# coding=utf-8
# *** WARNING: this file was generated by pulumi-language-python. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import builtins as _builtins
import warnings
import sys
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
if sys.version_info >= (3, 11):
    from typing import NotRequired, TypedDict, TypeAlias
else:
    from typing_extensions import NotRequired, TypedDict, TypeAlias
from .. import _utilities
from . import outputs
from ._inputs import *

__all__ = ['RuleSignonArgs', 'RuleSignon']

@pulumi.input_type
class RuleSignonArgs:
    def __init__(__self__, *,
                 access: Optional[pulumi.Input[_builtins.str]] = None,
                 authtype: Optional[pulumi.Input[_builtins.str]] = None,
                 behaviors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 factor_sequences: Optional[pulumi.Input[Sequence[pulumi.Input['RuleSignonFactorSequenceArgs']]]] = None,
                 identity_provider: Optional[pulumi.Input[_builtins.str]] = None,
                 identity_provider_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 mfa_lifetime: Optional[pulumi.Input[_builtins.int]] = None,
                 mfa_prompt: Optional[pulumi.Input[_builtins.str]] = None,
                 mfa_remember_device: Optional[pulumi.Input[_builtins.bool]] = None,
                 mfa_required: Optional[pulumi.Input[_builtins.bool]] = None,
                 name: Optional[pulumi.Input[_builtins.str]] = None,
                 network_connection: Optional[pulumi.Input[_builtins.str]] = None,
                 network_excludes: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 network_includes: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 policy_id: Optional[pulumi.Input[_builtins.str]] = None,
                 primary_factor: Optional[pulumi.Input[_builtins.str]] = None,
                 priority: Optional[pulumi.Input[_builtins.int]] = None,
                 risc_level: Optional[pulumi.Input[_builtins.str]] = None,
                 risk_level: Optional[pulumi.Input[_builtins.str]] = None,
                 session_idle: Optional[pulumi.Input[_builtins.int]] = None,
                 session_lifetime: Optional[pulumi.Input[_builtins.int]] = None,
                 session_persistent: Optional[pulumi.Input[_builtins.bool]] = None,
                 status: Optional[pulumi.Input[_builtins.str]] = None,
                 users_excludeds: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None):
        """
        The set of arguments for constructing a RuleSignon resource.
        :param pulumi.Input[_builtins.str] access: Allow or deny access based on the rule conditions: `ALLOW`, `DENY` or `CHALLENGE`. Default: `ALLOW`
        :param pulumi.Input[_builtins.str] authtype: Authentication entrypoint: `ANY`, `RADIUS` or `LDAP_INTERFACE`. Default: `ANY`
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] behaviors: List of behavior IDs
        :param pulumi.Input[Sequence[pulumi.Input['RuleSignonFactorSequenceArgs']]] factor_sequences: Auth factor sequences. Should be set if 'access = "CHALLENGE"'.
               	- 'primary_criteria_provider' - (Required) Primary provider of the auth section.
               	- 'primary_criteria_factor_type' - (Required) Primary factor type of the auth section.
               	- 'secondary_criteria' - (Optional) Additional authentication steps.
               	- 'provider' - (Required) Provider of the additional authentication step.
               	- 'factor_type' - (Required) Factor type of the additional authentication step.
        :param pulumi.Input[_builtins.str] identity_provider: Apply rule based on the IdP used: `ANY`, `OKTA` or `SPECIFIC_IDP`. Default: `ANY`. > **WARNING**: Use of `identity_provider` requires a feature flag to be enabled.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] identity_provider_ids: When identity_provider is `SPECIFIC_IDP` then this is the list of IdP IDs to apply the rule on
        :param pulumi.Input[_builtins.int] mfa_lifetime: Elapsed time before the next MFA challenge
        :param pulumi.Input[_builtins.str] mfa_prompt: Prompt for MFA based on the device used, a factor session lifetime, or every sign-on attempt: `DEVICE`, `SESSION` or`ALWAYS`.
        :param pulumi.Input[_builtins.bool] mfa_remember_device: Remember MFA device. Default: `false`
        :param pulumi.Input[_builtins.bool] mfa_required: Require MFA. Default: `false`
        :param pulumi.Input[_builtins.str] name: Policy Rule Name
        :param pulumi.Input[_builtins.str] network_connection: Network selection mode: `ANYWHERE`, `ZONE`, `ON_NETWORK`, or `OFF_NETWORK`. Default: `ANYWHERE`
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] network_excludes: Required if `network_connection` = `ZONE`. Indicates the network zones to exclude.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] network_includes: Required if `network_connection` = `ZONE`. Indicates the network zones to include.
        :param pulumi.Input[_builtins.str] policy_id: Policy ID of the Rule
        :param pulumi.Input[_builtins.str] primary_factor: Rule's primary factor. **WARNING** Ony works as a part of the Identity Engine. Valid values: `PASSWORD_IDP_ANY_FACTOR`, `PASSWORD_IDP`.
        :param pulumi.Input[_builtins.int] priority: Rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
        :param pulumi.Input[_builtins.str] risc_level: Risc level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
        :param pulumi.Input[_builtins.str] risk_level: Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
        :param pulumi.Input[_builtins.int] session_idle: Max minutes a session can be idle. Default: `120`
        :param pulumi.Input[_builtins.int] session_lifetime: Max minutes a session is active: Disable = 0. Default: `120`
        :param pulumi.Input[_builtins.bool] session_persistent: Whether session cookies will last across browser sessions. Okta Administrators can never have persistent session cookies. Default: `false`
        :param pulumi.Input[_builtins.str] status: Policy Rule Status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] users_excludeds: Set of User IDs to Exclude
        """
        if access is not None:
            pulumi.set(__self__, "access", access)
        if authtype is not None:
            pulumi.set(__self__, "authtype", authtype)
        if behaviors is not None:
            pulumi.set(__self__, "behaviors", behaviors)
        if factor_sequences is not None:
            pulumi.set(__self__, "factor_sequences", factor_sequences)
        if identity_provider is not None:
            pulumi.set(__self__, "identity_provider", identity_provider)
        if identity_provider_ids is not None:
            pulumi.set(__self__, "identity_provider_ids", identity_provider_ids)
        if mfa_lifetime is not None:
            pulumi.set(__self__, "mfa_lifetime", mfa_lifetime)
        if mfa_prompt is not None:
            pulumi.set(__self__, "mfa_prompt", mfa_prompt)
        if mfa_remember_device is not None:
            pulumi.set(__self__, "mfa_remember_device", mfa_remember_device)
        if mfa_required is not None:
            pulumi.set(__self__, "mfa_required", mfa_required)
        if name is not None:
            pulumi.set(__self__, "name", name)
        if network_connection is not None:
            pulumi.set(__self__, "network_connection", network_connection)
        if network_excludes is not None:
            pulumi.set(__self__, "network_excludes", network_excludes)
        if network_includes is not None:
            pulumi.set(__self__, "network_includes", network_includes)
        if policy_id is not None:
            pulumi.set(__self__, "policy_id", policy_id)
        if primary_factor is not None:
            pulumi.set(__self__, "primary_factor", primary_factor)
        if priority is not None:
            pulumi.set(__self__, "priority", priority)
        if risc_level is not None:
            warnings.warn("""Attribute typo, switch to risk_level instead. Default: `ANY`""", DeprecationWarning)
            pulumi.log.warn("""risc_level is deprecated: Attribute typo, switch to risk_level instead. Default: `ANY`""")
        if risc_level is not None:
            pulumi.set(__self__, "risc_level", risc_level)
        if risk_level is not None:
            pulumi.set(__self__, "risk_level", risk_level)
        if session_idle is not None:
            pulumi.set(__self__, "session_idle", session_idle)
        if session_lifetime is not None:
            pulumi.set(__self__, "session_lifetime", session_lifetime)
        if session_persistent is not None:
            pulumi.set(__self__, "session_persistent", session_persistent)
        if status is not None:
            pulumi.set(__self__, "status", status)
        if users_excludeds is not None:
            pulumi.set(__self__, "users_excludeds", users_excludeds)

