# coding=utf-8
# *** WARNING: this file was generated by pulumi-language-python. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import builtins as _builtins
import warnings
import sys
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
if sys.version_info >= (3, 11):
    from typing import NotRequired, TypedDict, TypeAlias
else:
    from typing_extensions import NotRequired, TypedDict, TypeAlias
from .. import _utilities

__all__ = ['IdentityProviderArgs', 'IdentityProvider']

@pulumi.input_type
class IdentityProviderArgs:
    def __init__(__self__, *,
                 alias: pulumi.Input[_builtins.str],
                 authorization_url: pulumi.Input[_builtins.str],
                 client_id: pulumi.Input[_builtins.str],
                 realm: pulumi.Input[_builtins.str],
                 token_url: pulumi.Input[_builtins.str],
                 accepts_prompt_none_forward_from_client: Optional[pulumi.Input[_builtins.bool]] = None,
                 add_read_token_role_on_create: Optional[pulumi.Input[_builtins.bool]] = None,
                 authenticate_by_default: Optional[pulumi.Input[_builtins.bool]] = None,
                 backchannel_supported: Optional[pulumi.Input[_builtins.bool]] = None,
                 client_secret: Optional[pulumi.Input[_builtins.str]] = None,
                 client_secret_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
                 default_scopes: Optional[pulumi.Input[_builtins.str]] = None,
                 disable_type_claim_check: Optional[pulumi.Input[_builtins.bool]] = None,
                 disable_user_info: Optional[pulumi.Input[_builtins.bool]] = None,
                 display_name: Optional[pulumi.Input[_builtins.str]] = None,
                 enabled: Optional[pulumi.Input[_builtins.bool]] = None,
                 extra_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
                 first_broker_login_flow_alias: Optional[pulumi.Input[_builtins.str]] = None,
                 gui_order: Optional[pulumi.Input[_builtins.str]] = None,
                 hide_on_login_page: Optional[pulumi.Input[_builtins.bool]] = None,
                 issuer: Optional[pulumi.Input[_builtins.str]] = None,
                 jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
                 link_only: Optional[pulumi.Input[_builtins.bool]] = None,
                 login_hint: Optional[pulumi.Input[_builtins.str]] = None,
                 logout_url: Optional[pulumi.Input[_builtins.str]] = None,
                 org_domain: Optional[pulumi.Input[_builtins.str]] = None,
                 org_redirect_mode_email_matches: Optional[pulumi.Input[_builtins.bool]] = None,
                 organization_id: Optional[pulumi.Input[_builtins.str]] = None,
                 post_broker_login_flow_alias: Optional[pulumi.Input[_builtins.str]] = None,
                 provider_id: Optional[pulumi.Input[_builtins.str]] = None,
                 store_token: Optional[pulumi.Input[_builtins.bool]] = None,
                 sync_mode: Optional[pulumi.Input[_builtins.str]] = None,
                 trust_email: Optional[pulumi.Input[_builtins.bool]] = None,
                 ui_locales: Optional[pulumi.Input[_builtins.bool]] = None,
                 user_info_url: Optional[pulumi.Input[_builtins.str]] = None,
                 validate_signature: Optional[pulumi.Input[_builtins.bool]] = None):
        """
        The set of arguments for constructing a IdentityProvider resource.
        :param pulumi.Input[_builtins.str] alias: The alias uniquely identifies an identity provider, and it is also used to build the redirect uri.
        :param pulumi.Input[_builtins.str] authorization_url: The Authorization Url.
        :param pulumi.Input[_builtins.str] client_id: The client or client identifier registered within the identity provider.
        :param pulumi.Input[_builtins.str] realm: The name of the realm. This is unique across Keycloak.
        :param pulumi.Input[_builtins.str] token_url: The Token URL.
        :param pulumi.Input[_builtins.bool] accepts_prompt_none_forward_from_client: When `true`, the IDP will accept forwarded authentication requests that contain the `prompt=none` query parameter. Defaults to `false`.
        :param pulumi.Input[_builtins.bool] add_read_token_role_on_create: When `true`, new users will be able to read stored tokens. This will automatically assign the `broker.read-token` role. Defaults to `false`.
        :param pulumi.Input[_builtins.bool] authenticate_by_default: Enable/disable authenticate users by default.
        :param pulumi.Input[_builtins.bool] backchannel_supported: Does the external IDP support backchannel logout? Defaults to `true`.
        :param pulumi.Input[_builtins.str] client_secret: The client or client secret registered within the identity provider. This field is able to obtain its value from vault, use $${vault.ID} format. Required without `client_secret_wo` and `client_secret_wo_version`.
        :param pulumi.Input[_builtins.int] client_secret_wo_version: Version of the Client secret write-only argument
        :param pulumi.Input[_builtins.str] default_scopes: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to `openid`.
        :param pulumi.Input[_builtins.bool] disable_type_claim_check: When `true`, disables the check for the `typ` claim of tokens received from the identity provider. Defaults to `false`.
        :param pulumi.Input[_builtins.bool] disable_user_info: When `true`, disables the usage of the user info service to obtain additional user information. Defaults to `false`.
        :param pulumi.Input[_builtins.str] display_name: Display name for the identity provider in the GUI.
        :param pulumi.Input[_builtins.bool] enabled: When `true`, users will be able to log in to this realm using this identity provider. Defaults to `true`.
        :param pulumi.Input[_builtins.str] first_broker_login_flow_alias: The authentication flow to use when users log in for the first time through this identity provider. Defaults to `first broker login`.
        :param pulumi.Input[_builtins.str] gui_order: A number defining the order of this identity provider in the GUI.
        :param pulumi.Input[_builtins.bool] hide_on_login_page: When `true`, this provider will be hidden on the login page, and is only accessible when requested explicitly. Defaults to `false`.
        :param pulumi.Input[_builtins.str] issuer: The issuer identifier for the issuer of the response. If not provided, no validation will be performed.
        :param pulumi.Input[_builtins.str] jwks_url: JSON Web Key Set URL.
        :param pulumi.Input[_builtins.bool] link_only: When `true`, users cannot sign-in using this provider, but their existing accounts will be linked when possible. Defaults to `false`.
        :param pulumi.Input[_builtins.str] login_hint: Pass login hint to identity provider.
        :param pulumi.Input[_builtins.str] logout_url: The Logout URL is the end session endpoint to use to sign-out the user from external identity provider.
        :param pulumi.Input[_builtins.str] org_domain: The organization domain to associate this identity provider with. it is used to map users to an organization based on their email domain and to authenticate them accordingly in the scope of the organization.
        :param pulumi.Input[_builtins.bool] org_redirect_mode_email_matches: Indicates whether to automatically redirect user to this identity provider when email domain matches domain.
        :param pulumi.Input[_builtins.str] organization_id: The ID of the organization to link this identity provider to.
        :param pulumi.Input[_builtins.str] post_broker_login_flow_alias: The authentication flow to use after users have successfully logged in, which can be used to perform additional user verification (such as OTP checking). Defaults to an empty string, which means no post login flow will be used.
        :param pulumi.Input[_builtins.str] provider_id: The ID of the identity provider to use. Defaults to `oidc`, which should be used unless you have extended Keycloak and provided your own implementation.
        :param pulumi.Input[_builtins.bool] store_token: When `true`, tokens will be stored after authenticating users. Defaults to `true`.
        :param pulumi.Input[_builtins.str] sync_mode: The default sync mode to use for all mappers attached to this identity provider. Can be once of `IMPORT`, `FORCE`, or `LEGACY`.
        :param pulumi.Input[_builtins.bool] trust_email: When `true`, email addresses for users in this provider will automatically be verified regardless of the realm's email verification policy. Defaults to `false`.
        :param pulumi.Input[_builtins.bool] ui_locales: Pass current locale to identity provider. Defaults to `false`.
        :param pulumi.Input[_builtins.str] user_info_url: User Info URL.
        :param pulumi.Input[_builtins.bool] validate_signature: Enable/disable signature validation of external IDP signatures. Defaults to `false`.
        """
        pulumi.set(__self__, "alias", alias)
        pulumi.set(__self__, "authorization_url", authorization_url)
        pulumi.set(__self__, "client_id", client_id)
        pulumi.set(__self__, "realm", realm)
        pulumi.set(__self__, "token_url", token_url)
        if accepts_prompt_none_forward_from_client is not None:
            pulumi.set(__self__, "accepts_prompt_none_forward_from_client", accepts_prompt_none_forward_from_client)
        if add_read_token_role_on_create is not None:
            pulumi.set(__self__, "add_read_token_role_on_create", add_read_token_role_on_create)
        if authenticate_by_default is not None:
            pulumi.set(__self__, "authenticate_by_default", authenticate_by_default)
        if backchannel_supported is not None:
            pulumi.set(__self__, "backchannel_supported", backchannel_supported)
        if client_secret is not None:
            pulumi.set(__self__, "client_secret", client_secret)
        if client_secret_wo_version is not None:
            pulumi.set(__self__, "client_secret_wo_version", client_secret_wo_version)
        if default_scopes is not None:
            pulumi.set(__self__, "default_scopes", default_scopes)
        if disable_type_claim_check is not None:
            pulumi.set(__self__, "disable_type_claim_check", disable_type_claim_check)
        if disable_user_info is not None:
            pulumi.set(__self__, "disable_user_info", disable_user_info)
        if display_name is not None:
            pulumi.set(__self__, "display_name", display_name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if extra_config is not None:
            pulumi.set(__self__, "extra_config", extra_config)
        if first_broker_login_flow_alias is not None:
            pulumi.set(__self__, "first_broker_login_flow_alias", first_broker_login_flow_alias)
        if gui_order is not None:
            pulumi.set(__self__, "gui_order", gui_order)
        if hide_on_login_page is not None:
            pulumi.set(__self__, "hide_on_login_page", hide_on_login_page)
        if issuer is not None:
            pulumi.set(__self__, "issuer", issuer)
        if jwks_url is not None:
            pulumi.set(__self__, "jwks_url", jwks_url)
        if link_only is not None:
            pulumi.set(__self__, "link_only", link_only)
        if login_hint is not None:
            pulumi.set(__self__, "login_hint", login_hint)
        if logout_url is not None:
            pulumi.set(__self__, "logout_url", logout_url)
        if org_domain is not None:
            pulumi.set(__self__, "org_domain", org_domain)
        if org_redirect_mode_email_matches is not None:
            pulumi.set(__self__, "org_redirect_mode_email_matches", org_redirect_mode_email_matches)
        if organization_id is not None:
            pulumi.set(__self__, "organization_id", organization_id)
        if post_broker_login_flow_alias is not None:
            pulumi.set(__self__, "post_broker_login_flow_alias", post_broker_login_flow_alias)
        if provider_id is not None:
            pulumi.set(__self__, "provider_id", provider_id)
        if store_token is not None:
            pulumi.set(__self__, "store_token", store_token)
        if sync_mode is not None:
            pulumi.set(__self__, "sync_mode", sync_mode)
        if trust_email is not None:
            pulumi.set(__self__, "trust_email", trust_email)
        if ui_locales is not None:
            pulumi.set(__self__, "ui_locales", ui_locales)
        if user_info_url is not None:
            pulumi.set(__self__, "user_info_url", user_info_url)
        if validate_signature is not None:
            pulumi.set(__self__, "validate_signature", validate_signature)

