# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities

__all__ = ['IdentityProviderArgs', 'IdentityProvider']

@pulumi.input_type
class IdentityProviderArgs:
    def __init__(__self__, *,
                 alias: pulumi.Input[str],
                 entity_id: pulumi.Input[str],
                 realm: pulumi.Input[str],
                 single_sign_on_service_url: pulumi.Input[str],
                 add_read_token_role_on_create: Optional[pulumi.Input[bool]] = None,
                 authenticate_by_default: Optional[pulumi.Input[bool]] = None,
                 authn_context_class_refs: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 authn_context_comparison_type: Optional[pulumi.Input[str]] = None,
                 authn_context_decl_refs: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 backchannel_supported: Optional[pulumi.Input[bool]] = None,
                 display_name: Optional[pulumi.Input[str]] = None,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 extra_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                 first_broker_login_flow_alias: Optional[pulumi.Input[str]] = None,
                 force_authn: Optional[pulumi.Input[bool]] = None,
                 gui_order: Optional[pulumi.Input[str]] = None,
                 hide_on_login_page: Optional[pulumi.Input[bool]] = None,
                 link_only: Optional[pulumi.Input[bool]] = None,
                 login_hint: Optional[pulumi.Input[str]] = None,
                 name_id_policy_format: Optional[pulumi.Input[str]] = None,
                 post_binding_authn_request: Optional[pulumi.Input[bool]] = None,
                 post_binding_logout: Optional[pulumi.Input[bool]] = None,
                 post_binding_response: Optional[pulumi.Input[bool]] = None,
                 post_broker_login_flow_alias: Optional[pulumi.Input[str]] = None,
                 principal_attribute: Optional[pulumi.Input[str]] = None,
                 principal_type: Optional[pulumi.Input[str]] = None,
                 provider_id: Optional[pulumi.Input[str]] = None,
                 signature_algorithm: Optional[pulumi.Input[str]] = None,
                 signing_certificate: Optional[pulumi.Input[str]] = None,
                 single_logout_service_url: Optional[pulumi.Input[str]] = None,
                 store_token: Optional[pulumi.Input[bool]] = None,
                 sync_mode: Optional[pulumi.Input[str]] = None,
                 trust_email: Optional[pulumi.Input[bool]] = None,
                 validate_signature: Optional[pulumi.Input[bool]] = None,
                 want_assertions_encrypted: Optional[pulumi.Input[bool]] = None,
                 want_assertions_signed: Optional[pulumi.Input[bool]] = None,
                 xml_sign_key_info_key_name_transformer: Optional[pulumi.Input[str]] = None):
        """
        The set of arguments for constructing a IdentityProvider resource.
        :param pulumi.Input[str] alias: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
        :param pulumi.Input[str] entity_id: The Entity ID that will be used to uniquely identify this SAML Service Provider.
        :param pulumi.Input[str] realm: Realm Name
        :param pulumi.Input[str] single_sign_on_service_url: SSO Logout URL.
        :param pulumi.Input[bool] add_read_token_role_on_create: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
        :param pulumi.Input[bool] authenticate_by_default: Enable/disable authenticate users by default.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] authn_context_class_refs: AuthnContext ClassRefs
        :param pulumi.Input[str] authn_context_comparison_type: AuthnContext Comparison
        :param pulumi.Input[Sequence[pulumi.Input[str]]] authn_context_decl_refs: AuthnContext DeclRefs
        :param pulumi.Input[bool] backchannel_supported: Does the external IDP support backchannel logout?
        :param pulumi.Input[str] display_name: Friendly name for Identity Providers.
        :param pulumi.Input[bool] enabled: Enable/disable this identity provider.
        :param pulumi.Input[str] first_broker_login_flow_alias: Alias of authentication flow, which is triggered after first login with this identity provider. Term 'First Login' means
               that there is not yet existing Keycloak account linked with the authenticated identity provider account.
        :param pulumi.Input[bool] force_authn: Require Force Authn.
        :param pulumi.Input[str] gui_order: GUI Order
        :param pulumi.Input[bool] hide_on_login_page: Hide On Login Page.
        :param pulumi.Input[bool] link_only: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don't
               want to allow login from the provider, but want to integrate with a provider
        :param pulumi.Input[str] login_hint: Login Hint.
        :param pulumi.Input[str] name_id_policy_format: Name ID Policy Format.
        :param pulumi.Input[bool] post_binding_authn_request: Post Binding Authn Request.
        :param pulumi.Input[bool] post_binding_logout: Post Binding Logout.
        :param pulumi.Input[bool] post_binding_response: Post Binding Response.
        :param pulumi.Input[str] post_broker_login_flow_alias: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want
               additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if
               you don't want any additional authenticators to be triggered after login with this identity provider. Also note, that
               authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
        :param pulumi.Input[str] principal_attribute: Principal Attribute
        :param pulumi.Input[str] principal_type: Principal Type
        :param pulumi.Input[str] provider_id: provider id, is always saml, unless you have a custom implementation
        :param pulumi.Input[str] signature_algorithm: Signing Algorithm.
        :param pulumi.Input[str] signing_certificate: Signing Certificate.
        :param pulumi.Input[str] single_logout_service_url: Logout URL.
        :param pulumi.Input[bool] store_token: Enable/disable if tokens must be stored after authenticating users.
        :param pulumi.Input[str] sync_mode: Sync Mode
        :param pulumi.Input[bool] trust_email: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
        :param pulumi.Input[bool] validate_signature: Enable/disable signature validation of SAML responses.
        :param pulumi.Input[bool] want_assertions_encrypted: Want Assertions Encrypted.
        :param pulumi.Input[bool] want_assertions_signed: Want Assertions Signed.
        :param pulumi.Input[str] xml_sign_key_info_key_name_transformer: Sign Key Transformer.
        """
        pulumi.set(__self__, "alias", alias)
        pulumi.set(__self__, "entity_id", entity_id)
        pulumi.set(__self__, "realm", realm)
        pulumi.set(__self__, "single_sign_on_service_url", single_sign_on_service_url)
        if add_read_token_role_on_create is not None:
            pulumi.set(__self__, "add_read_token_role_on_create", add_read_token_role_on_create)
        if authenticate_by_default is not None:
            pulumi.set(__self__, "authenticate_by_default", authenticate_by_default)
        if authn_context_class_refs is not None:
            pulumi.set(__self__, "authn_context_class_refs", authn_context_class_refs)
        if authn_context_comparison_type is not None:
            pulumi.set(__self__, "authn_context_comparison_type", authn_context_comparison_type)
        if authn_context_decl_refs is not None:
            pulumi.set(__self__, "authn_context_decl_refs", authn_context_decl_refs)
        if backchannel_supported is not None:
            pulumi.set(__self__, "backchannel_supported", backchannel_supported)
        if display_name is not None:
            pulumi.set(__self__, "display_name", display_name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if extra_config is not None:
            pulumi.set(__self__, "extra_config", extra_config)
        if first_broker_login_flow_alias is not None:
            pulumi.set(__self__, "first_broker_login_flow_alias", first_broker_login_flow_alias)
        if force_authn is not None:
            pulumi.set(__self__, "force_authn", force_authn)
        if gui_order is not None:
            pulumi.set(__self__, "gui_order", gui_order)
        if hide_on_login_page is not None:
            pulumi.set(__self__, "hide_on_login_page", hide_on_login_page)
        if link_only is not None:
            pulumi.set(__self__, "link_only", link_only)
        if login_hint is not None:
            pulumi.set(__self__, "login_hint", login_hint)
        if name_id_policy_format is not None:
            pulumi.set(__self__, "name_id_policy_format", name_id_policy_format)
        if post_binding_authn_request is not None:
            pulumi.set(__self__, "post_binding_authn_request", post_binding_authn_request)
        if post_binding_logout is not None:
            pulumi.set(__self__, "post_binding_logout", post_binding_logout)
        if post_binding_response is not None:
            pulumi.set(__self__, "post_binding_response", post_binding_response)
        if post_broker_login_flow_alias is not None:
            pulumi.set(__self__, "post_broker_login_flow_alias", post_broker_login_flow_alias)
        if principal_attribute is not None:
            pulumi.set(__self__, "principal_attribute", principal_attribute)
        if principal_type is not None:
            pulumi.set(__self__, "principal_type", principal_type)
        if provider_id is not None:
            pulumi.set(__self__, "provider_id", provider_id)
        if signature_algorithm is not None:
            pulumi.set(__self__, "signature_algorithm", signature_algorithm)
        if signing_certificate is not None:
            pulumi.set(__self__, "signing_certificate", signing_certificate)
        if single_logout_service_url is not None:
            pulumi.set(__self__, "single_logout_service_url", single_logout_service_url)
        if store_token is not None:
            pulumi.set(__self__, "store_token", store_token)
        if sync_mode is not None:
            pulumi.set(__self__, "sync_mode", sync_mode)
        if trust_email is not None:
            pulumi.set(__self__, "trust_email", trust_email)
        if validate_signature is not None:
            pulumi.set(__self__, "validate_signature", validate_signature)
        if want_assertions_encrypted is not None:
            pulumi.set(__self__, "want_assertions_encrypted", want_assertions_encrypted)
        if want_assertions_signed is not None:
            pulumi.set(__self__, "want_assertions_signed", want_assertions_signed)
        if xml_sign_key_info_key_name_transformer is not None:
            pulumi.set(__self__, "xml_sign_key_info_key_name_transformer", xml_sign_key_info_key_name_transformer)

    @property
    @pulumi.getter
    def alias(self) -> pulumi.Input[str]:
        """
        The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
        """
        return pulumi.get(self, "alias")

    @alias.setter
    def alias(self, value: pulumi.Input[str]):
        pulumi.set(self, "alias", value)

    @property
    @pulumi.getter(name="entityId")
    def entity_id(self) -> pulumi.Input[str]:
        """
        The Entity ID that will be used to uniquely identify this SAML Service Provider.
        """
        return pulumi.get(self, "entity_id")

