#[non_exhaustive]pub struct OidcIdentityProviderConfigRequest {
pub identity_provider_config_name: Option<String>,
pub issuer_url: Option<String>,
pub client_id: Option<String>,
pub username_claim: Option<String>,
pub username_prefix: Option<String>,
pub groups_claim: Option<String>,
pub groups_prefix: Option<String>,
pub required_claims: Option<HashMap<String, String>>,
}
Expand description
An object representing an OpenID Connect (OIDC) configuration. Before associating an OIDC identity provider to your cluster, review the considerations in Authenticating users for your cluster from an OpenID Connect identity provider in the Amazon EKS User Guide.
Fields (Non-exhaustive)
This struct is marked as non-exhaustive
Struct { .. }
syntax; cannot be matched against without a wildcard ..
; and struct update syntax will not work.identity_provider_config_name: Option<String>
The name of the OIDC provider configuration.
issuer_url: Option<String>
The URL of the OpenID identity provider that allows the API server to discover public signing keys for verifying tokens. The URL must begin with https://
and should correspond to the iss
claim in the provider's OIDC ID tokens. Per the OIDC standard, path components are allowed but query parameters are not. Typically the URL consists of only a hostname, like https://server.example.org
or https://example.com
. This URL should point to the level below .well-known/openid-configuration
and must be publicly accessible over the internet.
client_id: Option<String>
This is also known as audience. The ID for the client application that makes authentication requests to the OpenID identity provider.
username_claim: Option<String>
The JSON Web Token (JWT) claim to use as the username. The default is sub
, which is expected to be a unique identifier of the end user. You can choose other claims, such as email
or name
, depending on the OpenID identity provider. Claims other than email
are prefixed with the issuer URL to prevent naming clashes with other plug-ins.
username_prefix: Option<String>
The prefix that is prepended to username claims to prevent clashes with existing names. If you do not provide this field, and username
is a value other than email
, the prefix defaults to issuerurl#
. You can use the value -
to disable all prefixing.
groups_claim: Option<String>
The JWT claim that the provider uses to return your groups.
groups_prefix: Option<String>
The prefix that is prepended to group claims to prevent clashes with existing names (such as system:
groups). For example, the value oidc:
will create group names like oidc:engineering
and oidc:infra
.
required_claims: Option<HashMap<String, String>>
The key value pairs that describe required claims in the identity token. If set, each claim is verified to be present in the token with a matching value. For the maximum number of claims that you can require, see Amazon EKS service quotas in the Amazon EKS User Guide.
Implementations
sourceimpl OidcIdentityProviderConfigRequest
impl OidcIdentityProviderConfigRequest
sourcepub fn identity_provider_config_name(&self) -> Option<&str>
pub fn identity_provider_config_name(&self) -> Option<&str>
The name of the OIDC provider configuration.
sourcepub fn issuer_url(&self) -> Option<&str>
pub fn issuer_url(&self) -> Option<&str>
The URL of the OpenID identity provider that allows the API server to discover public signing keys for verifying tokens. The URL must begin with https://
and should correspond to the iss
claim in the provider's OIDC ID tokens. Per the OIDC standard, path components are allowed but query parameters are not. Typically the URL consists of only a hostname, like https://server.example.org
or https://example.com
. This URL should point to the level below .well-known/openid-configuration
and must be publicly accessible over the internet.
sourcepub fn client_id(&self) -> Option<&str>
pub fn client_id(&self) -> Option<&str>
This is also known as audience. The ID for the client application that makes authentication requests to the OpenID identity provider.
sourcepub fn username_claim(&self) -> Option<&str>
pub fn username_claim(&self) -> Option<&str>
The JSON Web Token (JWT) claim to use as the username. The default is sub
, which is expected to be a unique identifier of the end user. You can choose other claims, such as email
or name
, depending on the OpenID identity provider. Claims other than email
are prefixed with the issuer URL to prevent naming clashes with other plug-ins.