    @_builtins.property
    @pulumi.getter
    def alias(self) -> pulumi.Input[_builtins.str]:
        """
        The alias uniquely identifies an identity provider, and it is also used to build the redirect uri.
        """
        return pulumi.get(self, "alias")

    @alias.setter
    def alias(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "alias", value)

    @_builtins.property
    @pulumi.getter(name="authorizationUrl")
    def authorization_url(self) -> pulumi.Input[_builtins.str]:
        """
        The Authorization Url.
        """
        return pulumi.get(self, "authorization_url")

    @authorization_url.setter
    def authorization_url(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "authorization_url", value)

    @_builtins.property
    @pulumi.getter(name="clientId")
    def client_id(self) -> pulumi.Input[_builtins.str]:
        """
        The client or client identifier registered within the identity provider.
        """
        return pulumi.get(self, "client_id")

    @client_id.setter
    def client_id(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "client_id", value)

    @_builtins.property
    @pulumi.getter
    def realm(self) -> pulumi.Input[_builtins.str]:
        """
        The name of the realm. This is unique across Keycloak.
        """
        return pulumi.get(self, "realm")

    @realm.setter
    def realm(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "realm", value)

    @_builtins.property
    @pulumi.getter(name="tokenUrl")
    def token_url(self) -> pulumi.Input[_builtins.str]:
        """
        The Token URL.
        """
        return pulumi.get(self, "token_url")

    @token_url.setter
    def token_url(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "token_url", value)

    @_builtins.property
    @pulumi.getter(name="acceptsPromptNoneForwardFromClient")
    def accepts_prompt_none_forward_from_client(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, the IDP will accept forwarded authentication requests that contain the `prompt=none` query parameter. Defaults to `false`.
        """
        return pulumi.get(self, "accepts_prompt_none_forward_from_client")

    @accepts_prompt_none_forward_from_client.setter
    def accepts_prompt_none_forward_from_client(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "accepts_prompt_none_forward_from_client", value)

    @_builtins.property
    @pulumi.getter(name="addReadTokenRoleOnCreate")
    def add_read_token_role_on_create(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, new users will be able to read stored tokens. This will automatically assign the `broker.read-token` role. Defaults to `false`.
        """
        return pulumi.get(self, "add_read_token_role_on_create")

    @add_read_token_role_on_create.setter
    def add_read_token_role_on_create(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "add_read_token_role_on_create", value)

    @_builtins.property
    @pulumi.getter(name="authenticateByDefault")
    def authenticate_by_default(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Enable/disable authenticate users by default.
        """
        return pulumi.get(self, "authenticate_by_default")

    @authenticate_by_default.setter
    def authenticate_by_default(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "authenticate_by_default", value)

    @_builtins.property
    @pulumi.getter(name="backchannelSupported")
    def backchannel_supported(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Does the external IDP support backchannel logout? Defaults to `true`.
        """
        return pulumi.get(self, "backchannel_supported")

    @backchannel_supported.setter
    def backchannel_supported(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "backchannel_supported", value)

    @_builtins.property
    @pulumi.getter(name="clientSecret")
    def client_secret(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The client or client secret registered within the identity provider. This field is able to obtain its value from vault, use $${vault.ID} format. Required without `client_secret_wo` and `client_secret_wo_version`.
        """
        return pulumi.get(self, "client_secret")

    @client_secret.setter
    def client_secret(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "client_secret", value)

    @_builtins.property
    @pulumi.getter(name="clientSecretWoVersion")
    def client_secret_wo_version(self) -> Optional[pulumi.Input[_builtins.int]]:
        """
        Version of the Client secret write-only argument
        """
        return pulumi.get(self, "client_secret_wo_version")

    @client_secret_wo_version.setter
    def client_secret_wo_version(self, value: Optional[pulumi.Input[_builtins.int]]):
        pulumi.set(self, "client_secret_wo_version", value)

    @_builtins.property
    @pulumi.getter(name="defaultScopes")
    def default_scopes(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to `openid`.
        """
        return pulumi.get(self, "default_scopes")

    @default_scopes.setter
    def default_scopes(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "default_scopes", value)

    @_builtins.property
    @pulumi.getter(name="disableTypeClaimCheck")
    def disable_type_claim_check(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, disables the check for the `typ` claim of tokens received from the identity provider. Defaults to `false`.
        """
        return pulumi.get(self, "disable_type_claim_check")

    @disable_type_claim_check.setter
    def disable_type_claim_check(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "disable_type_claim_check", value)

    @_builtins.property
    @pulumi.getter(name="disableUserInfo")
    def disable_user_info(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, disables the usage of the user info service to obtain additional user information. Defaults to `false`.
        """
        return pulumi.get(self, "disable_user_info")

    @disable_user_info.setter
    def disable_user_info(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "disable_user_info", value)

    @_builtins.property
    @pulumi.getter(name="displayName")
    def display_name(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Display name for the identity provider in the GUI.
        """
        return pulumi.get(self, "display_name")

    @display_name.setter
    def display_name(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "display_name", value)

    @_builtins.property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, users will be able to log in to this realm using this identity provider. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "enabled", value)

    @_builtins.property
    @pulumi.getter(name="extraConfig")
    def extra_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
        return pulumi.get(self, "extra_config")

    @extra_config.setter
    def extra_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "extra_config", value)

    @_builtins.property
    @pulumi.getter(name="firstBrokerLoginFlowAlias")
    def first_broker_login_flow_alias(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The authentication flow to use when users log in for the first time through this identity provider. Defaults to `first broker login`.
        """
        return pulumi.get(self, "first_broker_login_flow_alias")

    @first_broker_login_flow_alias.setter
    def first_broker_login_flow_alias(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "first_broker_login_flow_alias", value)

    @_builtins.property
    @pulumi.getter(name="guiOrder")
    def gui_order(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        A number defining the order of this identity provider in the GUI.
        """
        return pulumi.get(self, "gui_order")

    @gui_order.setter
    def gui_order(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "gui_order", value)

    @_builtins.property
    @pulumi.getter(name="hideOnLoginPage")
    def hide_on_login_page(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, this provider will be hidden on the login page, and is only accessible when requested explicitly. Defaults to `false`.
        """
        return pulumi.get(self, "hide_on_login_page")

    @hide_on_login_page.setter
    def hide_on_login_page(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "hide_on_login_page", value)

    @_builtins.property
    @pulumi.getter
    def issuer(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The issuer identifier for the issuer of the response. If not provided, no validation will be performed.
        """
        return pulumi.get(self, "issuer")

    @issuer.setter
    def issuer(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "issuer", value)

    @_builtins.property
    @pulumi.getter(name="jwksUrl")
    def jwks_url(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        JSON Web Key Set URL.
        """
        return pulumi.get(self, "jwks_url")

    @jwks_url.setter
    def jwks_url(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "jwks_url", value)

    @_builtins.property
    @pulumi.getter(name="linkOnly")
    def link_only(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, users cannot sign-in using this provider, but their existing accounts will be linked when possible. Defaults to `false`.
        """
        return pulumi.get(self, "link_only")

    @link_only.setter
    def link_only(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "link_only", value)

    @_builtins.property
    @pulumi.getter(name="loginHint")
    def login_hint(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Pass login hint to identity provider.
        """
        return pulumi.get(self, "login_hint")

    @login_hint.setter
    def login_hint(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "login_hint", value)

    @_builtins.property
    @pulumi.getter(name="logoutUrl")
    def logout_url(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The Logout URL is the end session endpoint to use to sign-out the user from external identity provider.
        """
        return pulumi.get(self, "logout_url")

    @logout_url.setter
    def logout_url(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "logout_url", value)

    @_builtins.property
    @pulumi.getter(name="orgDomain")
    def org_domain(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The organization domain to associate this identity provider with. it is used to map users to an organization based on their email domain and to authenticate them accordingly in the scope of the organization.
        """
        return pulumi.get(self, "org_domain")

    @org_domain.setter
    def org_domain(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "org_domain", value)

    @_builtins.property
    @pulumi.getter(name="orgRedirectModeEmailMatches")
    def org_redirect_mode_email_matches(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Indicates whether to automatically redirect user to this identity provider when email domain matches domain.
        """
        return pulumi.get(self, "org_redirect_mode_email_matches")

    @org_redirect_mode_email_matches.setter
    def org_redirect_mode_email_matches(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "org_redirect_mode_email_matches", value)

    @_builtins.property
    @pulumi.getter(name="organizationId")
    def organization_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The ID of the organization to link this identity provider to.
        """
        return pulumi.get(self, "organization_id")

    @organization_id.setter
    def organization_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "organization_id", value)

    @_builtins.property
    @pulumi.getter(name="postBrokerLoginFlowAlias")
    def post_broker_login_flow_alias(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The authentication flow to use after users have successfully logged in, which can be used to perform additional user verification (such as OTP checking). Defaults to an empty string, which means no post login flow will be used.
        """
        return pulumi.get(self, "post_broker_login_flow_alias")