    @_builtins.property
    @pulumi.getter
    def access(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Allow or deny access based on the rule conditions: `ALLOW`, `DENY` or `CHALLENGE`. Default: `ALLOW`
        """
        return pulumi.get(self, "access")

    @access.setter
    def access(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "access", value)

    @_builtins.property
    @pulumi.getter
    def authtype(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Authentication entrypoint: `ANY`, `RADIUS` or `LDAP_INTERFACE`. Default: `ANY`
        """
        return pulumi.get(self, "authtype")

    @authtype.setter
    def authtype(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "authtype", value)

    @_builtins.property
    @pulumi.getter
    def behaviors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        List of behavior IDs
        """
        return pulumi.get(self, "behaviors")

    @behaviors.setter
    def behaviors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "behaviors", value)

    @_builtins.property
    @pulumi.getter(name="factorSequences")
    def factor_sequences(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['RuleSignonFactorSequenceArgs']]]]:
        """
        Auth factor sequences. Should be set if 'access = "CHALLENGE"'.
        	- 'primary_criteria_provider' - (Required) Primary provider of the auth section.
        	- 'primary_criteria_factor_type' - (Required) Primary factor type of the auth section.
        	- 'secondary_criteria' - (Optional) Additional authentication steps.
        	- 'provider' - (Required) Provider of the additional authentication step.
        	- 'factor_type' - (Required) Factor type of the additional authentication step.
        """
        return pulumi.get(self, "factor_sequences")

    @factor_sequences.setter
    def factor_sequences(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['RuleSignonFactorSequenceArgs']]]]):
        pulumi.set(self, "factor_sequences", value)

    @_builtins.property
    @pulumi.getter(name="identityProvider")
    def identity_provider(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Apply rule based on the IdP used: `ANY`, `OKTA` or `SPECIFIC_IDP`. Default: `ANY`. > **WARNING**: Use of `identity_provider` requires a feature flag to be enabled.
        """
        return pulumi.get(self, "identity_provider")

    @identity_provider.setter
    def identity_provider(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "identity_provider", value)

    @_builtins.property
    @pulumi.getter(name="identityProviderIds")
    def identity_provider_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        When identity_provider is `SPECIFIC_IDP` then this is the list of IdP IDs to apply the rule on
        """
        return pulumi.get(self, "identity_provider_ids")

    @identity_provider_ids.setter
    def identity_provider_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "identity_provider_ids", value)

    @_builtins.property
    @pulumi.getter(name="mfaLifetime")
    def mfa_lifetime(self) -> Optional[pulumi.Input[_builtins.int]]:
        """
        Elapsed time before the next MFA challenge
        """
        return pulumi.get(self, "mfa_lifetime")

    @mfa_lifetime.setter
    def mfa_lifetime(self, value: Optional[pulumi.Input[_builtins.int]]):
        pulumi.set(self, "mfa_lifetime", value)

    @_builtins.property
    @pulumi.getter(name="mfaPrompt")
    def mfa_prompt(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Prompt for MFA based on the device used, a factor session lifetime, or every sign-on attempt: `DEVICE`, `SESSION` or`ALWAYS`.
        """
        return pulumi.get(self, "mfa_prompt")

    @mfa_prompt.setter
    def mfa_prompt(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "mfa_prompt", value)

    @_builtins.property
    @pulumi.getter(name="mfaRememberDevice")
    def mfa_remember_device(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Remember MFA device. Default: `false`
        """
        return pulumi.get(self, "mfa_remember_device")

    @mfa_remember_device.setter
    def mfa_remember_device(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "mfa_remember_device", value)

    @_builtins.property
    @pulumi.getter(name="mfaRequired")
    def mfa_required(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Require MFA. Default: `false`
        """
        return pulumi.get(self, "mfa_required")

    @mfa_required.setter
    def mfa_required(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "mfa_required", value)

    @_builtins.property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Policy Rule Name
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "name", value)

    @_builtins.property
    @pulumi.getter(name="networkConnection")
    def network_connection(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Network selection mode: `ANYWHERE`, `ZONE`, `ON_NETWORK`, or `OFF_NETWORK`. Default: `ANYWHERE`
        """
        return pulumi.get(self, "network_connection")

    @network_connection.setter
    def network_connection(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "network_connection", value)

    @_builtins.property
    @pulumi.getter(name="networkExcludes")
    def network_excludes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        Required if `network_connection` = `ZONE`. Indicates the network zones to exclude.
        """
        return pulumi.get(self, "network_excludes")

    @network_excludes.setter
    def network_excludes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "network_excludes", value)

    @_builtins.property
    @pulumi.getter(name="networkIncludes")
    def network_includes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        Required if `network_connection` = `ZONE`. Indicates the network zones to include.
        """
        return pulumi.get(self, "network_includes")

    @network_includes.setter
    def network_includes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "network_includes", value)

    @_builtins.property
    @pulumi.getter(name="policyId")
    def policy_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Policy ID of the Rule
        """
        return pulumi.get(self, "policy_id")

    @policy_id.setter
    def policy_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "policy_id", value)

    @_builtins.property
    @pulumi.getter(name="primaryFactor")
    def primary_factor(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Rule's primary factor. **WARNING** Ony works as a part of the Identity Engine. Valid values: `PASSWORD_IDP_ANY_FACTOR`, `PASSWORD_IDP`.
        """
        return pulumi.get(self, "primary_factor")

    @primary_factor.setter
    def primary_factor(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "primary_factor", value)

    @_builtins.property
    @pulumi.getter
    def priority(self) -> Optional[pulumi.Input[_builtins.int]]:
        """
        Rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
        """
        return pulumi.get(self, "priority")

    @priority.setter
    def priority(self, value: Optional[pulumi.Input[_builtins.int]]):
        pulumi.set(self, "priority", value)

    @_builtins.property
    @pulumi.getter(name="riscLevel")
    @_utilities.deprecated("""Attribute typo, switch to risk_level instead. Default: `ANY`""")
    def risc_level(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Risc level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
        """
        return pulumi.get(self, "risc_level")

    @risc_level.setter
    def risc_level(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "risc_level", value)

    @_builtins.property
    @pulumi.getter(name="riskLevel")
    def risk_level(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
        """
        return pulumi.get(self, "risk_level")

    @risk_level.setter
    def risk_level(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "risk_level", value)