    @entity_id.setter
    def entity_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "entity_id", value)

    @property
    @pulumi.getter
    def realm(self) -> pulumi.Input[str]:
        """
        Realm Name
        """
        return pulumi.get(self, "realm")

    @realm.setter
    def realm(self, value: pulumi.Input[str]):
        pulumi.set(self, "realm", value)

    @property
    @pulumi.getter(name="singleSignOnServiceUrl")
    def single_sign_on_service_url(self) -> pulumi.Input[str]:
        """
        SSO Logout URL.
        """
        return pulumi.get(self, "single_sign_on_service_url")

    @single_sign_on_service_url.setter
    def single_sign_on_service_url(self, value: pulumi.Input[str]):
        pulumi.set(self, "single_sign_on_service_url", value)

    @property
    @pulumi.getter(name="addReadTokenRoleOnCreate")
    def add_read_token_role_on_create(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
        """
        return pulumi.get(self, "add_read_token_role_on_create")

    @add_read_token_role_on_create.setter
    def add_read_token_role_on_create(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "add_read_token_role_on_create", value)

    @property
    @pulumi.getter(name="authenticateByDefault")
    def authenticate_by_default(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable/disable authenticate users by default.
        """
        return pulumi.get(self, "authenticate_by_default")

    @authenticate_by_default.setter
    def authenticate_by_default(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "authenticate_by_default", value)

    @property
    @pulumi.getter(name="authnContextClassRefs")
    def authn_context_class_refs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        AuthnContext ClassRefs
        """
        return pulumi.get(self, "authn_context_class_refs")

    @authn_context_class_refs.setter
    def authn_context_class_refs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "authn_context_class_refs", value)

    @property
    @pulumi.getter(name="authnContextComparisonType")
    def authn_context_comparison_type(self) -> Optional[pulumi.Input[str]]:
        """
        AuthnContext Comparison
        """
        return pulumi.get(self, "authn_context_comparison_type")

    @authn_context_comparison_type.setter
    def authn_context_comparison_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "authn_context_comparison_type", value)

    @property
    @pulumi.getter(name="authnContextDeclRefs")
    def authn_context_decl_refs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        AuthnContext DeclRefs
        """
        return pulumi.get(self, "authn_context_decl_refs")

    @authn_context_decl_refs.setter
    def authn_context_decl_refs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "authn_context_decl_refs", value)

    @property
    @pulumi.getter(name="backchannelSupported")
    def backchannel_supported(self) -> Optional[pulumi.Input[bool]]:
        """
        Does the external IDP support backchannel logout?
        """
        return pulumi.get(self, "backchannel_supported")

    @backchannel_supported.setter
    def backchannel_supported(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "backchannel_supported", value)

    @property
    @pulumi.getter(name="displayName")
    def display_name(self) -> Optional[pulumi.Input[str]]:
        """
        Friendly name for Identity Providers.
        """
        return pulumi.get(self, "display_name")

    @display_name.setter
    def display_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "display_name", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable/disable this identity provider.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter(name="extraConfig")
    def extra_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
        return pulumi.get(self, "extra_config")

    @extra_config.setter
    def extra_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
        pulumi.set(self, "extra_config", value)

    @property
    @pulumi.getter(name="firstBrokerLoginFlowAlias")
    def first_broker_login_flow_alias(self) -> Optional[pulumi.Input[str]]:
        """
        Alias of authentication flow, which is triggered after first login with this identity provider. Term 'First Login' means
        that there is not yet existing Keycloak account linked with the authenticated identity provider account.
        """
        return pulumi.get(self, "first_broker_login_flow_alias")

    @first_broker_login_flow_alias.setter
    def first_broker_login_flow_alias(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "first_broker_login_flow_alias", value)

    @property
    @pulumi.getter(name="forceAuthn")
    def force_authn(self) -> Optional[pulumi.Input[bool]]:
        """
        Require Force Authn.
        """
        return pulumi.get(self, "force_authn")

    @force_authn.setter
    def force_authn(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "force_authn", value)

    @property
    @pulumi.getter(name="guiOrder")
    def gui_order(self) -> Optional[pulumi.Input[str]]:
        """
        GUI Order
        """
        return pulumi.get(self, "gui_order")

    @gui_order.setter
    def gui_order(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "gui_order", value)

    @property
    @pulumi.getter(name="hideOnLoginPage")
    def hide_on_login_page(self) -> Optional[pulumi.Input[bool]]:
        """
        Hide On Login Page.
        """
        return pulumi.get(self, "hide_on_login_page")

    @hide_on_login_page.setter
    def hide_on_login_page(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "hide_on_login_page", value)

    @property
    @pulumi.getter(name="linkOnly")
    def link_only(self) -> Optional[pulumi.Input[bool]]:
        """
        If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don't
        want to allow login from the provider, but want to integrate with a provider
        """
        return pulumi.get(self, "link_only")

    @link_only.setter
    def link_only(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "link_only", value)

    @property
    @pulumi.getter(name="loginHint")
    def login_hint(self) -> Optional[pulumi.Input[str]]:
        """
        Login Hint.
        """
        return pulumi.get(self, "login_hint")

    @login_hint.setter
    def login_hint(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "login_hint", value)

    @property
    @pulumi.getter(name="nameIdPolicyFormat")
    def name_id_policy_format(self) -> Optional[pulumi.Input[str]]:
        """
        Name ID Policy Format.
        """
        return pulumi.get(self, "name_id_policy_format")

    @name_id_policy_format.setter
    def name_id_policy_format(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name_id_policy_format", value)

    @property
    @pulumi.getter(name="postBindingAuthnRequest")
    def post_binding_authn_request(self) -> Optional[pulumi.Input[bool]]:
        """
        Post Binding Authn Request.
        """
        return pulumi.get(self, "post_binding_authn_request")

    @post_binding_authn_request.setter
    def post_binding_authn_request(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "post_binding_authn_request", value)

    @property
    @pulumi.getter(name="postBindingLogout")
    def post_binding_logout(self) -> Optional[pulumi.Input[bool]]:
        """
        Post Binding Logout.
        """
        return pulumi.get(self, "post_binding_logout")

    @post_binding_logout.setter
    def post_binding_logout(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "post_binding_logout", value)

    @property
    @pulumi.getter(name="postBindingResponse")
    def post_binding_response(self) -> Optional[pulumi.Input[bool]]:
        """
        Post Binding Response.
        """
        return pulumi.get(self, "post_binding_response")

    @post_binding_response.setter
    def post_binding_response(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "post_binding_response", value)

    @property
    @pulumi.getter(name="postBrokerLoginFlowAlias")
    def post_broker_login_flow_alias(self) -> Optional[pulumi.Input[str]]:
        """
        Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want
        additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if
        you don't want any additional authenticators to be triggered after login with this identity provider. Also note, that
        authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
        """
        return pulumi.get(self, "post_broker_login_flow_alias")

    @post_broker_login_flow_alias.setter
    def post_broker_login_flow_alias(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "post_broker_login_flow_alias", value)

    @property
    @pulumi.getter(name="principalAttribute")
    def principal_attribute(self) -> Optional[pulumi.Input[str]]:
        """
        Principal Attribute
        """
        return pulumi.get(self, "principal_attribute")

    @principal_attribute.setter
    def principal_attribute(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "principal_attribute", value)

    @property
    @pulumi.getter(name="principalType")
    def principal_type(self) -> Optional[pulumi.Input[str]]:
        """
        Principal Type
        """
        return pulumi.get(self, "principal_type")

    @principal_type.setter
    def principal_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "principal_type", value)

    @property
    @pulumi.getter(name="providerId")
    def provider_id(self) -> Optional[pulumi.Input[str]]:
        """
        provider id, is always saml, unless you have a custom implementation
        """
        return pulumi.get(self, "provider_id")

    @provider_id.setter
    def provider_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "provider_id", value)

    @property
    @pulumi.getter(name="signatureAlgorithm")
    def signature_algorithm(self) -> Optional[pulumi.Input[str]]:
        """
        Signing Algorithm.
        """
        return pulumi.get(self, "signature_algorithm")

    @signature_algorithm.setter
    def signature_algorithm(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "signature_algorithm", value)

    @property
    @pulumi.getter(name="signingCertificate")
    def signing_certificate(self) -> Optional[pulumi.Input[str]]:
        """
        Signing Certificate.
        """
        return pulumi.get(self, "signing_certificate")

    @signing_certificate.setter
    def signing_certificate(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "signing_certificate", value)

    @property
    @pulumi.getter(name="singleLogoutServiceUrl")
    def single_logout_service_url(self) -> Optional[pulumi.Input[str]]:
        """
        Logout URL.
        """
        return pulumi.get(self, "single_logout_service_url")

    @single_logout_service_url.setter
    def single_logout_service_url(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "single_logout_service_url", value)

    @property
    @pulumi.getter(name="storeToken")
    def store_token(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable/disable if tokens must be stored after authenticating users.
        """
        return pulumi.get(self, "store_token")

    @store_token.setter
    def store_token(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "store_token", value)

    @property
    @pulumi.getter(name="syncMode")
    def sync_mode(self) -> Optional[pulumi.Input[str]]:
        """
        Sync Mode
        """
        return pulumi.get(self, "sync_mode")

    @sync_mode.setter
    def sync_mode(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "sync_mode", value)

    @property
    @pulumi.getter(name="trustEmail")
    def trust_email(self) -> Optional[pulumi.Input[bool]]:
        """
        If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
        """
        return pulumi.get(self, "trust_email")

    @trust_email.setter
    def trust_email(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "trust_email", value)

    @property
    @pulumi.getter(name="validateSignature")
    def validate_signature(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable/disable signature validation of SAML responses.
        """
        return pulumi.get(self, "validate_signature")

    @validate_signature.setter
    def validate_signature(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "validate_signature", value)

