0),
ProviderName: pulumi.String("string"),
TokenSpec: &.OidcIdentityMappingTokenSpecArgs{
Audience: pulumi.String("string"),
ExpiresIn: pulumi.Float64(0),
GroupsPattern: pulumi.String("string"),
Scope: pulumi.String("string"),
Username: pulumi.String("string"),
UsernamePattern: pulumi.String("string"),
},
Description: pulumi.String("string"),
Name: pulumi.String("string"),
ProjectKey: pulumi.String("string"),
})

var oidcIdentityMappingResource = new OidcIdentityMapping("oidcIdentityMappingResource", OidcIdentityMappingArgs.builder()
    .claimsJson("string")
    .priority(0)
    .providerName("string")
    .tokenSpec(OidcIdentityMappingTokenSpecArgs.builder()
        .audience("string")
        .expiresIn(0)
        .groupsPattern("string")
        .scope("string")
        .username("string")
        .usernamePattern("string")
        .build())
    .description("string")
    .name("string")
    .projectKey("string")
    .build());

oidc_identity_mapping_resource = platform.OidcIdentityMapping("oidcIdentityMappingResource",
    claims_json="string",
    priority=0,
    provider_name="string",
    token_spec={
        "audience": "string",
        "expires_in": 0,
        "groups_pattern": "string",
        "scope": "string",
        "username": "string",
        "username_pattern": "string",
    },
    description="string",
    name="string",
    project_key="string")

const oidcIdentityMappingResource = new platform.OidcIdentityMapping("oidcIdentityMappingResource", {
    claimsJson: "string",
    priority: 0,
    providerName: "string",
    tokenSpec: {
        audience: "string",
        expiresIn: 0,
        groupsPattern: "string",
        scope: "string",
        username: "string",
        usernamePattern: "string",
    },
    description: "string",
    name: "string",
    projectKey: "string",
});

type: platform:OidcIdentityMapping
properties:
    claimsJson: string
    description: string
    name: string
    priority: 0
    projectKey: string
    providerName: string
    tokenSpec:
        audience: string
        expiresIn: 0
        groupsPattern: string
        scope: string
        username: string
        usernamePattern: string

OidcIdentityMapping Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The OidcIdentityMapping resource accepts the following input properties:

ClaimsJson string
Priority double: Priority of the identity mapping. The priority should be a number. The higher priority is set for the lower number. If you do not enter a value, the identity mapping is assigned the lowest priority. We recommend that you assign the highest priority (1) to the strongest permission gate. Set the lowest priority to the weakest permission for a logical and effective access control setup.
ProviderName string: Name of the OIDC configuration
TokenSpec OidcIdentityMappingTokenSpec: Specifications of the token. In case of success, a token with the following details will be generated and passed to OIDC Provider.
Description string: Description of the OIDC mapping
Name string: Name of the OIDC identity mapping
ProjectKey string: If set, this Identity Mapping will be available in the scope of the given project (editable by platform admin and project admin). If not set, this Identity Mapping will be global and only editable by platform admin. Once set, the projectKey cannot be changed.

ClaimsJson string
Priority float64: Priority of the identity mapping. The priority should be a number. The higher priority is set for the lower number. If you do not enter a value, the identity mapping is assigned the lowest priority. We recommend that you assign the highest priority (1) to the strongest permission gate. Set the lowest priority to the weakest permission for a logical and effective access control setup.
ProviderName string: Name of the OIDC configuration
TokenSpec OidcIdentityMappingTokenSpecArgs: Specifications of the token. In case of success, a token with the following details will be generated and passed to OIDC Provider.
Description string: Description of the OIDC mapping
Name string: Name of the OIDC identity mapping
ProjectKey string: If set, this Identity Mapping will be available in the scope of the given project (editable by platform admin and project admin). If not set, this Identity Mapping will be global and only editable by platform admin. Once set, the projectKey cannot be changed.