    @_builtins.property
    @pulumi.getter(name="sessionIdle")
    def session_idle(self) -> Optional[pulumi.Input[_builtins.int]]:
        """
        Max minutes a session can be idle. Default: `120`
        """
        return pulumi.get(self, "session_idle")

    @session_idle.setter
    def session_idle(self, value: Optional[pulumi.Input[_builtins.int]]):
        pulumi.set(self, "session_idle", value)

    @_builtins.property
    @pulumi.getter(name="sessionLifetime")
    def session_lifetime(self) -> Optional[pulumi.Input[_builtins.int]]:
        """
        Max minutes a session is active: Disable = 0. Default: `120`
        """
        return pulumi.get(self, "session_lifetime")

    @session_lifetime.setter
    def session_lifetime(self, value: Optional[pulumi.Input[_builtins.int]]):
        pulumi.set(self, "session_lifetime", value)

    @_builtins.property
    @pulumi.getter(name="sessionPersistent")
    def session_persistent(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Whether session cookies will last across browser sessions. Okta Administrators can never have persistent session cookies. Default: `false`
        """
        return pulumi.get(self, "session_persistent")

    @session_persistent.setter
    def session_persistent(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "session_persistent", value)

    @_builtins.property
    @pulumi.getter
    def status(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Policy Rule Status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
        """
        return pulumi.get(self, "status")

    @status.setter
    def status(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "status", value)

    @_builtins.property
    @pulumi.getter(name="usersExcludeds")
    def users_excludeds(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        Set of User IDs to Exclude
        """
        return pulumi.get(self, "users_excludeds")

    @users_excludeds.setter
    def users_excludeds(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "users_excludeds", value)


@pulumi.input_type
class _RuleSignonState:
    def __init__(__self__, *,
                 access: Optional[pulumi.Input[_builtins.str]] = None,
                 authtype: Optional[pulumi.Input[_builtins.str]] = None,
                 behaviors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 factor_sequences: Optional[pulumi.Input[Sequence[pulumi.Input['RuleSignonFactorSequenceArgs']]]] = None,
                 identity_provider: Optional[pulumi.Input[_builtins.str]] = None,
                 identity_provider_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 mfa_lifetime: Optional[pulumi.Input[_builtins.int]] = None,
                 mfa_prompt: Optional[pulumi.Input[_builtins.str]] = None,
                 mfa_remember_device: Optional[pulumi.Input[_builtins.bool]] = None,
                 mfa_required: Optional[pulumi.Input[_builtins.bool]] = None,
                 name: Optional[pulumi.Input[_builtins.str]] = None,
                 network_connection: Optional[pulumi.Input[_builtins.str]] = None,
                 network_excludes: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 network_includes: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 policy_id: Optional[pulumi.Input[_builtins.str]] = None,
                 primary_factor: Optional[pulumi.Input[_builtins.str]] = None,
                 priority: Optional[pulumi.Input[_builtins.int]] = None,
                 risc_level: Optional[pulumi.Input[_builtins.str]] = None,
                 risk_level: Optional[pulumi.Input[_builtins.str]] = None,
                 session_idle: Optional[pulumi.Input[_builtins.int]] = None,
                 session_lifetime: Optional[pulumi.Input[_builtins.int]] = None,
                 session_persistent: Optional[pulumi.Input[_builtins.bool]] = None,
                 status: Optional[pulumi.Input[_builtins.str]] = None,
                 users_excludeds: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None):
        """
        Input properties used for looking up and filtering RuleSignon resources.
        :param pulumi.Input[_builtins.str] access: Allow or deny access based on the rule conditions: `ALLOW`, `DENY` or `CHALLENGE`. Default: `ALLOW`
        :param pulumi.Input[_builtins.str] authtype: Authentication entrypoint: `ANY`, `RADIUS` or `LDAP_INTERFACE`. Default: `ANY`
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] behaviors: List of behavior IDs
        :param pulumi.Input[Sequence[pulumi.Input['RuleSignonFactorSequenceArgs']]] factor_sequences: Auth factor sequences. Should be set if 'access = "CHALLENGE"'.
               	- 'primary_criteria_provider' - (Required) Primary provider of the auth section.
               	- 'primary_criteria_factor_type' - (Required) Primary factor type of the auth section.
               	- 'secondary_criteria' - (Optional) Additional authentication steps.
               	- 'provider' - (Required) Provider of the additional authentication step.
               	- 'factor_type' - (Required) Factor type of the additional authentication step.
        :param pulumi.Input[_builtins.str] identity_provider: Apply rule based on the IdP used: `ANY`, `OKTA` or `SPECIFIC_IDP`. Default: `ANY`. > **WARNING**: Use of `identity_provider` requires a feature flag to be enabled.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] identity_provider_ids: When identity_provider is `SPECIFIC_IDP` then this is the list of IdP IDs to apply the rule on
        :param pulumi.Input[_builtins.int] mfa_lifetime: Elapsed time before the next MFA challenge
        :param pulumi.Input[_builtins.str] mfa_prompt: Prompt for MFA based on the device used, a factor session lifetime, or every sign-on attempt: `DEVICE`, `SESSION` or`ALWAYS`.
        :param pulumi.Input[_builtins.bool] mfa_remember_device: Remember MFA device. Default: `false`
        :param pulumi.Input[_builtins.bool] mfa_required: Require MFA. Default: `false`
        :param pulumi.Input[_builtins.str] name: Policy Rule Name
        :param pulumi.Input[_builtins.str] network_connection: Network selection mode: `ANYWHERE`, `ZONE`, `ON_NETWORK`, or `OFF_NETWORK`. Default: `ANYWHERE`
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] network_excludes: Required if `network_connection` = `ZONE`. Indicates the network zones to exclude.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] network_includes: Required if `network_connection` = `ZONE`. Indicates the network zones to include.
        :param pulumi.Input[_builtins.str] policy_id: Policy ID of the Rule
        :param pulumi.Input[_builtins.str] primary_factor: Rule's primary factor. **WARNING** Ony works as a part of the Identity Engine. Valid values: `PASSWORD_IDP_ANY_FACTOR`, `PASSWORD_IDP`.
        :param pulumi.Input[_builtins.int] priority: Rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
        :param pulumi.Input[_builtins.str] risc_level: Risc level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
        :param pulumi.Input[_builtins.str] risk_level: Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
        :param pulumi.Input[_builtins.int] session_idle: Max minutes a session can be idle. Default: `120`
        :param pulumi.Input[_builtins.int] session_lifetime: Max minutes a session is active: Disable = 0. Default: `120`
        :param pulumi.Input[_builtins.bool] session_persistent: Whether session cookies will last across browser sessions. Okta Administrators can never have persistent session cookies. Default: `false`
        :param pulumi.Input[_builtins.str] status: Policy Rule Status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] users_excludeds: Set of User IDs to Exclude
        """
        if access is not None:
            pulumi.set(__self__, "access", access)
        if authtype is not None:
            pulumi.set(__self__, "authtype", authtype)
        if behaviors is not None:
            pulumi.set(__self__, "behaviors", behaviors)
        if factor_sequences is not None:
            pulumi.set(__self__, "factor_sequences", factor_sequences)
        if identity_provider is not None:
            pulumi.set(__self__, "identity_provider", identity_provider)
        if identity_provider_ids is not None:
            pulumi.set(__self__, "identity_provider_ids", identity_provider_ids)
        if mfa_lifetime is not None:
            pulumi.set(__self__, "mfa_lifetime", mfa_lifetime)
        if mfa_prompt is not None:
            pulumi.set(__self__, "mfa_prompt", mfa_prompt)
        if mfa_remember_device is not None:
            pulumi.set(__self__, "mfa_remember_device", mfa_remember_device)
        if mfa_required is not None:
            pulumi.set(__self__, "mfa_required", mfa_required)
        if name is not None:
            pulumi.set(__self__, "name", name)
        if network_connection is not None:
            pulumi.set(__self__, "network_connection", network_connection)
        if network_excludes is not None:
            pulumi.set(__self__, "network_excludes", network_excludes)
        if network_includes is not None:
            pulumi.set(__self__, "network_includes", network_includes)
        if policy_id is not None:
            pulumi.set(__self__, "policy_id", policy_id)
        if primary_factor is not None:
            pulumi.set(__self__, "primary_factor", primary_factor)
        if priority is not None:
            pulumi.set(__self__, "priority", priority)
        if risc_level is not None:
            warnings.warn("""Attribute typo, switch to risk_level instead. Default: `ANY`""", DeprecationWarning)
            pulumi.log.warn("""risc_level is deprecated: Attribute typo, switch to risk_level instead. Default: `ANY`""")
        if risc_level is not None:
            pulumi.set(__self__, "risc_level", risc_level)
        if risk_level is not None:
            pulumi.set(__self__, "risk_level", risk_level)
        if session_idle is not None:
            pulumi.set(__self__, "session_idle", session_idle)
        if session_lifetime is not None:
            pulumi.set(__self__, "session_lifetime", session_lifetime)
        if session_persistent is not None:
            pulumi.set(__self__, "session_persistent", session_persistent)
        if status is not None:
            pulumi.set(__self__, "status", status)
        if users_excludeds is not None:
            pulumi.set(__self__, "users_excludeds", users_excludeds)

