# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities

__all__ = ['RoleMapperArgs', 'RoleMapper']

@pulumi.input_type
class RoleMapperArgs:
    def __init__(__self__, *,
                 ldap_roles_dn: pulumi.Input[str],
                 ldap_user_federation_id: pulumi.Input[str],
                 membership_ldap_attribute: pulumi.Input[str],
                 membership_user_ldap_attribute: pulumi.Input[str],
                 realm_id: pulumi.Input[str],
                 role_name_ldap_attribute: pulumi.Input[str],
                 role_object_classes: pulumi.Input[Sequence[pulumi.Input[str]]],
                 client_id: Optional[pulumi.Input[str]] = None,
                 memberof_ldap_attribute: Optional[pulumi.Input[str]] = None,
                 membership_attribute_type: Optional[pulumi.Input[str]] = None,
                 mode: Optional[pulumi.Input[str]] = None,
                 name: Optional[pulumi.Input[str]] = None,
                 roles_ldap_filter: Optional[pulumi.Input[str]] = None,
                 use_realm_roles_mapping: Optional[pulumi.Input[bool]] = None,
                 user_roles_retrieve_strategy: Optional[pulumi.Input[str]] = None):
        """
        The set of arguments for constructing a RoleMapper resource.
        :param pulumi.Input[str] ldap_roles_dn: The LDAP DN where roles can be found.
        :param pulumi.Input[str] ldap_user_federation_id: The ID of the LDAP user federation provider to attach this mapper to.
        :param pulumi.Input[str] membership_ldap_attribute: The name of the LDAP attribute that is used for membership mappings.
        :param pulumi.Input[str] membership_user_ldap_attribute: The name of the LDAP attribute on a user that is used for membership mappings.
        :param pulumi.Input[str] realm_id: The realm that this LDAP mapper will exist in.
        :param pulumi.Input[str] role_name_ldap_attribute: The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically `cn`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] role_object_classes: List of strings representing the object classes for the role. Must contain at least one.
        :param pulumi.Input[str] client_id: When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if `use_realm_roles_mapping` is `false`.
        :param pulumi.Input[str] memberof_ldap_attribute: Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to `memberOf`. This is only used when
        :param pulumi.Input[str] membership_attribute_type: Can be one of `DN` or `UID`. Defaults to `DN`.
        :param pulumi.Input[str] mode: Can be one of `READ_ONLY`, `LDAP_ONLY` or `IMPORT`. Defaults to `READ_ONLY`.
        :param pulumi.Input[str] name: Display name of this mapper when displayed in the console.
        :param pulumi.Input[str] roles_ldap_filter: When specified, adds an additional custom filter to be used when querying for roles. Must start with `(` and end with `)`.
        :param pulumi.Input[bool] use_realm_roles_mapping: When `true`, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to `true`.
        :param pulumi.Input[str] user_roles_retrieve_strategy: Can be one of `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`, `GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE`, or `LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY`. Defaults to `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`.
        """
        pulumi.set(__self__, "ldap_roles_dn", ldap_roles_dn)
        pulumi.set(__self__, "ldap_user_federation_id", ldap_user_federation_id)
        pulumi.set(__self__, "membership_ldap_attribute", membership_ldap_attribute)
        pulumi.set(__self__, "membership_user_ldap_attribute", membership_user_ldap_attribute)
        pulumi.set(__self__, "realm_id", realm_id)
        pulumi.set(__self__, "role_name_ldap_attribute", role_name_ldap_attribute)
        pulumi.set(__self__, "role_object_classes", role_object_classes)
        if client_id is not None:
            pulumi.set(__self__, "client_id", client_id)
        if memberof_ldap_attribute is not None:
            pulumi.set(__self__, "memberof_ldap_attribute", memberof_ldap_attribute)
        if membership_attribute_type is not None:
            pulumi.set(__self__, "membership_attribute_type", membership_attribute_type)
        if mode is not None:
            pulumi.set(__self__, "mode", mode)
        if name is not None:
            pulumi.set(__self__, "name", name)
        if roles_ldap_filter is not None:
            pulumi.set(__self__, "roles_ldap_filter", roles_ldap_filter)
        if use_realm_roles_mapping is not None:
            pulumi.set(__self__, "use_realm_roles_mapping", use_realm_roles_mapping)
        if user_roles_retrieve_strategy is not None:
            pulumi.set(__self__, "user_roles_retrieve_strategy", user_roles_retrieve_strategy)

    @property
    @pulumi.getter(name="ldapRolesDn")
    def ldap_roles_dn(self) -> pulumi.Input[str]:
        """
        The LDAP DN where roles can be found.
        """
        return pulumi.get(self, "ldap_roles_dn")

