diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index a7545595d..e455487ea 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -14,7 +14,7 @@ jobs:
uses: actions/checkout@v3
- name: Set up Go
- uses: actions/setup-go@v3
+ uses: actions/setup-go@v4
with:
go-version-file: go.mod
check-latest: true
@@ -36,7 +36,7 @@ jobs:
uses: actions/checkout@v3
- name: Set up Go
- uses: actions/setup-go@v3
+ uses: actions/setup-go@v4
with:
go-version-file: go.mod
check-latest: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3ecac3f88..6366ac2ad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,10 +14,11 @@ jobs:
run: git fetch --prune --unshallow
- name: Set up Go
- uses: actions/setup-go@v3
+ uses: actions/setup-go@v4
with:
go-version-file: go.mod
check-latest: true
+ cache: false
- name: Import GPG key
id: import_gpg
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 724fabfd2..2fd5fbba5 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -29,3 +29,7 @@ jobs:
steps:
- name: Scan for vulnerabilities in go code
uses: golang/govulncheck-action@v0.2.0
+ with:
+ go-version-input: 1.20.6
+ check-latest: true
+ cache: false
diff --git a/.github/workflows/sweep.yml b/.github/workflows/sweep.yml
index 4d350e059..f2b436dc8 100644
--- a/.github/workflows/sweep.yml
+++ b/.github/workflows/sweep.yml
@@ -15,7 +15,7 @@ jobs:
uses: actions/checkout@v3
- name: Set up Go
- uses: actions/setup-go@v3
+ uses: actions/setup-go@v4
with:
go-version-file: go.mod
check-latest: true
diff --git a/MIGRATION_GUIDE.md b/MIGRATION_GUIDE.md
index d5fca285a..4abbb5342 100644
--- a/MIGRATION_GUIDE.md
+++ b/MIGRATION_GUIDE.md
@@ -15,10 +15,10 @@ automated workflows before upgrading.
The `auth0_global_client` resource and data source were introduced primarily to allow managing the `custom_login_page`
and `custom_login_page_on` attributes in order to manage the custom login page of a tenant. These are now deprecated in
-favor of the `auth0_pages` resource.
+favor of the `auth0_pages` resource and data source.
-To ensure a smooth transition when we eventually remove the capability to manage the custom
-login page through the `auth0_global_client`, we recommend proactively migrating to the `auth0_pages` resource.
+To ensure a smooth transition when we eventually remove the capability to manage the custom
+login page through the `auth0_global_client`, we recommend proactively migrating to the `auth0_pages` resource and data source.
This will help you stay prepared for future changes.
@@ -55,7 +55,7 @@ resource "auth0_pages" "my_pages" {
#### Tenant Pages
The `change_password`, `guardian_mfa_page` and `error_page` attributes on the `auth0_tenant` have been deprecated in
-favor of managing them with the `auth0_pages` resource.
+favor of managing them with the `auth0_pages` resource.
To ensure a smooth transition when we eventually remove the capability to manage these custom Auth0 pages through the
`auth0_tenant` resource, we recommend proactively migrating to the `auth0_pages` resource. This will help you stay
@@ -151,7 +151,7 @@ resource "auth0_branding" "my_branding" {
colors {
primary = "#0059d6"
page_background = "#000000"
- }
+ }
}
```
diff --git a/docs/data-sources/client.md b/docs/data-sources/client.md
index c1bc5ce90..4df512c05 100644
--- a/docs/data-sources/client.md
+++ b/docs/data-sources/client.md
@@ -40,7 +40,7 @@ data "auth0_client" "some-client-by-id" {
- `callbacks` (List of String) URLs that Auth0 may call back to after a user authenticates for the client. Make sure to specify the protocol (https://) otherwise the callback may fail in some cases. With the exception of custom URI schemes for native clients, all callbacks should use protocol https://.
- `client_aliases` (List of String) List of audiences/realms for SAML protocol. Used by the wsfed addon.
- `client_metadata` (Map of String) Metadata associated with the client, in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. Field names (max 255 chars) are alphanumeric and may only include the following special characters: `:,-+=_*?"/\()<>@ [Tab] [Space]`.
-- `client_secret` (String) Secret for the client. Keep this private. To access this attribute you need to add the `read:client_keys` scope to the Terraform client. Otherwise, the attribute will contain an empty string.
+- `client_secret` (String, Sensitive) Secret for the client. Keep this private. To access this attribute you need to add the `read:client_keys` scope to the Terraform client. Otherwise, the attribute will contain an empty string.
- `cross_origin_auth` (Boolean) Whether this client can be used to make cross-origin authentication requests (`true`) or it is not allowed to make such requests (`false`). Requires the `coa_toggle_enabled` feature flag to be enabled on the tenant by the support team.
- `cross_origin_loc` (String) URL of the location in your site where the cross-origin verification takes place for the cross-origin auth flow when performing authentication in your own domain instead of Auth0 Universal Login page.
- `custom_login_page` (String) The content (HTML, CSS, JS) of the custom login page.
@@ -65,7 +65,7 @@ data "auth0_client" "some-client-by-id" {
- `signing_keys` (List of Map of String) List containing a map of the public cert of the signing key and the public cert of the signing key in PKCS7.
- `sso` (Boolean) Applies only to SSO clients and determines whether Auth0 will handle Single Sign-On (true) or whether the identity provider will (false).
- `sso_disabled` (Boolean) Indicates whether or not SSO is disabled.
-- `token_endpoint_auth_method` (String) Defines the requested authentication method for the token endpoint. Options include `none` (public client without a client secret), `client_secret_post` (client uses HTTP POST parameters), `client_secret_basic` (client uses HTTP Basic). Managing the authentication method through this attribute is deprecated and it will be removed in a future major version. Migrate to the `auth0_client_credentials` resource to manage a client's authentication method instead. Check the [MIGRATION GUIDE](https://github.com/auth0/terraform-provider-auth0/blob/main/MIGRATION_GUIDE.md#client-authentication-method) on how to do that.