    @_builtins.property
    @pulumi.getter
    def access(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Allow or deny access based on the rule conditions: `ALLOW`, `DENY` or `CHALLENGE`. Default: `ALLOW`
        """
        return pulumi.get(self, "access")

    @access.setter
    def access(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "access", value)

    @_builtins.property
    @pulumi.getter
    def authtype(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Authentication entrypoint: `ANY`, `RADIUS` or `LDAP_INTERFACE`. Default: `ANY`
        """
        return pulumi.get(self, "authtype")

    @authtype.setter
    def authtype(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "authtype", value)

    @_builtins.property
    @pulumi.getter
    def behaviors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        List of behavior IDs
        """
        return pulumi.get(self, "behaviors")

    @behaviors.setter
    def behaviors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "behaviors", value)

    @_builtins.property
    @pulumi.getter(name="factorSequences")
    def factor_sequences(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['RuleSignonFactorSequenceArgs']]]]:
        """
        Auth factor sequences. Should be set if 'access = "CHALLENGE"'.
        	- 'primary_criteria_provider' - (Required) Primary provider of the auth section.
        	- 'primary_criteria_factor_type' - (Required) Primary factor type of the auth section.
        	- 'secondary_criteria' - (Optional) Additional authentication steps.
        	- 'provider' - (Required) Provider of the additional authentication step.
        	- 'factor_type' - (Required) Factor type of the additional authentication step.
        """
        return pulumi.get(self, "factor_sequences")

    @factor_sequences.setter
    def factor_sequences(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['RuleSignonFactorSequenceArgs']]]]):
        pulumi.set(self, "factor_sequences", value)

    @_builtins.property
    @pulumi.getter(name="identityProvider")
    def identity_provider(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Apply rule based on the IdP used: `ANY`, `OKTA` or `SPECIFIC_IDP`. Default: `ANY`. > **WARNING**: Use of `identity_provider` requires a feature flag to be enabled.
        """
        return pulumi.get(self, "identity_provider")

    @identity_provider.setter
    def identity_provider(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "identity_provider", value)

    @_builtins.property
    @pulumi.getter(name="identityProviderIds")
    def identity_provider_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        When identity_provider is `SPECIFIC_IDP` then this is the list of IdP IDs to apply the rule on
        """
        return pulumi.get(self, "identity_provider_ids")

    @identity_provider_ids.setter
    def identity_provider_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "identity_provider_ids", value)

    @_builtins.property
    @pulumi.getter(name="mfaLifetime")
    def mfa_lifetime(self) -> Optional[pulumi.Input[_builtins.int]]:
        """
        Elapsed time before the next MFA challenge
        """
        return pulumi.get(self, "mfa_lifetime")

    @mfa_lifetime.setter
    def mfa_lifetime(self, value: Optional[pulumi.Input[_builtins.int]]):
        pulumi.set(self, "mfa_lifetime", value)

    @_builtins.property
    @pulumi.getter(name="mfaPrompt")
    def mfa_prompt(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Prompt for MFA based on the device used, a factor session lifetime, or every sign-on attempt: `DEVICE`, `SESSION` or`ALWAYS`.
        """
        return pulumi.get(self, "mfa_prompt")

    @mfa_prompt.setter
    def mfa_prompt(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "mfa_prompt", value)

    @_builtins.property
    @pulumi.getter(name="mfaRememberDevice")
    def mfa_remember_device(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Remember MFA device. Default: `false`
        """
        return pulumi.get(self, "mfa_remember_device")

    @mfa_remember_device.setter
    def mfa_remember_device(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "mfa_remember_device", value)

    @_builtins.property
    @pulumi.getter(name="mfaRequired")
    def mfa_required(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Require MFA. Default: `false`
        """
        return pulumi.get(self, "mfa_required")

    @mfa_required.setter
    def mfa_required(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "mfa_required", value)

    @_builtins.property
    @pulumi.getter
    def name(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Policy Rule Name
        """
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "name", value)

    @_builtins.property
    @pulumi.getter(name="networkConnection")
    def network_connection(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Network selection mode: `ANYWHERE`, `ZONE`, `ON_NETWORK`, or `OFF_NETWORK`. Default: `ANYWHERE`
        """
        return pulumi.get(self, "network_connection")

    @network_connection.setter
    def network_connection(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "network_connection", value)

    @_builtins.property
    @pulumi.getter(name="networkExcludes")
    def network_excludes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        Required if `network_connection` = `ZONE`. Indicates the network zones to exclude.
        """
        return pulumi.get(self, "network_excludes")

    @network_excludes.setter
    def network_excludes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "network_excludes", value)

    @_builtins.property
    @pulumi.getter(name="networkIncludes")
    def network_includes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        Required if `network_connection` = `ZONE`. Indicates the network zones to include.
        """
        return pulumi.get(self, "network_includes")

    @network_includes.setter
    def network_includes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "network_includes", value)

    @_builtins.property
    @pulumi.getter(name="policyId")
    def policy_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Policy ID of the Rule
        """
        return pulumi.get(self, "policy_id")

    @policy_id.setter
    def policy_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "policy_id", value)