    @ldap_roles_dn.setter
    def ldap_roles_dn(self, value: pulumi.Input[str]):
        pulumi.set(self, "ldap_roles_dn", value)

    @property
    @pulumi.getter(name="ldapUserFederationId")
    def ldap_user_federation_id(self) -> pulumi.Input[str]:
        """
        The ID of the LDAP user federation provider to attach this mapper to.
        """
        return pulumi.get(self, "ldap_user_federation_id")

    @ldap_user_federation_id.setter
    def ldap_user_federation_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "ldap_user_federation_id", value)

    @property
    @pulumi.getter(name="membershipLdapAttribute")
    def membership_ldap_attribute(self) -> pulumi.Input[str]:
        """
        The name of the LDAP attribute that is used for membership mappings.
        """
        return pulumi.get(self, "membership_ldap_attribute")

    @membership_ldap_attribute.setter
    def membership_ldap_attribute(self, value: pulumi.Input[str]):
        pulumi.set(self, "membership_ldap_attribute", value)

    @property
    @pulumi.getter(name="membershipUserLdapAttribute")
    def membership_user_ldap_attribute(self) -> pulumi.Input[str]:
        """
        The name of the LDAP attribute on a user that is used for membership mappings.
        """
        return pulumi.get(self, "membership_user_ldap_attribute")

    @membership_user_ldap_attribute.setter
    def membership_user_ldap_attribute(self, value: pulumi.Input[str]):
        pulumi.set(self, "membership_user_ldap_attribute", value)

    @property
    @pulumi.getter(name="realmId")
    def realm_id(self) -> pulumi.Input[str]:
        """
        The realm that this LDAP mapper will exist in.
        """
        return pulumi.get(self, "realm_id")

    @realm_id.setter
    def realm_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "realm_id", value)

    @property
    @pulumi.getter(name="roleNameLdapAttribute")
    def role_name_ldap_attribute(self) -> pulumi.Input[str]:
        """
        The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically `cn`.
        """
        return pulumi.get(self, "role_name_ldap_attribute")

    @role_name_ldap_attribute.setter
    def role_name_ldap_attribute(self, value: pulumi.Input[str]):
        pulumi.set(self, "role_name_ldap_attribute", value)

    @property
    @pulumi.getter(name="roleObjectClasses")
    def role_object_classes(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        List of strings representing the object classes for the role. Must contain at least one.
        """
        return pulumi.get(self, "role_object_classes")

    @role_object_classes.setter
    def role_object_classes(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "role_object_classes", value)

    @property
    @pulumi.getter(name="clientId")
    def client_id(self) -> Optional[pulumi.Input[str]]:
        """
        When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if `use_realm_roles_mapping` is `false`.
        """
        return pulumi.get(self, "client_id")

    @client_id.setter
    def client_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "client_id", value)

    @property
    @pulumi.getter(name="memberofLdapAttribute")
    def memberof_ldap_attribute(self) -> Optional[pulumi.Input[str]]:
        """
        Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to `memberOf`. This is only used when
        """
        return pulumi.get(self, "memberof_ldap_attribute")

    @memberof_ldap_attribute.setter
    def memberof_ldap_attribute(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "memberof_ldap_attribute", value)

    @property
    @pulumi.getter(name="membershipAttributeType")
    def membership_attribute_type(self) -> Optional[pulumi.Input[str]]:
        """
        Can be one of `DN` or `UID`. Defaults to `DN`.
        """
        return pulumi.get(self, "membership_attribute_type")

    @membership_attribute_type.setter
    def membership_attribute_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "membership_attribute_type", value)

    @property
    @pulumi.getter
    def mode(self) -> Optional[pulumi.Input[str]]:
        """
        Can be one of `READ_ONLY`, `LDAP_ONLY` or `IMPORT`. Defaults to `READ_ONLY`.
        """
        return pulumi.get(self, "mode")

    @mode.setter
    def mode(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "mode", value)

    @property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[str]]:
        """
        Display name of this mapper when displayed in the console.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter(name="rolesLdapFilter")
    def roles_ldap_filter(self) -> Optional[pulumi.Input[str]]:
        """
        When specified, adds an additional custom filter to be used when querying for roles. Must start with `(` and end with `)`.
        """
        return pulumi.get(self, "roles_ldap_filter")

    @roles_ldap_filter.setter
    def roles_ldap_filter(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "roles_ldap_filter", value)

    @property
    @pulumi.getter(name="useRealmRolesMapping")
    def use_realm_roles_mapping(self) -> Optional[pulumi.Input[bool]]:
        """
        When `true`, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to `true`.
        """
        return pulumi.get(self, "use_realm_roles_mapping")

    @use_realm_roles_mapping.setter
    def use_realm_roles_mapping(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "use_realm_roles_mapping", value)