    @property
    @pulumi.getter(name="wantAssertionsEncrypted")
    def want_assertions_encrypted(self) -> Optional[pulumi.Input[bool]]:
        """
        Want Assertions Encrypted.
        """
        return pulumi.get(self, "want_assertions_encrypted")

    @want_assertions_encrypted.setter
    def want_assertions_encrypted(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "want_assertions_encrypted", value)

    @property
    @pulumi.getter(name="wantAssertionsSigned")
    def want_assertions_signed(self) -> Optional[pulumi.Input[bool]]:
        """
        Want Assertions Signed.
        """
        return pulumi.get(self, "want_assertions_signed")

    @want_assertions_signed.setter
    def want_assertions_signed(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "want_assertions_signed", value)

    @property
    @pulumi.getter(name="xmlSignKeyInfoKeyNameTransformer")
    def xml_sign_key_info_key_name_transformer(self) -> Optional[pulumi.Input[str]]:
        """
        Sign Key Transformer.
        """
        return pulumi.get(self, "xml_sign_key_info_key_name_transformer")

    @xml_sign_key_info_key_name_transformer.setter
    def xml_sign_key_info_key_name_transformer(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "xml_sign_key_info_key_name_transformer", value)


@pulumi.input_type
class _IdentityProviderState:
    def __init__(__self__, *,
                 add_read_token_role_on_create: Optional[pulumi.Input[bool]] = None,
                 alias: Optional[pulumi.Input[str]] = None,
                 authenticate_by_default: Optional[pulumi.Input[bool]] = None,
                 authn_context_class_refs: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 authn_context_comparison_type: Optional[pulumi.Input[str]] = None,
                 authn_context_decl_refs: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 backchannel_supported: Optional[pulumi.Input[bool]] = None,
                 display_name: Optional[pulumi.Input[str]] = None,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 entity_id: Optional[pulumi.Input[str]] = None,
                 extra_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                 first_broker_login_flow_alias: Optional[pulumi.Input[str]] = None,
                 force_authn: Optional[pulumi.Input[bool]] = None,
                 gui_order: Optional[pulumi.Input[str]] = None,
                 hide_on_login_page: Optional[pulumi.Input[bool]] = None,
                 internal_id: Optional[pulumi.Input[str]] = None,
                 link_only: Optional[pulumi.Input[bool]] = None,
                 login_hint: Optional[pulumi.Input[str]] = None,
                 name_id_policy_format: Optional[pulumi.Input[str]] = None,
                 post_binding_authn_request: Optional[pulumi.Input[bool]] = None,
                 post_binding_logout: Optional[pulumi.Input[bool]] = None,
                 post_binding_response: Optional[pulumi.Input[bool]] = None,
                 post_broker_login_flow_alias: Optional[pulumi.Input[str]] = None,
                 principal_attribute: Optional[pulumi.Input[str]] = None,
                 principal_type: Optional[pulumi.Input[str]] = None,
                 provider_id: Optional[pulumi.Input[str]] = None,
                 realm: Optional[pulumi.Input[str]] = None,
                 signature_algorithm: Optional[pulumi.Input[str]] = None,
                 signing_certificate: Optional[pulumi.Input[str]] = None,
                 single_logout_service_url: Optional[pulumi.Input[str]] = None,
                 single_sign_on_service_url: Optional[pulumi.Input[str]] = None,
                 store_token: Optional[pulumi.Input[bool]] = None,
                 sync_mode: Optional[pulumi.Input[str]] = None,
                 trust_email: Optional[pulumi.Input[bool]] = None,
                 validate_signature: Optional[pulumi.Input[bool]] = None,
                 want_assertions_encrypted: Optional[pulumi.Input[bool]] = None,
                 want_assertions_signed: Optional[pulumi.Input[bool]] = None,
                 xml_sign_key_info_key_name_transformer: Optional[pulumi.Input[str]] = None):
        """
        Input properties used for looking up and filtering IdentityProvider resources.
        :param pulumi.Input[bool] add_read_token_role_on_create: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
        :param pulumi.Input[str] alias: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
        :param pulumi.Input[bool] authenticate_by_default: Enable/disable authenticate users by default.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] authn_context_class_refs: AuthnContext ClassRefs
        :param pulumi.Input[str] authn_context_comparison_type: AuthnContext Comparison
        :param pulumi.Input[Sequence[pulumi.Input[str]]] authn_context_decl_refs: AuthnContext DeclRefs
        :param pulumi.Input[bool] backchannel_supported: Does the external IDP support backchannel logout?
        :param pulumi.Input[str] display_name: Friendly name for Identity Providers.
        :param pulumi.Input[bool] enabled: Enable/disable this identity provider.
        :param pulumi.Input[str] entity_id: The Entity ID that will be used to uniquely identify this SAML Service Provider.
        :param pulumi.Input[str] first_broker_login_flow_alias: Alias of authentication flow, which is triggered after first login with this identity provider. Term 'First Login' means
               that there is not yet existing Keycloak account linked with the authenticated identity provider account.
        :param pulumi.Input[bool] force_authn: Require Force Authn.
        :param pulumi.Input[str] gui_order: GUI Order
        :param pulumi.Input[bool] hide_on_login_page: Hide On Login Page.
        :param pulumi.Input[str] internal_id: Internal Identity Provider Id
        :param pulumi.Input[bool] link_only: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don't
               want to allow login from the provider, but want to integrate with a provider
        :param pulumi.Input[str] login_hint: Login Hint.
        :param pulumi.Input[str] name_id_policy_format: Name ID Policy Format.
        :param pulumi.Input[bool] post_binding_authn_request: Post Binding Authn Request.
        :param pulumi.Input[bool] post_binding_logout: Post Binding Logout.
        :param pulumi.Input[bool] post_binding_response: Post Binding Response.
        :param pulumi.Input[str] post_broker_login_flow_alias: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want
               additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if
               you don't want any additional authenticators to be triggered after login with this identity provider. Also note, that
               authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
        :param pulumi.Input[str] principal_attribute: Principal Attribute
        :param pulumi.Input[str] principal_type: Principal Type
        :param pulumi.Input[str] provider_id: provider id, is always saml, unless you have a custom implementation
        :param pulumi.Input[str] realm: Realm Name
        :param pulumi.Input[str] signature_algorithm: Signing Algorithm.
        :param pulumi.Input[str] signing_certificate: Signing Certificate.
        :param pulumi.Input[str] single_logout_service_url: Logout URL.
        :param pulumi.Input[str] single_sign_on_service_url: SSO Logout URL.
        :param pulumi.Input[bool] store_token: Enable/disable if tokens must be stored after authenticating users.
        :param pulumi.Input[str] sync_mode: Sync Mode
        :param pulumi.Input[bool] trust_email: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
        :param pulumi.Input[bool] validate_signature: Enable/disable signature validation of SAML responses.
        :param pulumi.Input[bool] want_assertions_encrypted: Want Assertions Encrypted.
        :param pulumi.Input[bool] want_assertions_signed: Want Assertions Signed.
        :param pulumi.Input[str] xml_sign_key_info_key_name_transformer: Sign Key Transformer.
        """
        if add_read_token_role_on_create is not None:
            pulumi.set(__self__, "add_read_token_role_on_create", add_read_token_role_on_create)
        if alias is not None:
            pulumi.set(__self__, "alias", alias)
        if authenticate_by_default is not None:
            pulumi.set(__self__, "authenticate_by_default", authenticate_by_default)
        if authn_context_class_refs is not None:
            pulumi.set(__self__, "authn_context_class_refs", authn_context_class_refs)
        if authn_context_comparison_type is not None:
            pulumi.set(__self__, "authn_context_comparison_type", authn_context_comparison_type)
        if authn_context_decl_refs is not None:
            pulumi.set(__self__, "authn_context_decl_refs", authn_context_decl_refs)
        if backchannel_supported is not None:
            pulumi.set(__self__, "backchannel_supported", backchannel_supported)
        if display_name is not None:
            pulumi.set(__self__, "display_name", display_name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if entity_id is not None:
            pulumi.set(__self__, "entity_id", entity_id)
        if extra_config is not None:
            pulumi.set(__self__, "extra_config", extra_config)
        if first_broker_login_flow_alias is not None:
            pulumi.set(__self__, "first_broker_login_flow_alias", first_broker_login_flow_alias)
        if force_authn is not None:
            pulumi.set(__self__, "force_authn", force_authn)
        if gui_order is not None:
            pulumi.set(__self__, "gui_order", gui_order)
        if hide_on_login_page is not None:
            pulumi.set(__self__, "hide_on_login_page", hide_on_login_page)
        if internal_id is not None:
            pulumi.set(__self__, "internal_id", internal_id)
        if link_only is not None:
            pulumi.set(__self__, "link_only", link_only)
        if login_hint is not None:
            pulumi.set(__self__, "login_hint", login_hint)
        if name_id_policy_format is not None:
            pulumi.set(__self__, "name_id_policy_format", name_id_policy_format)
        if post_binding_authn_request is not None:
            pulumi.set(__self__, "post_binding_authn_request", post_binding_authn_request)
        if post_binding_logout is not None:
            pulumi.set(__self__, "post_binding_logout", post_binding_logout)
        if post_binding_response is not None:
            pulumi.set(__self__, "post_binding_response", post_binding_response)
        if post_broker_login_flow_alias is not None:
            pulumi.set(__self__, "post_broker_login_flow_alias", post_broker_login_flow_alias)
        if principal_attribute is not None:
            pulumi.set(__self__, "principal_attribute", principal_attribute)
        if principal_type is not None:
            pulumi.set(__self__, "principal_type", principal_type)
        if provider_id is not None:
            pulumi.set(__self__, "provider_id", provider_id)
        if realm is not None:
            pulumi.set(__self__, "realm", realm)
        if signature_algorithm is not None:
            pulumi.set(__self__, "signature_algorithm", signature_algorithm)
        if signing_certificate is not None:
            pulumi.set(__self__, "signing_certificate", signing_certificate)
        if single_logout_service_url is not None:
            pulumi.set(__self__, "single_logout_service_url", single_logout_service_url)
        if single_sign_on_service_url is not None:
            pulumi.set(__self__, "single_sign_on_service_url", single_sign_on_service_url)
        if store_token is not None:
            pulumi.set(__self__, "store_token", store_token)
        if sync_mode is not None:
            pulumi.set(__self__, "sync_mode", sync_mode)
        if trust_email is not None:
            pulumi.set(__self__, "trust_email", trust_email)
        if validate_signature is not None:
            pulumi.set(__self__, "validate_signature", validate_signature)
        if want_assertions_encrypted is not None:
            pulumi.set(__self__, "want_assertions_encrypted", want_assertions_encrypted)
        if want_assertions_signed is not None:
            pulumi.set(__self__, "want_assertions_signed", want_assertions_signed)
        if xml_sign_key_info_key_name_transformer is not None:
            pulumi.set(__self__, "xml_sign_key_info_key_name_transformer", xml_sign_key_info_key_name_transformer)