    @_builtins.property
    @pulumi.getter(name="primaryFactor")
    def primary_factor(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Rule's primary factor. **WARNING** Ony works as a part of the Identity Engine. Valid values: `PASSWORD_IDP_ANY_FACTOR`, `PASSWORD_IDP`.
        """
        return pulumi.get(self, "primary_factor")

    @primary_factor.setter
    def primary_factor(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "primary_factor", value)

    @_builtins.property
    @pulumi.getter
    def priority(self) -> Optional[pulumi.Input[_builtins.int]]:
        """
        Rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
        """
        return pulumi.get(self, "priority")

    @priority.setter
    def priority(self, value: Optional[pulumi.Input[_builtins.int]]):
        pulumi.set(self, "priority", value)

    @_builtins.property
    @pulumi.getter(name="riscLevel")
    @_utilities.deprecated("""Attribute typo, switch to risk_level instead. Default: `ANY`""")
    def risc_level(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Risc level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
        """
        return pulumi.get(self, "risc_level")

    @risc_level.setter
    def risc_level(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "risc_level", value)

    @_builtins.property
    @pulumi.getter(name="riskLevel")
    def risk_level(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
        """
        return pulumi.get(self, "risk_level")

    @risk_level.setter
    def risk_level(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "risk_level", value)

    @_builtins.property
    @pulumi.getter(name="sessionIdle")
    def session_idle(self) -> Optional[pulumi.Input[_builtins.int]]:
        """
        Max minutes a session can be idle. Default: `120`
        """
        return pulumi.get(self, "session_idle")

    @session_idle.setter
    def session_idle(self, value: Optional[pulumi.Input[_builtins.int]]):
        pulumi.set(self, "session_idle", value)

    @_builtins.property
    @pulumi.getter(name="sessionLifetime")
    def session_lifetime(self) -> Optional[pulumi.Input[_builtins.int]]:
        """
        Max minutes a session is active: Disable = 0. Default: `120`
        """
        return pulumi.get(self, "session_lifetime")

    @session_lifetime.setter
    def session_lifetime(self, value: Optional[pulumi.Input[_builtins.int]]):
        pulumi.set(self, "session_lifetime", value)

    @_builtins.property
    @pulumi.getter(name="sessionPersistent")
    def session_persistent(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Whether session cookies will last across browser sessions. Okta Administrators can never have persistent session cookies. Default: `false`
        """
        return pulumi.get(self, "session_persistent")

    @session_persistent.setter
    def session_persistent(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "session_persistent", value)

    @_builtins.property
    @pulumi.getter
    def status(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Policy Rule Status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
        """
        return pulumi.get(self, "status")

    @status.setter
    def status(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "status", value)

    @_builtins.property
    @pulumi.getter(name="usersExcludeds")
    def users_excludeds(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        Set of User IDs to Exclude
        """
        return pulumi.get(self, "users_excludeds")

    @users_excludeds.setter
    def users_excludeds(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "users_excludeds", value)


@pulumi.type_token("okta:policy/ruleSignon:RuleSignon")
class RuleSignon(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 access: Optional[pulumi.Input[_builtins.str]] = None,
                 authtype: Optional[pulumi.Input[_builtins.str]] = None,
                 behaviors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 factor_sequences: Optional[pulumi.Input[Sequence[pulumi.Input[Union['RuleSignonFactorSequenceArgs', 'RuleSignonFactorSequenceArgsDict']]]]] = None,
                 identity_provider: Optional[pulumi.Input[_builtins.str]] = None,
                 identity_provider_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 mfa_lifetime: Optional[pulumi.Input[_builtins.int]] = None,
                 mfa_prompt: Optional[pulumi.Input[_builtins.str]] = None,
                 mfa_remember_device: Optional[pulumi.Input[_builtins.bool]] = None,
                 mfa_required: Optional[pulumi.Input[_builtins.bool]] = None,
                 name: Optional[pulumi.Input[_builtins.str]] = None,
                 network_connection: Optional[pulumi.Input[_builtins.str]] = None,
                 network_excludes: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 network_includes: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 policy_id: Optional[pulumi.Input[_builtins.str]] = None,
                 primary_factor: Optional[pulumi.Input[_builtins.str]] = None,
                 priority: Optional[pulumi.Input[_builtins.int]] = None,
                 risc_level: Optional[pulumi.Input[_builtins.str]] = None,
                 risk_level: Optional[pulumi.Input[_builtins.str]] = None,
                 session_idle: Optional[pulumi.Input[_builtins.int]] = None,
                 session_lifetime: Optional[pulumi.Input[_builtins.int]] = None,
                 session_persistent: Optional[pulumi.Input[_builtins.bool]] = None,
                 status: Optional[pulumi.Input[_builtins.str]] = None,
                 users_excludeds: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 __props__=None):
        """
        Creates a Sign On Policy Rule. In case `Invalid condition type specified: riskScore.` error is thrown, set `risc_level` to an empty string, since this feature is not enabled.

        ## Example Usage

        ```python
        import pulumi
        import pulumi_okta as okta

        test = okta.policy.Signon("test",
            name="Example Policy",
            status="ACTIVE",
            description="Example Policy")
        new_city = okta.get_behaviour(name="New City")
        example = okta.policy.RuleSignon("example",
            access="CHALLENGE",
            authtype="RADIUS",
            name="Example Policy Rule",
            network_connection="ANYWHERE",
            policy_id=example_okta_policy_signon["id"],
            status="ACTIVE",
            risc_level="HIGH",
            behaviors=[new_city.id],
            factor_sequences=[
                {
                    "primary_criteria_factor_type": "token:hotp",
                    "primary_criteria_provider": "CUSTOM",
                    "secondary_criterias": [
                        {
                            "factor_type": "token:software:totp",
                            "provider": "OKTA",
                        },
                        {
                            "factor_type": "push",
                            "provider": "OKTA",
                        },
                        {
                            "factor_type": "password",
                            "provider": "OKTA",
                        },
                        {
                            "factor_type": "question",
                            "provider": "OKTA",
                        },
                        {
                            "factor_type": "sms",
                            "provider": "OKTA",
                        },
                        {
                            "factor_type": "token:software:totp",
                            "provider": "GOOGLE",
                        },
                        {
                            "factor_type": "email",
                            "provider": "OKTA",
                        },
                        {
                            "factor_type": "call",
                            "provider": "OKTA",
                        },
                        {
                            "factor_type": "webauthn",
                            "provider": "FIDO",
                        },
                        {
                            "factor_type": "token",
                            "provider": "RSA",
                        },
                        {
                            "factor_type": "token",
                            "provider": "SYMANTEC",
                        },
                    ],
                },
                {
                    "primary_criteria_factor_type": "token:software:totp",
                    "primary_criteria_provider": "OKTA",
                },
            ])
        ```

        ## Import

        ```sh
        $ pulumi import okta:policy/ruleSignon:RuleSignon example <policy_id>/<rule_id>
        ```