    @property
    @pulumi.getter(name="userRolesRetrieveStrategy")
    def user_roles_retrieve_strategy(self) -> Optional[pulumi.Input[str]]:
        """
        Can be one of `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`, `GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE`, or `LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY`. Defaults to `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`.
        """
        return pulumi.get(self, "user_roles_retrieve_strategy")

    @user_roles_retrieve_strategy.setter
    def user_roles_retrieve_strategy(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_roles_retrieve_strategy", value)


@pulumi.input_type
class _RoleMapperState:
    def __init__(__self__, *,
                 client_id: Optional[pulumi.Input[str]] = None,
                 ldap_roles_dn: Optional[pulumi.Input[str]] = None,
                 ldap_user_federation_id: Optional[pulumi.Input[str]] = None,
                 memberof_ldap_attribute: Optional[pulumi.Input[str]] = None,
                 membership_attribute_type: Optional[pulumi.Input[str]] = None,
                 membership_ldap_attribute: Optional[pulumi.Input[str]] = None,
                 membership_user_ldap_attribute: Optional[pulumi.Input[str]] = None,
                 mode: Optional[pulumi.Input[str]] = None,
                 name: Optional[pulumi.Input[str]] = None,
                 realm_id: Optional[pulumi.Input[str]] = None,
                 role_name_ldap_attribute: Optional[pulumi.Input[str]] = None,
                 role_object_classes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 roles_ldap_filter: Optional[pulumi.Input[str]] = None,
                 use_realm_roles_mapping: Optional[pulumi.Input[bool]] = None,
                 user_roles_retrieve_strategy: Optional[pulumi.Input[str]] = None):
        """
        Input properties used for looking up and filtering RoleMapper resources.
        :param pulumi.Input[str] client_id: When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if `use_realm_roles_mapping` is `false`.
        :param pulumi.Input[str] ldap_roles_dn: The LDAP DN where roles can be found.
        :param pulumi.Input[str] ldap_user_federation_id: The ID of the LDAP user federation provider to attach this mapper to.
        :param pulumi.Input[str] memberof_ldap_attribute: Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to `memberOf`. This is only used when
        :param pulumi.Input[str] membership_attribute_type: Can be one of `DN` or `UID`. Defaults to `DN`.
        :param pulumi.Input[str] membership_ldap_attribute: The name of the LDAP attribute that is used for membership mappings.
        :param pulumi.Input[str] membership_user_ldap_attribute: The name of the LDAP attribute on a user that is used for membership mappings.
        :param pulumi.Input[str] mode: Can be one of `READ_ONLY`, `LDAP_ONLY` or `IMPORT`. Defaults to `READ_ONLY`.
        :param pulumi.Input[str] name: Display name of this mapper when displayed in the console.
        :param pulumi.Input[str] realm_id: The realm that this LDAP mapper will exist in.
        :param pulumi.Input[str] role_name_ldap_attribute: The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically `cn`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] role_object_classes: List of strings representing the object classes for the role. Must contain at least one.
        :param pulumi.Input[str] roles_ldap_filter: When specified, adds an additional custom filter to be used when querying for roles. Must start with `(` and end with `)`.
        :param pulumi.Input[bool] use_realm_roles_mapping: When `true`, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to `true`.
        :param pulumi.Input[str] user_roles_retrieve_strategy: Can be one of `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`, `GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE`, or `LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY`. Defaults to `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`.
        """
        if client_id is not None:
            pulumi.set(__self__, "client_id", client_id)
        if ldap_roles_dn is not None:
            pulumi.set(__self__, "ldap_roles_dn", ldap_roles_dn)
        if ldap_user_federation_id is not None:
            pulumi.set(__self__, "ldap_user_federation_id", ldap_user_federation_id)
        if memberof_ldap_attribute is not None:
            pulumi.set(__self__, "memberof_ldap_attribute", memberof_ldap_attribute)
        if membership_attribute_type is not None:
            pulumi.set(__self__, "membership_attribute_type", membership_attribute_type)
        if membership_ldap_attribute is not None:
            pulumi.set(__self__, "membership_ldap_attribute", membership_ldap_attribute)
        if membership_user_ldap_attribute is not None:
            pulumi.set(__self__, "membership_user_ldap_attribute", membership_user_ldap_attribute)
        if mode is not None:
            pulumi.set(__self__, "mode", mode)
        if name is not None:
            pulumi.set(__self__, "name", name)
        if realm_id is not None:
            pulumi.set(__self__, "realm_id", realm_id)
        if role_name_ldap_attribute is not None:
            pulumi.set(__self__, "role_name_ldap_attribute", role_name_ldap_attribute)
        if role_object_classes is not None:
            pulumi.set(__self__, "role_object_classes", role_object_classes)
        if roles_ldap_filter is not None:
            pulumi.set(__self__, "roles_ldap_filter", roles_ldap_filter)
        if use_realm_roles_mapping is not None:
            pulumi.set(__self__, "use_realm_roles_mapping", use_realm_roles_mapping)
        if user_roles_retrieve_strategy is not None:
            pulumi.set(__self__, "user_roles_retrieve_strategy", user_roles_retrieve_strategy)