    @property
    @pulumi.getter(name="addReadTokenRoleOnCreate")
    def add_read_token_role_on_create(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
        """
        return pulumi.get(self, "add_read_token_role_on_create")

    @add_read_token_role_on_create.setter
    def add_read_token_role_on_create(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "add_read_token_role_on_create", value)

    @property
    @pulumi.getter
    def alias(self) -> Optional[pulumi.Input[str]]:
        """
        The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
        """
        return pulumi.get(self, "alias")

    @alias.setter
    def alias(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "alias", value)

    @property
    @pulumi.getter(name="authenticateByDefault")
    def authenticate_by_default(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable/disable authenticate users by default.
        """
        return pulumi.get(self, "authenticate_by_default")

    @authenticate_by_default.setter
    def authenticate_by_default(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "authenticate_by_default", value)

    @property
    @pulumi.getter(name="authnContextClassRefs")
    def authn_context_class_refs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        AuthnContext ClassRefs
        """
        return pulumi.get(self, "authn_context_class_refs")

    @authn_context_class_refs.setter
    def authn_context_class_refs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "authn_context_class_refs", value)

    @property
    @pulumi.getter(name="authnContextComparisonType")
    def authn_context_comparison_type(self) -> Optional[pulumi.Input[str]]:
        """
        AuthnContext Comparison
        """
        return pulumi.get(self, "authn_context_comparison_type")

    @authn_context_comparison_type.setter
    def authn_context_comparison_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "authn_context_comparison_type", value)

    @property
    @pulumi.getter(name="authnContextDeclRefs")
    def authn_context_decl_refs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        AuthnContext DeclRefs
        """
        return pulumi.get(self, "authn_context_decl_refs")

    @authn_context_decl_refs.setter
    def authn_context_decl_refs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "authn_context_decl_refs", value)

    @property
    @pulumi.getter(name="backchannelSupported")
    def backchannel_supported(self) -> Optional[pulumi.Input[bool]]:
        """
        Does the external IDP support backchannel logout?
        """
        return pulumi.get(self, "backchannel_supported")

    @backchannel_supported.setter
    def backchannel_supported(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "backchannel_supported", value)

    @property
    @pulumi.getter(name="displayName")
    def display_name(self) -> Optional[pulumi.Input[str]]:
        """
        Friendly name for Identity Providers.
        """
        return pulumi.get(self, "display_name")

    @display_name.setter
    def display_name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "display_name", value)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable/disable this identity provider.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter(name="entityId")
    def entity_id(self) -> Optional[pulumi.Input[str]]:
        """
        The Entity ID that will be used to uniquely identify this SAML Service Provider.
        """
        return pulumi.get(self, "entity_id")

    @entity_id.setter
    def entity_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "entity_id", value)

    @property
    @pulumi.getter(name="extraConfig")
    def extra_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
        return pulumi.get(self, "extra_config")

    @extra_config.setter
    def extra_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
        pulumi.set(self, "extra_config", value)

    @property
    @pulumi.getter(name="firstBrokerLoginFlowAlias")
    def first_broker_login_flow_alias(self) -> Optional[pulumi.Input[str]]:
        """
        Alias of authentication flow, which is triggered after first login with this identity provider. Term 'First Login' means
        that there is not yet existing Keycloak account linked with the authenticated identity provider account.
        """
        return pulumi.get(self, "first_broker_login_flow_alias")

    @first_broker_login_flow_alias.setter
    def first_broker_login_flow_alias(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "first_broker_login_flow_alias", value)

    @property
    @pulumi.getter(name="forceAuthn")
    def force_authn(self) -> Optional[pulumi.Input[bool]]:
        """
        Require Force Authn.
        """
        return pulumi.get(self, "force_authn")

    @force_authn.setter
    def force_authn(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "force_authn", value)

    @property
    @pulumi.getter(name="guiOrder")
    def gui_order(self) -> Optional[pulumi.Input[str]]:
        """
        GUI Order
        """
        return pulumi.get(self, "gui_order")

    @gui_order.setter
    def gui_order(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "gui_order", value)

    @property
    @pulumi.getter(name="hideOnLoginPage")
    def hide_on_login_page(self) -> Optional[pulumi.Input[bool]]:
        """
        Hide On Login Page.
        """
        return pulumi.get(self, "hide_on_login_page")

    @hide_on_login_page.setter
    def hide_on_login_page(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "hide_on_login_page", value)

    @property
    @pulumi.getter(name="internalId")
    def internal_id(self) -> Optional[pulumi.Input[str]]:
        """
        Internal Identity Provider Id
        """
        return pulumi.get(self, "internal_id")

    @internal_id.setter
    def internal_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "internal_id", value)

    @property
    @pulumi.getter(name="linkOnly")
    def link_only(self) -> Optional[pulumi.Input[bool]]:
        """
        If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don't
        want to allow login from the provider, but want to integrate with a provider
        """
        return pulumi.get(self, "link_only")

    @link_only.setter
    def link_only(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "link_only", value)

    @property
    @pulumi.getter(name="loginHint")
    def login_hint(self) -> Optional[pulumi.Input[str]]:
        """
        Login Hint.
        """
        return pulumi.get(self, "login_hint")

    @login_hint.setter
    def login_hint(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "login_hint", value)

    @property
    @pulumi.getter(name="nameIdPolicyFormat")
    def name_id_policy_format(self) -> Optional[pulumi.Input[str]]:
        """
        Name ID Policy Format.
        """
        return pulumi.get(self, "name_id_policy_format")

    @name_id_policy_format.setter
    def name_id_policy_format(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name_id_policy_format", value)

    @property
    @pulumi.getter(name="postBindingAuthnRequest")
    def post_binding_authn_request(self) -> Optional[pulumi.Input[bool]]:
        """
        Post Binding Authn Request.
        """
        return pulumi.get(self, "post_binding_authn_request")

    @post_binding_authn_request.setter
    def post_binding_authn_request(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "post_binding_authn_request", value)

    @property
    @pulumi.getter(name="postBindingLogout")
    def post_binding_logout(self) -> Optional[pulumi.Input[bool]]:
        """
        Post Binding Logout.
        """
        return pulumi.get(self, "post_binding_logout")

    @post_binding_logout.setter
    def post_binding_logout(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "post_binding_logout", value)

    @property
    @pulumi.getter(name="postBindingResponse")
    def post_binding_response(self) -> Optional[pulumi.Input[bool]]:
        """
        Post Binding Response.
        """
        return pulumi.get(self, "post_binding_response")

    @post_binding_response.setter
    def post_binding_response(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "post_binding_response", value)

    @property
    @pulumi.getter(name="postBrokerLoginFlowAlias")
    def post_broker_login_flow_alias(self) -> Optional[pulumi.Input[str]]:
        """
        Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want
        additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if
        you don't want any additional authenticators to be triggered after login with this identity provider. Also note, that
        authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
        """
        return pulumi.get(self, "post_broker_login_flow_alias")

    @post_broker_login_flow_alias.setter
    def post_broker_login_flow_alias(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "post_broker_login_flow_alias", value)

    @property
    @pulumi.getter(name="principalAttribute")
    def principal_attribute(self) -> Optional[pulumi.Input[str]]:
        """
        Principal Attribute
        """
        return pulumi.get(self, "principal_attribute")

    @principal_attribute.setter
    def principal_attribute(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "principal_attribute", value)

    @property
    @pulumi.getter(name="principalType")
    def principal_type(self) -> Optional[pulumi.Input[str]]:
        """
        Principal Type
        """
        return pulumi.get(self, "principal_type")

    @principal_type.setter
    def principal_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "principal_type", value)

    @property
    @pulumi.getter(name="providerId")
    def provider_id(self) -> Optional[pulumi.Input[str]]:
        """
        provider id, is always saml, unless you have a custom implementation
        """
        return pulumi.get(self, "provider_id")

    @provider_id.setter
    def provider_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "provider_id", value)

    @property
    @pulumi.getter
    def realm(self) -> Optional[pulumi.Input[str]]:
        """
        Realm Name
        """
        return pulumi.get(self, "realm")

    @realm.setter
    def realm(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "realm", value)

    @property
    @pulumi.getter(name="signatureAlgorithm")
    def signature_algorithm(self) -> Optional[pulumi.Input[str]]:
        """
        Signing Algorithm.
        """
        return pulumi.get(self, "signature_algorithm")

    @signature_algorithm.setter
    def signature_algorithm(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "signature_algorithm", value)

    @property
    @pulumi.getter(name="signingCertificate")
    def signing_certificate(self) -> Optional[pulumi.Input[str]]:
        """
        Signing Certificate.
        """
        return pulumi.get(self, "signing_certificate")

    @signing_certificate.setter
    def signing_certificate(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "signing_certificate", value)