sourcepub fn username_prefix(&self) -> Option<&str>
pub fn username_prefix(&self) -> Option<&str>
The prefix that is prepended to username claims to prevent clashes with existing names. If you do not provide this field, and username
is a value other than email
, the prefix defaults to issuerurl#
. You can use the value -
to disable all prefixing.
sourcepub fn groups_claim(&self) -> Option<&str>
pub fn groups_claim(&self) -> Option<&str>
The JWT claim that the provider uses to return your groups.
sourcepub fn groups_prefix(&self) -> Option<&str>
pub fn groups_prefix(&self) -> Option<&str>
The prefix that is prepended to group claims to prevent clashes with existing names (such as system:
groups). For example, the value oidc:
will create group names like oidc:engineering
and oidc:infra
.
sourcepub fn required_claims(&self) -> Option<&HashMap<String, String>>
pub fn required_claims(&self) -> Option<&HashMap<String, String>>
The key value pairs that describe required claims in the identity token. If set, each claim is verified to be present in the token with a matching value. For the maximum number of claims that you can require, see Amazon EKS service quotas in the Amazon EKS User Guide.
sourceimpl OidcIdentityProviderConfigRequest
impl OidcIdentityProviderConfigRequest
sourcepub fn builder() -> Builder
pub fn builder() -> Builder
Creates a new builder-style object to manufacture OidcIdentityProviderConfigRequest
Trait Implementations
sourceimpl Clone for OidcIdentityProviderConfigRequest
impl Clone for OidcIdentityProviderConfigRequest
sourcefn clone(&self) -> OidcIdentityProviderConfigRequest
fn clone(&self) -> OidcIdentityProviderConfigRequest
Returns a copy of the value. Read more
1.0.0 · sourcefn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
Performs copy-assignment from source
. Read more
sourceimpl PartialEq<OidcIdentityProviderConfigRequest> for OidcIdentityProviderConfigRequest
impl PartialEq<OidcIdentityProviderConfigRequest> for OidcIdentityProviderConfigRequest
sourcefn eq(&self, other: &OidcIdentityProviderConfigRequest) -> bool
fn eq(&self, other: &OidcIdentityProviderConfigRequest) -> bool
This method tests for self
and other
values to be equal, and is used
by ==
. Read more
sourcefn ne(&self, other: &OidcIdentityProviderConfigRequest) -> bool
fn ne(&self, other: &OidcIdentityProviderConfigRequest) -> bool
This method tests for !=
.
impl StructuralPartialEq for OidcIdentityProviderConfigRequest
Auto Trait Implementations
impl RefUnwindSafe for OidcIdentityProviderConfigRequest
impl Send for OidcIdentityProviderConfigRequest
impl Sync for OidcIdentityProviderConfigRequest
impl Unpin for OidcIdentityProviderConfigRequest
impl UnwindSafe for OidcIdentityProviderConfigRequest
Blanket Implementations
sourceimpl<T> BorrowMut<T> for T where
T: ?Sized,
impl<T> BorrowMut<T> for T where
T: ?Sized,
const: unstable · sourcefn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Mutably borrows from an owned value. Read more
sourceimpl<T> Instrument for T
impl<T> Instrument for T
sourcefn instrument(self, span: Span) -> Instrumented<Self>
fn instrument(self, span: Span) -> Instrumented<Self>
sourcefn in_current_span(self) -> Instrumented<Self>
fn in_current_span(self) -> Instrumented<Self>
sourceimpl<T> WithSubscriber for T
impl<T> WithSubscriber for T
sourcefn with_subscriber<S>(self, subscriber: S) -> WithDispatch<Self> where
S: Into<Dispatch>,
fn with_subscriber<S>(self, subscriber: S) -> WithDispatch<Self> where
S: Into<Dispatch>,
Attaches the provided Subscriber
to this type, returning a
WithDispatch
wrapper. Read more
sourcefn with_current_subscriber(self) -> WithDispatch<Self>
fn with_current_subscriber(self) -> WithDispatch<Self>
Attaches the current default Subscriber
to this type, returning a
WithDispatch
wrapper. Read more