• Role Store

sources

PrivX user & host sources

get/role-store/api/v1/sources

Source definitions - User and host directories. Common auth will also fetch these upon startup.

Authorizationstring

required

OAuth2 token

Default
"Bearer a-proper-token-goes-here"

Responses

Response examples

Successful response, returns an array of defined sources, returns an empty array if no sources defined

{
  "count": 123,
  "items": [
    {
      "id": "eef4aefc-d64e-4c2c-aba4-4914c86ce059",
      "created": "2017-01-01T15:05:05Z",
      "updated": "2017-01-01T15:05:05Z",
      "updated_by": "eef4aefc-d64e-4c2c-aba4-4914c86ce059",
      "author": "eef4aefc-d64e-4c2c-aba4-4914c86ce059",
      "enabled": true,
      "ttl": 86400,
      "status_code": "OK",
      "status_text": "Connection established",
      "name": "A pretty source",
      "comment": "A comment",
      "tags": [
        "string"
      ],
      "username_pattern": [
        "string"
      ],
      "external_user_mapping": [
        {
          "source_id": "string",
          "source_search_field": "string"
        }
      ],
      "session_password_enabled": true,
      "child_session_auto_logout_delay": 900,
      "session_password_policy": {
        "password_min_length": 16,
        "password_max_length": 16,
        "use_special_characters": true,
        "use_lower_case": true,
        "use_upper_case": true,
        "use_numbers": true,
        "password_entropy": 95,
        "password_strength": "STRONG"
      },
      "connection": {
        "type": "LDAP",
        "address": "string",
        "port": 123,
        "service_address_auto_update": true,
        "iam_access_key_id": "string",
        "iam_secret_access_key": "string",
        "iam_session_token": "string",
        "iam_fetch_roles": true,
        "iam_fetch_role_path_prefix": "string",
        "google_cloud_project_ids": [
          "string"
        ],
        "google_cloud_config_json": "string",
        "openstack_version": "V2",
        "openstack_endpoint": "string",
        "openstack_username": "string",
        "openstack_user_id": "string",
        "openstack_password": "string",
        "openstack_apikey": "string",
        "openstack_domainname": "string",
        "openstack_domainid": "string",
        "openstack_token_id": "string",
        "openstack_tenant_ids": [
          "string"
        ],
        "openstack_tenant_names": [
          "string"
        ],
        "azure_base_url": "string",
        "azure_subscription_id": "string",
        "azure_tenant_id": "string",
        "azure_client_id": "string",
        "azure_client_secret": "string",
        "ldap_protocol": "LDAP",
        "ldap_base": "string",
        "ldap_user_filter": "(&(!(objectclass=computer))(objectclass=user)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))) for Microsoft Active Directory",
        "ldap_bind_dn": "CN=Admin,OU=Users,OU=ad,DC=ad,DC=ordain,DC=ssh,DC=com",
        "ldap_bind_password": "FooBar",
        "ldap_user_dn_pattern": "uid={0},ou=people",
        "google_gsuite_domain": "mydomain.com, if left empty fetches all user domains",
        "google_gsuite_domain_admin_email": "admin@mydomain.com",
        "oidc_enabled": true,
        "oidc_issuer": "string",
        "oidc_button_title": "string",
        "oidc_client_id": "string",
        "oidc_client_secret": "string",
        "oidc_additional_scopes": [
          "string"
        ],
        "oidc_tags_attribute_name": "string",
        "attribute_mapping": {},
        "mfa_type": "DISABLED",
        "mfa_address": "string",
        "mfa_port": 123,
        "mfa_base_dn": "string",
        "domain_controller_fqdn": "string",
        "domain_controller_port": 123,
        "kerberos_ticket": "string",
        "enable_user_authentication": true,
        "enable_machine_authentication": true
      }
    }
  ]
}
post/role-store/api/v1/sources

Create a new source definition. Id, author, created & updated are automatically populated by the server.