    @property
    @pulumi.getter(name="singleLogoutServiceUrl")
    def single_logout_service_url(self) -> Optional[pulumi.Input[str]]:
        """
        Logout URL.
        """
        return pulumi.get(self, "single_logout_service_url")

    @single_logout_service_url.setter
    def single_logout_service_url(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "single_logout_service_url", value)

    @property
    @pulumi.getter(name="singleSignOnServiceUrl")
    def single_sign_on_service_url(self) -> Optional[pulumi.Input[str]]:
        """
        SSO Logout URL.
        """
        return pulumi.get(self, "single_sign_on_service_url")

    @single_sign_on_service_url.setter
    def single_sign_on_service_url(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "single_sign_on_service_url", value)

    @property
    @pulumi.getter(name="storeToken")
    def store_token(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable/disable if tokens must be stored after authenticating users.
        """
        return pulumi.get(self, "store_token")

    @store_token.setter
    def store_token(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "store_token", value)

    @property
    @pulumi.getter(name="syncMode")
    def sync_mode(self) -> Optional[pulumi.Input[str]]:
        """
        Sync Mode
        """
        return pulumi.get(self, "sync_mode")

    @sync_mode.setter
    def sync_mode(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "sync_mode", value)

    @property
    @pulumi.getter(name="trustEmail")
    def trust_email(self) -> Optional[pulumi.Input[bool]]:
        """
        If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
        """
        return pulumi.get(self, "trust_email")

    @trust_email.setter
    def trust_email(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "trust_email", value)

    @property
    @pulumi.getter(name="validateSignature")
    def validate_signature(self) -> Optional[pulumi.Input[bool]]:
        """
        Enable/disable signature validation of SAML responses.
        """
        return pulumi.get(self, "validate_signature")

    @validate_signature.setter
    def validate_signature(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "validate_signature", value)

    @property
    @pulumi.getter(name="wantAssertionsEncrypted")
    def want_assertions_encrypted(self) -> Optional[pulumi.Input[bool]]:
        """
        Want Assertions Encrypted.
        """
        return pulumi.get(self, "want_assertions_encrypted")

    @want_assertions_encrypted.setter
    def want_assertions_encrypted(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "want_assertions_encrypted", value)

    @property
    @pulumi.getter(name="wantAssertionsSigned")
    def want_assertions_signed(self) -> Optional[pulumi.Input[bool]]:
        """
        Want Assertions Signed.
        """
        return pulumi.get(self, "want_assertions_signed")

    @want_assertions_signed.setter
    def want_assertions_signed(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "want_assertions_signed", value)

    @property
    @pulumi.getter(name="xmlSignKeyInfoKeyNameTransformer")
    def xml_sign_key_info_key_name_transformer(self) -> Optional[pulumi.Input[str]]:
        """
        Sign Key Transformer.
        """
        return pulumi.get(self, "xml_sign_key_info_key_name_transformer")

    @xml_sign_key_info_key_name_transformer.setter
    def xml_sign_key_info_key_name_transformer(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "xml_sign_key_info_key_name_transformer", value)


class IdentityProvider(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 add_read_token_role_on_create: Optional[pulumi.Input[bool]] = None,
                 alias: Optional[pulumi.Input[str]] = None,
                 authenticate_by_default: Optional[pulumi.Input[bool]] = None,
                 authn_context_class_refs: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 authn_context_comparison_type: Optional[pulumi.Input[str]] = None,
                 authn_context_decl_refs: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 backchannel_supported: Optional[pulumi.Input[bool]] = None,
                 display_name: Optional[pulumi.Input[str]] = None,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 entity_id: Optional[pulumi.Input[str]] = None,
                 extra_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                 first_broker_login_flow_alias: Optional[pulumi.Input[str]] = None,
                 force_authn: Optional[pulumi.Input[bool]] = None,
                 gui_order: Optional[pulumi.Input[str]] = None,
                 hide_on_login_page: Optional[pulumi.Input[bool]] = None,
                 link_only: Optional[pulumi.Input[bool]] = None,
                 login_hint: Optional[pulumi.Input[str]] = None,
                 name_id_policy_format: Optional[pulumi.Input[str]] = None,
                 post_binding_authn_request: Optional[pulumi.Input[bool]] = None,
                 post_binding_logout: Optional[pulumi.Input[bool]] = None,
                 post_binding_response: Optional[pulumi.Input[bool]] = None,
                 post_broker_login_flow_alias: Optional[pulumi.Input[str]] = None,
                 principal_attribute: Optional[pulumi.Input[str]] = None,
                 principal_type: Optional[pulumi.Input[str]] = None,
                 provider_id: Optional[pulumi.Input[str]] = None,
                 realm: Optional[pulumi.Input[str]] = None,
                 signature_algorithm: Optional[pulumi.Input[str]] = None,
                 signing_certificate: Optional[pulumi.Input[str]] = None,
                 single_logout_service_url: Optional[pulumi.Input[str]] = None,
                 single_sign_on_service_url: Optional[pulumi.Input[str]] = None,
                 store_token: Optional[pulumi.Input[bool]] = None,
                 sync_mode: Optional[pulumi.Input[str]] = None,
                 trust_email: Optional[pulumi.Input[bool]] = None,
                 validate_signature: Optional[pulumi.Input[bool]] = None,
                 want_assertions_encrypted: Optional[pulumi.Input[bool]] = None,
                 want_assertions_signed: Optional[pulumi.Input[bool]] = None,
                 xml_sign_key_info_key_name_transformer: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        """
        ## # saml.IdentityProvider

        Allows to create and manage SAML Identity Providers within Keycloak.

        SAML (Security Assertion Markup Language) identity providers allows to authenticate through a third-party system, using SAML standard.

        ### Example Usage

        ```python
        import pulumi
        import pulumi_keycloak as keycloak

        realm_identity_provider = keycloak.saml.IdentityProvider("realm_identity_provider",
            realm="my-realm",
            alias="my-idp",
            single_sign_on_service_url="https://domain.com/adfs/ls/",
            single_logout_service_url="https://domain.com/adfs/ls/?wa=wsignout1.0",
            backchannel_supported=True,
            post_binding_response=True,
            post_binding_logout=True,
            post_binding_authn_request=True,
            store_token=False,
            trust_email=True,
            force_authn=True)
        ```

        ### Argument Reference

        The following arguments are supported:

        - `realm` - (Required) The name of the realm. This is unique across Keycloak.
        - `alias` - (Optional) The uniq name of identity provider.
        - `enabled` - (Optional) When false, users and clients will not be able to access this realm. Defaults to `true`.
        - `display_name` - (Optional) The display name for the realm that is shown when logging in to the admin console.
        - `store_token` - (Optional) Enable/disable if tokens must be stored after authenticating users. Defaults to `true`.
        - `add_read_token_role_on_create` - (Optional) Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role. Defaults to `false`.
        - `trust_email` - (Optional) If enabled then email provided by this provider is not verified even if verification is enabled for the realm. Defaults to `false`.
        - `link_only` - (Optional) If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don't want to allow login from the provider, but want to integrate with a provider. Defaults to `false`.
        - `hide_on_login_page` - (Optional) If hidden, then login with this provider is possible only if requested explicitly, e.g. using the 'kc_idp_hint' parameter.
        - `first_broker_login_flow_alias` - (Optional) Alias of authentication flow, which is triggered after first login with this identity provider. Term 'First Login' means that there is not yet existing Keycloak account linked with the authenticated identity provider account. Defaults to `first broker login`.
        - `post_broker_login_flow_alias` - (Optional) Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don't want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it. Defaults to empty.
        - `authenticate_by_default` - (Optional) Authenticate users by default. Defaults to `false`.

        #### SAML Configuration

        - `single_sign_on_service_url` - (Optional) The Url that must be used to send authentication requests (SAML AuthnRequest).
        - `single_logout_service_url` - (Optional) The Url that must be used to send logout requests.
        - `backchannel_supported` - (Optional) Does the external IDP support back-channel logout ?.
        - `name_id_policy_format` - (Optional) Specifies the URI reference corresponding to a name identifier format. Defaults to empty.
        - `post_binding_response` - (Optional) Indicates whether to respond to requests using HTTP-POST binding. If false, HTTP-REDIRECT binding will be used..
        - `post_binding_authn_request` - (Optional) Indicates whether the AuthnRequest must be sent using HTTP-POST binding. If false, HTTP-REDIRECT binding will be used.
        - `post_binding_logout` - (Optional) Indicates whether to respond to requests using HTTP-POST binding. If false, HTTP-REDIRECT binding will be used.
        - `want_assertions_signed` - (Optional) Indicates whether this service provider expects a signed Assertion.
        - `want_assertions_encrypted` - (Optional) Indicates whether this service provider expects an encrypted Assertion.
        - `force_authn` - (Optional) Indicates whether the identity provider must authenticate the presenter directly rather than rely on a previous security context.
        - `validate_signature` - (Optional) Enable/disable signature validation of SAML responses.
        - `signing_certificate` - (Optional) Signing Certificate.
        - `signature_algorithm` - (Optional) Signing Algorithm. Defaults to empty.
        - `xml_sign_key_info_key_name_transformer` - (Optional) Sign Key Transformer. Defaults to empty.

        ### Import

        Identity providers can be imported using the format `{{realm_id}}/{{idp_alias}}`, where `idp_alias` is the identity provider alias.