    @property
    @pulumi.getter(name="clientId")
    def client_id(self) -> Optional[pulumi.Input[str]]:
        """
        When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if `use_realm_roles_mapping` is `false`.
        """
        return pulumi.get(self, "client_id")

    @client_id.setter
    def client_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "client_id", value)

    @property
    @pulumi.getter(name="ldapRolesDn")
    def ldap_roles_dn(self) -> Optional[pulumi.Input[str]]:
        """
        The LDAP DN where roles can be found.
        """
        return pulumi.get(self, "ldap_roles_dn")

    @ldap_roles_dn.setter
    def ldap_roles_dn(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "ldap_roles_dn", value)

    @property
    @pulumi.getter(name="ldapUserFederationId")
    def ldap_user_federation_id(self) -> Optional[pulumi.Input[str]]:
        """
        The ID of the LDAP user federation provider to attach this mapper to.
        """
        return pulumi.get(self, "ldap_user_federation_id")

    @ldap_user_federation_id.setter
    def ldap_user_federation_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "ldap_user_federation_id", value)

    @property
    @pulumi.getter(name="memberofLdapAttribute")
    def memberof_ldap_attribute(self) -> Optional[pulumi.Input[str]]:
        """
        Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to `memberOf`. This is only used when
        """
        return pulumi.get(self, "memberof_ldap_attribute")

    @memberof_ldap_attribute.setter
    def memberof_ldap_attribute(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "memberof_ldap_attribute", value)

    @property
    @pulumi.getter(name="membershipAttributeType")
    def membership_attribute_type(self) -> Optional[pulumi.Input[str]]:
        """
        Can be one of `DN` or `UID`. Defaults to `DN`.
        """
        return pulumi.get(self, "membership_attribute_type")

    @membership_attribute_type.setter
    def membership_attribute_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "membership_attribute_type", value)

    @property
    @pulumi.getter(name="membershipLdapAttribute")
    def membership_ldap_attribute(self) -> Optional[pulumi.Input[str]]:
        """
        The name of the LDAP attribute that is used for membership mappings.
        """
        return pulumi.get(self, "membership_ldap_attribute")

    @membership_ldap_attribute.setter
    def membership_ldap_attribute(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "membership_ldap_attribute", value)

    @property
    @pulumi.getter(name="membershipUserLdapAttribute")
    def membership_user_ldap_attribute(self) -> Optional[pulumi.Input[str]]:
        """
        The name of the LDAP attribute on a user that is used for membership mappings.
        """
        return pulumi.get(self, "membership_user_ldap_attribute")

    @membership_user_ldap_attribute.setter
    def membership_user_ldap_attribute(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "membership_user_ldap_attribute", value)

    @property
    @pulumi.getter
    def mode(self) -> Optional[pulumi.Input[str]]:
        """
        Can be one of `READ_ONLY`, `LDAP_ONLY` or `IMPORT`. Defaults to `READ_ONLY`.
        """
        return pulumi.get(self, "mode")

    @mode.setter
    def mode(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "mode", value)

    @property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[str]]:
        """
        Display name of this mapper when displayed in the console.
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter(name="realmId")
    def realm_id(self) -> Optional[pulumi.Input[str]]:
        """
        The realm that this LDAP mapper will exist in.
        """
        return pulumi.get(self, "realm_id")

    @realm_id.setter
    def realm_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "realm_id", value)

    @property
    @pulumi.getter(name="roleNameLdapAttribute")
    def role_name_ldap_attribute(self) -> Optional[pulumi.Input[str]]:
        """
        The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically `cn`.
        """
        return pulumi.get(self, "role_name_ldap_attribute")

    @role_name_ldap_attribute.setter
    def role_name_ldap_attribute(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "role_name_ldap_attribute", value)

    @property
    @pulumi.getter(name="roleObjectClasses")
    def role_object_classes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of strings representing the object classes for the role. Must contain at least one.
        """
        return pulumi.get(self, "role_object_classes")

    @role_object_classes.setter
    def role_object_classes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "role_object_classes", value)

    @property
    @pulumi.getter(name="rolesLdapFilter")
    def roles_ldap_filter(self) -> Optional[pulumi.Input[str]]:
        """
        When specified, adds an additional custom filter to be used when querying for roles. Must start with `(` and end with `)`.
        """
        return pulumi.get(self, "roles_ldap_filter")

    @roles_ldap_filter.setter
    def roles_ldap_filter(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "roles_ldap_filter", value)