enabledboolean
ttlint

How often the source data should be refreshed, time in seconds

Example
86400
namestring

A name describing the source

Example
"A pretty source"
commentstring

A comment describing the object

Example
"A comment"
tagsarray

Array of tag strings

username_patternarray

Array of wildcarded username patters which should be authenticated against this source

external_user_mappingarray

Mapping external users to source users via id+username

source_idstring

A shared identifier between an external user source and this directory, used to map an external user to this source.

source_search_fieldstring

Search this field (be that AD/LDAP attribute or a database column) for the user id provided.

session_password_enabledboolean
child_session_auto_logout_delayint

Child session auto logout delay in seconds

Example
900
session_password_policyobject

Password policy for session password generation

password_min_lengthint

Minimum password length, must be large enough to produce at least WEAK passwords and at least 10

Example
16
password_max_lengthint

Maximum password length, must be smaller or equal to 99

Example
16
use_special_charactersboolean
Example
true
use_lower_caseboolean
Example
true
use_upper_caseboolean
Example
true
use_numbersboolean
Example
true
connectionobject

Source connection definition - depending on the type, either aws_iam_source, ad source or ldap_source is defined

typestring

Type of the source, LDAP, AD or AWS IAM

Enum
  • LDAP
  • AD
  • GOOGLEGSUITE
  • OIDC
  • AWS
  • GOOGLECLOUD
  • OPENSTACK
  • AZURE
  • LOCAL
addressstring

The address of the LDAP/AD/Local source provider

portint

The port of the LDAP/AD/Local source provider

service_address_auto_updateboolean

Should the host-service addresses be automatically updated if an address change is detected

iam_access_key_idstring

AWS access key

iam_secret_access_keystring

AWS secret access key

iam_session_tokenstring

AWS session token

iam_fetch_rolesboolean

Fetch roles from Amazon

iam_fetch_role_path_prefixstring

A prefix for roles to be fetched from Amazon

google_cloud_project_idsarray

Array of Google Cloud project IDs

google_cloud_config_jsonstring

Google Cloud service-account configuration. Base64 encoded JSON blob.

openstack_versionstring

The OpenStack version being configured.

Enum
  • V2
  • V3
openstack_endpointstring

OpenStack service endpoint url.

openstack_usernamestring

OpenStack user name for Identity V2 API.

openstack_user_idstring

OpenStack user ID for Identity V3 API, used with Username and DomainID or DomainName

openstack_passwordstring

OpenStack password for Identity V2 and V3. Either password or API key is used.

openstack_apikeystring

OpenStack API key for Identity V2 and V3. Either password or API key is used.

openstack_domainnamestring

OpenStack domain name for Identity V3, used with user name.

openstack_domainidstring

OpenStack domain ID for Identity V3, used with user name.

openstack_token_idstring

OpenStack token ID.

openstack_tenant_idsarray

Array of OpenStack tenant IDs.

openstack_tenant_namesarray

Array of OpenStack tenant names.

azure_base_urlstring

Azure connection endpoint url

azure_subscription_idstring

Azure subscription ID

azure_tenant_idstring

Azure tenant ID

azure_client_idstring

Azure client ID

azure_client_secretstring

Azure client secret

ldap_protocolstring
Enum
  • LDAP
  • LDAPS
  • STARTTLS
ldap_basestring

The base LDAP/AD DN of the search string

ldap_user_filterstring

The user filter for the base DN

Example
"(&(!(objectclass=computer))(objectclass=user)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))) for Microsoft Active Directory"
ldap_bind_dnstring

The browse account for LDAP/AD connection

Example
"CN=Admin,OU=Users,OU=ad,DC=ad,DC=ordain,DC=ssh,DC=com"
ldap_bind_passwordstring