    @post_broker_login_flow_alias.setter
    def post_broker_login_flow_alias(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "post_broker_login_flow_alias", value)

    @_builtins.property
    @pulumi.getter(name="providerId")
    def provider_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The ID of the identity provider to use. Defaults to `oidc`, which should be used unless you have extended Keycloak and provided your own implementation.
        """
        return pulumi.get(self, "provider_id")

    @provider_id.setter
    def provider_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "provider_id", value)

    @_builtins.property
    @pulumi.getter(name="storeToken")
    def store_token(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, tokens will be stored after authenticating users. Defaults to `true`.
        """
        return pulumi.get(self, "store_token")

    @store_token.setter
    def store_token(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "store_token", value)

    @_builtins.property
    @pulumi.getter(name="syncMode")
    def sync_mode(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The default sync mode to use for all mappers attached to this identity provider. Can be once of `IMPORT`, `FORCE`, or `LEGACY`.
        """
        return pulumi.get(self, "sync_mode")

    @sync_mode.setter
    def sync_mode(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "sync_mode", value)

    @_builtins.property
    @pulumi.getter(name="trustEmail")
    def trust_email(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, email addresses for users in this provider will automatically be verified regardless of the realm's email verification policy. Defaults to `false`.
        """
        return pulumi.get(self, "trust_email")

    @trust_email.setter
    def trust_email(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "trust_email", value)

    @_builtins.property
    @pulumi.getter(name="uiLocales")
    def ui_locales(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Pass current locale to identity provider. Defaults to `false`.
        """
        return pulumi.get(self, "ui_locales")

    @ui_locales.setter
    def ui_locales(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "ui_locales", value)

    @_builtins.property
    @pulumi.getter(name="userInfoUrl")
    def user_info_url(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        User Info URL.
        """
        return pulumi.get(self, "user_info_url")

    @user_info_url.setter
    def user_info_url(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "user_info_url", value)

    @_builtins.property
    @pulumi.getter(name="validateSignature")
    def validate_signature(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Enable/disable signature validation of external IDP signatures. Defaults to `false`.
        """
        return pulumi.get(self, "validate_signature")

    @validate_signature.setter
    def validate_signature(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "validate_signature", value)


@pulumi.input_type
class _IdentityProviderState:
    def __init__(__self__, *,
                 accepts_prompt_none_forward_from_client: Optional[pulumi.Input[_builtins.bool]] = None,
                 add_read_token_role_on_create: Optional[pulumi.Input[_builtins.bool]] = None,
                 alias: Optional[pulumi.Input[_builtins.str]] = None,
                 authenticate_by_default: Optional[pulumi.Input[_builtins.bool]] = None,
                 authorization_url: Optional[pulumi.Input[_builtins.str]] = None,
                 backchannel_supported: Optional[pulumi.Input[_builtins.bool]] = None,
                 client_id: Optional[pulumi.Input[_builtins.str]] = None,
                 client_secret: Optional[pulumi.Input[_builtins.str]] = None,
                 client_secret_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
                 default_scopes: Optional[pulumi.Input[_builtins.str]] = None,
                 disable_type_claim_check: Optional[pulumi.Input[_builtins.bool]] = None,
                 disable_user_info: Optional[pulumi.Input[_builtins.bool]] = None,
                 display_name: Optional[pulumi.Input[_builtins.str]] = None,
                 enabled: Optional[pulumi.Input[_builtins.bool]] = None,
                 extra_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
                 first_broker_login_flow_alias: Optional[pulumi.Input[_builtins.str]] = None,
                 gui_order: Optional[pulumi.Input[_builtins.str]] = None,
                 hide_on_login_page: Optional[pulumi.Input[_builtins.bool]] = None,
                 internal_id: Optional[pulumi.Input[_builtins.str]] = None,
                 issuer: Optional[pulumi.Input[_builtins.str]] = None,
                 jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
                 link_only: Optional[pulumi.Input[_builtins.bool]] = None,
                 login_hint: Optional[pulumi.Input[_builtins.str]] = None,
                 logout_url: Optional[pulumi.Input[_builtins.str]] = None,
                 org_domain: Optional[pulumi.Input[_builtins.str]] = None,
                 org_redirect_mode_email_matches: Optional[pulumi.Input[_builtins.bool]] = None,
                 organization_id: Optional[pulumi.Input[_builtins.str]] = None,
                 post_broker_login_flow_alias: Optional[pulumi.Input[_builtins.str]] = None,
                 provider_id: Optional[pulumi.Input[_builtins.str]] = None,
                 realm: Optional[pulumi.Input[_builtins.str]] = None,
                 store_token: Optional[pulumi.Input[_builtins.bool]] = None,
                 sync_mode: Optional[pulumi.Input[_builtins.str]] = None,
                 token_url: Optional[pulumi.Input[_builtins.str]] = None,
                 trust_email: Optional[pulumi.Input[_builtins.bool]] = None,
                 ui_locales: Optional[pulumi.Input[_builtins.bool]] = None,
                 user_info_url: Optional[pulumi.Input[_builtins.str]] = None,
                 validate_signature: Optional[pulumi.Input[_builtins.bool]] = None):
        """
        Input properties used for looking up and filtering IdentityProvider resources.
        :param pulumi.Input[_builtins.bool] accepts_prompt_none_forward_from_client: When `true`, the IDP will accept forwarded authentication requests that contain the `prompt=none` query parameter. Defaults to `false`.
        :param pulumi.Input[_builtins.bool] add_read_token_role_on_create: When `true`, new users will be able to read stored tokens. This will automatically assign the `broker.read-token` role. Defaults to `false`.
        :param pulumi.Input[_builtins.str] alias: The alias uniquely identifies an identity provider, and it is also used to build the redirect uri.
        :param pulumi.Input[_builtins.bool] authenticate_by_default: Enable/disable authenticate users by default.
        :param pulumi.Input[_builtins.str] authorization_url: The Authorization Url.
        :param pulumi.Input[_builtins.bool] backchannel_supported: Does the external IDP support backchannel logout? Defaults to `true`.
        :param pulumi.Input[_builtins.str] client_id: The client or client identifier registered within the identity provider.
        :param pulumi.Input[_builtins.str] client_secret: The client or client secret registered within the identity provider. This field is able to obtain its value from vault, use $${vault.ID} format. Required without `client_secret_wo` and `client_secret_wo_version`.
        :param pulumi.Input[_builtins.int] client_secret_wo_version: Version of the Client secret write-only argument
        :param pulumi.Input[_builtins.str] default_scopes: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to `openid`.
        :param pulumi.Input[_builtins.bool] disable_type_claim_check: When `true`, disables the check for the `typ` claim of tokens received from the identity provider. Defaults to `false`.
        :param pulumi.Input[_builtins.bool] disable_user_info: When `true`, disables the usage of the user info service to obtain additional user information. Defaults to `false`.
        :param pulumi.Input[_builtins.str] display_name: Display name for the identity provider in the GUI.
        :param pulumi.Input[_builtins.bool] enabled: When `true`, users will be able to log in to this realm using this identity provider. Defaults to `true`.
        :param pulumi.Input[_builtins.str] first_broker_login_flow_alias: The authentication flow to use when users log in for the first time through this identity provider. Defaults to `first broker login`.
        :param pulumi.Input[_builtins.str] gui_order: A number defining the order of this identity provider in the GUI.
        :param pulumi.Input[_builtins.bool] hide_on_login_page: When `true`, this provider will be hidden on the login page, and is only accessible when requested explicitly. Defaults to `false`.
        :param pulumi.Input[_builtins.str] internal_id: (Computed) The unique ID that Keycloak assigns to the identity provider upon creation.
        :param pulumi.Input[_builtins.str] issuer: The issuer identifier for the issuer of the response. If not provided, no validation will be performed.
        :param pulumi.Input[_builtins.str] jwks_url: JSON Web Key Set URL.
        :param pulumi.Input[_builtins.bool] link_only: When `true`, users cannot sign-in using this provider, but their existing accounts will be linked when possible. Defaults to `false`.
        :param pulumi.Input[_builtins.str] login_hint: Pass login hint to identity provider.
        :param pulumi.Input[_builtins.str] logout_url: The Logout URL is the end session endpoint to use to sign-out the user from external identity provider.
        :param pulumi.Input[_builtins.str] org_domain: The organization domain to associate this identity provider with. it is used to map users to an organization based on their email domain and to authenticate them accordingly in the scope of the organization.
        :param pulumi.Input[_builtins.bool] org_redirect_mode_email_matches: Indicates whether to automatically redirect user to this identity provider when email domain matches domain.
        :param pulumi.Input[_builtins.str] organization_id: The ID of the organization to link this identity provider to.
        :param pulumi.Input[_builtins.str] post_broker_login_flow_alias: The authentication flow to use after users have successfully logged in, which can be used to perform additional user verification (such as OTP checking). Defaults to an empty string, which means no post login flow will be used.
        :param pulumi.Input[_builtins.str] provider_id: The ID of the identity provider to use. Defaults to `oidc`, which should be used unless you have extended Keycloak and provided your own implementation.
        :param pulumi.Input[_builtins.str] realm: The name of the realm. This is unique across Keycloak.
        :param pulumi.Input[_builtins.bool] store_token: When `true`, tokens will be stored after authenticating users. Defaults to `true`.
        :param pulumi.Input[_builtins.str] sync_mode: The default sync mode to use for all mappers attached to this identity provider. Can be once of `IMPORT`, `FORCE`, or `LEGACY`.
        :param pulumi.Input[_builtins.str] token_url: The Token URL.
        :param pulumi.Input[_builtins.bool] trust_email: When `true`, email addresses for users in this provider will automatically be verified regardless of the realm's email verification policy. Defaults to `false`.
        :param pulumi.Input[_builtins.bool] ui_locales: Pass current locale to identity provider. Defaults to `false`.
        :param pulumi.Input[_builtins.str] user_info_url: User Info URL.
        :param pulumi.Input[_builtins.bool] validate_signature: Enable/disable signature validation of external IDP signatures. Defaults to `false`.
        """
        if accepts_prompt_none_forward_from_client is not None:
            pulumi.set(__self__, "accepts_prompt_none_forward_from_client", accepts_prompt_none_forward_from_client)
        if add_read_token_role_on_create is not None:
            pulumi.set(__self__, "add_read_token_role_on_create", add_read_token_role_on_create)
        if alias is not None:
            pulumi.set(__self__, "alias", alias)
        if authenticate_by_default is not None:
            pulumi.set(__self__, "authenticate_by_default", authenticate_by_default)
        if authorization_url is not None:
            pulumi.set(__self__, "authorization_url", authorization_url)
        if backchannel_supported is not None:
            pulumi.set(__self__, "backchannel_supported", backchannel_supported)
        if client_id is not None:
            pulumi.set(__self__, "client_id", client_id)
        if client_secret is not None:
            pulumi.set(__self__, "client_secret", client_secret)
        if client_secret_wo_version is not None:
            pulumi.set(__self__, "client_secret_wo_version", client_secret_wo_version)
        if default_scopes is not None:
            pulumi.set(__self__, "default_scopes", default_scopes)
        if disable_type_claim_check is not None:
            pulumi.set(__self__, "disable_type_claim_check", disable_type_claim_check)
        if disable_user_info is not None:
            pulumi.set(__self__, "disable_user_info", disable_user_info)
        if display_name is not None:
            pulumi.set(__self__, "display_name", display_name)
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if extra_config is not None:
            pulumi.set(__self__, "extra_config", extra_config)
        if first_broker_login_flow_alias is not None:
            pulumi.set(__self__, "first_broker_login_flow_alias", first_broker_login_flow_alias)
        if gui_order is not None:
            pulumi.set(__self__, "gui_order", gui_order)
        if hide_on_login_page is not None:
            pulumi.set(__self__, "hide_on_login_page", hide_on_login_page)
        if internal_id is not None:
            pulumi.set(__self__, "internal_id", internal_id)
        if issuer is not None:
            pulumi.set(__self__, "issuer", issuer)
        if jwks_url is not None:
            pulumi.set(__self__, "jwks_url", jwks_url)
        if link_only is not None:
            pulumi.set(__self__, "link_only", link_only)
        if login_hint is not None:
            pulumi.set(__self__, "login_hint", login_hint)
        if logout_url is not None:
            pulumi.set(__self__, "logout_url", logout_url)
        if org_domain is not None:
            pulumi.set(__self__, "org_domain", org_domain)
        if org_redirect_mode_email_matches is not None:
            pulumi.set(__self__, "org_redirect_mode_email_matches", org_redirect_mode_email_matches)
        if organization_id is not None:
            pulumi.set(__self__, "organization_id", organization_id)
        if post_broker_login_flow_alias is not None:
            pulumi.set(__self__, "post_broker_login_flow_alias", post_broker_login_flow_alias)
        if provider_id is not None:
            pulumi.set(__self__, "provider_id", provider_id)
        if realm is not None:
            pulumi.set(__self__, "realm", realm)
        if store_token is not None:
            pulumi.set(__self__, "store_token", store_token)
        if sync_mode is not None:
            pulumi.set(__self__, "sync_mode", sync_mode)
        if token_url is not None:
            pulumi.set(__self__, "token_url", token_url)
        if trust_email is not None:
            pulumi.set(__self__, "trust_email", trust_email)
        if ui_locales is not None:
            pulumi.set(__self__, "ui_locales", ui_locales)
        if user_info_url is not None:
            pulumi.set(__self__, "user_info_url", user_info_url)
        if validate_signature is not None:
            pulumi.set(__self__, "validate_signature", validate_signature)

