# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import warnings
import pulumi
import pulumi.runtime
from typing import Union
from .. import utilities, tables


class UserFederation(pulumi.CustomResource):
    batch_size_for_sync: pulumi.Output[float]
    """
    The number of users to sync within a single transaction.
    """
    bind_credential: pulumi.Output[str]
    """
    Password of LDAP admin.
    """
    bind_dn: pulumi.Output[str]
    """
    DN of LDAP admin, which will be used by Keycloak to access LDAP server.
    """
    cache_policy: pulumi.Output[str]
    changed_sync_period: pulumi.Output[float]
    """
    How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users
    sync.
    """
    connection_timeout: pulumi.Output[str]
    """
    LDAP connection timeout (duration string)
    """
    connection_url: pulumi.Output[str]
    """
    Connection URL to the LDAP server.
    """
    custom_user_search_filter: pulumi.Output[str]
    """
    Additional LDAP filter for filtering searched users. Must begin with '(' and end with ')'.
    """
    edit_mode: pulumi.Output[str]
    """
    READ_ONLY and WRITABLE are self-explanatory. UNSYNCED allows user data to be imported but not synced back to LDAP.
    """
    enabled: pulumi.Output[bool]
    """
    When false, this provider will not be used when performing queries for users.
    """
    full_sync_period: pulumi.Output[float]
    """
    How frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync.
    """
    import_enabled: pulumi.Output[bool]
    """
    When true, LDAP users will be imported into the Keycloak database.
    """
    kerberos: pulumi.Output[dict]
    """
    Settings regarding kerberos authentication for this realm.

      * `kerberosRealm` (`str`)
      * `keyTab` (`str`)
      * `serverPrincipal` (`str`)
      * `useKerberosForPasswordAuthentication` (`bool`)
    """
    name: pulumi.Output[str]
    """
    Display name of the provider when displayed in the console.
    """
    pagination: pulumi.Output[bool]
    """
    When true, Keycloak assumes the LDAP server supports pagination.
    """
    priority: pulumi.Output[float]
    """
    Priority of this provider when looking up users. Lower values are first.
    """
    rdn_ldap_attribute: pulumi.Output[str]
    """
    Name of the LDAP attribute to use as the relative distinguished name.
    """
    read_timeout: pulumi.Output[str]
    """
    LDAP read timeout (duration string)
    """
    realm_id: pulumi.Output[str]
    """
    The realm this provider will provide user federation for.
    """
    search_scope: pulumi.Output[str]
    """
    ONE_LEVEL: only search for users in the DN specified by user_dn. SUBTREE: search entire LDAP subtree.
    """
    sync_registrations: pulumi.Output[bool]
    """
    When true, newly created users will be synced back to LDAP.
    """
    use_truststore_spi: pulumi.Output[str]
    user_object_classes: pulumi.Output[list]
    """
    All values of LDAP objectClass attribute for users in LDAP.
    """
    username_ldap_attribute: pulumi.Output[str]
    """
    Name of the LDAP attribute to use as the Keycloak username.
    """
    users_dn: pulumi.Output[str]
    """
    Full DN of LDAP tree where your users are.
    """
    uuid_ldap_attribute: pulumi.Output[str]
    """
    Name of the LDAP attribute to use as a unique object identifier for objects in LDAP.
    """
    validate_password_policy: pulumi.Output[bool]
    """
    When true, Keycloak will validate passwords using the realm policy before updating it.
    """
    vendor: pulumi.Output[str]
    """
    LDAP vendor. I am almost certain this field does nothing, but the UI indicates that it is required.
    """
    def __init__(__self__, resource_name, opts=None, batch_size_for_sync=None, bind_credential=None, bind_dn=None, cache_policy=None, changed_sync_period=None, connection_timeout=None, connection_url=None, custom_user_search_filter=None, edit_mode=None, enabled=None, full_sync_period=None, import_enabled=None, kerberos=None, name=None, pagination=None, priority=None, rdn_ldap_attribute=None, read_timeout=None, realm_id=None, search_scope=None, sync_registrations=None, use_truststore_spi=None, user_object_classes=None, username_ldap_attribute=None, users_dn=None, uuid_ldap_attribute=None, validate_password_policy=None, vendor=None, __props__=None, __name__=None, __opts__=None):
        """
        ## # ldap.UserFederation

        Allows for creating and managing LDAP user federation providers within Keycloak.