+- `token_endpoint_auth_method` (String) The authentication method for the token endpoint. Results include `none` (public client without a client secret), `client_secret_post` (client uses HTTP POST parameters), `client_secret_basic` (client uses HTTP Basic). Managing a client's authentication method can be done via the `auth0_client_credentials` resource.
- `web_origins` (List of String) URLs that represent valid web origins for use with web message response mode.
@@ -73,34 +73,208 @@ data "auth0_client" "some-client-by-id" {
Read-Only:
-- `aws` (Map of String)
-- `azure_blob` (Map of String)
-- `azure_sb` (Map of String)
-- `box` (Map of String)
-- `cloudbees` (Map of String)
-- `concur` (Map of String)
-- `dropbox` (Map of String)
-- `echosign` (Map of String)
-- `egnyte` (Map of String)
-- `firebase` (Map of String)
-- `layer` (Map of String)
-- `mscrm` (Map of String)
-- `newrelic` (Map of String)
-- `office365` (Map of String)
-- `rms` (Map of String)
-- `salesforce` (Map of String)
-- `salesforce_api` (Map of String)
-- `salesforce_sandbox_api` (Map of String)
+- `aws` (List of Object) (see [below for nested schema](#nestedobjatt--addons--aws))
+- `azure_blob` (List of Object) (see [below for nested schema](#nestedobjatt--addons--azure_blob))
+- `azure_sb` (List of Object) (see [below for nested schema](#nestedobjatt--addons--azure_sb))
+- `box` (List of Object) (see [below for nested schema](#nestedobjatt--addons--box))
+- `cloudbees` (List of Object) (see [below for nested schema](#nestedobjatt--addons--cloudbees))
+- `concur` (List of Object) (see [below for nested schema](#nestedobjatt--addons--concur))
+- `dropbox` (List of Object) (see [below for nested schema](#nestedobjatt--addons--dropbox))
+- `echosign` (List of Object) (see [below for nested schema](#nestedobjatt--addons--echosign))
+- `egnyte` (List of Object) (see [below for nested schema](#nestedobjatt--addons--egnyte))
+- `firebase` (List of Object) (see [below for nested schema](#nestedobjatt--addons--firebase))
+- `layer` (List of Object) (see [below for nested schema](#nestedobjatt--addons--layer))
+- `mscrm` (List of Object) (see [below for nested schema](#nestedobjatt--addons--mscrm))
+- `newrelic` (List of Object) (see [below for nested schema](#nestedobjatt--addons--newrelic))
+- `office365` (List of Object) (see [below for nested schema](#nestedobjatt--addons--office365))
+- `rms` (List of Object) (see [below for nested schema](#nestedobjatt--addons--rms))
+- `salesforce` (List of Object) (see [below for nested schema](#nestedobjatt--addons--salesforce))
+- `salesforce_api` (List of Object) (see [below for nested schema](#nestedobjatt--addons--salesforce_api))
+- `salesforce_sandbox_api` (List of Object) (see [below for nested schema](#nestedobjatt--addons--salesforce_sandbox_api))
- `samlp` (List of Object) (see [below for nested schema](#nestedobjatt--addons--samlp))
-- `sap_api` (Map of String)
-- `sentry` (Map of String)
-- `sharepoint` (Map of String)
-- `slack` (Map of String)
-- `springcm` (Map of String)
-- `wams` (Map of String)
-- `wsfed` (Map of String)
-- `zendesk` (Map of String)
-- `zoom` (Map of String)
+- `sap_api` (List of Object) (see [below for nested schema](#nestedobjatt--addons--sap_api))
+- `sentry` (List of Object) (see [below for nested schema](#nestedobjatt--addons--sentry))
+- `sharepoint` (List of Object) (see [below for nested schema](#nestedobjatt--addons--sharepoint))
+- `slack` (List of Object) (see [below for nested schema](#nestedobjatt--addons--slack))
+- `springcm` (List of Object) (see [below for nested schema](#nestedobjatt--addons--springcm))
+- `sso_integration` (List of Object) (see [below for nested schema](#nestedobjatt--addons--sso_integration))
+- `wams` (List of Object) (see [below for nested schema](#nestedobjatt--addons--wams))
+- `wsfed` (List of Object) (see [below for nested schema](#nestedobjatt--addons--wsfed))
+- `zendesk` (List of Object) (see [below for nested schema](#nestedobjatt--addons--zendesk))
+- `zoom` (List of Object) (see [below for nested schema](#nestedobjatt--addons--zoom))
+
+
+### Nested Schema for `addons.aws`
+
+Read-Only:
+
+- `lifetime_in_seconds` (Number)
+- `principal` (String)
+- `role` (String)
+
+
+
+### Nested Schema for `addons.azure_blob`
+
+Read-Only:
+
+- `account_name` (String)
+- `blob_delete` (Boolean)
+- `blob_name` (String)
+- `blob_read` (Boolean)
+- `blob_write` (Boolean)
+- `container_delete` (Boolean)
+- `container_list` (Boolean)
+- `container_name` (String)
+- `container_read` (Boolean)
+- `container_write` (Boolean)
+- `expiration` (Number)
+- `signed_identifier` (String)
+- `storage_access_key` (String)
+
+
+
+### Nested Schema for `addons.azure_sb`
+
+Read-Only:
+
+- `entity_path` (String)
+- `expiration` (Number)
+- `namespace` (String)
+- `sas_key` (String)
+- `sas_key_name` (String)
+
+
+
+### Nested Schema for `addons.box`
+
+Read-Only:
+
+
+
+
+### Nested Schema for `addons.cloudbees`
+
+Read-Only:
+
+
+
+
+### Nested Schema for `addons.concur`
+
+Read-Only:
+
+
+
+
