xcsh_authentication (Data Source)

Retrieves information about an Authentication resource in F5 Distributed Cloud. This is a read-only data source.

~> Note: For more information, see the F5 Distributed Cloud API documentation.

Example Usage

# Authentication Data Source Example

terraform {
  required_version = ">= 1.0"

  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0.1.0"
    }
  }
}

# Look up an existing Authentication by name
data "xcsh_authentication" "example" {
  name      = "example-authentication"
  namespace = "staging"
}

output "authentication_id" {
  value = data.xcsh_authentication.example.id
}

Argument Reference

-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use block syntax field_name { ... }. Empty OneOf object attributes use field_name = {}; conditional selection uses condition ? {} : null. Boolean attributes (such as add_hsts and http_redirect) use = true or = false.

🔶 High Risk Operations — Some operations on this resource have high danger level. Destructive operations may require confirmation.

Metadata Argument Reference

• name - Required String
Name of the Authentication

• namespace - Required String
Namespace where the Authentication exists

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• annotations - Optional Map
Annotations applied to this resource

• cookie_params - Optional String
Specifies different cookie related config parameters for authentication

• description - Optional String
Description of the Authentication

• id - Optional String
Unique identifier for the resource

• labels - Optional Map
Labels applied to this resource

• oidc_auth - Optional String
OIDCAuthType

• auth_hmac - Optional String
HMAC primary and secondary keys to be used for hashing the Cookie. Each key also have an associated expiry timestamp, beyond which key is invalid

• cookie_expiry - Optional Number
Specifies in seconds max duration of the allocated cookie. This maps to “Max-Age” attribute in the session cookie. This will act as an expiry duration on the client-side after which client will not be setting the cookie as part of the request

• cookie_refresh_interval - Optional Number
Specifies in seconds refresh interval for session cookie. This is used to keep the active user active and reduce RE-login. When an incoming cookie’s session expiry is still valid, and time to expire falls behind this interval, RE-issue a cookie with new expiry and with the same original session

• kms_key_hmac - Optional Object
Configuration parameter for kms key HMAC

• session_expiry - Optional Number
Specifies in seconds max lifetime of an authenticated session after which the user will be forced to login again. Default session expiry is 86400 seconds(24 hours)

• prim_key - Optional String
SecretType is used in an object to indicate a sensitive/confidential field

• prim_key_expiry - Optional String
HMAC Primary Key Expiry. Primary HMAC Key Expiry time

• sec_key - Optional String
SecretType is used in an object to indicate a sensitive/confidential field

• sec_key_expiry - Optional String
HMAC Secondary Key Expiry. Secondary HMAC Key Expiry time

• blindfold_secret_info - Optional String
BlindfoldSecretInfoType specifies information about the Secret managed by F5XC Secret Management

• clear_secret_info - Optional String
ClearSecretInfoType specifies information about the Secret that is not encrypted

• decryption_provider - Optional String
Name of the Secret Management Access object that contains information about the backend Secret Management service

• location - Optional String
Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location

• store_provider - Optional String
Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///

• provider_ref - Optional String
Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///

• url - Optional String
URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding

• blindfold_secret_info - Optional String
BlindfoldSecretInfoType specifies information about the Secret managed by F5XC Secret Management

• clear_secret_info - Optional String
ClearSecretInfoType specifies information about the Secret that is not encrypted

• decryption_provider - Optional String
Name of the Secret Management Access object that contains information about the backend Secret Management service

• location - Optional String
Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location

• client_secret - Optional String
SecretType is used in an object to indicate a sensitive/confidential field

• oidc_auth_params - Optional String
Configuration parameter for OIDC auth params

• oidc_client_id - Optional String
Client ID used while sending the Authorization Request to OIDC server

• oidc_well_known_config_url - Optional String
An OIDC well-known configuration URL that will be used to fetch authentication related endpoints

• blindfold_secret_info - Optional String
BlindfoldSecretInfoType specifies information about the Secret managed by F5XC Secret Management

• clear_secret_info - Optional String
ClearSecretInfoType specifies information about the Secret that is not encrypted

• decryption_provider - Optional String
Name of the Secret Management Access object that contains information about the backend Secret Management service

• location - Optional String
Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location

• auth_endpoint_url - Optional String
URL of the authorization server’s authorization endpoint

• end_session_endpoint_url - Optional String
URL of the authorization server’s Logout endpoint

• token_endpoint_url - Optional String
URL of the authorization server’s Token endpoint

Common Types

The following type definitions are used throughout this resource. See the full definition here rather than repeated inline.

Object Reference {#common-object-reference}

Object references establish a direct reference from one configuration object to another in F5 Distributed Cloud. References use the format tenant/namespace/name.

Field	Type	Description
`name`	String	Name of the referenced object
`namespace`	String	Namespace containing the referenced object
`tenant`	String	Tenant of the referenced object (system-managed)

Transformers {#common-transformers}

Transformers apply transformations to input values before matching. Multiple transformers can be applied in order.

Value	Description
`LOWER_CASE`	Convert to lowercase
`UPPER_CASE`	Convert to uppercase
`BASE64_DECODE`	Decodebase64 content
`NORMALIZE_PATH`	Normalize URL path
`REMOVE_WHITESPACE`	Remove whitespace characters
`URL_DECODE`	Decode URL-encoded characters
`TRIM_LEFT`	Trim leading whitespace
`TRIM_RIGHT`	Trim trailing whitespace
`TRIM`	Trim both leading and trailing whitespace

HTTP Methods {#common-http-methods}

HTTP methods used for request matching.

Value	Description
`ANY`	Match any HTTP method
`GET`	HTTP GET request
`HEAD`	HTTP HEAD request
`POST`	HTTP POST request
`PUT`	HTTP PUT request
`DELETE`	HTTP DELETE request
`CONNECT`	HTTP CONNECT request
`OPTIONS`	HTTP OPTIONS request
`TRACE`	HTTP TRACE request
`PATCH`	HTTP PATCH request
`COPY`	HTTP COPY request (WebDAV)

TLS Fingerprints {#common-tls-fingerprints}

TLS fingerprint categories for malicious client detection.

Value	Description
`TLS_FINGERPRINT_NONE`	No fingerprint matching
`ANY_MALICIOUS_FINGERPRINT`	Match any known malicious fingerprint
`ADWARE`	Adware-associated fingerprints
`DRIDEX`	Dridex malware fingerprints
`GOOTKIT`	Gootkit malware fingerprints
`RANSOMWARE`	Ransomware-associated fingerprints
`TRICKBOT`	Trickbot malware fingerprints

IP Threat Categories {#common-ip-threat-categories}

IP address threat categories for security filtering.

Value	Description
`SPAM_SOURCES`	Known spam sources
`WINDOWS_EXPLOITS`	Windows exploit sources
`WEB_ATTACKS`	Web attack sources
`BOTNETS`	Known botnet IPs
`SCANNERS`	Network scanner IPs
`REPUTATION`	Poor reputation IPs
`PHISHING`	Phishing-related IPs
`PROXY`	Anonymous proxy IPs
`MOBILE_THREATS`	Mobile threat sources
`TOR_PROXY`	Tor exit nodes
`DENIAL_OF_SERVICE`	DoS attack sources
`NETWORK`	Known bad network ranges