    @_builtins.property
    @pulumi.getter(name="acceptsPromptNoneForwardFromClient")
    def accepts_prompt_none_forward_from_client(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, the IDP will accept forwarded authentication requests that contain the `prompt=none` query parameter. Defaults to `false`.
        """
        return pulumi.get(self, "accepts_prompt_none_forward_from_client")

    @accepts_prompt_none_forward_from_client.setter
    def accepts_prompt_none_forward_from_client(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "accepts_prompt_none_forward_from_client", value)

    @_builtins.property
    @pulumi.getter(name="addReadTokenRoleOnCreate")
    def add_read_token_role_on_create(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, new users will be able to read stored tokens. This will automatically assign the `broker.read-token` role. Defaults to `false`.
        """
        return pulumi.get(self, "add_read_token_role_on_create")

    @add_read_token_role_on_create.setter
    def add_read_token_role_on_create(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "add_read_token_role_on_create", value)

    @_builtins.property
    @pulumi.getter
    def alias(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The alias uniquely identifies an identity provider, and it is also used to build the redirect uri.
        """
        return pulumi.get(self, "alias")

    @alias.setter
    def alias(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "alias", value)

    @_builtins.property
    @pulumi.getter(name="authenticateByDefault")
    def authenticate_by_default(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Enable/disable authenticate users by default.
        """
        return pulumi.get(self, "authenticate_by_default")

    @authenticate_by_default.setter
    def authenticate_by_default(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "authenticate_by_default", value)

    @_builtins.property
    @pulumi.getter(name="authorizationUrl")
    def authorization_url(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The Authorization Url.
        """
        return pulumi.get(self, "authorization_url")

    @authorization_url.setter
    def authorization_url(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "authorization_url", value)

    @_builtins.property
    @pulumi.getter(name="backchannelSupported")
    def backchannel_supported(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Does the external IDP support backchannel logout? Defaults to `true`.
        """
        return pulumi.get(self, "backchannel_supported")

    @backchannel_supported.setter
    def backchannel_supported(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "backchannel_supported", value)

    @_builtins.property
    @pulumi.getter(name="clientId")
    def client_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The client or client identifier registered within the identity provider.
        """
        return pulumi.get(self, "client_id")

    @client_id.setter
    def client_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "client_id", value)

    @_builtins.property
    @pulumi.getter(name="clientSecret")
    def client_secret(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The client or client secret registered within the identity provider. This field is able to obtain its value from vault, use $${vault.ID} format. Required without `client_secret_wo` and `client_secret_wo_version`.
        """
        return pulumi.get(self, "client_secret")

    @client_secret.setter
    def client_secret(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "client_secret", value)

    @_builtins.property
    @pulumi.getter(name="clientSecretWoVersion")
    def client_secret_wo_version(self) -> Optional[pulumi.Input[_builtins.int]]:
        """
        Version of the Client secret write-only argument
        """
        return pulumi.get(self, "client_secret_wo_version")

    @client_secret_wo_version.setter
    def client_secret_wo_version(self, value: Optional[pulumi.Input[_builtins.int]]):
        pulumi.set(self, "client_secret_wo_version", value)

    @_builtins.property
    @pulumi.getter(name="defaultScopes")
    def default_scopes(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to `openid`.
        """
        return pulumi.get(self, "default_scopes")

    @default_scopes.setter
    def default_scopes(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "default_scopes", value)

    @_builtins.property
    @pulumi.getter(name="disableTypeClaimCheck")
    def disable_type_claim_check(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, disables the check for the `typ` claim of tokens received from the identity provider. Defaults to `false`.
        """
        return pulumi.get(self, "disable_type_claim_check")

    @disable_type_claim_check.setter
    def disable_type_claim_check(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "disable_type_claim_check", value)

    @_builtins.property
    @pulumi.getter(name="disableUserInfo")
    def disable_user_info(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, disables the usage of the user info service to obtain additional user information. Defaults to `false`.
        """
        return pulumi.get(self, "disable_user_info")

    @disable_user_info.setter
    def disable_user_info(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "disable_user_info", value)

    @_builtins.property
    @pulumi.getter(name="displayName")
    def display_name(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Display name for the identity provider in the GUI.
        """
        return pulumi.get(self, "display_name")

    @display_name.setter
    def display_name(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "display_name", value)

    @_builtins.property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, users will be able to log in to this realm using this identity provider. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "enabled", value)

    @_builtins.property
    @pulumi.getter(name="extraConfig")
    def extra_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
        return pulumi.get(self, "extra_config")

    @extra_config.setter
    def extra_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "extra_config", value)

    @_builtins.property
    @pulumi.getter(name="firstBrokerLoginFlowAlias")
    def first_broker_login_flow_alias(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The authentication flow to use when users log in for the first time through this identity provider. Defaults to `first broker login`.
        """
        return pulumi.get(self, "first_broker_login_flow_alias")

    @first_broker_login_flow_alias.setter
    def first_broker_login_flow_alias(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "first_broker_login_flow_alias", value)

    @_builtins.property
    @pulumi.getter(name="guiOrder")
    def gui_order(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        A number defining the order of this identity provider in the GUI.
        """
        return pulumi.get(self, "gui_order")

    @gui_order.setter
    def gui_order(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "gui_order", value)

    @_builtins.property
    @pulumi.getter(name="hideOnLoginPage")
    def hide_on_login_page(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, this provider will be hidden on the login page, and is only accessible when requested explicitly. Defaults to `false`.
        """
        return pulumi.get(self, "hide_on_login_page")

    @hide_on_login_page.setter
    def hide_on_login_page(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "hide_on_login_page", value)

    @_builtins.property
    @pulumi.getter(name="internalId")
    def internal_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        (Computed) The unique ID that Keycloak assigns to the identity provider upon creation.
        """
        return pulumi.get(self, "internal_id")

    @internal_id.setter
    def internal_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "internal_id", value)

    @_builtins.property
    @pulumi.getter
    def issuer(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The issuer identifier for the issuer of the response. If not provided, no validation will be performed.
        """
        return pulumi.get(self, "issuer")

    @issuer.setter
    def issuer(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "issuer", value)

    @_builtins.property
    @pulumi.getter(name="jwksUrl")
    def jwks_url(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        JSON Web Key Set URL.
        """
        return pulumi.get(self, "jwks_url")

    @jwks_url.setter
    def jwks_url(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "jwks_url", value)