+### Nested Schema for `addons.dropbox`
+
+Read-Only:
+
+
+
+
+### Nested Schema for `addons.echosign`
+
+Read-Only:
+
+- `domain` (String)
+
+
+
+### Nested Schema for `addons.egnyte`
+
+Read-Only:
+
+- `domain` (String)
+
+
+
+### Nested Schema for `addons.firebase`
+
+Read-Only:
+
+- `client_email` (String)
+- `lifetime_in_seconds` (Number)
+- `private_key` (String)
+- `private_key_id` (String)
+- `secret` (String)
+
+
+
+### Nested Schema for `addons.layer`
+
+Read-Only:
+
+- `expiration` (Number)
+- `key_id` (String)
+- `principal` (String)
+- `private_key` (String)
+- `provider_id` (String)
+
+
+
+### Nested Schema for `addons.mscrm`
+
+Read-Only:
+
+- `url` (String)
+
+
+
+### Nested Schema for `addons.newrelic`
+
+Read-Only:
+
+- `account` (String)
+
+
+
+### Nested Schema for `addons.office365`
+
+Read-Only:
+
+- `connection` (String)
+- `domain` (String)
+
+
+
+### Nested Schema for `addons.rms`
+
+Read-Only:
+
+- `url` (String)
+
+
+
+### Nested Schema for `addons.salesforce`
+
+Read-Only:
+
+- `entity_id` (String)
+
+
+
+### Nested Schema for `addons.salesforce_api`
+
+Read-Only:
+
+- `client_id` (String)
+- `community_name` (String)
+- `community_url_section` (String)
+- `principal` (String)
+
+
+
+### Nested Schema for `addons.salesforce_sandbox_api`
+
+Read-Only:
+
+- `client_id` (String)
+- `community_name` (String)
+- `community_url_section` (String)
+- `principal` (String)
+
### Nested Schema for `addons.samlp`
@@ -116,7 +290,7 @@ Read-Only:
- `include_attribute_name_format` (Boolean)
- `issuer` (String)
- `lifetime_in_seconds` (Number)
-- `logout` (Map of String)
+- `logout` (List of Object) (see [below for nested schema](#nestedobjatt--addons--samlp--logout))
- `map_identities` (Boolean)
- `map_unknown_claims_as_is` (Boolean)
- `mappings` (Map of String)
@@ -129,6 +303,102 @@ Read-Only:
- `signing_cert` (String)
- `typed_attributes` (Boolean)
+
+### Nested Schema for `addons.samlp.logout`
+
+Read-Only:
+
+- `callback` (String)
+- `slo_enabled` (Boolean)
+
+
+
+
+### Nested Schema for `addons.sap_api`
+
+Read-Only:
+
+- `client_id` (String)
+- `name_identifier_format` (String)
+- `scope` (String)
+- `service_password` (String)
+- `token_endpoint_url` (String)
+- `username_attribute` (String)
+
+
+
+### Nested Schema for `addons.sentry`
+
+Read-Only:
+
+- `base_url` (String)
+- `org_slug` (String)
+
+
+
+### Nested Schema for `addons.sharepoint`
+
+Read-Only:
+
+- `external_url` (List of String)
+- `url` (String)
+
+
+
+### Nested Schema for `addons.slack`
+
+Read-Only:
+
+- `team` (String)
+
+
+
+### Nested Schema for `addons.springcm`
+
+Read-Only:
+
+- `acs_url` (String)
+
+
+
+### Nested Schema for `addons.sso_integration`
+
+Read-Only:
+
+- `name` (String)
+- `version` (String)
+
+
+
+### Nested Schema for `addons.wams`
+
+Read-Only:
+
+- `master_key` (String)
+
+
+
+### Nested Schema for `addons.wsfed`
+
+Read-Only:
+
+
+
+
+### Nested Schema for `addons.zendesk`
+
+Read-Only:
+
+- `account_name` (String)
+
+
+
+### Nested Schema for `addons.zoom`
+
+Read-Only:
+
+- `account` (String)
+
diff --git a/docs/data-sources/global_client.md b/docs/data-sources/global_client.md
deleted file mode 100644
index 39eaaee5c..000000000
--- a/docs/data-sources/global_client.md
+++ /dev/null
@@ -1,202 +0,0 @@
----
-page_title: "Data Source: auth0_global_client"
-description: |-
- Retrieve a tenant's global Auth0 application client.
- !> This resource has been deprecated in favor of the auth0_pages resource and it will be removed in a future version.Check the MIGRATION_GUIDE https://github.com/auth0/terraform-provider-auth0/blob/main/MIGRATION_GUIDE.md#global-client for more info.
----
-
-# Data Source: auth0_global_client
-
-Retrieve a tenant's global Auth0 application client.
-
-!> This resource has been deprecated in favor of the `auth0_pages` resource and it will be removed in a future version.Check the [MIGRATION_GUIDE](https://github.com/auth0/terraform-provider-auth0/blob/main/MIGRATION_GUIDE.md#global-client) for more info.
-
-## Example Usage
-
-```terraform
-data "auth0_global_client" "global" {}
-```
-
-
-## Schema
-
-### Read-Only
-
-- `addons` (List of Object) Addons enabled for this client and their associated configurations. (see [below for nested schema](#nestedatt--addons))
-- `allowed_clients` (List of String) List of applications ID's that will be allowed to make delegation request. By default, all applications will be allowed.
-- `allowed_logout_urls` (List of String) URLs that Auth0 may redirect to after logout.
-- `allowed_origins` (List of String) URLs that represent valid origins for cross-origin resource sharing. By default, all your callback URLs will be allowed.
-- `app_type` (String) Type of application the client represents. Possible values are: `native`, `spa`, `regular_web`, `non_interactive`, `sso_integration`. Specific SSO integrations types accepted as well are: `rms`, `box`, `cloudbees`, `concur`, `dropbox`, `mscrm`, `echosign`, `egnyte`, `newrelic`, `office365`, `salesforce`, `sentry`, `sharepoint`, `slack`, `springcm`, `zendesk`, `zoom`.