        Keycloak can use an LDAP user federation provider to federate users to Keycloak
        from a directory system such as LDAP or Active Directory. Federated users
        will exist within the realm and will be able to log in to clients. Federated
        users can have their attributes defined using mappers.

        ### Example Usage

        ```python
        import pulumi
        import pulumi_keycloak as keycloak

        realm = keycloak.Realm("realm",
            enabled=True,
            realm="test")
        ldap_user_federation = keycloak.ldap.UserFederation("ldapUserFederation",
            bind_credential="admin",
            bind_dn="cn=admin,dc=example,dc=org",
            connection_timeout="5s",
            connection_url="ldap://openldap",
            enabled=True,
            rdn_ldap_attribute="cn",
            read_timeout="10s",
            realm_id=realm.id,
            user_object_classes=[
                "simpleSecurityObject",
                "organizationalRole",
            ],
            username_ldap_attribute="cn",
            users_dn="dc=example,dc=org",
            uuid_ldap_attribute="entryDN")
        ```

        ### Argument Reference

        The following arguments are supported:

        - `realm_id` - (Required) The realm that this provider will provide user federation for.
        - `name` - (Required) Display name of the provider when displayed in the console.
        - `enabled` - (Optional) When `false`, this provider will not be used when performing queries for users. Defaults to `true`.
        - `priority` - (Optional) Priority of this provider when looking up users. Lower values are first. Defaults to `0`.
        - `import_enabled` - (Optional) When `true`, LDAP users will be imported into the Keycloak database. Defaults to `true`.
        - `edit_mode` - (Optional) Can be one of `READ_ONLY`, `WRITABLE`, or `UNSYNCED`. `UNSYNCED` allows user data to be imported but not synced back to LDAP. Defaults to `READ_ONLY`.
        - `sync_registrations` - (Optional) When `true`, newly created users will be synced back to LDAP. Defaults to `false`.
        - `vendor` - (Optional) Can be one of `OTHER`, `EDIRECTORY`, `AD`, `RHDS`, or `TIVOLI`. When this is selected in the GUI, it provides reasonable defaults for other fields. When used with the Keycloak API, this attribute does nothing, but is still required. Defaults to `OPTIONAL`.
        - `username_ldap_attribute` - (Required) Name of the LDAP attribute to use as the Keycloak username.
        - `rdn_ldap_attribute` - (Required) Name of the LDAP attribute to use as the relative distinguished name.
        - `uuid_ldap_attribute` - (Required) Name of the LDAP attribute to use as a unique object identifier for objects in LDAP.
        - `user_object_classes` - (Required) Array of all values of LDAP objectClass attribute for users in LDAP. Must contain at least one.
        - `connection_url` - (Required) Connection URL to the LDAP server.
        - `users_dn` - (Required) Full DN of LDAP tree where your users are.
        - `bind_dn` - (Optional) DN of LDAP admin, which will be used by Keycloak to access LDAP server. This attribute must be set if `bind_credential` is set.
        - `bind_credential` - (Optional) Password of LDAP admin. This attribute must be set if `bind_dn` is set.
        - `custom_user_search_filter` - (Optional) Additional LDAP filter for filtering searched users. Must begin with `(` and end with `)`.
        - `search_scope` - (Optional) Can be one of `ONE_LEVEL` or `SUBTREE`:
            - `ONE_LEVEL`: Only search for users in the DN specified by `user_dn`.
            - `SUBTREE`: Search entire LDAP subtree.
        - `validate_password_policy` - (Optional) When `true`, Keycloak will validate passwords using the realm policy before updating it.
        - `use_truststore_spi` - (Optional) Can be one of `ALWAYS`, `ONLY_FOR_LDAPS`, or `NEVER`:
            - `ALWAYS` - Always use the truststore SPI for LDAP connections.
            - `NEVER` - Never use the truststore SPI for LDAP connections.
            - `ONLY_FOR_LDAPS` - Only use the truststore SPI if your LDAP connection uses the ldaps protocol.
        - `connection_timeout` - (Optional) LDAP connection timeout in the format of a [Go duration string](https://golang.org/pkg/time/#Duration.String).
        - `read_timeout` - (Optional) LDAP read timeout in the format of a [Go duration string](https://golang.org/pkg/time/#Duration.String).
        - `pagination` - (Optional) When true, Keycloak assumes the LDAP server supports pagination. Defaults to `true`.
        - `batch_size_for_sync` - (Optional) The number of users to sync within a single transaction. Defaults to `1000`.
        - `full_sync_period` - (Optional) How frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync.
        - `changed_sync_period` - (Optional) How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync.
        - `cache_policy` - (Optional) Can be one of `DEFAULT`, `EVICT_DAILY`, `EVICT_WEEKLY`, `MAX_LIFESPAN`, or `NO_CACHE`. Defaults to `DEFAULT`.