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[_builtins.str] access: Allow or deny access based on the rule conditions: `ALLOW`, `DENY` or `CHALLENGE`. Default: `ALLOW`
        :param pulumi.Input[_builtins.str] authtype: Authentication entrypoint: `ANY`, `RADIUS` or `LDAP_INTERFACE`. Default: `ANY`
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] behaviors: List of behavior IDs
        :param pulumi.Input[Sequence[pulumi.Input[Union['RuleSignonFactorSequenceArgs', 'RuleSignonFactorSequenceArgsDict']]]] factor_sequences: Auth factor sequences. Should be set if 'access = "CHALLENGE"'.
               	- 'primary_criteria_provider' - (Required) Primary provider of the auth section.
               	- 'primary_criteria_factor_type' - (Required) Primary factor type of the auth section.
               	- 'secondary_criteria' - (Optional) Additional authentication steps.
               	- 'provider' - (Required) Provider of the additional authentication step.
               	- 'factor_type' - (Required) Factor type of the additional authentication step.
        :param pulumi.Input[_builtins.str] identity_provider: Apply rule based on the IdP used: `ANY`, `OKTA` or `SPECIFIC_IDP`. Default: `ANY`. > **WARNING**: Use of `identity_provider` requires a feature flag to be enabled.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] identity_provider_ids: When identity_provider is `SPECIFIC_IDP` then this is the list of IdP IDs to apply the rule on
        :param pulumi.Input[_builtins.int] mfa_lifetime: Elapsed time before the next MFA challenge
        :param pulumi.Input[_builtins.str] mfa_prompt: Prompt for MFA based on the device used, a factor session lifetime, or every sign-on attempt: `DEVICE`, `SESSION` or`ALWAYS`.
        :param pulumi.Input[_builtins.bool] mfa_remember_device: Remember MFA device. Default: `false`
        :param pulumi.Input[_builtins.bool] mfa_required: Require MFA. Default: `false`
        :param pulumi.Input[_builtins.str] name: Policy Rule Name
        :param pulumi.Input[_builtins.str] network_connection: Network selection mode: `ANYWHERE`, `ZONE`, `ON_NETWORK`, or `OFF_NETWORK`. Default: `ANYWHERE`
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] network_excludes: Required if `network_connection` = `ZONE`. Indicates the network zones to exclude.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] network_includes: Required if `network_connection` = `ZONE`. Indicates the network zones to include.
        :param pulumi.Input[_builtins.str] policy_id: Policy ID of the Rule
        :param pulumi.Input[_builtins.str] primary_factor: Rule's primary factor. **WARNING** Ony works as a part of the Identity Engine. Valid values: `PASSWORD_IDP_ANY_FACTOR`, `PASSWORD_IDP`.
        :param pulumi.Input[_builtins.int] priority: Rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
        :param pulumi.Input[_builtins.str] risc_level: Risc level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
        :param pulumi.Input[_builtins.str] risk_level: Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
        :param pulumi.Input[_builtins.int] session_idle: Max minutes a session can be idle. Default: `120`
        :param pulumi.Input[_builtins.int] session_lifetime: Max minutes a session is active: Disable = 0. Default: `120`
        :param pulumi.Input[_builtins.bool] session_persistent: Whether session cookies will last across browser sessions. Okta Administrators can never have persistent session cookies. Default: `false`
        :param pulumi.Input[_builtins.str] status: Policy Rule Status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] users_excludeds: Set of User IDs to Exclude
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: Optional[RuleSignonArgs] = None,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        Creates a Sign On Policy Rule. In case `Invalid condition type specified: riskScore.` error is thrown, set `risc_level` to an empty string, since this feature is not enabled.

        ## Example Usage

        ```python
        import pulumi
        import pulumi_okta as okta

        test = okta.policy.Signon("test",
            name="Example Policy",
            status="ACTIVE",
            description="Example Policy")
        new_city = okta.get_behaviour(name="New City")
        example = okta.policy.RuleSignon("example",
            access="CHALLENGE",
            authtype="RADIUS",
            name="Example Policy Rule",
            network_connection="ANYWHERE",
            policy_id=example_okta_policy_signon["id"],
            status="ACTIVE",
            risc_level="HIGH",
            behaviors=[new_city.id],
            factor_sequences=[
                {
                    "primary_criteria_factor_type": "token:hotp",
                    "primary_criteria_provider": "CUSTOM",
                    "secondary_criterias": [
                        {
                            "factor_type": "token:software:totp",
                            "provider": "OKTA",
                        },
                        {
                            "factor_type": "push",
                            "provider": "OKTA",
                        },
                        {
                            "factor_type": "password",
                            "provider": "OKTA",
                        },
                        {
                            "factor_type": "question",
                            "provider": "OKTA",
                        },
                        {
                            "factor_type": "sms",
                            "provider": "OKTA",
                        },
                        {
                            "factor_type": "token:software:totp",
                            "provider": "GOOGLE",
                        },
                        {
                            "factor_type": "email",
                            "provider": "OKTA",
                        },
                        {
                            "factor_type": "call",
                            "provider": "OKTA",
                        },
                        {
                            "factor_type": "webauthn",
                            "provider": "FIDO",
                        },
                        {
                            "factor_type": "token",
                            "provider": "RSA",
                        },
                        {
                            "factor_type": "token",
                            "provider": "SYMANTEC",
                        },
                    ],
                },
                {
                    "primary_criteria_factor_type": "token:software:totp",
                    "primary_criteria_provider": "OKTA",
                },
            ])
        ```

        ## Import

        ```sh
        $ pulumi import okta:policy/ruleSignon:RuleSignon example <policy_id>/<rule_id>
        ```

        :param str resource_name: The name of the resource.
        :param RuleSignonArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(RuleSignonArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 access: Optional[pulumi.Input[_builtins.str]] = None,
                 authtype: Optional[pulumi.Input[_builtins.str]] = None,
                 behaviors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 factor_sequences: Optional[pulumi.Input[Sequence[pulumi.Input[Union['RuleSignonFactorSequenceArgs', 'RuleSignonFactorSequenceArgsDict']]]]] = None,
                 identity_provider: Optional[pulumi.Input[_builtins.str]] = None,
                 identity_provider_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 mfa_lifetime: Optional[pulumi.Input[_builtins.int]] = None,
                 mfa_prompt: Optional[pulumi.Input[_builtins.str]] = None,
                 mfa_remember_device: Optional[pulumi.Input[_builtins.bool]] = None,
                 mfa_required: Optional[pulumi.Input[_builtins.bool]] = None,
                 name: Optional[pulumi.Input[_builtins.str]] = None,
                 network_connection: Optional[pulumi.Input[_builtins.str]] = None,
                 network_excludes: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 network_includes: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 policy_id: Optional[pulumi.Input[_builtins.str]] = None,
                 primary_factor: Optional[pulumi.Input[_builtins.str]] = None,
                 priority: Optional[pulumi.Input[_builtins.int]] = None,
                 risc_level: Optional[pulumi.Input[_builtins.str]] = None,
                 risk_level: Optional[pulumi.Input[_builtins.str]] = None,
                 session_idle: Optional[pulumi.Input[_builtins.int]] = None,
                 session_lifetime: Optional[pulumi.Input[_builtins.int]] = None,
                 session_persistent: Optional[pulumi.Input[_builtins.bool]] = None,
                 status: Optional[pulumi.Input[_builtins.str]] = None,
                 users_excludeds: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = RuleSignonArgs.__new__(RuleSignonArgs)