The browse account password for LDAP/AD connection

Example
"FooBar"
ldap_user_dn_patternstring

Where to capture the user's distinguished name

Example
"uid={0},ou=people"
google_gsuite_domainstring
Example
"mydomain.com, if left empty fetches all user domains"
google_gsuite_domain_admin_emailstring
Example
"admin@mydomain.com"
oidc_enabledboolean
oidc_issuerstring
oidc_button_titlestring
oidc_client_idstring
oidc_client_secretstring
oidc_additional_scopesarray
oidc_tags_attribute_namestring
attribute_mappingobject

An object containing remote:local mappings for mapping attributes from remote source to local attribute schema.

mfa_typestring

Multifactor-authentication-back-end type

Enum
  • DISABLED
  • INTERNAL
  • RADIUS
  • OIDC
  • FIDO
mfa_addressstring

Multifactor-authentication-back-end address

mfa_portint

Multifactor-authentication back-end port

mfa_base_dnstring

Base DN of users who need to authenticate using MFA

domain_controller_fqdnstring

Domain Controller FQDN for Kerberos authentication

domain_controller_portint

Domain Controller port number for Kerberos authentication

kerberos_ticketstring

Base64 encoded Kerberos ticket for Kerberos authentication

enable_user_authenticationboolean

Is user authentication enabled for this source

enable_machine_authenticationboolean

Is machine user authentication enabled for this source

Responses

Request examples

{
  "enabled": true,
  "ttl": 86400,
  "name": "A pretty source",
  "comment": "A comment",
  "tags": [
    "string"
  ],
  "username_pattern": [
    "string"
  ],
  "external_user_mapping": [
    {
      "source_id": "string",
      "source_search_field": "string"
    }
  ],
  "session_password_enabled": true,
  "child_session_auto_logout_delay": 900,
  "session_password_policy": {
    "password_min_length": 16,
    "password_max_length": 16,
    "use_special_characters": true,
    "use_lower_case": true,
    "use_upper_case": true,
    "use_numbers": true
  },
  "connection": {
    "type": "LDAP",
    "address": "string",
    "port": 123,
    "service_address_auto_update": true,
    "iam_access_key_id": "string",
    "iam_secret_access_key": "string",
    "iam_session_token": "string",
    "iam_fetch_roles": true,
    "iam_fetch_role_path_prefix": "string",
    "google_cloud_project_ids": [
      "string"
    ],
    "google_cloud_config_json": "string",
    "openstack_version": "V2",
    "openstack_endpoint": "string",
    "openstack_username": "string",
    "openstack_user_id": "string",
    "openstack_password": "string",
    "openstack_apikey": "string",
    "openstack_domainname": "string",
    "openstack_domainid": "string",
    "openstack_token_id": "string",
    "openstack_tenant_ids": [
      "string"
    ],
    "openstack_tenant_names": [
      "string"
    ],
    "azure_base_url": "string",
    "azure_subscription_id": "string",
    "azure_tenant_id": "string",
    "azure_client_id": "string",
    "azure_client_secret": "string",
    "ldap_protocol": "LDAP",
    "ldap_base": "string",
    "ldap_user_filter": "(&(!(objectclass=computer))(objectclass=user)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))) for Microsoft Active Directory",
    "ldap_bind_dn": "CN=Admin,OU=Users,OU=ad,DC=ad,DC=ordain,DC=ssh,DC=com",
    "ldap_bind_password": "FooBar",
    "ldap_user_dn_pattern": "uid={0},ou=people",
    "google_gsuite_domain": "mydomain.com, if left empty fetches all user domains",
    "google_gsuite_domain_admin_email": "admin@mydomain.com",
    "oidc_enabled": true,
    "oidc_issuer": "string",
    "oidc_button_title": "string",
    "oidc_client_id": "string",
    "oidc_client_secret": "string",
    "oidc_additional_scopes": [
      "string"
    ],
    "oidc_tags_attribute_name": "string",
    "attribute_mapping": {},
    "mfa_type": "DISABLED",
    "mfa_address": "string",
    "mfa_port": 123,
    "mfa_base_dn": "string",
    "domain_controller_fqdn": "string",
    "domain_controller_port": 123,
    "kerberos_ticket": "string",
    "enable_user_authentication": true,
    "enable_machine_authentication": true
  }
}