claimsJson String
priority Double: Priority of the identity mapping. The priority should be a number. The higher priority is set for the lower number. If you do not enter a value, the identity mapping is assigned the lowest priority. We recommend that you assign the highest priority (1) to the strongest permission gate. Set the lowest priority to the weakest permission for a logical and effective access control setup.
providerName String: Name of the OIDC configuration
tokenSpec OidcIdentityMappingTokenSpec: Specifications of the token. In case of success, a token with the following details will be generated and passed to OIDC Provider.
description String: Description of the OIDC mapping
name String: Name of the OIDC identity mapping
projectKey String: If set, this Identity Mapping will be available in the scope of the given project (editable by platform admin and project admin). If not set, this Identity Mapping will be global and only editable by platform admin. Once set, the projectKey cannot be changed.

claimsJson string
priority number: Priority of the identity mapping. The priority should be a number. The higher priority is set for the lower number. If you do not enter a value, the identity mapping is assigned the lowest priority. We recommend that you assign the highest priority (1) to the strongest permission gate. Set the lowest priority to the weakest permission for a logical and effective access control setup.
providerName string: Name of the OIDC configuration
tokenSpec OidcIdentityMappingTokenSpec: Specifications of the token. In case of success, a token with the following details will be generated and passed to OIDC Provider.
description string: Description of the OIDC mapping
name string: Name of the OIDC identity mapping
projectKey string: If set, this Identity Mapping will be available in the scope of the given project (editable by platform admin and project admin). If not set, this Identity Mapping will be global and only editable by platform admin. Once set, the projectKey cannot be changed.

claims_json str
priority float: Priority of the identity mapping. The priority should be a number. The higher priority is set for the lower number. If you do not enter a value, the identity mapping is assigned the lowest priority. We recommend that you assign the highest priority (1) to the strongest permission gate. Set the lowest priority to the weakest permission for a logical and effective access control setup.
provider_name str: Name of the OIDC configuration
token_spec OidcIdentityMappingTokenSpecArgs: Specifications of the token. In case of success, a token with the following details will be generated and passed to OIDC Provider.
description str: Description of the OIDC mapping
name str: Name of the OIDC identity mapping
project_key str: If set, this Identity Mapping will be available in the scope of the given project (editable by platform admin and project admin). If not set, this Identity Mapping will be global and only editable by platform admin. Once set, the projectKey cannot be changed.

claimsJson String
priority Number: Priority of the identity mapping. The priority should be a number. The higher priority is set for the lower number. If you do not enter a value, the identity mapping is assigned the lowest priority. We recommend that you assign the highest priority (1) to the strongest permission gate. Set the lowest priority to the weakest permission for a logical and effective access control setup.
providerName String: Name of the OIDC configuration
tokenSpec Property Map: Specifications of the token. In case of success, a token with the following details will be generated and passed to OIDC Provider.
description String: Description of the OIDC mapping
name String: Name of the OIDC identity mapping
projectKey String: If set, this Identity Mapping will be available in the scope of the given project (editable by platform admin and project admin). If not set, this Identity Mapping will be global and only editable by platform admin. Once set, the projectKey cannot be changed.

Outputs

All input properties are implicitly available as output properties. Additionally, the OidcIdentityMapping resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

Look up Existing OidcIdentityMapping Resource

Get an existing OidcIdentityMapping resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: OidcIdentityMappingState, opts?: CustomResourceOptions): OidcIdentityMapping

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        claims_json: Optional[str] = None,
        description: Optional[str] = None,
        name: Optional[str] = None,
        priority: Optional[float] = None,
        project_key: Optional[str] = None,
        provider_name: Optional[str] = None,
        token_spec: Optional[OidcIdentityMappingTokenSpecArgs] = None) -> OidcIdentityMapping

func GetOidcIdentityMapping(ctx *Context, name string, id IDInput, state *OidcIdentityMappingState, opts ...ResourceOption) (*OidcIdentityMapping, error)

public static OidcIdentityMapping Get(string name, Input<string> id, OidcIdentityMappingState? state, CustomResourceOptions? opts = null)

public static OidcIdentityMapping get(String name, Output<String> id, OidcIdentityMappingState state, CustomResourceOptions options)

resources:  _:    type: platform:OidcIdentityMapping    get:      id: ${id}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