    @_builtins.property
    @pulumi.getter(name="linkOnly")
    def link_only(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, users cannot sign-in using this provider, but their existing accounts will be linked when possible. Defaults to `false`.
        """
        return pulumi.get(self, "link_only")

    @link_only.setter
    def link_only(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "link_only", value)

    @_builtins.property
    @pulumi.getter(name="loginHint")
    def login_hint(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Pass login hint to identity provider.
        """
        return pulumi.get(self, "login_hint")

    @login_hint.setter
    def login_hint(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "login_hint", value)

    @_builtins.property
    @pulumi.getter(name="logoutUrl")
    def logout_url(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The Logout URL is the end session endpoint to use to sign-out the user from external identity provider.
        """
        return pulumi.get(self, "logout_url")

    @logout_url.setter
    def logout_url(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "logout_url", value)

    @_builtins.property
    @pulumi.getter(name="orgDomain")
    def org_domain(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The organization domain to associate this identity provider with. it is used to map users to an organization based on their email domain and to authenticate them accordingly in the scope of the organization.
        """
        return pulumi.get(self, "org_domain")

    @org_domain.setter
    def org_domain(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "org_domain", value)

    @_builtins.property
    @pulumi.getter(name="orgRedirectModeEmailMatches")
    def org_redirect_mode_email_matches(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Indicates whether to automatically redirect user to this identity provider when email domain matches domain.
        """
        return pulumi.get(self, "org_redirect_mode_email_matches")

    @org_redirect_mode_email_matches.setter
    def org_redirect_mode_email_matches(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "org_redirect_mode_email_matches", value)

    @_builtins.property
    @pulumi.getter(name="organizationId")
    def organization_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The ID of the organization to link this identity provider to.
        """
        return pulumi.get(self, "organization_id")

    @organization_id.setter
    def organization_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "organization_id", value)

    @_builtins.property
    @pulumi.getter(name="postBrokerLoginFlowAlias")
    def post_broker_login_flow_alias(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The authentication flow to use after users have successfully logged in, which can be used to perform additional user verification (such as OTP checking). Defaults to an empty string, which means no post login flow will be used.
        """
        return pulumi.get(self, "post_broker_login_flow_alias")

    @post_broker_login_flow_alias.setter
    def post_broker_login_flow_alias(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "post_broker_login_flow_alias", value)

    @_builtins.property
    @pulumi.getter(name="providerId")
    def provider_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The ID of the identity provider to use. Defaults to `oidc`, which should be used unless you have extended Keycloak and provided your own implementation.
        """
        return pulumi.get(self, "provider_id")

    @provider_id.setter
    def provider_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "provider_id", value)

    @_builtins.property
    @pulumi.getter
    def realm(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The name of the realm. This is unique across Keycloak.
        """
        return pulumi.get(self, "realm")

    @realm.setter
    def realm(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "realm", value)

    @_builtins.property
    @pulumi.getter(name="storeToken")
    def store_token(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, tokens will be stored after authenticating users. Defaults to `true`.
        """
        return pulumi.get(self, "store_token")

    @store_token.setter
    def store_token(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "store_token", value)

    @_builtins.property
    @pulumi.getter(name="syncMode")
    def sync_mode(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The default sync mode to use for all mappers attached to this identity provider. Can be once of `IMPORT`, `FORCE`, or `LEGACY`.
        """
        return pulumi.get(self, "sync_mode")

    @sync_mode.setter
    def sync_mode(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "sync_mode", value)

    @_builtins.property
    @pulumi.getter(name="tokenUrl")
    def token_url(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The Token URL.
        """
        return pulumi.get(self, "token_url")

    @token_url.setter
    def token_url(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "token_url", value)

    @_builtins.property
    @pulumi.getter(name="trustEmail")
    def trust_email(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true`, email addresses for users in this provider will automatically be verified regardless of the realm's email verification policy. Defaults to `false`.
        """
        return pulumi.get(self, "trust_email")

    @trust_email.setter
    def trust_email(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "trust_email", value)

    @_builtins.property
    @pulumi.getter(name="uiLocales")
    def ui_locales(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Pass current locale to identity provider. Defaults to `false`.
        """
        return pulumi.get(self, "ui_locales")

    @ui_locales.setter
    def ui_locales(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "ui_locales", value)

    @_builtins.property
    @pulumi.getter(name="userInfoUrl")
    def user_info_url(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        User Info URL.
        """
        return pulumi.get(self, "user_info_url")

    @user_info_url.setter
    def user_info_url(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "user_info_url", value)

    @_builtins.property
    @pulumi.getter(name="validateSignature")
    def validate_signature(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Enable/disable signature validation of external IDP signatures. Defaults to `false`.
        """
        return pulumi.get(self, "validate_signature")

    @validate_signature.setter
    def validate_signature(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "validate_signature", value)


@pulumi.type_token("keycloak:oidc/identityProvider:IdentityProvider")
class IdentityProvider(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 accepts_prompt_none_forward_from_client: Optional[pulumi.Input[_builtins.bool]] = None,
                 add_read_token_role_on_create: Optional[pulumi.Input[_builtins.bool]] = None,
                 alias: Optional[pulumi.Input[_builtins.str]] = None,
                 authenticate_by_default: Optional[pulumi.Input[_builtins.bool]] = None,
                 authorization_url: Optional[pulumi.Input[_builtins.str]] = None,
                 backchannel_supported: Optional[pulumi.Input[_builtins.bool]] = None,
                 client_id: Optional[pulumi.Input[_builtins.str]] = None,
                 client_secret: Optional[pulumi.Input[_builtins.str]] = None,
                 client_secret_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
                 default_scopes: Optional[pulumi.Input[_builtins.str]] = None,
                 disable_type_claim_check: Optional[pulumi.Input[_builtins.bool]] = None,
                 disable_user_info: Optional[pulumi.Input[_builtins.bool]] = None,
                 display_name: Optional[pulumi.Input[_builtins.str]] = None,
                 enabled: Optional[pulumi.Input[_builtins.bool]] = None,
                 extra_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
                 first_broker_login_flow_alias: Optional[pulumi.Input[_builtins.str]] = None,
                 gui_order: Optional[pulumi.Input[_builtins.str]] = None,
                 hide_on_login_page: Optional[pulumi.Input[_builtins.bool]] = None,
                 issuer: Optional[pulumi.Input[_builtins.str]] = None,
                 jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
                 link_only: Optional[pulumi.Input[_builtins.bool]] = None,
                 login_hint: Optional[pulumi.Input[_builtins.str]] = None,
                 logout_url: Optional[pulumi.Input[_builtins.str]] = None,
                 org_domain: Optional[pulumi.Input[_builtins.str]] = None,
                 org_redirect_mode_email_matches: Optional[pulumi.Input[_builtins.bool]] = None,
                 organization_id: Optional[pulumi.Input[_builtins.str]] = None,
                 post_broker_login_flow_alias: Optional[pulumi.Input[_builtins.str]] = None,
                 provider_id: Optional[pulumi.Input[_builtins.str]] = None,
                 realm: Optional[pulumi.Input[_builtins.str]] = None,
                 store_token: Optional[pulumi.Input[_builtins.bool]] = None,
                 sync_mode: Optional[pulumi.Input[_builtins.str]] = None,
                 token_url: Optional[pulumi.Input[_builtins.str]] = None,
                 trust_email: Optional[pulumi.Input[_builtins.bool]] = None,
                 ui_locales: Optional[pulumi.Input[_builtins.bool]] = None,
                 user_info_url: Optional[pulumi.Input[_builtins.str]] = None,
                 validate_signature: Optional[pulumi.Input[_builtins.bool]] = None,
                 __props__=None):
        """
        Allows for creating and managing OIDC Identity Providers within Keycloak.

        OIDC (OpenID Connect) identity providers allows users to authenticate through a third party system using the OIDC standard.

        > **NOTICE:** This resource now supports write-only arguments
        for client secret via the new arguments `client_secret_wo` and `client_secret_wo_version`. Using write-only arguments
        prevents sensitive values from being stored in plan and state files. You cannot use `client_secret_wo` and
        `client_secret_wo_version` alongside `client_secret` as this will result in a validation error due to conflicts.
        > 
        > For backward compatibility, the behavior of the original `client_secret` argument remains unchanged.

        ## Example Usage

        ```python
        import pulumi
        import pulumi_keycloak as keycloak

        realm = keycloak.Realm("realm",
            realm="my-realm",
            enabled=True)
        realm_identity_provider = keycloak.oidc.IdentityProvider("realm_identity_provider",
            realm=realm.id,
            alias="my-idp",
            authorization_url="https://authorizationurl.com",
            client_id="clientID",
            client_secret="clientSecret",
            token_url="https://tokenurl.com",
            extra_config={
                "clientAuthMethod": "client_secret_post",
            })
        ```

        ## Import

        Identity providers can be imported using the format `{{realm_id}}/{{idp_alias}}`, where `idp_alias` is the identity provider alias.