        Example:

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[bool] add_read_token_role_on_create: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
        :param pulumi.Input[str] alias: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
        :param pulumi.Input[bool] authenticate_by_default: Enable/disable authenticate users by default.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] authn_context_class_refs: AuthnContext ClassRefs
        :param pulumi.Input[str] authn_context_comparison_type: AuthnContext Comparison
        :param pulumi.Input[Sequence[pulumi.Input[str]]] authn_context_decl_refs: AuthnContext DeclRefs
        :param pulumi.Input[bool] backchannel_supported: Does the external IDP support backchannel logout?
        :param pulumi.Input[str] display_name: Friendly name for Identity Providers.
        :param pulumi.Input[bool] enabled: Enable/disable this identity provider.
        :param pulumi.Input[str] entity_id: The Entity ID that will be used to uniquely identify this SAML Service Provider.
        :param pulumi.Input[str] first_broker_login_flow_alias: Alias of authentication flow, which is triggered after first login with this identity provider. Term 'First Login' means
               that there is not yet existing Keycloak account linked with the authenticated identity provider account.
        :param pulumi.Input[bool] force_authn: Require Force Authn.
        :param pulumi.Input[str] gui_order: GUI Order
        :param pulumi.Input[bool] hide_on_login_page: Hide On Login Page.
        :param pulumi.Input[bool] link_only: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don't
               want to allow login from the provider, but want to integrate with a provider
        :param pulumi.Input[str] login_hint: Login Hint.
        :param pulumi.Input[str] name_id_policy_format: Name ID Policy Format.
        :param pulumi.Input[bool] post_binding_authn_request: Post Binding Authn Request.
        :param pulumi.Input[bool] post_binding_logout: Post Binding Logout.
        :param pulumi.Input[bool] post_binding_response: Post Binding Response.
        :param pulumi.Input[str] post_broker_login_flow_alias: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want
               additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if
               you don't want any additional authenticators to be triggered after login with this identity provider. Also note, that
               authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
        :param pulumi.Input[str] principal_attribute: Principal Attribute
        :param pulumi.Input[str] principal_type: Principal Type
        :param pulumi.Input[str] provider_id: provider id, is always saml, unless you have a custom implementation
        :param pulumi.Input[str] realm: Realm Name
        :param pulumi.Input[str] signature_algorithm: Signing Algorithm.
        :param pulumi.Input[str] signing_certificate: Signing Certificate.
        :param pulumi.Input[str] single_logout_service_url: Logout URL.
        :param pulumi.Input[str] single_sign_on_service_url: SSO Logout URL.
        :param pulumi.Input[bool] store_token: Enable/disable if tokens must be stored after authenticating users.
        :param pulumi.Input[str] sync_mode: Sync Mode
        :param pulumi.Input[bool] trust_email: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
        :param pulumi.Input[bool] validate_signature: Enable/disable signature validation of SAML responses.
        :param pulumi.Input[bool] want_assertions_encrypted: Want Assertions Encrypted.
        :param pulumi.Input[bool] want_assertions_signed: Want Assertions Signed.
        :param pulumi.Input[str] xml_sign_key_info_key_name_transformer: Sign Key Transformer.
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: IdentityProviderArgs,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        ## # saml.IdentityProvider

        Allows to create and manage SAML Identity Providers within Keycloak.

        SAML (Security Assertion Markup Language) identity providers allows to authenticate through a third-party system, using SAML standard.

        ### Example Usage

        ```python
        import pulumi
        import pulumi_keycloak as keycloak

        realm_identity_provider = keycloak.saml.IdentityProvider("realm_identity_provider",
            realm="my-realm",
            alias="my-idp",
            single_sign_on_service_url="https://domain.com/adfs/ls/",
            single_logout_service_url="https://domain.com/adfs/ls/?wa=wsignout1.0",
            backchannel_supported=True,
            post_binding_response=True,
            post_binding_logout=True,
            post_binding_authn_request=True,
            store_token=False,
            trust_email=True,
            force_authn=True)
        ```

        ### Argument Reference

        The following arguments are supported:

        - `realm` - (Required) The name of the realm. This is unique across Keycloak.
        - `alias` - (Optional) The uniq name of identity provider.
        - `enabled` - (Optional) When false, users and clients will not be able to access this realm. Defaults to `true`.
        - `display_name` - (Optional) The display name for the realm that is shown when logging in to the admin console.
        - `store_token` - (Optional) Enable/disable if tokens must be stored after authenticating users. Defaults to `true`.
        - `add_read_token_role_on_create` - (Optional) Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role. Defaults to `false`.
        - `trust_email` - (Optional) If enabled then email provided by this provider is not verified even if verification is enabled for the realm. Defaults to `false`.
        - `link_only` - (Optional) If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don't want to allow login from the provider, but want to integrate with a provider. Defaults to `false`.
        - `hide_on_login_page` - (Optional) If hidden, then login with this provider is possible only if requested explicitly, e.g. using the 'kc_idp_hint' parameter.
        - `first_broker_login_flow_alias` - (Optional) Alias of authentication flow, which is triggered after first login with this identity provider. Term 'First Login' means that there is not yet existing Keycloak account linked with the authenticated identity provider account. Defaults to `first broker login`.
        - `post_broker_login_flow_alias` - (Optional) Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if you don't want any additional authenticators to be triggered after login with this identity provider. Also note, that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it. Defaults to empty.
        - `authenticate_by_default` - (Optional) Authenticate users by default. Defaults to `false`.

        #### SAML Configuration

        - `single_sign_on_service_url` - (Optional) The Url that must be used to send authentication requests (SAML AuthnRequest).
        - `single_logout_service_url` - (Optional) The Url that must be used to send logout requests.
        - `backchannel_supported` - (Optional) Does the external IDP support back-channel logout ?.
        - `name_id_policy_format` - (Optional) Specifies the URI reference corresponding to a name identifier format. Defaults to empty.
        - `post_binding_response` - (Optional) Indicates whether to respond to requests using HTTP-POST binding. If false, HTTP-REDIRECT binding will be used..
        - `post_binding_authn_request` - (Optional) Indicates whether the AuthnRequest must be sent using HTTP-POST binding. If false, HTTP-REDIRECT binding will be used.
        - `post_binding_logout` - (Optional) Indicates whether to respond to requests using HTTP-POST binding. If false, HTTP-REDIRECT binding will be used.
        - `want_assertions_signed` - (Optional) Indicates whether this service provider expects a signed Assertion.
        - `want_assertions_encrypted` - (Optional) Indicates whether this service provider expects an encrypted Assertion.
        - `force_authn` - (Optional) Indicates whether the identity provider must authenticate the presenter directly rather than rely on a previous security context.
        - `validate_signature` - (Optional) Enable/disable signature validation of SAML responses.
        - `signing_certificate` - (Optional) Signing Certificate.
        - `signature_algorithm` - (Optional) Signing Algorithm. Defaults to empty.
        - `xml_sign_key_info_key_name_transformer` - (Optional) Sign Key Transformer. Defaults to empty.

        ### Import

        Identity providers can be imported using the format `{{realm_id}}/{{idp_alias}}`, where `idp_alias` is the identity provider alias.

        Example:

        :param str resource_name: The name of the resource.
        :param IdentityProviderArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(IdentityProviderArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 add_read_token_role_on_create: Optional[pulumi.Input[bool]] = None,
                 alias: Optional[pulumi.Input[str]] = None,
                 authenticate_by_default: Optional[pulumi.Input[bool]] = None,
                 authn_context_class_refs: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 authn_context_comparison_type: Optional[pulumi.Input[str]] = None,
                 authn_context_decl_refs: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 backchannel_supported: Optional[pulumi.Input[bool]] = None,
                 display_name: Optional[pulumi.Input[str]] = None,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 entity_id: Optional[pulumi.Input[str]] = None,
                 extra_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                 first_broker_login_flow_alias: Optional[pulumi.Input[str]] = None,
                 force_authn: Optional[pulumi.Input[bool]] = None,
                 gui_order: Optional[pulumi.Input[str]] = None,
                 hide_on_login_page: Optional[pulumi.Input[bool]] = None,
                 link_only: Optional[pulumi.Input[bool]] = None,
                 login_hint: Optional[pulumi.Input[str]] = None,
                 name_id_policy_format: Optional[pulumi.Input[str]] = None,
                 post_binding_authn_request: Optional[pulumi.Input[bool]] = None,
                 post_binding_logout: Optional[pulumi.Input[bool]] = None,
                 post_binding_response: Optional[pulumi.Input[bool]] = None,
                 post_broker_login_flow_alias: Optional[pulumi.Input[str]] = None,
                 principal_attribute: Optional[pulumi.Input[str]] = None,
                 principal_type: Optional[pulumi.Input[str]] = None,
                 provider_id: Optional[pulumi.Input[str]] = None,
                 realm: Optional[pulumi.Input[str]] = None,
                 signature_algorithm: Optional[pulumi.Input[str]] = None,
                 signing_certificate: Optional[pulumi.Input[str]] = None,
                 single_logout_service_url: Optional[pulumi.Input[str]] = None,
                 single_sign_on_service_url: Optional[pulumi.Input[str]] = None,
                 store_token: Optional[pulumi.Input[bool]] = None,
                 sync_mode: Optional[pulumi.Input[str]] = None,
                 trust_email: Optional[pulumi.Input[bool]] = None,
                 validate_signature: Optional[pulumi.Input[bool]] = None,
                 want_assertions_encrypted: Optional[pulumi.Input[bool]] = None,
                 want_assertions_signed: Optional[pulumi.Input[bool]] = None,
                 xml_sign_key_info_key_name_transformer: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = IdentityProviderArgs.__new__(IdentityProviderArgs)