            __props__.__dict__["access"] = access
            __props__.__dict__["authtype"] = authtype
            __props__.__dict__["behaviors"] = behaviors
            __props__.__dict__["factor_sequences"] = factor_sequences
            __props__.__dict__["identity_provider"] = identity_provider
            __props__.__dict__["identity_provider_ids"] = identity_provider_ids
            __props__.__dict__["mfa_lifetime"] = mfa_lifetime
            __props__.__dict__["mfa_prompt"] = mfa_prompt
            __props__.__dict__["mfa_remember_device"] = mfa_remember_device
            __props__.__dict__["mfa_required"] = mfa_required
            __props__.__dict__["name"] = name
            __props__.__dict__["network_connection"] = network_connection
            __props__.__dict__["network_excludes"] = network_excludes
            __props__.__dict__["network_includes"] = network_includes
            __props__.__dict__["policy_id"] = policy_id
            __props__.__dict__["primary_factor"] = primary_factor
            __props__.__dict__["priority"] = priority
            __props__.__dict__["risc_level"] = risc_level
            __props__.__dict__["risk_level"] = risk_level
            __props__.__dict__["session_idle"] = session_idle
            __props__.__dict__["session_lifetime"] = session_lifetime
            __props__.__dict__["session_persistent"] = session_persistent
            __props__.__dict__["status"] = status
            __props__.__dict__["users_excludeds"] = users_excludeds
        super(RuleSignon, __self__).__init__(
            'okta:policy/ruleSignon:RuleSignon',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            access: Optional[pulumi.Input[_builtins.str]] = None,
            authtype: Optional[pulumi.Input[_builtins.str]] = None,
            behaviors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
            factor_sequences: Optional[pulumi.Input[Sequence[pulumi.Input[Union['RuleSignonFactorSequenceArgs', 'RuleSignonFactorSequenceArgsDict']]]]] = None,
            identity_provider: Optional[pulumi.Input[_builtins.str]] = None,
            identity_provider_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
            mfa_lifetime: Optional[pulumi.Input[_builtins.int]] = None,
            mfa_prompt: Optional[pulumi.Input[_builtins.str]] = None,
            mfa_remember_device: Optional[pulumi.Input[_builtins.bool]] = None,
            mfa_required: Optional[pulumi.Input[_builtins.bool]] = None,
            name: Optional[pulumi.Input[_builtins.str]] = None,
            network_connection: Optional[pulumi.Input[_builtins.str]] = None,
            network_excludes: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
            network_includes: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
            policy_id: Optional[pulumi.Input[_builtins.str]] = None,
            primary_factor: Optional[pulumi.Input[_builtins.str]] = None,
            priority: Optional[pulumi.Input[_builtins.int]] = None,
            risc_level: Optional[pulumi.Input[_builtins.str]] = None,
            risk_level: Optional[pulumi.Input[_builtins.str]] = None,
            session_idle: Optional[pulumi.Input[_builtins.int]] = None,
            session_lifetime: Optional[pulumi.Input[_builtins.int]] = None,
            session_persistent: Optional[pulumi.Input[_builtins.bool]] = None,
            status: Optional[pulumi.Input[_builtins.str]] = None,
            users_excludeds: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None) -> 'RuleSignon':
        """
        Get an existing RuleSignon resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[_builtins.str] access: Allow or deny access based on the rule conditions: `ALLOW`, `DENY` or `CHALLENGE`. Default: `ALLOW`
        :param pulumi.Input[_builtins.str] authtype: Authentication entrypoint: `ANY`, `RADIUS` or `LDAP_INTERFACE`. Default: `ANY`
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] behaviors: List of behavior IDs
        :param pulumi.Input[Sequence[pulumi.Input[Union['RuleSignonFactorSequenceArgs', 'RuleSignonFactorSequenceArgsDict']]]] factor_sequences: Auth factor sequences. Should be set if 'access = "CHALLENGE"'.
               	- 'primary_criteria_provider' - (Required) Primary provider of the auth section.
               	- 'primary_criteria_factor_type' - (Required) Primary factor type of the auth section.
               	- 'secondary_criteria' - (Optional) Additional authentication steps.
               	- 'provider' - (Required) Provider of the additional authentication step.
               	- 'factor_type' - (Required) Factor type of the additional authentication step.
        :param pulumi.Input[_builtins.str] identity_provider: Apply rule based on the IdP used: `ANY`, `OKTA` or `SPECIFIC_IDP`. Default: `ANY`. > **WARNING**: Use of `identity_provider` requires a feature flag to be enabled.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] identity_provider_ids: When identity_provider is `SPECIFIC_IDP` then this is the list of IdP IDs to apply the rule on
        :param pulumi.Input[_builtins.int] mfa_lifetime: Elapsed time before the next MFA challenge
        :param pulumi.Input[_builtins.str] mfa_prompt: Prompt for MFA based on the device used, a factor session lifetime, or every sign-on attempt: `DEVICE`, `SESSION` or`ALWAYS`.
        :param pulumi.Input[_builtins.bool] mfa_remember_device: Remember MFA device. Default: `false`
        :param pulumi.Input[_builtins.bool] mfa_required: Require MFA. Default: `false`
        :param pulumi.Input[_builtins.str] name: Policy Rule Name
        :param pulumi.Input[_builtins.str] network_connection: Network selection mode: `ANYWHERE`, `ZONE`, `ON_NETWORK`, or `OFF_NETWORK`. Default: `ANYWHERE`
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] network_excludes: Required if `network_connection` = `ZONE`. Indicates the network zones to exclude.
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] network_includes: Required if `network_connection` = `ZONE`. Indicates the network zones to include.
        :param pulumi.Input[_builtins.str] policy_id: Policy ID of the Rule
        :param pulumi.Input[_builtins.str] primary_factor: Rule's primary factor. **WARNING** Ony works as a part of the Identity Engine. Valid values: `PASSWORD_IDP_ANY_FACTOR`, `PASSWORD_IDP`.
        :param pulumi.Input[_builtins.int] priority: Rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
        :param pulumi.Input[_builtins.str] risc_level: Risc level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
        :param pulumi.Input[_builtins.str] risk_level: Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
        :param pulumi.Input[_builtins.int] session_idle: Max minutes a session can be idle. Default: `120`
        :param pulumi.Input[_builtins.int] session_lifetime: Max minutes a session is active: Disable = 0. Default: `120`
        :param pulumi.Input[_builtins.bool] session_persistent: Whether session cookies will last across browser sessions. Okta Administrators can never have persistent session cookies. Default: `false`
        :param pulumi.Input[_builtins.str] status: Policy Rule Status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] users_excludeds: Set of User IDs to Exclude
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _RuleSignonState.__new__(_RuleSignonState)