-- `callbacks` (List of String) URLs that Auth0 may call back to after a user authenticates for the client. Make sure to specify the protocol (https://) otherwise the callback may fail in some cases. With the exception of custom URI schemes for native clients, all callbacks should use protocol https://.
-- `client_aliases` (List of String) List of audiences/realms for SAML protocol. Used by the wsfed addon.
-- `client_id` (String) The ID of the client.
-- `client_metadata` (Map of String) Metadata associated with the client, in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. Field names (max 255 chars) are alphanumeric and may only include the following special characters: `:,-+=_*?"/\()<>@ [Tab] [Space]`.
-- `client_secret` (String) Secret for the client. Keep this private. To access this attribute you need to add the `read:client_keys` scope to the Terraform client. Otherwise, the attribute will contain an empty string. Use this attribute on the `auth0_client_credentials` resource instead, to allow managing it directly or use the `auth0_client` data source to read this property.
-- `cross_origin_auth` (Boolean) Whether this client can be used to make cross-origin authentication requests (`true`) or it is not allowed to make such requests (`false`). Requires the `coa_toggle_enabled` feature flag to be enabled on the tenant by the support team.
-- `cross_origin_loc` (String) URL of the location in your site where the cross-origin verification takes place for the cross-origin auth flow when performing authentication in your own domain instead of Auth0 Universal Login page.
-- `custom_login_page` (String) The content (HTML, CSS, JS) of the custom login page.
-- `custom_login_page_on` (Boolean) Indicates whether a custom login page is to be used.
-- `description` (String) Description of the purpose of the client.
-- `encryption_key` (Map of String) Encryption used for WS-Fed responses with this client.
-- `form_template` (String) HTML form template to be used for WS-Federation.
-- `grant_types` (List of String) Types of grants that this client is authorized to use.
-- `id` (String) The ID of this resource.
-- `initiate_login_uri` (String) Initiate login URI. Must be HTTPS or an empty string.
-- `is_first_party` (Boolean) Indicates whether this client is a first-party client.
-- `is_token_endpoint_ip_header_trusted` (Boolean) Indicates whether the token endpoint IP header is trusted. This attribute can only be updated after the client gets created.
-- `jwt_configuration` (List of Object) Configuration settings for the JWTs issued for this client. (see [below for nested schema](#nestedatt--jwt_configuration))
-- `logo_uri` (String) URL of the logo for the client. Recommended size is 150px x 150px. If none is set, the default badge for the application type will be shown.
-- `mobile` (List of Object) Additional configuration for native mobile apps. (see [below for nested schema](#nestedatt--mobile))
-- `name` (String) Name of the client.
-- `native_social_login` (List of Object) Configuration settings to toggle native social login for mobile native applications. Once this is set it must stay set, with both resources set to `false` in order to change the `app_type`. (see [below for nested schema](#nestedatt--native_social_login))
-- `oidc_backchannel_logout_urls` (Set of String) Set of URLs that are valid to call back from Auth0 for OIDC backchannel logout. Currently only one URL is allowed.
-- `oidc_conformant` (Boolean) Indicates whether this client will conform to strict OIDC specifications.
-- `organization_require_behavior` (String) Defines how to proceed during an authentication transaction when `organization_usage = "require"`. Can be `no_prompt` (default), `pre_login_prompt` or `post_login_prompt`.
-- `organization_usage` (String) Defines how to proceed during an authentication transaction with regards to an organization. Can be `deny` (default), `allow` or `require`.
-- `refresh_token` (List of Object) Configuration settings for the refresh tokens issued for this client. (see [below for nested schema](#nestedatt--refresh_token))
-- `signing_keys` (List of Map of String) List containing a map of the public cert of the signing key and the public cert of the signing key in PKCS7.
-- `sso` (Boolean) Applies only to SSO clients and determines whether Auth0 will handle Single Sign-On (true) or whether the identity provider will (false).
-- `sso_disabled` (Boolean) Indicates whether or not SSO is disabled.
-- `token_endpoint_auth_method` (String) Defines the requested authentication method for the token endpoint. Options include `none` (public client without a client secret), `client_secret_post` (client uses HTTP POST parameters), `client_secret_basic` (client uses HTTP Basic). Managing the authentication method through this attribute is deprecated and it will be removed in a future major version. Migrate to the `auth0_client_credentials` resource to manage a client's authentication method instead. Check the [MIGRATION GUIDE](https://github.com/auth0/terraform-provider-auth0/blob/main/MIGRATION_GUIDE.md#client-authentication-method) on how to do that.
-- `web_origins` (List of String) URLs that represent valid web origins for use with web message response mode.