    @property
    @pulumi.getter(name="useRealmRolesMapping")
    def use_realm_roles_mapping(self) -> Optional[pulumi.Input[bool]]:
        """
        When `true`, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to `true`.
        """
        return pulumi.get(self, "use_realm_roles_mapping")

    @use_realm_roles_mapping.setter
    def use_realm_roles_mapping(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "use_realm_roles_mapping", value)

    @property
    @pulumi.getter(name="userRolesRetrieveStrategy")
    def user_roles_retrieve_strategy(self) -> Optional[pulumi.Input[str]]:
        """
        Can be one of `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`, `GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE`, or `LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY`. Defaults to `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`.
        """
        return pulumi.get(self, "user_roles_retrieve_strategy")

    @user_roles_retrieve_strategy.setter
    def user_roles_retrieve_strategy(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "user_roles_retrieve_strategy", value)


class RoleMapper(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 client_id: Optional[pulumi.Input[str]] = None,
                 ldap_roles_dn: Optional[pulumi.Input[str]] = None,
                 ldap_user_federation_id: Optional[pulumi.Input[str]] = None,
                 memberof_ldap_attribute: Optional[pulumi.Input[str]] = None,
                 membership_attribute_type: Optional[pulumi.Input[str]] = None,
                 membership_ldap_attribute: Optional[pulumi.Input[str]] = None,
                 membership_user_ldap_attribute: Optional[pulumi.Input[str]] = None,
                 mode: Optional[pulumi.Input[str]] = None,
                 name: Optional[pulumi.Input[str]] = None,
                 realm_id: Optional[pulumi.Input[str]] = None,
                 role_name_ldap_attribute: Optional[pulumi.Input[str]] = None,
                 role_object_classes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 roles_ldap_filter: Optional[pulumi.Input[str]] = None,
                 use_realm_roles_mapping: Optional[pulumi.Input[bool]] = None,
                 user_roles_retrieve_strategy: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        """
        Allows for creating and managing role mappers for Keycloak users federated via LDAP.

        The LDAP group mapper can be used to map an LDAP user's roles from some DN to Keycloak roles.

        ## Example Usage

        ```python
        import pulumi
        import pulumi_keycloak as keycloak

        realm = keycloak.Realm("realm",
            realm="my-realm",
            enabled=True)
        ldap_user_federation = keycloak.ldap.UserFederation("ldap_user_federation",
            name="openldap",
            realm_id=realm.id,
            username_ldap_attribute="cn",
            rdn_ldap_attribute="cn",
            uuid_ldap_attribute="entryDN",
            user_object_classes=[
                "simpleSecurityObject",
                "organizationalRole",
            ],
            connection_url="ldap://openldap",
            users_dn="dc=example,dc=org",
            bind_dn="cn=admin,dc=example,dc=org",
            bind_credential="admin")
        ldap_role_mapper = keycloak.ldap.RoleMapper("ldap_role_mapper",
            realm_id=realm.id,
            ldap_user_federation_id=ldap_user_federation.id,
            name="role-mapper",
            ldap_roles_dn="dc=example,dc=org",
            role_name_ldap_attribute="cn",
            role_object_classes=["groupOfNames"],
            membership_attribute_type="DN",
            membership_ldap_attribute="member",
            membership_user_ldap_attribute="cn",
            user_roles_retrieve_strategy="GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE",
            memberof_ldap_attribute="memberOf")
        ```

        ## Import

        LDAP mappers can be imported using the format `{{realm_id}}/{{ldap_user_federation_id}}/{{ldap_mapper_id}}`.

        The ID of the LDAP user federation provider and the mapper can be found within the Keycloak GUI, and they are typically GUIDs.

        Example:

        bash

        ```sh
        $ pulumi import keycloak:ldap/roleMapper:RoleMapper ldap_role_mapper my-realm/af2a6ca3-e4d7-49c3-b08b-1b3c70b4b860/3d923ece-1a91-4bf7-adaf-3b82f2a12b67
        ```