            __props__.__dict__["add_read_token_role_on_create"] = add_read_token_role_on_create
            if alias is None and not opts.urn:
                raise TypeError("Missing required property 'alias'")
            __props__.__dict__["alias"] = alias
            __props__.__dict__["authenticate_by_default"] = authenticate_by_default
            __props__.__dict__["authn_context_class_refs"] = authn_context_class_refs
            __props__.__dict__["authn_context_comparison_type"] = authn_context_comparison_type
            __props__.__dict__["authn_context_decl_refs"] = authn_context_decl_refs
            __props__.__dict__["backchannel_supported"] = backchannel_supported
            __props__.__dict__["display_name"] = display_name
            __props__.__dict__["enabled"] = enabled
            if entity_id is None and not opts.urn:
                raise TypeError("Missing required property 'entity_id'")
            __props__.__dict__["entity_id"] = entity_id
            __props__.__dict__["extra_config"] = extra_config
            __props__.__dict__["first_broker_login_flow_alias"] = first_broker_login_flow_alias
            __props__.__dict__["force_authn"] = force_authn
            __props__.__dict__["gui_order"] = gui_order
            __props__.__dict__["hide_on_login_page"] = hide_on_login_page
            __props__.__dict__["link_only"] = link_only
            __props__.__dict__["login_hint"] = login_hint
            __props__.__dict__["name_id_policy_format"] = name_id_policy_format
            __props__.__dict__["post_binding_authn_request"] = post_binding_authn_request
            __props__.__dict__["post_binding_logout"] = post_binding_logout
            __props__.__dict__["post_binding_response"] = post_binding_response
            __props__.__dict__["post_broker_login_flow_alias"] = post_broker_login_flow_alias
            __props__.__dict__["principal_attribute"] = principal_attribute
            __props__.__dict__["principal_type"] = principal_type
            __props__.__dict__["provider_id"] = provider_id
            if realm is None and not opts.urn:
                raise TypeError("Missing required property 'realm'")
            __props__.__dict__["realm"] = realm
            __props__.__dict__["signature_algorithm"] = signature_algorithm
            __props__.__dict__["signing_certificate"] = signing_certificate
            __props__.__dict__["single_logout_service_url"] = single_logout_service_url
            if single_sign_on_service_url is None and not opts.urn:
                raise TypeError("Missing required property 'single_sign_on_service_url'")
            __props__.__dict__["single_sign_on_service_url"] = single_sign_on_service_url
            __props__.__dict__["store_token"] = store_token
            __props__.__dict__["sync_mode"] = sync_mode
            __props__.__dict__["trust_email"] = trust_email
            __props__.__dict__["validate_signature"] = validate_signature
            __props__.__dict__["want_assertions_encrypted"] = want_assertions_encrypted
            __props__.__dict__["want_assertions_signed"] = want_assertions_signed
            __props__.__dict__["xml_sign_key_info_key_name_transformer"] = xml_sign_key_info_key_name_transformer
            __props__.__dict__["internal_id"] = None
        super(IdentityProvider, __self__).__init__(
            'keycloak:saml/identityProvider:IdentityProvider',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            add_read_token_role_on_create: Optional[pulumi.Input[bool]] = None,
            alias: Optional[pulumi.Input[str]] = None,
            authenticate_by_default: Optional[pulumi.Input[bool]] = None,
            authn_context_class_refs: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
            authn_context_comparison_type: Optional[pulumi.Input[str]] = None,
            authn_context_decl_refs: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
            backchannel_supported: Optional[pulumi.Input[bool]] = None,
            display_name: Optional[pulumi.Input[str]] = None,
            enabled: Optional[pulumi.Input[bool]] = None,
            entity_id: Optional[pulumi.Input[str]] = None,
            extra_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
            first_broker_login_flow_alias: Optional[pulumi.Input[str]] = None,
            force_authn: Optional[pulumi.Input[bool]] = None,
            gui_order: Optional[pulumi.Input[str]] = None,
            hide_on_login_page: Optional[pulumi.Input[bool]] = None,
            internal_id: Optional[pulumi.Input[str]] = None,
            link_only: Optional[pulumi.Input[bool]] = None,
            login_hint: Optional[pulumi.Input[str]] = None,
            name_id_policy_format: Optional[pulumi.Input[str]] = None,
            post_binding_authn_request: Optional[pulumi.Input[bool]] = None,
            post_binding_logout: Optional[pulumi.Input[bool]] = None,
            post_binding_response: Optional[pulumi.Input[bool]] = None,
            post_broker_login_flow_alias: Optional[pulumi.Input[str]] = None,
            principal_attribute: Optional[pulumi.Input[str]] = None,
            principal_type: Optional[pulumi.Input[str]] = None,
            provider_id: Optional[pulumi.Input[str]] = None,
            realm: Optional[pulumi.Input[str]] = None,
            signature_algorithm: Optional[pulumi.Input[str]] = None,
            signing_certificate: Optional[pulumi.Input[str]] = None,
            single_logout_service_url: Optional[pulumi.Input[str]] = None,
            single_sign_on_service_url: Optional[pulumi.Input[str]] = None,
            store_token: Optional[pulumi.Input[bool]] = None,
            sync_mode: Optional[pulumi.Input[str]] = None,
            trust_email: Optional[pulumi.Input[bool]] = None,
            validate_signature: Optional[pulumi.Input[bool]] = None,
            want_assertions_encrypted: Optional[pulumi.Input[bool]] = None,
            want_assertions_signed: Optional[pulumi.Input[bool]] = None,
            xml_sign_key_info_key_name_transformer: Optional[pulumi.Input[str]] = None) -> 'IdentityProvider':
        """
        Get an existing IdentityProvider resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[bool] add_read_token_role_on_create: Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
        :param pulumi.Input[str] alias: The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
        :param pulumi.Input[bool] authenticate_by_default: Enable/disable authenticate users by default.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] authn_context_class_refs: AuthnContext ClassRefs
        :param pulumi.Input[str] authn_context_comparison_type: AuthnContext Comparison
        :param pulumi.Input[Sequence[pulumi.Input[str]]] authn_context_decl_refs: AuthnContext DeclRefs
        :param pulumi.Input[bool] backchannel_supported: Does the external IDP support backchannel logout?
        :param pulumi.Input[str] display_name: Friendly name for Identity Providers.
        :param pulumi.Input[bool] enabled: Enable/disable this identity provider.
        :param pulumi.Input[str] entity_id: The Entity ID that will be used to uniquely identify this SAML Service Provider.
        :param pulumi.Input[str] first_broker_login_flow_alias: Alias of authentication flow, which is triggered after first login with this identity provider. Term 'First Login' means
               that there is not yet existing Keycloak account linked with the authenticated identity provider account.
        :param pulumi.Input[bool] force_authn: Require Force Authn.
        :param pulumi.Input[str] gui_order: GUI Order
        :param pulumi.Input[bool] hide_on_login_page: Hide On Login Page.
        :param pulumi.Input[str] internal_id: Internal Identity Provider Id
        :param pulumi.Input[bool] link_only: If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don't
               want to allow login from the provider, but want to integrate with a provider
        :param pulumi.Input[str] login_hint: Login Hint.
        :param pulumi.Input[str] name_id_policy_format: Name ID Policy Format.
        :param pulumi.Input[bool] post_binding_authn_request: Post Binding Authn Request.
        :param pulumi.Input[bool] post_binding_logout: Post Binding Logout.
        :param pulumi.Input[bool] post_binding_response: Post Binding Response.
        :param pulumi.Input[str] post_broker_login_flow_alias: Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want
               additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if
               you don't want any additional authenticators to be triggered after login with this identity provider. Also note, that
               authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
        :param pulumi.Input[str] principal_attribute: Principal Attribute
        :param pulumi.Input[str] principal_type: Principal Type
        :param pulumi.Input[str] provider_id: provider id, is always saml, unless you have a custom implementation
        :param pulumi.Input[str] realm: Realm Name
        :param pulumi.Input[str] signature_algorithm: Signing Algorithm.
        :param pulumi.Input[str] signing_certificate: Signing Certificate.
        :param pulumi.Input[str] single_logout_service_url: Logout URL.
        :param pulumi.Input[str] single_sign_on_service_url: SSO Logout URL.
        :param pulumi.Input[bool] store_token: Enable/disable if tokens must be stored after authenticating users.
        :param pulumi.Input[str] sync_mode: Sync Mode
        :param pulumi.Input[bool] trust_email: If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
        :param pulumi.Input[bool] validate_signature: Enable/disable signature validation of SAML responses.
        :param pulumi.Input[bool] want_assertions_encrypted: Want Assertions Encrypted.
        :param pulumi.Input[bool] want_assertions_signed: Want Assertions Signed.
        :param pulumi.Input[str] xml_sign_key_info_key_name_transformer: Sign Key Transformer.
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _IdentityProviderState.__new__(_IdentityProviderState)

        __props__.__dict__["add_read_token_role_on_create"] = add_read_token_role_on_create
        __props__.__dict__["alias"] = alias
        __props__.__dict__["authenticate_by_default"] = authenticate_by_default
        __props__.__dict__["authn_context_class_refs"] = authn_context_class_refs
        __props__.__dict__["authn_context_comparison_type"] = authn_context_comparison_type
        __props__.__dict__["authn_context_decl_refs"] = authn_context_decl_refs
        __props__.__dict__["backchannel_supported"] = backchannel_supported
        __props__.__dict__["display_name"] = display_name
        __props__.__dict__["enabled"] = enabled
        __props__.__dict__["entity_id"] = entity_id
        __props__.__dict__["extra_config"] = extra_config
        __props__.__dict__["first_broker_login_flow_alias"] = first_broker_login_flow_alias
        __props__.__dict__["force_authn"] = force_authn
        __props__.__dict__["gui_order"] = gui_order
        __props__.__dict__["hide_on_login_page"] = hide_on_login_page
        __props__.__dict__["internal_id"] = internal_id
        __props__.__dict__["link_only"] = link_only
        __props__.__dict__["login_hint"] = login_hint
        __props__.__dict__["name_id_policy_format"] = name_id_policy_format
        __props__.__dict__["post_binding_authn_request"] = post_binding_authn_request
        __props__.__dict__["post_binding_logout"] = post_binding_logout
        __props__.__dict__["post_binding_response"] = post_binding_response
        __props__.__dict__["post_broker_login_flow_alias"] = post_broker_login_flow_alias
        __props__.__dict__["principal_attribute"] = principal_attribute
        __props__.__dict__["principal_type"] = principal_type
        __props__.__dict__["provider_id"] = provider_id
        __props__.__dict__["realm"] = realm
        __props__.__dict__["signature_algorithm"] = signature_algorithm
        __props__.__dict__["signing_certificate"] = signing_certificate
        __props__.__dict__["single_logout_service_url"] = single_logout_service_url
        __props__.__dict__["single_sign_on_service_url"] = single_sign_on_service_url
        __props__.__dict__["store_token"] = store_token
        __props__.__dict__["sync_mode"] = sync_mode
        __props__.__dict__["trust_email"] = trust_email
        __props__.__dict__["validate_signature"] = validate_signature
        __props__.__dict__["want_assertions_encrypted"] = want_assertions_encrypted
        __props__.__dict__["want_assertions_signed"] = want_assertions_signed
        __props__.__dict__["xml_sign_key_info_key_name_transformer"] = xml_sign_key_info_key_name_transformer
        return IdentityProvider(resource_name, opts=opts, __props__=__props__)