-
-
-### Nested Schema for `addons`
-
-Read-Only:
-
-- `aws` (Map of String)
-- `azure_blob` (Map of String)
-- `azure_sb` (Map of String)
-- `box` (Map of String)
-- `cloudbees` (Map of String)
-- `concur` (Map of String)
-- `dropbox` (Map of String)
-- `echosign` (Map of String)
-- `egnyte` (Map of String)
-- `firebase` (Map of String)
-- `layer` (Map of String)
-- `mscrm` (Map of String)
-- `newrelic` (Map of String)
-- `office365` (Map of String)
-- `rms` (Map of String)
-- `salesforce` (Map of String)
-- `salesforce_api` (Map of String)
-- `salesforce_sandbox_api` (Map of String)
-- `samlp` (List of Object) (see [below for nested schema](#nestedobjatt--addons--samlp))
-- `sap_api` (Map of String)
-- `sentry` (Map of String)
-- `sharepoint` (Map of String)
-- `slack` (Map of String)
-- `springcm` (Map of String)
-- `wams` (Map of String)
-- `wsfed` (Map of String)
-- `zendesk` (Map of String)
-- `zoom` (Map of String)
-
-
-### Nested Schema for `addons.samlp`
-
-Read-Only:
-
-- `audience` (String)
-- `authn_context_class_ref` (String)
-- `binding` (String)
-- `create_upn_claim` (Boolean)
-- `destination` (String)
-- `digest_algorithm` (String)
-- `include_attribute_name_format` (Boolean)
-- `issuer` (String)
-- `lifetime_in_seconds` (Number)
-- `logout` (Map of String)
-- `map_identities` (Boolean)
-- `map_unknown_claims_as_is` (Boolean)
-- `mappings` (Map of String)
-- `name_identifier_format` (String)
-- `name_identifier_probes` (List of String)
-- `passthrough_claims_with_no_mapping` (Boolean)
-- `recipient` (String)
-- `sign_response` (Boolean)
-- `signature_algorithm` (String)
-- `signing_cert` (String)
-- `typed_attributes` (Boolean)
-
-
-
-
-### Nested Schema for `jwt_configuration`
-
-Read-Only:
-
-- `alg` (String)
-- `lifetime_in_seconds` (Number)
-- `scopes` (Map of String)
-- `secret_encoded` (Boolean)
-
-
-
-### Nested Schema for `mobile`
-
-Read-Only:
-
-- `android` (List of Object) (see [below for nested schema](#nestedobjatt--mobile--android))
-- `ios` (List of Object) (see [below for nested schema](#nestedobjatt--mobile--ios))
-
-
-### Nested Schema for `mobile.android`
-
-Read-Only:
-
-- `app_package_name` (String)
-- `sha256_cert_fingerprints` (List of String)
-
-
-
-### Nested Schema for `mobile.ios`
-
-Read-Only:
-
-- `app_bundle_identifier` (String)
-- `team_id` (String)
-
-
-
-
-### Nested Schema for `native_social_login`
-
-Read-Only:
-
-- `apple` (List of Object) (see [below for nested schema](#nestedobjatt--native_social_login--apple))
-- `facebook` (List of Object) (see [below for nested schema](#nestedobjatt--native_social_login--facebook))
-
-
-### Nested Schema for `native_social_login.apple`
-
-Read-Only:
-
-- `enabled` (Boolean)
-
-
-
-### Nested Schema for `native_social_login.facebook`
-
-Read-Only:
-
-- `enabled` (Boolean)
-
-
-
-
-### Nested Schema for `refresh_token`
-
-Read-Only:
-
-- `expiration_type` (String)
-- `idle_token_lifetime` (Number)
-- `infinite_idle_token_lifetime` (Boolean)
-- `infinite_token_lifetime` (Boolean)
-- `leeway` (Number)
-- `rotation_type` (String)
-- `token_lifetime` (Number)
-
-
diff --git a/docs/data-sources/pages.md b/docs/data-sources/pages.md
new file mode 100644
index 000000000..2afba97e9
--- /dev/null
+++ b/docs/data-sources/pages.md
@@ -0,0 +1,64 @@
+---
+page_title: "Data Source: auth0_pages"
+description: |-
+ Use this data source to access the HTML for the login, reset password, multi-factor authentication and error pages.
+---
+
+# Data Source: auth0_pages
+
+Use this data source to access the HTML for the login, reset password, multi-factor authentication and error pages.
+
+## Example Usage
+
+```terraform
+data "auth0_pages" "my_pages" {}
+```
+
+
+## Schema
+
+### Read-Only
+
+- `change_password` (List of Object) Configuration settings for customizing the Password Reset page. (see [below for nested schema](#nestedatt--change_password))
+- `error` (List of Object) Configuration settings for the Error pages. (see [below for nested schema](#nestedatt--error))
+- `guardian_mfa` (List of Object) Configuration settings for customizing the Guardian Multi-Factor Authentication page. (see [below for nested schema](#nestedatt--guardian_mfa))
+- `id` (String) The ID of this resource.
+- `login` (List of Object) Configuration settings for customizing the Login page. (see [below for nested schema](#nestedatt--login))
+
+
+### Nested Schema for `change_password`
+
+Read-Only:
+
+- `enabled` (Boolean)
+- `html` (String)
+
+
+
+### Nested Schema for `error`
+
+Read-Only:
+
+- `html` (String)
+- `show_log_link` (Boolean)
+- `url` (String)
+
+
+
+### Nested Schema for `guardian_mfa`
+
+Read-Only:
+
+- `enabled` (Boolean)
+- `html` (String)
+
+
+
+### Nested Schema for `login`
+
+Read-Only:
+
+- `enabled` (Boolean)
+- `html` (String)
+
+
diff --git a/docs/data-sources/resource_server.md b/docs/data-sources/resource_server.md
index f413275b5..0d54dc868 100644
--- a/docs/data-sources/resource_server.md
+++ b/docs/data-sources/resource_server.md
@@ -27,7 +27,7 @@ data "auth0_resource_server" "some-resource-server-by-id" {
### Optional
-- `identifier` (String) The unique identifier for the resource server. If not provided, `resource_server_id` must be set.
+- `identifier` (String) Unique identifier for the resource server. Used as the audience parameter for authorization calls. If not provided, `resource_server_id` must be set.
- `resource_server_id` (String) The ID of the resource server. If not provided, `identifier` must be set.
### Read-Only
@@ -51,6 +51,6 @@ data "auth0_resource_server" "some-resource-server-by-id" {
Read-Only:
- `description` (String)
-- `value` (String)
+- `name` (String)
diff --git a/docs/data-sources/role.md b/docs/data-sources/role.md
index 70dc3b384..15aa03d8f 100644
--- a/docs/data-sources/role.md
+++ b/docs/data-sources/role.md
@@ -32,9 +32,9 @@ data "auth0_role" "some-role-by-id" {
### Read-Only
-- `description` (String) Description of the role.
+- `description` (String) The description of the role.
- `id` (String) The ID of this resource.