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[str] client_id: When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if `use_realm_roles_mapping` is `false`.
        :param pulumi.Input[str] ldap_roles_dn: The LDAP DN where roles can be found.
        :param pulumi.Input[str] ldap_user_federation_id: The ID of the LDAP user federation provider to attach this mapper to.
        :param pulumi.Input[str] memberof_ldap_attribute: Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to `memberOf`. This is only used when
        :param pulumi.Input[str] membership_attribute_type: Can be one of `DN` or `UID`. Defaults to `DN`.
        :param pulumi.Input[str] membership_ldap_attribute: The name of the LDAP attribute that is used for membership mappings.
        :param pulumi.Input[str] membership_user_ldap_attribute: The name of the LDAP attribute on a user that is used for membership mappings.
        :param pulumi.Input[str] mode: Can be one of `READ_ONLY`, `LDAP_ONLY` or `IMPORT`. Defaults to `READ_ONLY`.
        :param pulumi.Input[str] name: Display name of this mapper when displayed in the console.
        :param pulumi.Input[str] realm_id: The realm that this LDAP mapper will exist in.
        :param pulumi.Input[str] role_name_ldap_attribute: The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically `cn`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] role_object_classes: List of strings representing the object classes for the role. Must contain at least one.
        :param pulumi.Input[str] roles_ldap_filter: When specified, adds an additional custom filter to be used when querying for roles. Must start with `(` and end with `)`.
        :param pulumi.Input[bool] use_realm_roles_mapping: When `true`, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to `true`.
        :param pulumi.Input[str] user_roles_retrieve_strategy: Can be one of `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`, `GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE`, or `LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY`. Defaults to `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`.
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: RoleMapperArgs,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        Allows for creating and managing role mappers for Keycloak users federated via LDAP.

        The LDAP group mapper can be used to map an LDAP user's roles from some DN to Keycloak roles.

        ## Example Usage

        ```python
        import pulumi
        import pulumi_keycloak as keycloak

        realm = keycloak.Realm("realm",
            realm="my-realm",
            enabled=True)
        ldap_user_federation = keycloak.ldap.UserFederation("ldap_user_federation",
            name="openldap",
            realm_id=realm.id,
            username_ldap_attribute="cn",
            rdn_ldap_attribute="cn",
            uuid_ldap_attribute="entryDN",
            user_object_classes=[
                "simpleSecurityObject",
                "organizationalRole",
            ],
            connection_url="ldap://openldap",
            users_dn="dc=example,dc=org",
            bind_dn="cn=admin,dc=example,dc=org",
            bind_credential="admin")
        ldap_role_mapper = keycloak.ldap.RoleMapper("ldap_role_mapper",
            realm_id=realm.id,
            ldap_user_federation_id=ldap_user_federation.id,
            name="role-mapper",
            ldap_roles_dn="dc=example,dc=org",
            role_name_ldap_attribute="cn",
            role_object_classes=["groupOfNames"],
            membership_attribute_type="DN",
            membership_ldap_attribute="member",
            membership_user_ldap_attribute="cn",
            user_roles_retrieve_strategy="GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE",
            memberof_ldap_attribute="memberOf")
        ```

        ## Import

        LDAP mappers can be imported using the format `{{realm_id}}/{{ldap_user_federation_id}}/{{ldap_mapper_id}}`.

        The ID of the LDAP user federation provider and the mapper can be found within the Keycloak GUI, and they are typically GUIDs.

        Example:

        bash

        ```sh
        $ pulumi import keycloak:ldap/roleMapper:RoleMapper ldap_role_mapper my-realm/af2a6ca3-e4d7-49c3-b08b-1b3c70b4b860/3d923ece-1a91-4bf7-adaf-3b82f2a12b67
        ```

        :param str resource_name: The name of the resource.
        :param RoleMapperArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(RoleMapperArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 client_id: Optional[pulumi.Input[str]] = None,
                 ldap_roles_dn: Optional[pulumi.Input[str]] = None,
                 ldap_user_federation_id: Optional[pulumi.Input[str]] = None,
                 memberof_ldap_attribute: Optional[pulumi.Input[str]] = None,
                 membership_attribute_type: Optional[pulumi.Input[str]] = None,
                 membership_ldap_attribute: Optional[pulumi.Input[str]] = None,
                 membership_user_ldap_attribute: Optional[pulumi.Input[str]] = None,
                 mode: Optional[pulumi.Input[str]] = None,
                 name: Optional[pulumi.Input[str]] = None,
                 realm_id: Optional[pulumi.Input[str]] = None,
                 role_name_ldap_attribute: Optional[pulumi.Input[str]] = None,
                 role_object_classes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 roles_ldap_filter: Optional[pulumi.Input[str]] = None,
                 use_realm_roles_mapping: Optional[pulumi.Input[bool]] = None,
                 user_roles_retrieve_strategy: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = RoleMapperArgs.__new__(RoleMapperArgs)