Response examples

Source Successfully created

{
  "id": "5bf77342-221c-11ee-be56-0242ac120002"
}
get/role-store/api/v1/sources/{source_id}

Get source object by ID.

source_idstring

required

Source id

Responses

Response examples

Successful response, returns a source if found

{
  "id": "eef4aefc-d64e-4c2c-aba4-4914c86ce059",
  "created": "2017-01-01T15:05:05Z",
  "updated": "2017-01-01T15:05:05Z",
  "updated_by": "eef4aefc-d64e-4c2c-aba4-4914c86ce059",
  "author": "eef4aefc-d64e-4c2c-aba4-4914c86ce059",
  "enabled": true,
  "ttl": 86400,
  "status_code": "OK",
  "status_text": "Connection established",
  "name": "A pretty source",
  "comment": "A comment",
  "tags": [
    "string"
  ],
  "username_pattern": [
    "string"
  ],
  "external_user_mapping": [
    {
      "source_id": "string",
      "source_search_field": "string"
    }
  ],
  "session_password_enabled": true,
  "child_session_auto_logout_delay": 900,
  "session_password_policy": {
    "password_min_length": 16,
    "password_max_length": 16,
    "use_special_characters": true,
    "use_lower_case": true,
    "use_upper_case": true,
    "use_numbers": true,
    "password_entropy": 95,
    "password_strength": "STRONG"
  },
  "connection": {
    "type": "LDAP",
    "address": "string",
    "port": 123,
    "service_address_auto_update": true,
    "iam_access_key_id": "string",
    "iam_secret_access_key": "string",
    "iam_session_token": "string",
    "iam_fetch_roles": true,
    "iam_fetch_role_path_prefix": "string",
    "google_cloud_project_ids": [
      "string"
    ],
    "google_cloud_config_json": "string",
    "openstack_version": "V2",
    "openstack_endpoint": "string",
    "openstack_username": "string",
    "openstack_user_id": "string",
    "openstack_password": "string",
    "openstack_apikey": "string",
    "openstack_domainname": "string",
    "openstack_domainid": "string",
    "openstack_token_id": "string",
    "openstack_tenant_ids": [
      "string"
    ],
    "openstack_tenant_names": [
      "string"
    ],
    "azure_base_url": "string",
    "azure_subscription_id": "string",
    "azure_tenant_id": "string",
    "azure_client_id": "string",
    "azure_client_secret": "string",
    "ldap_protocol": "LDAP",
    "ldap_base": "string",
    "ldap_user_filter": "(&(!(objectclass=computer))(objectclass=user)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))) for Microsoft Active Directory",
    "ldap_bind_dn": "CN=Admin,OU=Users,OU=ad,DC=ad,DC=ordain,DC=ssh,DC=com",
    "ldap_bind_password": "FooBar",
    "ldap_user_dn_pattern": "uid={0},ou=people",
    "google_gsuite_domain": "mydomain.com, if left empty fetches all user domains",
    "google_gsuite_domain_admin_email": "admin@mydomain.com",
    "oidc_enabled": true,
    "oidc_issuer": "string",
    "oidc_button_title": "string",
    "oidc_client_id": "string",
    "oidc_client_secret": "string",
    "oidc_additional_scopes": [
      "string"
    ],
    "oidc_tags_attribute_name": "string",
    "attribute_mapping": {},
    "mfa_type": "DISABLED",
    "mfa_address": "string",
    "mfa_port": 123,
    "mfa_base_dn": "string",
    "domain_controller_fqdn": "string",
    "domain_controller_port": 123,
    "kerberos_ticket": "string",
    "enable_user_authentication": true,
    "enable_machine_authentication": true
  }
}
put/role-store/api/v1/sources/{source_id}

Update a source.