        Example:

        bash

        ```sh
        $ pulumi import keycloak:oidc/identityProvider:IdentityProvider realm_identity_provider my-realm/my-idp
        ```

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[_builtins.bool] accepts_prompt_none_forward_from_client: When `true`, the IDP will accept forwarded authentication requests that contain the `prompt=none` query parameter. Defaults to `false`.
        :param pulumi.Input[_builtins.bool] add_read_token_role_on_create: When `true`, new users will be able to read stored tokens. This will automatically assign the `broker.read-token` role. Defaults to `false`.
        :param pulumi.Input[_builtins.str] alias: The alias uniquely identifies an identity provider, and it is also used to build the redirect uri.
        :param pulumi.Input[_builtins.bool] authenticate_by_default: Enable/disable authenticate users by default.
        :param pulumi.Input[_builtins.str] authorization_url: The Authorization Url.
        :param pulumi.Input[_builtins.bool] backchannel_supported: Does the external IDP support backchannel logout? Defaults to `true`.
        :param pulumi.Input[_builtins.str] client_id: The client or client identifier registered within the identity provider.
        :param pulumi.Input[_builtins.str] client_secret: The client or client secret registered within the identity provider. This field is able to obtain its value from vault, use $${vault.ID} format. Required without `client_secret_wo` and `client_secret_wo_version`.
        :param pulumi.Input[_builtins.int] client_secret_wo_version: Version of the Client secret write-only argument
        :param pulumi.Input[_builtins.str] default_scopes: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to `openid`.
        :param pulumi.Input[_builtins.bool] disable_type_claim_check: When `true`, disables the check for the `typ` claim of tokens received from the identity provider. Defaults to `false`.
        :param pulumi.Input[_builtins.bool] disable_user_info: When `true`, disables the usage of the user info service to obtain additional user information. Defaults to `false`.
        :param pulumi.Input[_builtins.str] display_name: Display name for the identity provider in the GUI.
        :param pulumi.Input[_builtins.bool] enabled: When `true`, users will be able to log in to this realm using this identity provider. Defaults to `true`.
        :param pulumi.Input[_builtins.str] first_broker_login_flow_alias: The authentication flow to use when users log in for the first time through this identity provider. Defaults to `first broker login`.
        :param pulumi.Input[_builtins.str] gui_order: A number defining the order of this identity provider in the GUI.
        :param pulumi.Input[_builtins.bool] hide_on_login_page: When `true`, this provider will be hidden on the login page, and is only accessible when requested explicitly. Defaults to `false`.
        :param pulumi.Input[_builtins.str] issuer: The issuer identifier for the issuer of the response. If not provided, no validation will be performed.
        :param pulumi.Input[_builtins.str] jwks_url: JSON Web Key Set URL.
        :param pulumi.Input[_builtins.bool] link_only: When `true`, users cannot sign-in using this provider, but their existing accounts will be linked when possible. Defaults to `false`.
        :param pulumi.Input[_builtins.str] login_hint: Pass login hint to identity provider.
        :param pulumi.Input[_builtins.str] logout_url: The Logout URL is the end session endpoint to use to sign-out the user from external identity provider.
        :param pulumi.Input[_builtins.str] org_domain: The organization domain to associate this identity provider with. it is used to map users to an organization based on their email domain and to authenticate them accordingly in the scope of the organization.
        :param pulumi.Input[_builtins.bool] org_redirect_mode_email_matches: Indicates whether to automatically redirect user to this identity provider when email domain matches domain.
        :param pulumi.Input[_builtins.str] organization_id: The ID of the organization to link this identity provider to.
        :param pulumi.Input[_builtins.str] post_broker_login_flow_alias: The authentication flow to use after users have successfully logged in, which can be used to perform additional user verification (such as OTP checking). Defaults to an empty string, which means no post login flow will be used.
        :param pulumi.Input[_builtins.str] provider_id: The ID of the identity provider to use. Defaults to `oidc`, which should be used unless you have extended Keycloak and provided your own implementation.
        :param pulumi.Input[_builtins.str] realm: The name of the realm. This is unique across Keycloak.
        :param pulumi.Input[_builtins.bool] store_token: When `true`, tokens will be stored after authenticating users. Defaults to `true`.
        :param pulumi.Input[_builtins.str] sync_mode: The default sync mode to use for all mappers attached to this identity provider. Can be once of `IMPORT`, `FORCE`, or `LEGACY`.
        :param pulumi.Input[_builtins.str] token_url: The Token URL.
        :param pulumi.Input[_builtins.bool] trust_email: When `true`, email addresses for users in this provider will automatically be verified regardless of the realm's email verification policy. Defaults to `false`.
        :param pulumi.Input[_builtins.bool] ui_locales: Pass current locale to identity provider. Defaults to `false`.
        :param pulumi.Input[_builtins.str] user_info_url: User Info URL.
        :param pulumi.Input[_builtins.bool] validate_signature: Enable/disable signature validation of external IDP signatures. Defaults to `false`.
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: IdentityProviderArgs,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        Allows for creating and managing OIDC Identity Providers within Keycloak.

        OIDC (OpenID Connect) identity providers allows users to authenticate through a third party system using the OIDC standard.

        > **NOTICE:** This resource now supports write-only arguments
        for client secret via the new arguments `client_secret_wo` and `client_secret_wo_version`. Using write-only arguments
        prevents sensitive values from being stored in plan and state files. You cannot use `client_secret_wo` and
        `client_secret_wo_version` alongside `client_secret` as this will result in a validation error due to conflicts.
        > 
        > For backward compatibility, the behavior of the original `client_secret` argument remains unchanged.

        ## Example Usage

        ```python
        import pulumi
        import pulumi_keycloak as keycloak

        realm = keycloak.Realm("realm",
            realm="my-realm",
            enabled=True)
        realm_identity_provider = keycloak.oidc.IdentityProvider("realm_identity_provider",
            realm=realm.id,
            alias="my-idp",
            authorization_url="https://authorizationurl.com",
            client_id="clientID",
            client_secret="clientSecret",
            token_url="https://tokenurl.com",
            extra_config={
                "clientAuthMethod": "client_secret_post",
            })
        ```

        ## Import

        Identity providers can be imported using the format `{{realm_id}}/{{idp_alias}}`, where `idp_alias` is the identity provider alias.

        Example:

        bash

        ```sh
        $ pulumi import keycloak:oidc/identityProvider:IdentityProvider realm_identity_provider my-realm/my-idp
        ```

        :param str resource_name: The name of the resource.
        :param IdentityProviderArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(IdentityProviderArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 accepts_prompt_none_forward_from_client: Optional[pulumi.Input[_builtins.bool]] = None,
                 add_read_token_role_on_create: Optional[pulumi.Input[_builtins.bool]] = None,
                 alias: Optional[pulumi.Input[_builtins.str]] = None,
                 authenticate_by_default: Optional[pulumi.Input[_builtins.bool]] = None,
                 authorization_url: Optional[pulumi.Input[_builtins.str]] = None,
                 backchannel_supported: Optional[pulumi.Input[_builtins.bool]] = None,
                 client_id: Optional[pulumi.Input[_builtins.str]] = None,
                 client_secret: Optional[pulumi.Input[_builtins.str]] = None,
                 client_secret_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
                 default_scopes: Optional[pulumi.Input[_builtins.str]] = None,
                 disable_type_claim_check: Optional[pulumi.Input[_builtins.bool]] = None,
                 disable_user_info: Optional[pulumi.Input[_builtins.bool]] = None,
                 display_name: Optional[pulumi.Input[_builtins.str]] = None,
                 enabled: Optional[pulumi.Input[_builtins.bool]] = None,
                 extra_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
                 first_broker_login_flow_alias: Optional[pulumi.Input[_builtins.str]] = None,
                 gui_order: Optional[pulumi.Input[_builtins.str]] = None,
                 hide_on_login_page: Optional[pulumi.Input[_builtins.bool]] = None,
                 issuer: Optional[pulumi.Input[_builtins.str]] = None,
                 jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
                 link_only: Optional[pulumi.Input[_builtins.bool]] = None,
                 login_hint: Optional[pulumi.Input[_builtins.str]] = None,
                 logout_url: Optional[pulumi.Input[_builtins.str]] = None,
                 org_domain: Optional[pulumi.Input[_builtins.str]] = None,
                 org_redirect_mode_email_matches: Optional[pulumi.Input[_builtins.bool]] = None,
                 organization_id: Optional[pulumi.Input[_builtins.str]] = None,
                 post_broker_login_flow_alias: Optional[pulumi.Input[_builtins.str]] = None,
                 provider_id: Optional[pulumi.Input[_builtins.str]] = None,
                 realm: Optional[pulumi.Input[_builtins.str]] = None,
                 store_token: Optional[pulumi.Input[_builtins.bool]] = None,
                 sync_mode: Optional[pulumi.Input[_builtins.str]] = None,
                 token_url: Optional[pulumi.Input[_builtins.str]] = None,
                 trust_email: Optional[pulumi.Input[_builtins.bool]] = None,
                 ui_locales: Optional[pulumi.Input[_builtins.bool]] = None,
                 user_info_url: Optional[pulumi.Input[_builtins.str]] = None,
                 validate_signature: Optional[pulumi.Input[_builtins.bool]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = IdentityProviderArgs.__new__(IdentityProviderArgs)

