Replace

POST

/api/web/custom/namespaces/{namespace}/oidc_providers/{name}

const url = 'https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/web/custom/namespaces/example/oidc_providers/example';
const options = {
  method: 'POST',
  headers: {Authorization: '<Authorization>', 'Content-Type': 'application/json'},
  body: '{"name":"example","namespace":"example","spec":{"azure_oidc_spec_type":{"authorization_url":"example","backchannel_logout":true,"client_id":"example","client_secret":"example","default_scopes":"example","issuer":"example","jwks_url":"example","logout_url":"example","prompt":"UNSPECIFIED","token_url":"example","user_info_url":"example"},"google_oidc_spec_type":{"client_id":"example","client_secret":"example","hosted_domain":"example"},"oidc_v10_spec_type":{"allowed_clock_skew":"example","authorization_url":"example","backchannel_logout":true,"client_id":"example","client_secret":"example","default_scopes":"example","disable_user_info":true,"display_name":"example","forwarded_query_parameters":"example","issuer":"example","jwks_url":"example","logout_url":"example","pass_current_locale":true,"pass_login_hint":true,"prompt":"UNSPECIFIED","token_url":"example","user_info_url":"example","validate_signatures":true},"okta_oidc_spec_type":{"authorization_url":"example","backchannel_logout":true,"client_id":"example","client_secret":"example","default_scopes":"example","issuer":"example","jwks_url":"example","logout_url":"example","prompt":"UNSPECIFIED","token_url":"example","user_info_url":"example"},"provider_type":"DEFAULT"}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/web/custom/namespaces/example/oidc_providers/example \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "name": "example", "namespace": "example", "spec": { "azure_oidc_spec_type": { "authorization_url": "example", "backchannel_logout": true, "client_id": "example", "client_secret": "example", "default_scopes": "example", "issuer": "example", "jwks_url": "example", "logout_url": "example", "prompt": "UNSPECIFIED", "token_url": "example", "user_info_url": "example" }, "google_oidc_spec_type": { "client_id": "example", "client_secret": "example", "hosted_domain": "example" }, "oidc_v10_spec_type": { "allowed_clock_skew": "example", "authorization_url": "example", "backchannel_logout": true, "client_id": "example", "client_secret": "example", "default_scopes": "example", "disable_user_info": true, "display_name": "example", "forwarded_query_parameters": "example", "issuer": "example", "jwks_url": "example", "logout_url": "example", "pass_current_locale": true, "pass_login_hint": true, "prompt": "UNSPECIFIED", "token_url": "example", "user_info_url": "example", "validate_signatures": true }, "okta_oidc_spec_type": { "authorization_url": "example", "backchannel_logout": true, "client_id": "example", "client_secret": "example", "default_scopes": "example", "issuer": "example", "jwks_url": "example", "logout_url": "example", "prompt": "UNSPECIFIED", "token_url": "example", "user_info_url": "example" }, "provider_type": "DEFAULT" } }'

Replace updates OIDC provider parameters for a given provider instance. Since we never store client secret, any time this operation is performed, user will need to input the original/new client secret along with other existing fields as delta operations is not supported.

NOTE: Operations performed via API client is encouraged to issue a detail GET on the current oidc_provider resource to retrieve all configured fields and this can be used in constructing payload for the update operation. Params which are not sent as part of replace operation will GET removed/unset if those params were configured prior to this operation. So its important that replace operation payload needs to have complete fields with their values as required in your final configuration. For example: admin needs to update client secret of an existing SSO configuation - first issue detail GET on the current oidc_provider resource, use all of the fields in spec.gc_spec from response and construct the replace request spec. Now update only client_secret field with the new value as required and send request.

Examples of this operation.

Authorizations

ApiToken

Parameters

Path Parameters

namespace

required

string

Namespace Supports only system namespace.

name

required

string

Name Name of the oidc_provider object.

Request Body^required

application/json

Replace Request

ReplaceRequest is the request format for replacing an OIDC provider in IAM.

object

name

name

Name of the oidc_provider object.

string

>= 6 characters <= 1024 characters

namespace

namespace

Supports only system namespace.

string

>= 6 characters <= 1024 characters

spec

object

azure_oidc_spec_type

object

authorization_url

authorization url

The authorization URL of your OIDC application. Required: YES.

string

<= 1024 characters

backchannel_logout

backchannel logout

Does the external IDP support backchannel logout?

boolean format: boolean

client_id

client ID

Client ID of the OIDC application registered with Azure provider. REQUIRED field Required: YES.

string

<= 1024 characters

client_secret

client secret

Secret of the OIDC application registered with Azure provider. Required: YES.

string

<= 1024 characters

default_scopes

default scopes

The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. The recommendation is to set the default scopes as ‘openid profile email’ and is to add additional scopes if needed.

string

<= 256 characters

issuer

issuer

The issuer identifier for the issuer of the response. If not provided, no validation will be performed.

string

<= 1024 characters

jwks_url

JWKS URL

URL where identity provider keys in JWK format are stored.

string

<= 1024 characters

logout_url

logout url

Logout URL specified in your OIDC application.

string

<= 1024 characters

prompt

string

default: UNSPECIFIED

Allowed values: UNSPECIFIED NONE CONSENT LOGIN SELECT_ACCOUNT

token_url

token url

The token URL of your OIDC application. Required: YES.

string

<= 1024 characters

user_info_url

user info url

The User Info URL specified in your OIDC application.