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[float] batch_size_for_sync: The number of users to sync within a single transaction.
        :param pulumi.Input[str] bind_credential: Password of LDAP admin.
        :param pulumi.Input[str] bind_dn: DN of LDAP admin, which will be used by Keycloak to access LDAP server.
        :param pulumi.Input[float] changed_sync_period: How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users
               sync.
        :param pulumi.Input[str] connection_timeout: LDAP connection timeout (duration string)
        :param pulumi.Input[str] connection_url: Connection URL to the LDAP server.
        :param pulumi.Input[str] custom_user_search_filter: Additional LDAP filter for filtering searched users. Must begin with '(' and end with ')'.
        :param pulumi.Input[str] edit_mode: READ_ONLY and WRITABLE are self-explanatory. UNSYNCED allows user data to be imported but not synced back to LDAP.
        :param pulumi.Input[bool] enabled: When false, this provider will not be used when performing queries for users.
        :param pulumi.Input[float] full_sync_period: How frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync.
        :param pulumi.Input[bool] import_enabled: When true, LDAP users will be imported into the Keycloak database.
        :param pulumi.Input[dict] kerberos: Settings regarding kerberos authentication for this realm.
        :param pulumi.Input[str] name: Display name of the provider when displayed in the console.
        :param pulumi.Input[bool] pagination: When true, Keycloak assumes the LDAP server supports pagination.
        :param pulumi.Input[float] priority: Priority of this provider when looking up users. Lower values are first.
        :param pulumi.Input[str] rdn_ldap_attribute: Name of the LDAP attribute to use as the relative distinguished name.
        :param pulumi.Input[str] read_timeout: LDAP read timeout (duration string)
        :param pulumi.Input[str] realm_id: The realm this provider will provide user federation for.
        :param pulumi.Input[str] search_scope: ONE_LEVEL: only search for users in the DN specified by user_dn. SUBTREE: search entire LDAP subtree.
        :param pulumi.Input[bool] sync_registrations: When true, newly created users will be synced back to LDAP.
        :param pulumi.Input[list] user_object_classes: All values of LDAP objectClass attribute for users in LDAP.
        :param pulumi.Input[str] username_ldap_attribute: Name of the LDAP attribute to use as the Keycloak username.
        :param pulumi.Input[str] users_dn: Full DN of LDAP tree where your users are.
        :param pulumi.Input[str] uuid_ldap_attribute: Name of the LDAP attribute to use as a unique object identifier for objects in LDAP.
        :param pulumi.Input[bool] validate_password_policy: When true, Keycloak will validate passwords using the realm policy before updating it.
        :param pulumi.Input[str] vendor: LDAP vendor. I am almost certain this field does nothing, but the UI indicates that it is required.