            __props__.__dict__["accepts_prompt_none_forward_from_client"] = accepts_prompt_none_forward_from_client
            __props__.__dict__["add_read_token_role_on_create"] = add_read_token_role_on_create
            if alias is None and not opts.urn:
                raise TypeError("Missing required property 'alias'")
            __props__.__dict__["alias"] = alias
            __props__.__dict__["authenticate_by_default"] = authenticate_by_default
            if authorization_url is None and not opts.urn:
                raise TypeError("Missing required property 'authorization_url'")
            __props__.__dict__["authorization_url"] = authorization_url
            __props__.__dict__["backchannel_supported"] = backchannel_supported
            if client_id is None and not opts.urn:
                raise TypeError("Missing required property 'client_id'")
            __props__.__dict__["client_id"] = client_id
            __props__.__dict__["client_secret"] = None if client_secret is None else pulumi.Output.secret(client_secret)
            __props__.__dict__["client_secret_wo_version"] = client_secret_wo_version
            __props__.__dict__["default_scopes"] = default_scopes
            __props__.__dict__["disable_type_claim_check"] = disable_type_claim_check
            __props__.__dict__["disable_user_info"] = disable_user_info
            __props__.__dict__["display_name"] = display_name
            __props__.__dict__["enabled"] = enabled
            __props__.__dict__["extra_config"] = extra_config
            __props__.__dict__["first_broker_login_flow_alias"] = first_broker_login_flow_alias
            __props__.__dict__["gui_order"] = gui_order
            __props__.__dict__["hide_on_login_page"] = hide_on_login_page
            __props__.__dict__["issuer"] = issuer
            __props__.__dict__["jwks_url"] = jwks_url
            __props__.__dict__["link_only"] = link_only
            __props__.__dict__["login_hint"] = login_hint
            __props__.__dict__["logout_url"] = logout_url
            __props__.__dict__["org_domain"] = org_domain
            __props__.__dict__["org_redirect_mode_email_matches"] = org_redirect_mode_email_matches
            __props__.__dict__["organization_id"] = organization_id
            __props__.__dict__["post_broker_login_flow_alias"] = post_broker_login_flow_alias
            __props__.__dict__["provider_id"] = provider_id
            if realm is None and not opts.urn:
                raise TypeError("Missing required property 'realm'")
            __props__.__dict__["realm"] = realm
            __props__.__dict__["store_token"] = store_token
            __props__.__dict__["sync_mode"] = sync_mode
            if token_url is None and not opts.urn:
                raise TypeError("Missing required property 'token_url'")
            __props__.__dict__["token_url"] = token_url
            __props__.__dict__["trust_email"] = trust_email
            __props__.__dict__["ui_locales"] = ui_locales
            __props__.__dict__["user_info_url"] = user_info_url
            __props__.__dict__["validate_signature"] = validate_signature
            __props__.__dict__["internal_id"] = None
        secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["clientSecret"])
        opts = pulumi.ResourceOptions.merge(opts, secret_opts)
        super(IdentityProvider, __self__).__init__(
            'keycloak:oidc/identityProvider:IdentityProvider',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            accepts_prompt_none_forward_from_client: Optional[pulumi.Input[_builtins.bool]] = None,
            add_read_token_role_on_create: Optional[pulumi.Input[_builtins.bool]] = None,
            alias: Optional[pulumi.Input[_builtins.str]] = None,
            authenticate_by_default: Optional[pulumi.Input[_builtins.bool]] = None,
            authorization_url: Optional[pulumi.Input[_builtins.str]] = None,
            backchannel_supported: Optional[pulumi.Input[_builtins.bool]] = None,
            client_id: Optional[pulumi.Input[_builtins.str]] = None,
            client_secret: Optional[pulumi.Input[_builtins.str]] = None,
            client_secret_wo_version: Optional[pulumi.Input[_builtins.int]] = None,
            default_scopes: Optional[pulumi.Input[_builtins.str]] = None,
            disable_type_claim_check: Optional[pulumi.Input[_builtins.bool]] = None,
            disable_user_info: Optional[pulumi.Input[_builtins.bool]] = None,
            display_name: Optional[pulumi.Input[_builtins.str]] = None,
            enabled: Optional[pulumi.Input[_builtins.bool]] = None,
            extra_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
            first_broker_login_flow_alias: Optional[pulumi.Input[_builtins.str]] = None,
            gui_order: Optional[pulumi.Input[_builtins.str]] = None,
            hide_on_login_page: Optional[pulumi.Input[_builtins.bool]] = None,
            internal_id: Optional[pulumi.Input[_builtins.str]] = None,
            issuer: Optional[pulumi.Input[_builtins.str]] = None,
            jwks_url: Optional[pulumi.Input[_builtins.str]] = None,
            link_only: Optional[pulumi.Input[_builtins.bool]] = None,
            login_hint: Optional[pulumi.Input[_builtins.str]] = None,
            logout_url: Optional[pulumi.Input[_builtins.str]] = None,
            org_domain: Optional[pulumi.Input[_builtins.str]] = None,
            org_redirect_mode_email_matches: Optional[pulumi.Input[_builtins.bool]] = None,
            organization_id: Optional[pulumi.Input[_builtins.str]] = None,
            post_broker_login_flow_alias: Optional[pulumi.Input[_builtins.str]] = None,
            provider_id: Optional[pulumi.Input[_builtins.str]] = None,
            realm: Optional[pulumi.Input[_builtins.str]] = None,
            store_token: Optional[pulumi.Input[_builtins.bool]] = None,
            sync_mode: Optional[pulumi.Input[_builtins.str]] = None,
            token_url: Optional[pulumi.Input[_builtins.str]] = None,
            trust_email: Optional[pulumi.Input[_builtins.bool]] = None,
            ui_locales: Optional[pulumi.Input[_builtins.bool]] = None,
            user_info_url: Optional[pulumi.Input[_builtins.str]] = None,
            validate_signature: Optional[pulumi.Input[_builtins.bool]] = None) -> 'IdentityProvider':
        """
        Get an existing IdentityProvider resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[_builtins.bool] accepts_prompt_none_forward_from_client: When `true`, the IDP will accept forwarded authentication requests that contain the `prompt=none` query parameter. Defaults to `false`.
        :param pulumi.Input[_builtins.bool] add_read_token_role_on_create: When `true`, new users will be able to read stored tokens. This will automatically assign the `broker.read-token` role. Defaults to `false`.
        :param pulumi.Input[_builtins.str] alias: The alias uniquely identifies an identity provider, and it is also used to build the redirect uri.
        :param pulumi.Input[_builtins.bool] authenticate_by_default: Enable/disable authenticate users by default.
        :param pulumi.Input[_builtins.str] authorization_url: The Authorization Url.
        :param pulumi.Input[_builtins.bool] backchannel_supported: Does the external IDP support backchannel logout? Defaults to `true`.
        :param pulumi.Input[_builtins.str] client_id: The client or client identifier registered within the identity provider.
        :param pulumi.Input[_builtins.str] client_secret: The client or client secret registered within the identity provider. This field is able to obtain its value from vault, use $${vault.ID} format. Required without `client_secret_wo` and `client_secret_wo_version`.
        :param pulumi.Input[_builtins.int] client_secret_wo_version: Version of the Client secret write-only argument
        :param pulumi.Input[_builtins.str] default_scopes: The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to `openid`.
        :param pulumi.Input[_builtins.bool] disable_type_claim_check: When `true`, disables the check for the `typ` claim of tokens received from the identity provider. Defaults to `false`.
        :param pulumi.Input[_builtins.bool] disable_user_info: When `true`, disables the usage of the user info service to obtain additional user information. Defaults to `false`.
        :param pulumi.Input[_builtins.str] display_name: Display name for the identity provider in the GUI.
        :param pulumi.Input[_builtins.bool] enabled: When `true`, users will be able to log in to this realm using this identity provider. Defaults to `true`.
        :param pulumi.Input[_builtins.str] first_broker_login_flow_alias: The authentication flow to use when users log in for the first time through this identity provider. Defaults to `first broker login`.
        :param pulumi.Input[_builtins.str] gui_order: A number defining the order of this identity provider in the GUI.
        :param pulumi.Input[_builtins.bool] hide_on_login_page: When `true`, this provider will be hidden on the login page, and is only accessible when requested explicitly. Defaults to `false`.
        :param pulumi.Input[_builtins.str] internal_id: (Computed) The unique ID that Keycloak assigns to the identity provider upon creation.
        :param pulumi.Input[_builtins.str] issuer: The issuer identifier for the issuer of the response. If not provided, no validation will be performed.
        :param pulumi.Input[_builtins.str] jwks_url: JSON Web Key Set URL.
        :param pulumi.Input[_builtins.bool] link_only: When `true`, users cannot sign-in using this provider, but their existing accounts will be linked when possible. Defaults to `false`.
        :param pulumi.Input[_builtins.str] login_hint: Pass login hint to identity provider.
        :param pulumi.Input[_builtins.str] logout_url: The Logout URL is the end session endpoint to use to sign-out the user from external identity provider.
        :param pulumi.Input[_builtins.str] org_domain: The organization domain to associate this identity provider with. it is used to map users to an organization based on their email domain and to authenticate them accordingly in the scope of the organization.
        :param pulumi.Input[_builtins.bool] org_redirect_mode_email_matches: Indicates whether to automatically redirect user to this identity provider when email domain matches domain.
        :param pulumi.Input[_builtins.str] organization_id: The ID of the organization to link this identity provider to.
        :param pulumi.Input[_builtins.str] post_broker_login_flow_alias: The authentication flow to use after users have successfully logged in, which can be used to perform additional user verification (such as OTP checking). Defaults to an empty string, which means no post login flow will be used.
        :param pulumi.Input[_builtins.str] provider_id: The ID of the identity provider to use. Defaults to `oidc`, which should be used unless you have extended Keycloak and provided your own implementation.
        :param pulumi.Input[_builtins.str] realm: The name of the realm. This is unique across Keycloak.
        :param pulumi.Input[_builtins.bool] store_token: When `true`, tokens will be stored after authenticating users. Defaults to `true`.
        :param pulumi.Input[_builtins.str] sync_mode: The default sync mode to use for all mappers attached to this identity provider. Can be once of `IMPORT`, `FORCE`, or `LEGACY`.
        :param pulumi.Input[_builtins.str] token_url: The Token URL.
        :param pulumi.Input[_builtins.bool] trust_email: When `true`, email addresses for users in this provider will automatically be verified regardless of the realm's email verification policy. Defaults to `false`.
        :param pulumi.Input[_builtins.bool] ui_locales: Pass current locale to identity provider. Defaults to `false`.
        :param pulumi.Input[_builtins.str] user_info_url: User Info URL.
        :param pulumi.Input[_builtins.bool] validate_signature: Enable/disable signature validation of external IDP signatures. Defaults to `false`.
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _IdentityProviderState.__new__(_IdentityProviderState)