ClaimsJson string
Description string: Description of the OIDC mapping
Name string: Name of the OIDC identity mapping
Priority double: Priority of the identity mapping. The priority should be a number. The higher priority is set for the lower number. If you do not enter a value, the identity mapping is assigned the lowest priority. We recommend that you assign the highest priority (1) to the strongest permission gate. Set the lowest priority to the weakest permission for a logical and effective access control setup.
ProjectKey string: If set, this Identity Mapping will be available in the scope of the given project (editable by platform admin and project admin). If not set, this Identity Mapping will be global and only editable by platform admin. Once set, the projectKey cannot be changed.
ProviderName string: Name of the OIDC configuration
TokenSpec OidcIdentityMappingTokenSpec: Specifications of the token. In case of success, a token with the following details will be generated and passed to OIDC Provider.

ClaimsJson string
Description string: Description of the OIDC mapping
Name string: Name of the OIDC identity mapping
Priority float64: Priority of the identity mapping. The priority should be a number. The higher priority is set for the lower number. If you do not enter a value, the identity mapping is assigned the lowest priority. We recommend that you assign the highest priority (1) to the strongest permission gate. Set the lowest priority to the weakest permission for a logical and effective access control setup.
ProjectKey string: If set, this Identity Mapping will be available in the scope of the given project (editable by platform admin and project admin). If not set, this Identity Mapping will be global and only editable by platform admin. Once set, the projectKey cannot be changed.
ProviderName string: Name of the OIDC configuration
TokenSpec OidcIdentityMappingTokenSpecArgs: Specifications of the token. In case of success, a token with the following details will be generated and passed to OIDC Provider.

claimsJson String
description String: Description of the OIDC mapping
name String: Name of the OIDC identity mapping
priority Double: Priority of the identity mapping. The priority should be a number. The higher priority is set for the lower number. If you do not enter a value, the identity mapping is assigned the lowest priority. We recommend that you assign the highest priority (1) to the strongest permission gate. Set the lowest priority to the weakest permission for a logical and effective access control setup.
projectKey String: If set, this Identity Mapping will be available in the scope of the given project (editable by platform admin and project admin). If not set, this Identity Mapping will be global and only editable by platform admin. Once set, the projectKey cannot be changed.
providerName String: Name of the OIDC configuration
tokenSpec OidcIdentityMappingTokenSpec: Specifications of the token. In case of success, a token with the following details will be generated and passed to OIDC Provider.

claimsJson string
description string: Description of the OIDC mapping
name string: Name of the OIDC identity mapping
priority number: Priority of the identity mapping. The priority should be a number. The higher priority is set for the lower number. If you do not enter a value, the identity mapping is assigned the lowest priority. We recommend that you assign the highest priority (1) to the strongest permission gate. Set the lowest priority to the weakest permission for a logical and effective access control setup.
projectKey string: If set, this Identity Mapping will be available in the scope of the given project (editable by platform admin and project admin). If not set, this Identity Mapping will be global and only editable by platform admin. Once set, the projectKey cannot be changed.
providerName string: Name of the OIDC configuration
tokenSpec OidcIdentityMappingTokenSpec: Specifications of the token. In case of success, a token with the following details will be generated and passed to OIDC Provider.

claims_json str
description str: Description of the OIDC mapping
name str: Name of the OIDC identity mapping
priority float: Priority of the identity mapping. The priority should be a number. The higher priority is set for the lower number. If you do not enter a value, the identity mapping is assigned the lowest priority. We recommend that you assign the highest priority (1) to the strongest permission gate. Set the lowest priority to the weakest permission for a logical and effective access control setup.
project_key str: If set, this Identity Mapping will be available in the scope of the given project (editable by platform admin and project admin). If not set, this Identity Mapping will be global and only editable by platform admin. Once set, the projectKey cannot be changed.
provider_name str: Name of the OIDC configuration
token_spec OidcIdentityMappingTokenSpecArgs: Specifications of the token. In case of success, a token with the following details will be generated and passed to OIDC Provider.