enabledboolean
ttlint

How often the source data should be refreshed, time in seconds

Example
86400
namestring

A name describing the source

Example
"A pretty source"
commentstring

A comment describing the object

Example
"A comment"
tagsarray

Array of tag strings

username_patternarray

Array of wildcarded username patters which should be authenticated against this source

external_user_mappingarray

Mapping external users to source users via id+username

source_idstring

A shared identifier between an external user source and this directory, used to map an external user to this source.

source_search_fieldstring

Search this field (be that AD/LDAP attribute or a database column) for the user id provided.

session_password_enabledboolean
child_session_auto_logout_delayint

Child session auto logout delay in seconds

Example
900
session_password_policyobject

Password policy for session password generation

password_min_lengthint

Minimum password length, must be large enough to produce at least WEAK passwords and at least 10

Example
16
password_max_lengthint

Maximum password length, must be smaller or equal to 99

Example
16
use_special_charactersboolean
Example
true
use_lower_caseboolean
Example
true
use_upper_caseboolean
Example
true
use_numbersboolean
Example
true
connectionobject

Source connection definition - depending on the type, either aws_iam_source, ad source or ldap_source is defined

typestring

Type of the source, LDAP, AD or AWS IAM

Enum
  • LDAP
  • AD
  • GOOGLEGSUITE
  • OIDC
  • AWS
  • GOOGLECLOUD
  • OPENSTACK
  • AZURE
  • LOCAL
addressstring

The address of the LDAP/AD/Local source provider

portint

The port of the LDAP/AD/Local source provider

service_address_auto_updateboolean

Should the host-service addresses be automatically updated if an address change is detected

iam_access_key_idstring

AWS access key

iam_secret_access_keystring

AWS secret access key

iam_session_tokenstring

AWS session token

iam_fetch_rolesboolean

Fetch roles from Amazon

iam_fetch_role_path_prefixstring

A prefix for roles to be fetched from Amazon

google_cloud_project_idsarray

Array of Google Cloud project IDs

google_cloud_config_jsonstring

Google Cloud service-account configuration. Base64 encoded JSON blob.

openstack_versionstring

The OpenStack version being configured.

Enum
  • V2
  • V3
openstack_endpointstring

OpenStack service endpoint url.

openstack_usernamestring

OpenStack user name for Identity V2 API.

openstack_user_idstring

OpenStack user ID for Identity V3 API, used with Username and DomainID or DomainName

openstack_passwordstring

OpenStack password for Identity V2 and V3. Either password or API key is used.

openstack_apikeystring

OpenStack API key for Identity V2 and V3. Either password or API key is used.

openstack_domainnamestring

OpenStack domain name for Identity V3, used with user name.

openstack_domainidstring

OpenStack domain ID for Identity V3, used with user name.

openstack_token_idstring

OpenStack token ID.

openstack_tenant_idsarray

Array of OpenStack tenant IDs.

openstack_tenant_namesarray

Array of OpenStack tenant names.

azure_base_urlstring

Azure connection endpoint url

azure_subscription_idstring

Azure subscription ID

azure_tenant_idstring

Azure tenant ID

azure_client_idstring

Azure client ID

azure_client_secretstring

Azure client secret

ldap_protocolstring
Enum
  • LDAP
  • LDAPS
  • STARTTLS
ldap_basestring

The base LDAP/AD DN of the search string

ldap_user_filterstring

The user filter for the base DN

Example
"(&(!(objectclass=computer))(objectclass=user)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))) for Microsoft Active Directory"
ldap_bind_dnstring

The browse account for LDAP/AD connection

Example
"CN=Admin,OU=Users,OU=ad,DC=ad,DC=ordain,DC=ssh,DC=com"
ldap_bind_passwordstring