        __props__.__dict__["accepts_prompt_none_forward_from_client"] = accepts_prompt_none_forward_from_client
        __props__.__dict__["add_read_token_role_on_create"] = add_read_token_role_on_create
        __props__.__dict__["alias"] = alias
        __props__.__dict__["authenticate_by_default"] = authenticate_by_default
        __props__.__dict__["authorization_url"] = authorization_url
        __props__.__dict__["backchannel_supported"] = backchannel_supported
        __props__.__dict__["client_id"] = client_id
        __props__.__dict__["client_secret"] = client_secret
        __props__.__dict__["client_secret_wo_version"] = client_secret_wo_version
        __props__.__dict__["default_scopes"] = default_scopes
        __props__.__dict__["disable_type_claim_check"] = disable_type_claim_check
        __props__.__dict__["disable_user_info"] = disable_user_info
        __props__.__dict__["display_name"] = display_name
        __props__.__dict__["enabled"] = enabled
        __props__.__dict__["extra_config"] = extra_config
        __props__.__dict__["first_broker_login_flow_alias"] = first_broker_login_flow_alias
        __props__.__dict__["gui_order"] = gui_order
        __props__.__dict__["hide_on_login_page"] = hide_on_login_page
        __props__.__dict__["internal_id"] = internal_id
        __props__.__dict__["issuer"] = issuer
        __props__.__dict__["jwks_url"] = jwks_url
        __props__.__dict__["link_only"] = link_only
        __props__.__dict__["login_hint"] = login_hint
        __props__.__dict__["logout_url"] = logout_url
        __props__.__dict__["org_domain"] = org_domain
        __props__.__dict__["org_redirect_mode_email_matches"] = org_redirect_mode_email_matches
        __props__.__dict__["organization_id"] = organization_id
        __props__.__dict__["post_broker_login_flow_alias"] = post_broker_login_flow_alias
        __props__.__dict__["provider_id"] = provider_id
        __props__.__dict__["realm"] = realm
        __props__.__dict__["store_token"] = store_token
        __props__.__dict__["sync_mode"] = sync_mode
        __props__.__dict__["token_url"] = token_url
        __props__.__dict__["trust_email"] = trust_email
        __props__.__dict__["ui_locales"] = ui_locales
        __props__.__dict__["user_info_url"] = user_info_url
        __props__.__dict__["validate_signature"] = validate_signature
        return IdentityProvider(resource_name, opts=opts, __props__=__props__)

    @_builtins.property
    @pulumi.getter(name="acceptsPromptNoneForwardFromClient")
    def accepts_prompt_none_forward_from_client(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        When `true`, the IDP will accept forwarded authentication requests that contain the `prompt=none` query parameter. Defaults to `false`.
        """
        return pulumi.get(self, "accepts_prompt_none_forward_from_client")

    @_builtins.property
    @pulumi.getter(name="addReadTokenRoleOnCreate")
    def add_read_token_role_on_create(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        When `true`, new users will be able to read stored tokens. This will automatically assign the `broker.read-token` role. Defaults to `false`.
        """
        return pulumi.get(self, "add_read_token_role_on_create")

    @_builtins.property
    @pulumi.getter
    def alias(self) -> pulumi.Output[_builtins.str]:
        """
        The alias uniquely identifies an identity provider, and it is also used to build the redirect uri.
        """
        return pulumi.get(self, "alias")

    @_builtins.property
    @pulumi.getter(name="authenticateByDefault")
    def authenticate_by_default(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        Enable/disable authenticate users by default.
        """
        return pulumi.get(self, "authenticate_by_default")

    @_builtins.property
    @pulumi.getter(name="authorizationUrl")
    def authorization_url(self) -> pulumi.Output[_builtins.str]:
        """
        The Authorization Url.
        """
        return pulumi.get(self, "authorization_url")

    @_builtins.property
    @pulumi.getter(name="backchannelSupported")
    def backchannel_supported(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        Does the external IDP support backchannel logout? Defaults to `true`.
        """
        return pulumi.get(self, "backchannel_supported")

    @_builtins.property
    @pulumi.getter(name="clientId")
    def client_id(self) -> pulumi.Output[_builtins.str]:
        """
        The client or client identifier registered within the identity provider.
        """
        return pulumi.get(self, "client_id")

    @_builtins.property
    @pulumi.getter(name="clientSecret")
    def client_secret(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The client or client secret registered within the identity provider. This field is able to obtain its value from vault, use $${vault.ID} format. Required without `client_secret_wo` and `client_secret_wo_version`.
        """
        return pulumi.get(self, "client_secret")

    @_builtins.property
    @pulumi.getter(name="clientSecretWoVersion")
    def client_secret_wo_version(self) -> pulumi.Output[Optional[_builtins.int]]:
        """
        Version of the Client secret write-only argument
        """
        return pulumi.get(self, "client_secret_wo_version")

    @_builtins.property
    @pulumi.getter(name="defaultScopes")
    def default_scopes(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to `openid`.
        """
        return pulumi.get(self, "default_scopes")

    @_builtins.property
    @pulumi.getter(name="disableTypeClaimCheck")
    def disable_type_claim_check(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        When `true`, disables the check for the `typ` claim of tokens received from the identity provider. Defaults to `false`.
        """
        return pulumi.get(self, "disable_type_claim_check")

    @_builtins.property
    @pulumi.getter(name="disableUserInfo")
    def disable_user_info(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        When `true`, disables the usage of the user info service to obtain additional user information. Defaults to `false`.
        """
        return pulumi.get(self, "disable_user_info")

    @_builtins.property
    @pulumi.getter(name="displayName")
    def display_name(self) -> pulumi.Output[_builtins.str]:
        """
        Display name for the identity provider in the GUI.
        """
        return pulumi.get(self, "display_name")

    @_builtins.property
    @pulumi.getter
    def enabled(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        When `true`, users will be able to log in to this realm using this identity provider. Defaults to `true`.
        """
        return pulumi.get(self, "enabled")

    @_builtins.property
    @pulumi.getter(name="extraConfig")
    def extra_config(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
        return pulumi.get(self, "extra_config")

    @_builtins.property
    @pulumi.getter(name="firstBrokerLoginFlowAlias")
    def first_broker_login_flow_alias(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The authentication flow to use when users log in for the first time through this identity provider. Defaults to `first broker login`.
        """
        return pulumi.get(self, "first_broker_login_flow_alias")

    @_builtins.property
    @pulumi.getter(name="guiOrder")
    def gui_order(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        A number defining the order of this identity provider in the GUI.
        """
        return pulumi.get(self, "gui_order")

    @_builtins.property
    @pulumi.getter(name="hideOnLoginPage")
    def hide_on_login_page(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        When `true`, this provider will be hidden on the login page, and is only accessible when requested explicitly. Defaults to `false`.
        """
        return pulumi.get(self, "hide_on_login_page")

    @_builtins.property
    @pulumi.getter(name="internalId")
    def internal_id(self) -> pulumi.Output[_builtins.str]:
        """
        (Computed) The unique ID that Keycloak assigns to the identity provider upon creation.
        """
        return pulumi.get(self, "internal_id")

    @_builtins.property
    @pulumi.getter
    def issuer(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The issuer identifier for the issuer of the response. If not provided, no validation will be performed.
        """
        return pulumi.get(self, "issuer")

    @_builtins.property
    @pulumi.getter(name="jwksUrl")
    def jwks_url(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        JSON Web Key Set URL.
        """
        return pulumi.get(self, "jwks_url")

    @_builtins.property
    @pulumi.getter(name="linkOnly")
    def link_only(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        When `true`, users cannot sign-in using this provider, but their existing accounts will be linked when possible. Defaults to `false`.
        """
        return pulumi.get(self, "link_only")

    @_builtins.property
    @pulumi.getter(name="loginHint")
    def login_hint(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Pass login hint to identity provider.
        """
        return pulumi.get(self, "login_hint")

    @_builtins.property
    @pulumi.getter(name="logoutUrl")
    def logout_url(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The Logout URL is the end session endpoint to use to sign-out the user from external identity provider.
        """
        return pulumi.get(self, "logout_url")

    @_builtins.property
    @pulumi.getter(name="orgDomain")
    def org_domain(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The organization domain to associate this identity provider with. it is used to map users to an organization based on their email domain and to authenticate them accordingly in the scope of the organization.
        """
        return pulumi.get(self, "org_domain")

    @_builtins.property
    @pulumi.getter(name="orgRedirectModeEmailMatches")
    def org_redirect_mode_email_matches(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        Indicates whether to automatically redirect user to this identity provider when email domain matches domain.
        """
        return pulumi.get(self, "org_redirect_mode_email_matches")

    @_builtins.property
    @pulumi.getter(name="organizationId")
    def organization_id(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The ID of the organization to link this identity provider to.
        """
        return pulumi.get(self, "organization_id")

    @_builtins.property
    @pulumi.getter(name="postBrokerLoginFlowAlias")
    def post_broker_login_flow_alias(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The authentication flow to use after users have successfully logged in, which can be used to perform additional user verification (such as OTP checking). Defaults to an empty string, which means no post login flow will be used.
        """
        return pulumi.get(self, "post_broker_login_flow_alias")

    @_builtins.property
    @pulumi.getter(name="providerId")
    def provider_id(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The ID of the identity provider to use. Defaults to `oidc`, which should be used unless you have extended Keycloak and provided your own implementation.
        """
        return pulumi.get(self, "provider_id")

    @_builtins.property
    @pulumi.getter
    def realm(self) -> pulumi.Output[_builtins.str]:
        """
        The name of the realm. This is unique across Keycloak.
        """
        return pulumi.get(self, "realm")

    @_builtins.property
    @pulumi.getter(name="storeToken")
    def store_token(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        When `true`, tokens will be stored after authenticating users. Defaults to `true`.
        """
        return pulumi.get(self, "store_token")

    @_builtins.property
    @pulumi.getter(name="syncMode")
    def sync_mode(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The default sync mode to use for all mappers attached to this identity provider. Can be once of `IMPORT`, `FORCE`, or `LEGACY`.
        """
        return pulumi.get(self, "sync_mode")

    @_builtins.property
    @pulumi.getter(name="tokenUrl")
    def token_url(self) -> pulumi.Output[_builtins.str]:
        """
        The Token URL.
        """
        return pulumi.get(self, "token_url")

    @_builtins.property
    @pulumi.getter(name="trustEmail")
    def trust_email(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        When `true`, email addresses for users in this provider will automatically be verified regardless of the realm's email verification policy. Defaults to `false`.
        """
        return pulumi.get(self, "trust_email")

    @_builtins.property
    @pulumi.getter(name="uiLocales")
    def ui_locales(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        Pass current locale to identity provider. Defaults to `false`.
        """
        return pulumi.get(self, "ui_locales")

    @_builtins.property
    @pulumi.getter(name="userInfoUrl")
    def user_info_url(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        User Info URL.
        """
        return pulumi.get(self, "user_info_url")

    @_builtins.property
    @pulumi.getter(name="validateSignature")
    def validate_signature(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        Enable/disable signature validation of external IDP signatures. Defaults to `false`.
        """
        return pulumi.get(self, "validate_signature")

