streamtime_oauth_provider (Resource)

The identity provider people sign in with. Supply the issuer, signing-key, token and sign-in addresses from its discovery document, and the client you registered there. Streamtime validates those addresses against discovery.

Example Usage

resource "streamtime_oauth_provider" "sso" {
  identifier             = "sso"
  issuer                 = "https://accounts.example.com"
  client_id              = "streamtime"
  jwks_endpoint_uri      = "https://accounts.example.com/keys"
  token_endpoint_uri     = "https://accounts.example.com/token"
  authorize_endpoint_uri = "https://accounts.example.com/authorize"

  client_secret = var.oidc_client_secret
}

variable "oidc_client_secret" {
  type      = string
  sensitive = true
}

Schema

Required

• authorize_endpoint_uri (String) The provider’s sign-in page address: authorization_endpoint in its discovery document.
• client_id (String) The client ID you registered for Streamtime at your identity provider.
• client_secret (String, Sensitive) The client secret you registered for Streamtime at your identity provider.
• identifier (String) A short name for the provider, up to 24 lowercase letters, numbers and dashes. Changing it creates a new provider.
• issuer (String) The issuer address of your identity provider, for example https://accounts.example.com.
• jwks_endpoint_uri (String) Where the provider publishes its signing keys: jwks_uri in its discovery document.
• token_endpoint_uri (String) The provider’s token address: token_endpoint in its discovery document.

Optional

• audience (String) The audience the provider puts in its tokens, when it uses one.
• email_claim_name (String) The token claim that holds the person’s email address.
• groups_claim_name (String) The token claim that holds the person’s groups.
• groups_claim_scope (String) The scope that makes the provider include the groups claim.
• refresh_token (Boolean) Whether people stay signed in by refreshing their session.
• scope (String) The scopes Streamtime asks for when people sign in.
• sub_claim_name (String) The token claim that holds the person’s unique ID.
• tls_trusted_cert (String) The certificate authority bundle to trust when the provider uses a private certificate, in PEM format.
• userinfo_endpoint_uri (String) The provider’s user information address, when it has one.

Read-Only

• id (String) ID of the sign-in provider. Use it to import an existing one.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# Import by the provider's identifier. Set `client_secret` in your configuration:
# Streamtime does not return it.
terraform import streamtime_oauth_provider.sso sso