            __props__.__dict__["client_id"] = client_id
            if ldap_roles_dn is None and not opts.urn:
                raise TypeError("Missing required property 'ldap_roles_dn'")
            __props__.__dict__["ldap_roles_dn"] = ldap_roles_dn
            if ldap_user_federation_id is None and not opts.urn:
                raise TypeError("Missing required property 'ldap_user_federation_id'")
            __props__.__dict__["ldap_user_federation_id"] = ldap_user_federation_id
            __props__.__dict__["memberof_ldap_attribute"] = memberof_ldap_attribute
            __props__.__dict__["membership_attribute_type"] = membership_attribute_type
            if membership_ldap_attribute is None and not opts.urn:
                raise TypeError("Missing required property 'membership_ldap_attribute'")
            __props__.__dict__["membership_ldap_attribute"] = membership_ldap_attribute
            if membership_user_ldap_attribute is None and not opts.urn:
                raise TypeError("Missing required property 'membership_user_ldap_attribute'")
            __props__.__dict__["membership_user_ldap_attribute"] = membership_user_ldap_attribute
            __props__.__dict__["mode"] = mode
            __props__.__dict__["name"] = name
            if realm_id is None and not opts.urn:
                raise TypeError("Missing required property 'realm_id'")
            __props__.__dict__["realm_id"] = realm_id
            if role_name_ldap_attribute is None and not opts.urn:
                raise TypeError("Missing required property 'role_name_ldap_attribute'")
            __props__.__dict__["role_name_ldap_attribute"] = role_name_ldap_attribute
            if role_object_classes is None and not opts.urn:
                raise TypeError("Missing required property 'role_object_classes'")
            __props__.__dict__["role_object_classes"] = role_object_classes
            __props__.__dict__["roles_ldap_filter"] = roles_ldap_filter
            __props__.__dict__["use_realm_roles_mapping"] = use_realm_roles_mapping
            __props__.__dict__["user_roles_retrieve_strategy"] = user_roles_retrieve_strategy
        super(RoleMapper, __self__).__init__(
            'keycloak:ldap/roleMapper:RoleMapper',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            client_id: Optional[pulumi.Input[str]] = None,
            ldap_roles_dn: Optional[pulumi.Input[str]] = None,
            ldap_user_federation_id: Optional[pulumi.Input[str]] = None,
            memberof_ldap_attribute: Optional[pulumi.Input[str]] = None,
            membership_attribute_type: Optional[pulumi.Input[str]] = None,
            membership_ldap_attribute: Optional[pulumi.Input[str]] = None,
            membership_user_ldap_attribute: Optional[pulumi.Input[str]] = None,
            mode: Optional[pulumi.Input[str]] = None,
            name: Optional[pulumi.Input[str]] = None,
            realm_id: Optional[pulumi.Input[str]] = None,
            role_name_ldap_attribute: Optional[pulumi.Input[str]] = None,
            role_object_classes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
            roles_ldap_filter: Optional[pulumi.Input[str]] = None,
            use_realm_roles_mapping: Optional[pulumi.Input[bool]] = None,
            user_roles_retrieve_strategy: Optional[pulumi.Input[str]] = None) -> 'RoleMapper':
        """
        Get an existing RoleMapper resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[str] client_id: When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if `use_realm_roles_mapping` is `false`.
        :param pulumi.Input[str] ldap_roles_dn: The LDAP DN where roles can be found.
        :param pulumi.Input[str] ldap_user_federation_id: The ID of the LDAP user federation provider to attach this mapper to.
        :param pulumi.Input[str] memberof_ldap_attribute: Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to `memberOf`. This is only used when
        :param pulumi.Input[str] membership_attribute_type: Can be one of `DN` or `UID`. Defaults to `DN`.
        :param pulumi.Input[str] membership_ldap_attribute: The name of the LDAP attribute that is used for membership mappings.
        :param pulumi.Input[str] membership_user_ldap_attribute: The name of the LDAP attribute on a user that is used for membership mappings.
        :param pulumi.Input[str] mode: Can be one of `READ_ONLY`, `LDAP_ONLY` or `IMPORT`. Defaults to `READ_ONLY`.
        :param pulumi.Input[str] name: Display name of this mapper when displayed in the console.
        :param pulumi.Input[str] realm_id: The realm that this LDAP mapper will exist in.
        :param pulumi.Input[str] role_name_ldap_attribute: The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically `cn`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] role_object_classes: List of strings representing the object classes for the role. Must contain at least one.
        :param pulumi.Input[str] roles_ldap_filter: When specified, adds an additional custom filter to be used when querying for roles. Must start with `(` and end with `)`.
        :param pulumi.Input[bool] use_realm_roles_mapping: When `true`, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to `true`.
        :param pulumi.Input[str] user_roles_retrieve_strategy: Can be one of `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`, `GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE`, or `LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY`. Defaults to `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`.
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _RoleMapperState.__new__(_RoleMapperState)