claimsJson String
description String: Description of the OIDC mapping
name String: Name of the OIDC identity mapping
priority Number: Priority of the identity mapping. The priority should be a number. The higher priority is set for the lower number. If you do not enter a value, the identity mapping is assigned the lowest priority. We recommend that you assign the highest priority (1) to the strongest permission gate. Set the lowest priority to the weakest permission for a logical and effective access control setup.
projectKey String: If set, this Identity Mapping will be available in the scope of the given project (editable by platform admin and project admin). If not set, this Identity Mapping will be global and only editable by platform admin. Once set, the projectKey cannot be changed.
providerName String: Name of the OIDC configuration
tokenSpec Property Map: Specifications of the token. In case of success, a token with the following details will be generated and passed to OIDC Provider.

Supporting Types

OidcIdentityMappingTokenSpec, OidcIdentityMappingTokenSpecArgs

Audience string: Sets of (space separated) the JFrog services to which the mapping applies. Default value is *@*, which applies to all services.
ExpiresIn double: Token expiry time in seconds. Default value is 60.
GroupsPattern string: Provide a pattern which is used to map OIDC groups to Artifactory groups.
Scope string: Scope of the token. Must start with applied-permissions/user, applied-permissions/admin, applied-permissions/roles:, or applied-permissions/groups:. Group names must be comma-separated, double quotes wrapped, e.g. applied-permissions/groups:\"readers\",\"my-group\", Role permissions are only applicable when in project scope and must be comma-separated, double quotes wrapped, e.g. applied-permissions:roles:<project-key>:"Developer","Viewer".username` is also required when setting role permission.
Username string: User name of the OIDC user. Not applicable when scope is set to applied-permissions/groups. Must be set when scope is set to applied-permissions/roles.
UsernamePattern string: Provide a pattern which is used to map OIDC user to Artifactory user.

Audience string: Sets of (space separated) the JFrog services to which the mapping applies. Default value is *@*, which applies to all services.
ExpiresIn float64: Token expiry time in seconds. Default value is 60.
GroupsPattern string: Provide a pattern which is used to map OIDC groups to Artifactory groups.
Scope string: Scope of the token. Must start with applied-permissions/user, applied-permissions/admin, applied-permissions/roles:, or applied-permissions/groups:. Group names must be comma-separated, double quotes wrapped, e.g. applied-permissions/groups:\"readers\",\"my-group\", Role permissions are only applicable when in project scope and must be comma-separated, double quotes wrapped, e.g. applied-permissions:roles:<project-key>:"Developer","Viewer".username` is also required when setting role permission.
Username string: User name of the OIDC user. Not applicable when scope is set to applied-permissions/groups. Must be set when scope is set to applied-permissions/roles.
UsernamePattern string: Provide a pattern which is used to map OIDC user to Artifactory user.

audience String: Sets of (space separated) the JFrog services to which the mapping applies. Default value is *@*, which applies to all services.
expiresIn Double: Token expiry time in seconds. Default value is 60.
groupsPattern String: Provide a pattern which is used to map OIDC groups to Artifactory groups.
scope String: Scope of the token. Must start with applied-permissions/user, applied-permissions/admin, applied-permissions/roles:, or applied-permissions/groups:. Group names must be comma-separated, double quotes wrapped, e.g. applied-permissions/groups:\"readers\",\"my-group\", Role permissions are only applicable when in project scope and must be comma-separated, double quotes wrapped, e.g. applied-permissions:roles:<project-key>:"Developer","Viewer".username` is also required when setting role permission.
username String: User name of the OIDC user. Not applicable when scope is set to applied-permissions/groups. Must be set when scope is set to applied-permissions/roles.
usernamePattern String: Provide a pattern which is used to map OIDC user to Artifactory user.