The browse account password for LDAP/AD connection

Example
"FooBar"
ldap_user_dn_patternstring

Where to capture the user's distinguished name

Example
"uid={0},ou=people"
google_gsuite_domainstring
Example
"mydomain.com, if left empty fetches all user domains"
google_gsuite_domain_admin_emailstring
Example
"admin@mydomain.com"
oidc_enabledboolean
oidc_issuerstring
oidc_button_titlestring
oidc_client_idstring
oidc_client_secretstring
oidc_additional_scopesarray
oidc_tags_attribute_namestring
attribute_mappingobject

An object containing remote:local mappings for mapping attributes from remote source to local attribute schema.

mfa_typestring

Multifactor-authentication-back-end type

Enum
  • DISABLED
  • INTERNAL
  • RADIUS
  • OIDC
  • FIDO
mfa_addressstring

Multifactor-authentication-back-end address

mfa_portint

Multifactor-authentication back-end port

mfa_base_dnstring

Base DN of users who need to authenticate using MFA

domain_controller_fqdnstring

Domain Controller FQDN for Kerberos authentication

domain_controller_portint

Domain Controller port number for Kerberos authentication

kerberos_ticketstring

Base64 encoded Kerberos ticket for Kerberos authentication

enable_user_authenticationboolean

Is user authentication enabled for this source

enable_machine_authenticationboolean

Is machine user authentication enabled for this source

Responses

Request examples

{
  "enabled": true,
  "ttl": 86400,
  "name": "A pretty source",
  "comment": "A comment",
  "tags": [
    "string"
  ],
  "username_pattern": [
    "string"
  ],
  "external_user_mapping": [
    {
      "source_id": "string",
      "source_search_field": "string"
    }
  ],
  "session_password_enabled": true,
  "child_session_auto_logout_delay": 900,
  "session_password_policy": {
    "password_min_length": 16,
    "password_max_length": 16,
    "use_special_characters": true,
    "use_lower_case": true,
    "use_upper_case": true,
    "use_numbers": true
  },
  "connection": {
    "type": "LDAP",
    "address": "string",
    "port": 123,
    "service_address_auto_update": true,
    "iam_access_key_id": "string",
    "iam_secret_access_key": "string",
    "iam_session_token": "string",
    "iam_fetch_roles": true,
    "iam_fetch_role_path_prefix": "string",
    "google_cloud_project_ids": [
      "string"
    ],
    "google_cloud_config_json": "string",
    "openstack_version": "V2",
    "openstack_endpoint": "string",
    "openstack_username": "string",
    "openstack_user_id": "string",
    "openstack_password": "string",
    "openstack_apikey": "string",
    "openstack_domainname": "string",
    "openstack_domainid": "string",
    "openstack_token_id": "string",
    "openstack_tenant_ids": [
      "string"
    ],
    "openstack_tenant_names": [
      "string"
    ],
    "azure_base_url": "string",
    "azure_subscription_id": "string",
    "azure_tenant_id": "string",
    "azure_client_id": "string",
    "azure_client_secret": "string",
    "ldap_protocol": "LDAP",
    "ldap_base": "string",
    "ldap_user_filter": "(&(!(objectclass=computer))(objectclass=user)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))) for Microsoft Active Directory",
    "ldap_bind_dn": "CN=Admin,OU=Users,OU=ad,DC=ad,DC=ordain,DC=ssh,DC=com",
    "ldap_bind_password": "FooBar",
    "ldap_user_dn_pattern": "uid={0},ou=people",
    "google_gsuite_domain": "mydomain.com, if left empty fetches all user domains",
    "google_gsuite_domain_admin_email": "admin@mydomain.com",
    "oidc_enabled": true,
    "oidc_issuer": "string",
    "oidc_button_title": "string",
    "oidc_client_id": "string",
    "oidc_client_secret": "string",
    "oidc_additional_scopes": [
      "string"
    ],
    "oidc_tags_attribute_name": "string",
    "attribute_mapping": {},
    "mfa_type": "DISABLED",
    "mfa_address": "string",
    "mfa_port": 123,
    "mfa_base_dn": "string",
    "domain_controller_fqdn": "string",
    "domain_controller_port": 123,
    "kerberos_ticket": "string",
    "enable_user_authentication": true,
    "enable_machine_authentication": true
  }
}

Response examples

Source successfully updated

Empty response

delete/role-store/api/v1/sources/{source_id}

Delete source by ID.

source_idstring

required

Source id

Responses

Response examples

Source Successfully deleted

Empty response

post/role-store/api/v1/sources/refresh

Fetch hosts from local host directory, or users from any user directory.