        __props__.__dict__["client_id"] = client_id
        __props__.__dict__["ldap_roles_dn"] = ldap_roles_dn
        __props__.__dict__["ldap_user_federation_id"] = ldap_user_federation_id
        __props__.__dict__["memberof_ldap_attribute"] = memberof_ldap_attribute
        __props__.__dict__["membership_attribute_type"] = membership_attribute_type
        __props__.__dict__["membership_ldap_attribute"] = membership_ldap_attribute
        __props__.__dict__["membership_user_ldap_attribute"] = membership_user_ldap_attribute
        __props__.__dict__["mode"] = mode
        __props__.__dict__["name"] = name
        __props__.__dict__["realm_id"] = realm_id
        __props__.__dict__["role_name_ldap_attribute"] = role_name_ldap_attribute
        __props__.__dict__["role_object_classes"] = role_object_classes
        __props__.__dict__["roles_ldap_filter"] = roles_ldap_filter
        __props__.__dict__["use_realm_roles_mapping"] = use_realm_roles_mapping
        __props__.__dict__["user_roles_retrieve_strategy"] = user_roles_retrieve_strategy
        return RoleMapper(resource_name, opts=opts, __props__=__props__)

    @property
    @pulumi.getter(name="clientId")
    def client_id(self) -> pulumi.Output[Optional[str]]:
        """
        When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if `use_realm_roles_mapping` is `false`.
        """
        return pulumi.get(self, "client_id")

    @property
    @pulumi.getter(name="ldapRolesDn")
    def ldap_roles_dn(self) -> pulumi.Output[str]:
        """
        The LDAP DN where roles can be found.
        """
        return pulumi.get(self, "ldap_roles_dn")

    @property
    @pulumi.getter(name="ldapUserFederationId")
    def ldap_user_federation_id(self) -> pulumi.Output[str]:
        """
        The ID of the LDAP user federation provider to attach this mapper to.
        """
        return pulumi.get(self, "ldap_user_federation_id")

    @property
    @pulumi.getter(name="memberofLdapAttribute")
    def memberof_ldap_attribute(self) -> pulumi.Output[Optional[str]]:
        """
        Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to `memberOf`. This is only used when
        """
        return pulumi.get(self, "memberof_ldap_attribute")

    @property
    @pulumi.getter(name="membershipAttributeType")
    def membership_attribute_type(self) -> pulumi.Output[Optional[str]]:
        """
        Can be one of `DN` or `UID`. Defaults to `DN`.
        """
        return pulumi.get(self, "membership_attribute_type")

    @property
    @pulumi.getter(name="membershipLdapAttribute")
    def membership_ldap_attribute(self) -> pulumi.Output[str]:
        """
        The name of the LDAP attribute that is used for membership mappings.
        """
        return pulumi.get(self, "membership_ldap_attribute")

    @property
    @pulumi.getter(name="membershipUserLdapAttribute")
    def membership_user_ldap_attribute(self) -> pulumi.Output[str]:
        """
        The name of the LDAP attribute on a user that is used for membership mappings.
        """
        return pulumi.get(self, "membership_user_ldap_attribute")

    @property
    @pulumi.getter
    def mode(self) -> pulumi.Output[Optional[str]]:
        """
        Can be one of `READ_ONLY`, `LDAP_ONLY` or `IMPORT`. Defaults to `READ_ONLY`.
        """
        return pulumi.get(self, "mode")

    @property
    @pulumi.getter
    def name(self) -> pulumi.Output[str]:
        """
        Display name of this mapper when displayed in the console.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter(name="realmId")
    def realm_id(self) -> pulumi.Output[str]:
        """
        The realm that this LDAP mapper will exist in.
        """
        return pulumi.get(self, "realm_id")

    @property
    @pulumi.getter(name="roleNameLdapAttribute")
    def role_name_ldap_attribute(self) -> pulumi.Output[str]:
        """
        The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically `cn`.
        """
        return pulumi.get(self, "role_name_ldap_attribute")

    @property
    @pulumi.getter(name="roleObjectClasses")
    def role_object_classes(self) -> pulumi.Output[Sequence[str]]:
        """
        List of strings representing the object classes for the role. Must contain at least one.
        """
        return pulumi.get(self, "role_object_classes")

    @property
    @pulumi.getter(name="rolesLdapFilter")
    def roles_ldap_filter(self) -> pulumi.Output[Optional[str]]:
        """
        When specified, adds an additional custom filter to be used when querying for roles. Must start with `(` and end with `)`.
        """
        return pulumi.get(self, "roles_ldap_filter")

    @property
    @pulumi.getter(name="useRealmRolesMapping")
    def use_realm_roles_mapping(self) -> pulumi.Output[Optional[bool]]:
        """
        When `true`, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to `true`.
        """
        return pulumi.get(self, "use_realm_roles_mapping")

    @property
    @pulumi.getter(name="userRolesRetrieveStrategy")
    def user_roles_retrieve_strategy(self) -> pulumi.Output[Optional[str]]:
        """
        Can be one of `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`, `GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE`, or `LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY`. Defaults to `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`.
        """
        return pulumi.get(self, "user_roles_retrieve_strategy")