-- `permissions` (Set of Object) Configuration settings for permissions (scopes) attached to the role. Managing permissions through the `permissions` attribute is deprecated and it will be removed in a future major version. Migrate to the `auth0_role_permission` or `auth0_role_permissions` resource to manage role permissions instead. Check the [MIGRATION GUIDE](https://github.com/auth0/terraform-provider-auth0/blob/main/MIGRATION_GUIDE.md#role-permissions) for more info. (see [below for nested schema](#nestedatt--permissions))
+- `permissions` (Set of Object) Configuration settings for permissions (scopes) attached to the role. (see [below for nested schema](#nestedatt--permissions))
### Nested Schema for `permissions`
diff --git a/docs/data-sources/tenant.md b/docs/data-sources/tenant.md
index 8a684e4e1..1bcb8f6b6 100644
--- a/docs/data-sources/tenant.md
+++ b/docs/data-sources/tenant.md
@@ -20,16 +20,13 @@ data "auth0_tenant" "my_tenant" {}
### Read-Only
- `allowed_logout_urls` (List of String) URLs that Auth0 may redirect to after logout.
-- `change_password` (List of Object) Configuration settings for change password page. This attribute is deprecated in favor of the `auth0_pages` resource and it will be removed in a future major version. Check the [MIGRATION_GUIDE](https://github.com/auth0/terraform-provider-auth0/blob/main/MIGRATION_GUIDE.md#tenant-pages) for more info. (see [below for nested schema](#nestedatt--change_password))
- `default_audience` (String) API Audience to use by default for API Authorization flows. This setting is equivalent to appending the audience to every authorization request made to the tenant for every application.
- `default_directory` (String) Name of the connection to be used for Password Grant exchanges. Options include `auth0-adldap`, `ad`, `auth0`, `email`, `sms`, `waad`, and `adfs`.
- `default_redirection_uri` (String) The default absolute redirection URI. Must be HTTPS or an empty string.
- `domain` (String) Your Auth0 domain name.
- `enabled_locales` (List of String) Supported locales for the user interface. The first locale in the list will be used to set the default locale.
-- `error_page` (List of Object) Configuration settings for error pages. This attribute is deprecated in favor of the `auth0_pages` resource and it will be removed in a future major version. Check the [MIGRATION_GUIDE](https://github.com/auth0/terraform-provider-auth0/blob/main/MIGRATION_GUIDE.md#tenant-pages) for more info. (see [below for nested schema](#nestedatt--error_page))
- `flags` (List of Object) Configuration settings for tenant flags. (see [below for nested schema](#nestedatt--flags))
- `friendly_name` (String) Friendly name for the tenant.
-- `guardian_mfa_page` (List of Object) Configuration settings for the Guardian MFA page. This attribute is deprecated in favor of the `auth0_pages` resource and it will be removed in a future major version. Check the [MIGRATION_GUIDE](https://github.com/auth0/terraform-provider-auth0/blob/main/MIGRATION_GUIDE.md#tenant-pages) for more info. (see [below for nested schema](#nestedatt--guardian_mfa_page))
- `id` (String) The ID of this resource.
- `idle_session_lifetime` (Number) Number of hours during which a session can be inactive before the user must log in again.
- `management_api_identifier` (String) The identifier value of the built-in Management API resource server, which can be used as an audience when configuring client grants.
@@ -39,26 +36,6 @@ data "auth0_tenant" "my_tenant" {}
- `session_lifetime` (Number) Number of hours during which a session will stay valid.
- `support_email` (String) Support email address for authenticating users.
- `support_url` (String) Support URL for authenticating users.
-- `universal_login` (List of Object) Configuration settings for Universal Login. These configuration settings have been deprecated. Migrate to managing these settings through the `auth0_branding` resource. Check the [MIGRATION_GUIDE](https://github.com/auth0/terraform-provider-auth0/blob/main/MIGRATION_GUIDE.md#tenant-universal-login) for more info. (see [below for nested schema](#nestedatt--universal_login))
-
-
-### Nested Schema for `change_password`
-
-Read-Only:
-
-- `enabled` (Boolean)
-- `html` (String)
-
-
-
-### Nested Schema for `error_page`
-
-Read-Only:
-
-- `html` (String)
-- `show_log_link` (Boolean)
-- `url` (String)
-
### Nested Schema for `flags`
@@ -86,19 +63,9 @@ Read-Only:
- `mfa_show_factor_list_on_enrollment` (Boolean)
- `no_disclose_enterprise_connections` (Boolean)
- `revoke_refresh_token_grant` (Boolean)
-- `universal_login` (Boolean)
- `use_scope_descriptions_for_consent` (Boolean)
-
-### Nested Schema for `guardian_mfa_page`
-
-Read-Only:
-
-- `enabled` (Boolean)
-- `html` (String)
-
-
### Nested Schema for `session_cookie`
@@ -107,19 +74,3 @@ Read-Only:
- `mode` (String)
-
-### Nested Schema for `universal_login`
-
-Read-Only:
-
-- `colors` (List of Object) (see [below for nested schema](#nestedobjatt--universal_login--colors))
-
-
-### Nested Schema for `universal_login.colors`
-
-Read-Only:
-
-- `page_background` (String)
-- `primary` (String)
-
-
diff --git a/docs/resources/action.md b/docs/resources/action.md
index f19d9f910..4627a9f5b 100644
--- a/docs/resources/action.md
+++ b/docs/resources/action.md
@@ -67,7 +67,7 @@ resource "auth0_action" "my_action" {
- `dependencies` (Block Set) List of third party npm modules, and their versions, that this action depends on. (see [below for nested schema](#nestedblock--dependencies))
- `deploy` (Boolean) Deploying an action will create a new immutable version of the action. If the action is currently bound to a trigger, then the system will begin executing the newly deployed version of the action immediately.
-- `runtime` (String) The Node runtime. Defaults to `node12`. Possible values are: `node12`, `node16` or `node18`.
+- `runtime` (String) The Node runtime. Defaults to `node12`. Possible values are: `node12`, `node16` or `node18-actions`.