        The **kerberos** object supports the following:

          * `kerberosRealm` (`pulumi.Input[str]`)
          * `keyTab` (`pulumi.Input[str]`)
          * `serverPrincipal` (`pulumi.Input[str]`)
          * `useKerberosForPasswordAuthentication` (`pulumi.Input[bool]`)
        """
        if __name__ is not None:
            warnings.warn("explicit use of __name__ is deprecated", DeprecationWarning)
            resource_name = __name__
        if __opts__ is not None:
            warnings.warn("explicit use of __opts__ is deprecated, use 'opts' instead", DeprecationWarning)
            opts = __opts__
        if opts is None:
            opts = pulumi.ResourceOptions()
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.version is None:
            opts.version = utilities.get_version()
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = dict()

            __props__['batch_size_for_sync'] = batch_size_for_sync
            __props__['bind_credential'] = bind_credential
            __props__['bind_dn'] = bind_dn
            __props__['cache_policy'] = cache_policy
            __props__['changed_sync_period'] = changed_sync_period
            __props__['connection_timeout'] = connection_timeout
            if connection_url is None:
                raise TypeError("Missing required property 'connection_url'")
            __props__['connection_url'] = connection_url
            __props__['custom_user_search_filter'] = custom_user_search_filter
            __props__['edit_mode'] = edit_mode
            __props__['enabled'] = enabled
            __props__['full_sync_period'] = full_sync_period
            __props__['import_enabled'] = import_enabled
            __props__['kerberos'] = kerberos
            __props__['name'] = name
            __props__['pagination'] = pagination
            __props__['priority'] = priority
            if rdn_ldap_attribute is None:
                raise TypeError("Missing required property 'rdn_ldap_attribute'")
            __props__['rdn_ldap_attribute'] = rdn_ldap_attribute
            __props__['read_timeout'] = read_timeout
            if realm_id is None:
                raise TypeError("Missing required property 'realm_id'")
            __props__['realm_id'] = realm_id
            __props__['search_scope'] = search_scope
            __props__['sync_registrations'] = sync_registrations
            __props__['use_truststore_spi'] = use_truststore_spi
            if user_object_classes is None:
                raise TypeError("Missing required property 'user_object_classes'")
            __props__['user_object_classes'] = user_object_classes
            if username_ldap_attribute is None:
                raise TypeError("Missing required property 'username_ldap_attribute'")
            __props__['username_ldap_attribute'] = username_ldap_attribute
            if users_dn is None:
                raise TypeError("Missing required property 'users_dn'")
            __props__['users_dn'] = users_dn
            if uuid_ldap_attribute is None:
                raise TypeError("Missing required property 'uuid_ldap_attribute'")
            __props__['uuid_ldap_attribute'] = uuid_ldap_attribute
            __props__['validate_password_policy'] = validate_password_policy
            __props__['vendor'] = vendor
        super(UserFederation, __self__).__init__(
            'keycloak:ldap/userFederation:UserFederation',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name, id, opts=None, batch_size_for_sync=None, bind_credential=None, bind_dn=None, cache_policy=None, changed_sync_period=None, connection_timeout=None, connection_url=None, custom_user_search_filter=None, edit_mode=None, enabled=None, full_sync_period=None, import_enabled=None, kerberos=None, name=None, pagination=None, priority=None, rdn_ldap_attribute=None, read_timeout=None, realm_id=None, search_scope=None, sync_registrations=None, use_truststore_spi=None, user_object_classes=None, username_ldap_attribute=None, users_dn=None, uuid_ldap_attribute=None, validate_password_policy=None, vendor=None):
        """
        Get an existing UserFederation resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param str id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[float] batch_size_for_sync: The number of users to sync within a single transaction.
        :param pulumi.Input[str] bind_credential: Password of LDAP admin.
        :param pulumi.Input[str] bind_dn: DN of LDAP admin, which will be used by Keycloak to access LDAP server.
        :param pulumi.Input[float] changed_sync_period: How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users
               sync.
        :param pulumi.Input[str] connection_timeout: LDAP connection timeout (duration string)
        :param pulumi.Input[str] connection_url: Connection URL to the LDAP server.
        :param pulumi.Input[str] custom_user_search_filter: Additional LDAP filter for filtering searched users. Must begin with '(' and end with ')'.
        :param pulumi.Input[str] edit_mode: READ_ONLY and WRITABLE are self-explanatory. UNSYNCED allows user data to be imported but not synced back to LDAP.
        :param pulumi.Input[bool] enabled: When false, this provider will not be used when performing queries for users.
        :param pulumi.Input[float] full_sync_period: How frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync.
        :param pulumi.Input[bool] import_enabled: When true, LDAP users will be imported into the Keycloak database.
        :param pulumi.Input[dict] kerberos: Settings regarding kerberos authentication for this realm.
        :param pulumi.Input[str] name: Display name of the provider when displayed in the console.
        :param pulumi.Input[bool] pagination: When true, Keycloak assumes the LDAP server supports pagination.
        :param pulumi.Input[float] priority: Priority of this provider when looking up users. Lower values are first.
        :param pulumi.Input[str] rdn_ldap_attribute: Name of the LDAP attribute to use as the relative distinguished name.
        :param pulumi.Input[str] read_timeout: LDAP read timeout (duration string)
        :param pulumi.Input[str] realm_id: The realm this provider will provide user federation for.
        :param pulumi.Input[str] search_scope: ONE_LEVEL: only search for users in the DN specified by user_dn. SUBTREE: search entire LDAP subtree.
        :param pulumi.Input[bool] sync_registrations: When true, newly created users will be synced back to LDAP.
        :param pulumi.Input[list] user_object_classes: All values of LDAP objectClass attribute for users in LDAP.
        :param pulumi.Input[str] username_ldap_attribute: Name of the LDAP attribute to use as the Keycloak username.
        :param pulumi.Input[str] users_dn: Full DN of LDAP tree where your users are.
        :param pulumi.Input[str] uuid_ldap_attribute: Name of the LDAP attribute to use as a unique object identifier for objects in LDAP.
        :param pulumi.Input[bool] validate_password_policy: When true, Keycloak will validate passwords using the realm policy before updating it.
        :param pulumi.Input[str] vendor: LDAP vendor. I am almost certain this field does nothing, but the UI indicates that it is required.