        __props__.__dict__["access"] = access
        __props__.__dict__["authtype"] = authtype
        __props__.__dict__["behaviors"] = behaviors
        __props__.__dict__["factor_sequences"] = factor_sequences
        __props__.__dict__["identity_provider"] = identity_provider
        __props__.__dict__["identity_provider_ids"] = identity_provider_ids
        __props__.__dict__["mfa_lifetime"] = mfa_lifetime
        __props__.__dict__["mfa_prompt"] = mfa_prompt
        __props__.__dict__["mfa_remember_device"] = mfa_remember_device
        __props__.__dict__["mfa_required"] = mfa_required
        __props__.__dict__["name"] = name
        __props__.__dict__["network_connection"] = network_connection
        __props__.__dict__["network_excludes"] = network_excludes
        __props__.__dict__["network_includes"] = network_includes
        __props__.__dict__["policy_id"] = policy_id
        __props__.__dict__["primary_factor"] = primary_factor
        __props__.__dict__["priority"] = priority
        __props__.__dict__["risc_level"] = risc_level
        __props__.__dict__["risk_level"] = risk_level
        __props__.__dict__["session_idle"] = session_idle
        __props__.__dict__["session_lifetime"] = session_lifetime
        __props__.__dict__["session_persistent"] = session_persistent
        __props__.__dict__["status"] = status
        __props__.__dict__["users_excludeds"] = users_excludeds
        return RuleSignon(resource_name, opts=opts, __props__=__props__)

    @_builtins.property
    @pulumi.getter
    def access(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Allow or deny access based on the rule conditions: `ALLOW`, `DENY` or `CHALLENGE`. Default: `ALLOW`
        """
        return pulumi.get(self, "access")

    @_builtins.property
    @pulumi.getter
    def authtype(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Authentication entrypoint: `ANY`, `RADIUS` or `LDAP_INTERFACE`. Default: `ANY`
        """
        return pulumi.get(self, "authtype")

    @_builtins.property
    @pulumi.getter
    def behaviors(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
        """
        List of behavior IDs
        """
        return pulumi.get(self, "behaviors")

    @_builtins.property
    @pulumi.getter(name="factorSequences")
    def factor_sequences(self) -> pulumi.Output[Optional[Sequence['outputs.RuleSignonFactorSequence']]]:
        """
        Auth factor sequences. Should be set if 'access = "CHALLENGE"'.
        	- 'primary_criteria_provider' - (Required) Primary provider of the auth section.
        	- 'primary_criteria_factor_type' - (Required) Primary factor type of the auth section.
        	- 'secondary_criteria' - (Optional) Additional authentication steps.
        	- 'provider' - (Required) Provider of the additional authentication step.
        	- 'factor_type' - (Required) Factor type of the additional authentication step.
        """
        return pulumi.get(self, "factor_sequences")

    @_builtins.property
    @pulumi.getter(name="identityProvider")
    def identity_provider(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Apply rule based on the IdP used: `ANY`, `OKTA` or `SPECIFIC_IDP`. Default: `ANY`. > **WARNING**: Use of `identity_provider` requires a feature flag to be enabled.
        """
        return pulumi.get(self, "identity_provider")

    @_builtins.property
    @pulumi.getter(name="identityProviderIds")
    def identity_provider_ids(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
        """
        When identity_provider is `SPECIFIC_IDP` then this is the list of IdP IDs to apply the rule on
        """
        return pulumi.get(self, "identity_provider_ids")

    @_builtins.property
    @pulumi.getter(name="mfaLifetime")
    def mfa_lifetime(self) -> pulumi.Output[Optional[_builtins.int]]:
        """
        Elapsed time before the next MFA challenge
        """
        return pulumi.get(self, "mfa_lifetime")

    @_builtins.property
    @pulumi.getter(name="mfaPrompt")
    def mfa_prompt(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Prompt for MFA based on the device used, a factor session lifetime, or every sign-on attempt: `DEVICE`, `SESSION` or`ALWAYS`.
        """
        return pulumi.get(self, "mfa_prompt")

    @_builtins.property
    @pulumi.getter(name="mfaRememberDevice")
    def mfa_remember_device(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        Remember MFA device. Default: `false`
        """
        return pulumi.get(self, "mfa_remember_device")

    @_builtins.property
    @pulumi.getter(name="mfaRequired")
    def mfa_required(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        Require MFA. Default: `false`
        """
        return pulumi.get(self, "mfa_required")

    @_builtins.property
    @pulumi.getter
    def name(self) -> pulumi.Output[_builtins.str]:
        """
        Policy Rule Name
        """
        return pulumi.get(self, "name")

    @_builtins.property
    @pulumi.getter(name="networkConnection")
    def network_connection(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Network selection mode: `ANYWHERE`, `ZONE`, `ON_NETWORK`, or `OFF_NETWORK`. Default: `ANYWHERE`
        """
        return pulumi.get(self, "network_connection")

    @_builtins.property
    @pulumi.getter(name="networkExcludes")
    def network_excludes(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
        """
        Required if `network_connection` = `ZONE`. Indicates the network zones to exclude.
        """
        return pulumi.get(self, "network_excludes")

    @_builtins.property
    @pulumi.getter(name="networkIncludes")
    def network_includes(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
        """
        Required if `network_connection` = `ZONE`. Indicates the network zones to include.
        """
        return pulumi.get(self, "network_includes")

    @_builtins.property
    @pulumi.getter(name="policyId")
    def policy_id(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Policy ID of the Rule
        """
        return pulumi.get(self, "policy_id")

    @_builtins.property
    @pulumi.getter(name="primaryFactor")
    def primary_factor(self) -> pulumi.Output[_builtins.str]:
        """
        Rule's primary factor. **WARNING** Ony works as a part of the Identity Engine. Valid values: `PASSWORD_IDP_ANY_FACTOR`, `PASSWORD_IDP`.
        """
        return pulumi.get(self, "primary_factor")

    @_builtins.property
    @pulumi.getter
    def priority(self) -> pulumi.Output[Optional[_builtins.int]]:
        """
        Rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
        """
        return pulumi.get(self, "priority")

    @_builtins.property
    @pulumi.getter(name="riscLevel")
    @_utilities.deprecated("""Attribute typo, switch to risk_level instead. Default: `ANY`""")
    def risc_level(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Risc level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
        """
        return pulumi.get(self, "risc_level")

    @_builtins.property
    @pulumi.getter(name="riskLevel")
    def risk_level(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
        """
        return pulumi.get(self, "risk_level")

    @_builtins.property
    @pulumi.getter(name="sessionIdle")
    def session_idle(self) -> pulumi.Output[Optional[_builtins.int]]:
        """
        Max minutes a session can be idle. Default: `120`
        """
        return pulumi.get(self, "session_idle")

    @_builtins.property
    @pulumi.getter(name="sessionLifetime")
    def session_lifetime(self) -> pulumi.Output[Optional[_builtins.int]]:
        """
        Max minutes a session is active: Disable = 0. Default: `120`
        """
        return pulumi.get(self, "session_lifetime")

    @_builtins.property
    @pulumi.getter(name="sessionPersistent")
    def session_persistent(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        Whether session cookies will last across browser sessions. Okta Administrators can never have persistent session cookies. Default: `false`
        """
        return pulumi.get(self, "session_persistent")

    @_builtins.property
    @pulumi.getter
    def status(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Policy Rule Status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
        """
        return pulumi.get(self, "status")

    @_builtins.property
    @pulumi.getter(name="usersExcludeds")
    def users_excludeds(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
        """
        Set of User IDs to Exclude
        """
        return pulumi.get(self, "users_excludeds")