- `secrets` (Block List) List of secrets that are included in an action or a version of an action. (see [below for nested schema](#nestedblock--secrets))
### Read-Only
@@ -106,10 +106,10 @@ Required:
Import is supported using the following syntax:
```shell
-# An action can be imported using the action's ID.
+# This resource can be imported by specifying the action ID.
#
# Example:
-terraform import auth0_action.my_action 12f4f21b-017a-319d-92e7-2291c1ca36c4
+terraform import auth0_action.my_action "12f4f21b-017a-319d-92e7-2291c1ca36c4"
```
~> For security reasons importing `secrets` is not allowed. Therefore, it is advised to import
diff --git a/docs/resources/attack_protection.md b/docs/resources/attack_protection.md
index 28d13b9ad..918fa91bd 100644
--- a/docs/resources/attack_protection.md
+++ b/docs/resources/attack_protection.md
@@ -65,53 +65,62 @@ resource "auth0_attack_protection" "my_protection" {
### Nested Schema for `breached_password_detection`
-Optional:
+Required:
-- `admin_notification_frequency` (Set of String) When "admin_notification" is enabled, determines how often email notifications are sent. Possible values: `immediately`, `daily`, `weekly`, `monthly`.
- `enabled` (Boolean) Whether breached password detection is active.
+
+Optional:
+
+- `admin_notification_frequency` (Set of String) When `admin_notification` is enabled within the `shields` property, determines how often email notifications are sent. Possible values: `immediately`, `daily`, `weekly`, `monthly`.
- `method` (String) The subscription level for breached password detection methods. Use "enhanced" to enable Credential Guard. Possible values: `standard`, `enhanced`.
- `pre_user_registration` (Block List, Max: 1) Configuration options that apply before every user registration attempt. Only available on public tenants. (see [below for nested schema](#nestedblock--breached_password_detection--pre_user_registration))
-- `shields` (Set of String) Action to take when a breached password is detected.
+- `shields` (Set of String) Action to take when a breached password is detected. Options include: `block` (block compromised user accounts), `user_notification` (send an email to user when we detect that they are using compromised credentials) and `admin_notification` (send an email with a summary of the number of accounts logging in with compromised credentials).
### Nested Schema for `breached_password_detection.pre_user_registration`
Optional:
-- `shields` (Set of String) Action to take when a breached password is detected during a signup. Possible values: `block`, `admin_notification`.
+- `shields` (Set of String) Action to take when a breached password is detected during a signup. Possible values: `block` (block compromised credentials for new accounts), `admin_notification` (send an email notification with a summary of compromised credentials in new accounts).
### Nested Schema for `brute_force_protection`
-Optional:
+Required:
-- `allowlist` (Set of String) List of trusted IP addresses that will not have attack protection enforced against them.
- `enabled` (Boolean) Whether brute force attack protections are active.
-- `max_attempts` (Number) Maximum number of unsuccessful attempts. Only available on public tenants.
-- `mode` (String) Determines whether the IP address is used when counting failed attempts. Possible values: `count_per_identifier_and_ip` or `count_per_identifier`.
-- `shields` (Set of String) Action to take when a brute force protection threshold is violated. Possible values: `block`, `user_notification`
+
+Optional:
+
+- `allowlist` (Set of String) List of trusted IP addresses that will not have attack protection enforced against them. This field allows you to specify multiple IP addresses, or ranges. You can use IPv4 or IPv6 addresses and CIDR notation.
+- `max_attempts` (Number) Maximum number of consecutive failed login attempts from a single user before blocking is triggered. Only available on public tenants.
+- `mode` (String) Determines whether the IP address is used when counting failed attempts. Possible values: `count_per_identifier_and_ip` (lockout an account from a given IP Address) or `count_per_identifier` (lockout an account regardless of IP Address).
+- `shields` (Set of String) Action to take when a brute force protection threshold is violated. Possible values: `block` (block login attempts for a flagged user account), `user_notification` (send an email to user when their account has been blocked).
### Nested Schema for `suspicious_ip_throttling`
-Optional:
+Required:
-- `allowlist` (Set of String) List of trusted IP addresses that will not have attack protection enforced against them.
- `enabled` (Boolean) Whether suspicious IP throttling attack protections are active.
+
+Optional:
+
+- `allowlist` (Set of String) List of trusted IP addresses that will not have attack protection enforced against them. This field allows you to specify multiple IP addresses, or ranges. You can use IPv4 or IPv6 addresses and CIDR notation.
- `pre_login` (Block List, Max: 1) Configuration options that apply before every login attempt. Only available on public tenants. (see [below for nested schema](#nestedblock--suspicious_ip_throttling--pre_login))
- `pre_user_registration` (Block List, Max: 1) Configuration options that apply before every user registration attempt. Only available on public tenants. (see [below for nested schema](#nestedblock--suspicious_ip_throttling--pre_user_registration))
-- `shields` (Set of String) Action to take when a suspicious IP throttling threshold is violated. Possible values: `block`, `admin_notification`
+- `shields` (Set of String) Action to take when a suspicious IP throttling threshold is violated. Possible values: `block` (throttle traffic from an IP address when there is a high number of login attempts targeting too many different accounts), `admin_notification` (send an email notification when traffic is throttled on one or more IP addresses due to high-velocity traffic).
### Nested Schema for `suspicious_ip_throttling.pre_login`
Optional:
-- `max_attempts` (Number) Total number of attempts allowed per day.
-- `rate` (Number) Interval of time, given in milliseconds, at which new attempts are granted.
+- `max_attempts` (Number) The maximum number of failed login attempts allowed from a single IP address.
+- `rate` (Number) Interval of time, given in milliseconds at which new login tokens will become available after they have been used by an IP address. Each login attempt will be added on the defined throttling rate.
@@ -119,8 +128,8 @@ Optional:
Optional:
-- `max_attempts` (Number) Total number of attempts allowed.