string

<= 1024 characters

google_oidc_spec_type

object

client_id

client ID

Client ID of the OIDC application registered with google provider. REQUIRED field Required: YES.

string

<= 1024 characters

client_secret

client secret

Secret of the OIDC application registered with google provider. Required: YES.

string

<= 1024 characters

hosted_domain

hosted domain

Set hosted domain to restrict user input on login form to use email address from this email domain. For example, setting value company.com will enforce user email input to have only username@company.com leave empty if no restriction is required for email address. Ie for example allow user@company1.com and user@company2.com.

string

<= 1024 characters

oidc_v10_spec_type

object

allowed_clock_skew

allowed clock skew

Clock skew in seconds that is tolerated when validating identity provider tokens. Default value is zero.

string format: int64

<= 1024 characters

authorization_url

authorization url

The authorization URL of your OIDC application. Required: YES.

string

<= 1024 characters

backchannel_logout

backchannel logout

Does the external IDP support backchannel logout?

boolean format: boolean

client_id

client ID

Client ID of the OIDC application registered with your identity/OIDC provider. Required: YES.

string

<= 1024 characters

client_secret

client secret

Secret of the OIDC application registered with your identity/OIDC provider. Required: YES.

string

<= 1024 characters

default_scopes

default scopes

string

<= 256 characters

disable_user_info

disable user info

Disable fetching of user info information.

boolean format: boolean

display_name

display name

Friendly name for identity provider.

string

<= 1024 characters

forwarded_query_parameters

forwarded query parameters

Non OpenID Connect/OAuth standard query parameters to be forwarded to external IDP from the initial application request to Authorization Endpoint. Multiple parameters can be entered, separated by comma (,).

string

<= 1024 characters

issuer

issuer

The issuer identifier for the issuer of the response. If not provided, no validation will be performed.

string

<= 1024 characters

jwks_url

JWKS URL

URL where identity provider keys in JWK format are stored.

string

<= 1024 characters

logout_url

logout url

Logout URL specified in your OIDC application.

string

<= 1024 characters

pass_current_locale

pass current locale

Pass the current locale to the identity provider.

boolean format: boolean

pass_login_hint

pass login hint

Pass login_hint to identity provider.

boolean format: boolean

prompt

string

default: UNSPECIFIED

Allowed values: UNSPECIFIED NONE CONSENT LOGIN SELECT_ACCOUNT

token_url

token url

The token URL of your OIDC application. Required: YES.

string

<= 1024 characters

user_info_url

user info url

The User Info URL specified in your OIDC application.

string

<= 1024 characters

validate_signatures

validate signatures

Enable/disable signature validation of external IDP signatures.

boolean format: boolean

okta_oidc_spec_type

object

authorization_url

authorization url

The authorization URL of your OIDC application. Required: YES.

string

<= 1024 characters

backchannel_logout

backchannel logout

Does the external IDP support backchannel logout?

boolean format: boolean

client_id

client ID

Client ID of the OIDC application registered with Azure provider. Required: YES.

string

<= 1024 characters

client_secret

client secret

Secret of the OIDC application registered with Azure provider. Required: YES.

string

<= 1024 characters

default_scopes

default scopes

string

<= 256 characters

issuer

issuer

The issuer identifier for the issuer of the response. If not provided, no validation will be performed.

string

<= 1024 characters

jwks_url

JWKS URL

URL where identity provider keys in JWK format are stored.

string

<= 1024 characters

logout_url

logout url

Logout URL specified in your OIDC application.

string

<= 1024 characters

prompt

string

default: UNSPECIFIED

Allowed values: UNSPECIFIED NONE CONSENT LOGIN SELECT_ACCOUNT

token_url

token url

The token URL of your OIDC application. Required: YES.

string

<= 1024 characters

user_info_url

user info url

The User Info URL specified in your OIDC application.

string

<= 1024 characters

provider_type

string

default: DEFAULT

Allowed values: DEFAULT GOOGLE AZURE OKTA

Responses

200

A successful response.

application/json

Replace Response

ReplaceResponse is the response format for replacing an OIDC provider in IAM. Response body is empty.

object

err

string

default: EUNKNOWN

Allowed values: EUNKNOWN EOK EEXISTS EFAILED ENOTFOUND

Example

{
  "err": "EUNKNOWN"
}

401

Returned when operation is not authorized.

application/json

string format: string

Example^generated

example

403

Returned when there is no permission to access resource.

application/json

string format: string

Example^generated

example

404

Returned when resource is not found.

application/json

string format: string

Example^generated

example

409

Returned when operation on resource is conflicting with current value.

application/json

string format: string

Example^generated

example

429

Returned when operation has been rejected as it is happening too frequently.

application/json

string format: string

Example^generated

example

500

Returned when server encountered an error in processing API.

application/json

string format: string

Example^generated

example

503

Returned when service is unavailable temporarily.

application/json

string format: string

Example^generated

example

504

Returned when server timed out processing request.

application/json

string format: string

Example^generated

example

Replace

Authorizations

Parameters

Path Parameters

Request Bodyrequired

Responses

200

Example

401

Examplegenerated

403

Examplegenerated

404

Examplegenerated

409

Examplegenerated

429

Examplegenerated

500

Examplegenerated

503

Examplegenerated

504

Examplegenerated

Request Body^required

Example^generated

Example^generated

Example^generated

Example^generated

Example^generated

Example^generated

Example^generated

Example^generated