# coding=utf-8
# *** WARNING: this file was generated by pulumi-language-python. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import builtins as _builtins
import warnings
import sys
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
if sys.version_info >= (3, 11):
    from typing import NotRequired, TypedDict, TypeAlias
else:
    from typing_extensions import NotRequired, TypedDict, TypeAlias
from .. import _utilities

__all__ = ['OidcKeyAllowedClientIDArgs', 'OidcKeyAllowedClientID']

@pulumi.input_type
class OidcKeyAllowedClientIDArgs:
    def __init__(__self__, *,
                 allowed_client_id: pulumi.Input[_builtins.str],
                 key_name: pulumi.Input[_builtins.str],
                 namespace: Optional[pulumi.Input[_builtins.str]] = None):
        """
        The set of arguments for constructing a OidcKeyAllowedClientID resource.

        :param pulumi.Input[_builtins.str] allowed_client_id: Client ID to allow usage with the OIDC named key
        :param pulumi.Input[_builtins.str] key_name: Name of the OIDC Key allow the Client ID.
        :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
               The value should not contain leading or trailing forward slashes.
               The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
               *Available only for Vault Enterprise*.
        """
        pulumi.set(__self__, "allowed_client_id", allowed_client_id)
        pulumi.set(__self__, "key_name", key_name)
        if namespace is not None:
            pulumi.set(__self__, "namespace", namespace)

    @_builtins.property
    @pulumi.getter(name="allowedClientId")
    def allowed_client_id(self) -> pulumi.Input[_builtins.str]:
        """
        Client ID to allow usage with the OIDC named key
        """
        return pulumi.get(self, "allowed_client_id")

    @allowed_client_id.setter
    def allowed_client_id(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "allowed_client_id", value)

    @_builtins.property
    @pulumi.getter(name="keyName")
    def key_name(self) -> pulumi.Input[_builtins.str]:
        """
        Name of the OIDC Key allow the Client ID.
        """
        return pulumi.get(self, "key_name")

    @key_name.setter
    def key_name(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "key_name", value)

    @_builtins.property
    @pulumi.getter
    def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The namespace to provision the resource in.
        The value should not contain leading or trailing forward slashes.
        The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
        *Available only for Vault Enterprise*.
        """
        return pulumi.get(self, "namespace")

    @namespace.setter
    def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "namespace", value)


@pulumi.input_type
class _OidcKeyAllowedClientIDState:
    def __init__(__self__, *,
                 allowed_client_id: Optional[pulumi.Input[_builtins.str]] = None,
                 key_name: Optional[pulumi.Input[_builtins.str]] = None,
                 namespace: Optional[pulumi.Input[_builtins.str]] = None):
        """
        Input properties used for looking up and filtering OidcKeyAllowedClientID resources.

        :param pulumi.Input[_builtins.str] allowed_client_id: Client ID to allow usage with the OIDC named key
        :param pulumi.Input[_builtins.str] key_name: Name of the OIDC Key allow the Client ID.
        :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
               The value should not contain leading or trailing forward slashes.
               The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
               *Available only for Vault Enterprise*.
        """
        if allowed_client_id is not None:
            pulumi.set(__self__, "allowed_client_id", allowed_client_id)
        if key_name is not None:
            pulumi.set(__self__, "key_name", key_name)
        if namespace is not None:
            pulumi.set(__self__, "namespace", namespace)

    @_builtins.property
    @pulumi.getter(name="allowedClientId")
    def allowed_client_id(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Client ID to allow usage with the OIDC named key
        """
        return pulumi.get(self, "allowed_client_id")

    @allowed_client_id.setter
    def allowed_client_id(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "allowed_client_id", value)

    @_builtins.property
    @pulumi.getter(name="keyName")
    def key_name(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Name of the OIDC Key allow the Client ID.
        """
        return pulumi.get(self, "key_name")

    @key_name.setter
    def key_name(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "key_name", value)

    @_builtins.property
    @pulumi.getter
    def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The namespace to provision the resource in.
        The value should not contain leading or trailing forward slashes.
        The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
        *Available only for Vault Enterprise*.
        """
        return pulumi.get(self, "namespace")

    @namespace.setter
    def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "namespace", value)


@pulumi.type_token("vault:identity/oidcKeyAllowedClientID:OidcKeyAllowedClientID")
class OidcKeyAllowedClientID(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 allowed_client_id: Optional[pulumi.Input[_builtins.str]] = None,
                 key_name: Optional[pulumi.Input[_builtins.str]] = None,
                 namespace: Optional[pulumi.Input[_builtins.str]] = None,
                 __props__=None):
        """
        Allows an Identity OIDC Role to use an OIDC Named key to generate
        [identity tokens](https://www.vaultproject.io/docs/secrets/identity/index.html#identity-tokens).

        The Identity secrets engine is the identity management solution for Vault. It internally
        maintains the clients who are recognized by Vault.

        Use this with `identity.OidcKey`
        and `identity.OidcKeyAllowedClientID`
        to configure a Role to generate Identity Tokens.