        The **kerberos** object supports the following:

          * `kerberosRealm` (`pulumi.Input[str]`)
          * `keyTab` (`pulumi.Input[str]`)
          * `serverPrincipal` (`pulumi.Input[str]`)
          * `useKerberosForPasswordAuthentication` (`pulumi.Input[bool]`)
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = dict()

        __props__["batch_size_for_sync"] = batch_size_for_sync
        __props__["bind_credential"] = bind_credential
        __props__["bind_dn"] = bind_dn
        __props__["cache_policy"] = cache_policy
        __props__["changed_sync_period"] = changed_sync_period
        __props__["connection_timeout"] = connection_timeout
        __props__["connection_url"] = connection_url
        __props__["custom_user_search_filter"] = custom_user_search_filter
        __props__["edit_mode"] = edit_mode
        __props__["enabled"] = enabled
        __props__["full_sync_period"] = full_sync_period
        __props__["import_enabled"] = import_enabled
        __props__["kerberos"] = kerberos
        __props__["name"] = name
        __props__["pagination"] = pagination
        __props__["priority"] = priority
        __props__["rdn_ldap_attribute"] = rdn_ldap_attribute
        __props__["read_timeout"] = read_timeout
        __props__["realm_id"] = realm_id
        __props__["search_scope"] = search_scope
        __props__["sync_registrations"] = sync_registrations
        __props__["use_truststore_spi"] = use_truststore_spi
        __props__["user_object_classes"] = user_object_classes
        __props__["username_ldap_attribute"] = username_ldap_attribute
        __props__["users_dn"] = users_dn
        __props__["uuid_ldap_attribute"] = uuid_ldap_attribute
        __props__["validate_password_policy"] = validate_password_policy
        __props__["vendor"] = vendor
        return UserFederation(resource_name, opts=opts, __props__=__props__)

    def translate_output_property(self, prop):
        return tables._CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop

    def translate_input_property(self, prop):
        return tables._SNAKE_TO_CAMEL_CASE_TABLE.get(prop) or prop