    @property
    @pulumi.getter(name="addReadTokenRoleOnCreate")
    def add_read_token_role_on_create(self) -> pulumi.Output[Optional[bool]]:
        """
        Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
        """
        return pulumi.get(self, "add_read_token_role_on_create")

    @property
    @pulumi.getter
    def alias(self) -> pulumi.Output[str]:
        """
        The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
        """
        return pulumi.get(self, "alias")

    @property
    @pulumi.getter(name="authenticateByDefault")
    def authenticate_by_default(self) -> pulumi.Output[Optional[bool]]:
        """
        Enable/disable authenticate users by default.
        """
        return pulumi.get(self, "authenticate_by_default")

    @property
    @pulumi.getter(name="authnContextClassRefs")
    def authn_context_class_refs(self) -> pulumi.Output[Optional[Sequence[str]]]:
        """
        AuthnContext ClassRefs
        """
        return pulumi.get(self, "authn_context_class_refs")

    @property
    @pulumi.getter(name="authnContextComparisonType")
    def authn_context_comparison_type(self) -> pulumi.Output[Optional[str]]:
        """
        AuthnContext Comparison
        """
        return pulumi.get(self, "authn_context_comparison_type")

    @property
    @pulumi.getter(name="authnContextDeclRefs")
    def authn_context_decl_refs(self) -> pulumi.Output[Optional[Sequence[str]]]:
        """
        AuthnContext DeclRefs
        """
        return pulumi.get(self, "authn_context_decl_refs")

    @property
    @pulumi.getter(name="backchannelSupported")
    def backchannel_supported(self) -> pulumi.Output[Optional[bool]]:
        """
        Does the external IDP support backchannel logout?
        """
        return pulumi.get(self, "backchannel_supported")

    @property
    @pulumi.getter(name="displayName")
    def display_name(self) -> pulumi.Output[Optional[str]]:
        """
        Friendly name for Identity Providers.
        """
        return pulumi.get(self, "display_name")

    @property
    @pulumi.getter
    def enabled(self) -> pulumi.Output[Optional[bool]]:
        """
        Enable/disable this identity provider.
        """
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter(name="entityId")
    def entity_id(self) -> pulumi.Output[str]:
        """
        The Entity ID that will be used to uniquely identify this SAML Service Provider.
        """
        return pulumi.get(self, "entity_id")

    @property
    @pulumi.getter(name="extraConfig")
    def extra_config(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
        return pulumi.get(self, "extra_config")

    @property
    @pulumi.getter(name="firstBrokerLoginFlowAlias")
    def first_broker_login_flow_alias(self) -> pulumi.Output[Optional[str]]:
        """
        Alias of authentication flow, which is triggered after first login with this identity provider. Term 'First Login' means
        that there is not yet existing Keycloak account linked with the authenticated identity provider account.
        """
        return pulumi.get(self, "first_broker_login_flow_alias")

    @property
    @pulumi.getter(name="forceAuthn")
    def force_authn(self) -> pulumi.Output[Optional[bool]]:
        """
        Require Force Authn.
        """
        return pulumi.get(self, "force_authn")

    @property
    @pulumi.getter(name="guiOrder")
    def gui_order(self) -> pulumi.Output[Optional[str]]:
        """
        GUI Order
        """
        return pulumi.get(self, "gui_order")

    @property
    @pulumi.getter(name="hideOnLoginPage")
    def hide_on_login_page(self) -> pulumi.Output[Optional[bool]]:
        """
        Hide On Login Page.
        """
        return pulumi.get(self, "hide_on_login_page")

    @property
    @pulumi.getter(name="internalId")
    def internal_id(self) -> pulumi.Output[str]:
        """
        Internal Identity Provider Id
        """
        return pulumi.get(self, "internal_id")

    @property
    @pulumi.getter(name="linkOnly")
    def link_only(self) -> pulumi.Output[Optional[bool]]:
        """
        If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don't
        want to allow login from the provider, but want to integrate with a provider
        """
        return pulumi.get(self, "link_only")

    @property
    @pulumi.getter(name="loginHint")
    def login_hint(self) -> pulumi.Output[Optional[str]]:
        """
        Login Hint.
        """
        return pulumi.get(self, "login_hint")

    @property
    @pulumi.getter(name="nameIdPolicyFormat")
    def name_id_policy_format(self) -> pulumi.Output[Optional[str]]:
        """
        Name ID Policy Format.
        """
        return pulumi.get(self, "name_id_policy_format")

    @property
    @pulumi.getter(name="postBindingAuthnRequest")
    def post_binding_authn_request(self) -> pulumi.Output[Optional[bool]]:
        """
        Post Binding Authn Request.
        """
        return pulumi.get(self, "post_binding_authn_request")

    @property
    @pulumi.getter(name="postBindingLogout")
    def post_binding_logout(self) -> pulumi.Output[Optional[bool]]:
        """
        Post Binding Logout.
        """
        return pulumi.get(self, "post_binding_logout")

    @property
    @pulumi.getter(name="postBindingResponse")
    def post_binding_response(self) -> pulumi.Output[Optional[bool]]:
        """
        Post Binding Response.
        """
        return pulumi.get(self, "post_binding_response")

    @property
    @pulumi.getter(name="postBrokerLoginFlowAlias")
    def post_broker_login_flow_alias(self) -> pulumi.Output[Optional[str]]:
        """
        Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want
        additional verification of each user authenticated with this identity provider (for example OTP). Leave this empty if
        you don't want any additional authenticators to be triggered after login with this identity provider. Also note, that
        authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
        """
        return pulumi.get(self, "post_broker_login_flow_alias")

    @property
    @pulumi.getter(name="principalAttribute")
    def principal_attribute(self) -> pulumi.Output[Optional[str]]:
        """
        Principal Attribute
        """
        return pulumi.get(self, "principal_attribute")

    @property
    @pulumi.getter(name="principalType")
    def principal_type(self) -> pulumi.Output[Optional[str]]:
        """
        Principal Type
        """
        return pulumi.get(self, "principal_type")

    @property
    @pulumi.getter(name="providerId")
    def provider_id(self) -> pulumi.Output[Optional[str]]:
        """
        provider id, is always saml, unless you have a custom implementation
        """
        return pulumi.get(self, "provider_id")

    @property
    @pulumi.getter
    def realm(self) -> pulumi.Output[str]:
        """
        Realm Name
        """
        return pulumi.get(self, "realm")

    @property
    @pulumi.getter(name="signatureAlgorithm")
    def signature_algorithm(self) -> pulumi.Output[Optional[str]]:
        """
        Signing Algorithm.
        """
        return pulumi.get(self, "signature_algorithm")

    @property
    @pulumi.getter(name="signingCertificate")
    def signing_certificate(self) -> pulumi.Output[Optional[str]]:
        """
        Signing Certificate.
        """
        return pulumi.get(self, "signing_certificate")

    @property
    @pulumi.getter(name="singleLogoutServiceUrl")
    def single_logout_service_url(self) -> pulumi.Output[Optional[str]]:
        """
        Logout URL.
        """
        return pulumi.get(self, "single_logout_service_url")

    @property
    @pulumi.getter(name="singleSignOnServiceUrl")
    def single_sign_on_service_url(self) -> pulumi.Output[str]:
        """
        SSO Logout URL.
        """
        return pulumi.get(self, "single_sign_on_service_url")

    @property
    @pulumi.getter(name="storeToken")
    def store_token(self) -> pulumi.Output[Optional[bool]]:
        """
        Enable/disable if tokens must be stored after authenticating users.
        """
        return pulumi.get(self, "store_token")

    @property
    @pulumi.getter(name="syncMode")
    def sync_mode(self) -> pulumi.Output[Optional[str]]:
        """
        Sync Mode
        """
        return pulumi.get(self, "sync_mode")

    @property
    @pulumi.getter(name="trustEmail")
    def trust_email(self) -> pulumi.Output[Optional[bool]]:
        """
        If enabled then email provided by this provider is not verified even if verification is enabled for the realm.
        """
        return pulumi.get(self, "trust_email")

    @property
    @pulumi.getter(name="validateSignature")
    def validate_signature(self) -> pulumi.Output[Optional[bool]]:
        """
        Enable/disable signature validation of SAML responses.
        """
        return pulumi.get(self, "validate_signature")

    @property
    @pulumi.getter(name="wantAssertionsEncrypted")
    def want_assertions_encrypted(self) -> pulumi.Output[Optional[bool]]:
        """
        Want Assertions Encrypted.
        """
        return pulumi.get(self, "want_assertions_encrypted")

    @property
    @pulumi.getter(name="wantAssertionsSigned")
    def want_assertions_signed(self) -> pulumi.Output[Optional[bool]]:
        """
        Want Assertions Signed.
        """
        return pulumi.get(self, "want_assertions_signed")

    @property
    @pulumi.getter(name="xmlSignKeyInfoKeyNameTransformer")
    def xml_sign_key_info_key_name_transformer(self) -> pulumi.Output[Optional[str]]:
        """
        Sign Key Transformer.
        """
        return pulumi.get(self, "xml_sign_key_info_key_name_transformer")