        > **NOTE on `allowed_client_ids`:** Terraform currently
        provides both a standalone Allowed Client ID (a single
        Client ID), and a OIDC Named Key with a inline list of Allowed Client IDs.
        At this time you cannot use an OIDC Named Key inline list of Allowed Client IDs
        in conjunction with any Allowed Client ID resources. Doing so will cause
        a conflict of the list of Allowed Client IDs for the named Key.

        ## Example Usage

        ```python
        import pulumi
        import pulumi_vault as vault

        key = vault.identity.OidcKey("key",
            name="key",
            algorithm="RS256")
        role = vault.identity.OidcRole("role",
            name="role",
            key=key.name)
        role_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID("role",
            key_name=key.name,
            allowed_client_id=role.client_id)
        ```


        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[_builtins.str] allowed_client_id: Client ID to allow usage with the OIDC named key
        :param pulumi.Input[_builtins.str] key_name: Name of the OIDC Key allow the Client ID.
        :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
               The value should not contain leading or trailing forward slashes.
               The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
               *Available only for Vault Enterprise*.
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: OidcKeyAllowedClientIDArgs,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        Allows an Identity OIDC Role to use an OIDC Named key to generate
        [identity tokens](https://www.vaultproject.io/docs/secrets/identity/index.html#identity-tokens).

        The Identity secrets engine is the identity management solution for Vault. It internally
        maintains the clients who are recognized by Vault.

        Use this with `identity.OidcKey`
        and `identity.OidcKeyAllowedClientID`
        to configure a Role to generate Identity Tokens.

        > **NOTE on `allowed_client_ids`:** Terraform currently
        provides both a standalone Allowed Client ID (a single
        Client ID), and a OIDC Named Key with a inline list of Allowed Client IDs.
        At this time you cannot use an OIDC Named Key inline list of Allowed Client IDs
        in conjunction with any Allowed Client ID resources. Doing so will cause
        a conflict of the list of Allowed Client IDs for the named Key.

        ## Example Usage

        ```python
        import pulumi
        import pulumi_vault as vault

        key = vault.identity.OidcKey("key",
            name="key",
            algorithm="RS256")
        role = vault.identity.OidcRole("role",
            name="role",
            key=key.name)
        role_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID("role",
            key_name=key.name,
            allowed_client_id=role.client_id)
        ```


        :param str resource_name: The name of the resource.
        :param OidcKeyAllowedClientIDArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(OidcKeyAllowedClientIDArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 allowed_client_id: Optional[pulumi.Input[_builtins.str]] = None,
                 key_name: Optional[pulumi.Input[_builtins.str]] = None,
                 namespace: Optional[pulumi.Input[_builtins.str]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = OidcKeyAllowedClientIDArgs.__new__(OidcKeyAllowedClientIDArgs)

            if allowed_client_id is None and not opts.urn:
                raise TypeError("Missing required property 'allowed_client_id'")
            __props__.__dict__["allowed_client_id"] = allowed_client_id
            if key_name is None and not opts.urn:
                raise TypeError("Missing required property 'key_name'")
            __props__.__dict__["key_name"] = key_name
            __props__.__dict__["namespace"] = namespace
        super(OidcKeyAllowedClientID, __self__).__init__(
            'vault:identity/oidcKeyAllowedClientID:OidcKeyAllowedClientID',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            allowed_client_id: Optional[pulumi.Input[_builtins.str]] = None,
            key_name: Optional[pulumi.Input[_builtins.str]] = None,
            namespace: Optional[pulumi.Input[_builtins.str]] = None) -> 'OidcKeyAllowedClientID':
        """
        Get an existing OidcKeyAllowedClientID resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[_builtins.str] allowed_client_id: Client ID to allow usage with the OIDC named key
        :param pulumi.Input[_builtins.str] key_name: Name of the OIDC Key allow the Client ID.
        :param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
               The value should not contain leading or trailing forward slashes.
               The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
               *Available only for Vault Enterprise*.
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _OidcKeyAllowedClientIDState.__new__(_OidcKeyAllowedClientIDState)

        __props__.__dict__["allowed_client_id"] = allowed_client_id
        __props__.__dict__["key_name"] = key_name
        __props__.__dict__["namespace"] = namespace
        return OidcKeyAllowedClientID(resource_name, opts=opts, __props__=__props__)

    @_builtins.property
    @pulumi.getter(name="allowedClientId")
    def allowed_client_id(self) -> pulumi.Output[_builtins.str]:
        """
        Client ID to allow usage with the OIDC named key
        """
        return pulumi.get(self, "allowed_client_id")

    @_builtins.property
    @pulumi.getter(name="keyName")
    def key_name(self) -> pulumi.Output[_builtins.str]:
        """
        Name of the OIDC Key allow the Client ID.
        """
        return pulumi.get(self, "key_name")

    @_builtins.property
    @pulumi.getter
    def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The namespace to provision the resource in.
        The value should not contain leading or trailing forward slashes.
        The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
        *Available only for Vault Enterprise*.
        """
        return pulumi.get(self, "namespace")