audience string: Sets of (space separated) the JFrog services to which the mapping applies. Default value is *@*, which applies to all services.
expiresIn number: Token expiry time in seconds. Default value is 60.
groupsPattern string: Provide a pattern which is used to map OIDC groups to Artifactory groups.
scope string: Scope of the token. Must start with applied-permissions/user, applied-permissions/admin, applied-permissions/roles:, or applied-permissions/groups:. Group names must be comma-separated, double quotes wrapped, e.g. applied-permissions/groups:\"readers\",\"my-group\", Role permissions are only applicable when in project scope and must be comma-separated, double quotes wrapped, e.g. applied-permissions:roles:<project-key>:"Developer","Viewer".username` is also required when setting role permission.
username string: User name of the OIDC user. Not applicable when scope is set to applied-permissions/groups. Must be set when scope is set to applied-permissions/roles.
usernamePattern string: Provide a pattern which is used to map OIDC user to Artifactory user.

audience str: Sets of (space separated) the JFrog services to which the mapping applies. Default value is *@*, which applies to all services.
expires_in float: Token expiry time in seconds. Default value is 60.
groups_pattern str: Provide a pattern which is used to map OIDC groups to Artifactory groups.
scope str: Scope of the token. Must start with applied-permissions/user, applied-permissions/admin, applied-permissions/roles:, or applied-permissions/groups:. Group names must be comma-separated, double quotes wrapped, e.g. applied-permissions/groups:\"readers\",\"my-group\", Role permissions are only applicable when in project scope and must be comma-separated, double quotes wrapped, e.g. applied-permissions:roles:<project-key>:"Developer","Viewer".username` is also required when setting role permission.
username str: User name of the OIDC user. Not applicable when scope is set to applied-permissions/groups. Must be set when scope is set to applied-permissions/roles.
username_pattern str: Provide a pattern which is used to map OIDC user to Artifactory user.

audience String: Sets of (space separated) the JFrog services to which the mapping applies. Default value is *@*, which applies to all services.
expiresIn Number: Token expiry time in seconds. Default value is 60.
groupsPattern String: Provide a pattern which is used to map OIDC groups to Artifactory groups.
scope String: Scope of the token. Must start with applied-permissions/user, applied-permissions/admin, applied-permissions/roles:, or applied-permissions/groups:. Group names must be comma-separated, double quotes wrapped, e.g. applied-permissions/groups:\"readers\",\"my-group\", Role permissions are only applicable when in project scope and must be comma-separated, double quotes wrapped, e.g. applied-permissions:roles:<project-key>:"Developer","Viewer".username` is also required when setting role permission.
username String: User name of the OIDC user. Not applicable when scope is set to applied-permissions/groups. Must be set when scope is set to applied-permissions/roles.
usernamePattern String: Provide a pattern which is used to map OIDC user to Artifactory user.

Import

$ pulumi import platform:index/oidcIdentityMapping:OidcIdentityMapping my-oidc-identity-mapping my-oidc-identity-mapping:my-oidc-configuration

$ pulumi import platform:index/oidcIdentityMapping:OidcIdentityMapping my-oidc-identity-mapping my-oidc-identity-mapping:my-oidc-configuration:myproj

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository: platform jfrog/terraform-provider-platform
License
Notes: This Pulumi package is based on the platform Terraform Provider.

platform 2.2.1 published on Friday, Mar 7, 2025 by jfrog

jfrog/terraform-provider-platform

platform.OidcIdentityMapping

On this page

On this page

Example Usage

Create OidcIdentityMapping Resource

Constructor syntax

Parameters

Constructor example

OidcIdentityMapping Resource Properties

Inputs

Outputs

Look up Existing OidcIdentityMapping Resource

Supporting Types

OidcIdentityMappingTokenSpec, OidcIdentityMappingTokenSpecArgs

Import

Package Details

On this page

On this page