Array of strings

Responses

Response examples

Successful response, refresh started for listed directories.

{
  "id": "eef4aefc-d64e-4c2c-aba4-4914c86ce059",
  "created": "2017-01-01T15:05:05Z",
  "updated": "2017-01-01T15:05:05Z",
  "updated_by": "eef4aefc-d64e-4c2c-aba4-4914c86ce059",
  "author": "eef4aefc-d64e-4c2c-aba4-4914c86ce059",
  "enabled": true,
  "ttl": 86400,
  "status_code": "OK",
  "status_text": "Connection established",
  "name": "A pretty source",
  "comment": "A comment",
  "tags": [
    "string"
  ],
  "username_pattern": [
    "string"
  ],
  "external_user_mapping": [
    {
      "source_id": "string",
      "source_search_field": "string"
    }
  ],
  "session_password_enabled": true,
  "child_session_auto_logout_delay": 900,
  "session_password_policy": {
    "password_min_length": 16,
    "password_max_length": 16,
    "use_special_characters": true,
    "use_lower_case": true,
    "use_upper_case": true,
    "use_numbers": true,
    "password_entropy": 95,
    "password_strength": "STRONG"
  },
  "connection": {
    "type": "LDAP",
    "address": "string",
    "port": 123,
    "service_address_auto_update": true,
    "iam_access_key_id": "string",
    "iam_secret_access_key": "string",
    "iam_session_token": "string",
    "iam_fetch_roles": true,
    "iam_fetch_role_path_prefix": "string",
    "google_cloud_project_ids": [
      "string"
    ],
    "google_cloud_config_json": "string",
    "openstack_version": "V2",
    "openstack_endpoint": "string",
    "openstack_username": "string",
    "openstack_user_id": "string",
    "openstack_password": "string",
    "openstack_apikey": "string",
    "openstack_domainname": "string",
    "openstack_domainid": "string",
    "openstack_token_id": "string",
    "openstack_tenant_ids": [
      "string"
    ],
    "openstack_tenant_names": [
      "string"
    ],
    "azure_base_url": "string",
    "azure_subscription_id": "string",
    "azure_tenant_id": "string",
    "azure_client_id": "string",
    "azure_client_secret": "string",
    "ldap_protocol": "LDAP",
    "ldap_base": "string",
    "ldap_user_filter": "(&(!(objectclass=computer))(objectclass=user)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))) for Microsoft Active Directory",
    "ldap_bind_dn": "CN=Admin,OU=Users,OU=ad,DC=ad,DC=ordain,DC=ssh,DC=com",
    "ldap_bind_password": "FooBar",
    "ldap_user_dn_pattern": "uid={0},ou=people",
    "google_gsuite_domain": "mydomain.com, if left empty fetches all user domains",
    "google_gsuite_domain_admin_email": "admin@mydomain.com",
    "oidc_enabled": true,
    "oidc_issuer": "string",
    "oidc_button_title": "string",
    "oidc_client_id": "string",
    "oidc_client_secret": "string",
    "oidc_additional_scopes": [
      "string"
    ],
    "oidc_tags_attribute_name": "string",
    "attribute_mapping": {},
    "mfa_type": "DISABLED",
    "mfa_address": "string",
    "mfa_port": 123,
    "mfa_base_dn": "string",
    "domain_controller_fqdn": "string",
    "domain_controller_port": 123,
    "kerberos_ticket": "string",
    "enable_user_authentication": true,
    "enable_machine_authentication": true
  }
}

Was this page helpful?