-- `rate` (Number) Interval of time, given in milliseconds, at which new attempts are granted.
+- `max_attempts` (Number) The maximum number of sign up attempts allowed from a single IP address.
+- `rate` (Number) Interval of time, given in milliseconds at which new sign up tokens will become available after they have been used by an IP address. Each sign up attempt will be added on the defined throttling rate.
## Import
@@ -133,5 +142,5 @@ Import is supported using the following syntax:
# We recommend [Version 4 UUID](https://www.uuidgenerator.net/version4)
#
# Example:
-terraform import auth0_attack_protection.my_protection 24940d4b-4bd4-44e7-894e-f92e4de36a40
+terraform import auth0_attack_protection.my_protection "24940d4b-4bd4-44e7-894e-f92e4de36a40"
```
diff --git a/docs/resources/branding.md b/docs/resources/branding.md
index f10ef934b..fe9588b5c 100644
--- a/docs/resources/branding.md
+++ b/docs/resources/branding.md
@@ -77,5 +77,5 @@ Import is supported using the following syntax:
# We recommend [Version 4 UUID](https://www.uuidgenerator.net/version4)
#
# Example:
-terraform import auth0_branding.my_brand 22f4f21b-017a-319d-92e7-2291c1ca36c4
+terraform import auth0_branding.my_brand "22f4f21b-017a-319d-92e7-2291c1ca36c4"
```
diff --git a/docs/resources/branding_theme.md b/docs/resources/branding_theme.md
index b605cf5f3..7b15e31df 100644
--- a/docs/resources/branding_theme.md
+++ b/docs/resources/branding_theme.md
@@ -271,8 +271,8 @@ Optional:
Import is supported using the following syntax:
```shell
-# Branding Themes can be imported using their ID.
+# This resource can be imported by specifying the Branding Theme ID.
#
# Example:
-terraform import auth0_branding_theme.my_theme XXXXXXXXXXXXXXXXXXXX
+terraform import auth0_branding_theme.my_theme "XXXXXXXXXXXXXXXXXXXX"
```
diff --git a/docs/resources/client.md b/docs/resources/client.md
index 03f1e0cba..49d29f41f 100644
--- a/docs/resources/client.md
+++ b/docs/resources/client.md
@@ -97,7 +97,6 @@ resource "auth0_client" "my_client" {
- `callbacks` (List of String) URLs that Auth0 may call back to after a user authenticates for the client. Make sure to specify the protocol (https://) otherwise the callback may fail in some cases. With the exception of custom URI schemes for native clients, all callbacks should use protocol https://.
- `client_aliases` (List of String) List of audiences/realms for SAML protocol. Used by the wsfed addon.
- `client_metadata` (Map of String) Metadata associated with the client, in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. Field names (max 255 chars) are alphanumeric and may only include the following special characters: `:,-+=_*?"/\()<>@ [Tab] [Space]`.
-- `client_secret_rotation_trigger` (Map of String, Deprecated) Custom metadata for the rotation. The contents of this map are arbitrary and are hashed by the provider. When the hash changes, a rotation is triggered. For example, the map could contain the user making the change, the date of the change, and a text reason for the change. For more info: [rotate-client-secret](https://auth0.com/docs/get-started/applications/rotate-client-secret). Migrate to the `auth0_client_credentials` resource to manage a client's secret directly instead. Refer to the [client secret rotation guide](Refer to the [client secret rotation guide](https://registry.terraform.io/providers/auth0/auth0/latest/docs/guides/client_secret_rotation) for instructions on how to rotate client secrets with zero downtime.
- `cross_origin_auth` (Boolean) Whether this client can be used to make cross-origin authentication requests (`true`) or it is not allowed to make such requests (`false`). Requires the `coa_toggle_enabled` feature flag to be enabled on the tenant by the support team.
- `cross_origin_loc` (String) URL of the location in your site where the cross-origin verification takes place for the cross-origin auth flow when performing authentication in your own domain instead of Auth0 Universal Login page.
- `custom_login_page` (String) The content (HTML, CSS, JS) of the custom login page.
@@ -120,13 +119,11 @@ resource "auth0_client" "my_client" {
- `refresh_token` (Block List, Max: 1) Configuration settings for the refresh tokens issued for this client. (see [below for nested schema](#nestedblock--refresh_token))
- `sso` (Boolean) Applies only to SSO clients and determines whether Auth0 will handle Single Sign-On (true) or whether the identity provider will (false).
- `sso_disabled` (Boolean) Indicates whether or not SSO is disabled.
-- `token_endpoint_auth_method` (String, Deprecated) Defines the requested authentication method for the token endpoint. Options include `none` (public client without a client secret), `client_secret_post` (client uses HTTP POST parameters), `client_secret_basic` (client uses HTTP Basic). Managing the authentication method through this attribute is deprecated and it will be removed in a future major version. Migrate to the `auth0_client_credentials` resource to manage a client's authentication method instead. Check the [MIGRATION GUIDE](https://github.com/auth0/terraform-provider-auth0/blob/main/MIGRATION_GUIDE.md#client-authentication-method) on how to do that.
- `web_origins` (List of String) URLs that represent valid web origins for use with web message response mode.
### Read-Only
- `client_id` (String) The ID of the client.
-- `client_secret` (String, Sensitive, Deprecated) Secret for the client. Keep this private. To access this attribute you need to add the `read:client_keys` scope to the Terraform client. Otherwise, the attribute will contain an empty string. Use this attribute on the `auth0_client_credentials` resource instead, to allow managing it directly or use the `auth0_client` data source to read this property.
- `id` (String) The ID of this resource.
- `signing_keys` (List of Map of String, Sensitive) List containing a map of the public cert of the signing key and the public cert of the signing key in PKCS7.
@@ -135,34 +132,199 @@ resource "auth0_client" "my_client" {
Optional:
-- `aws` (Map of String)
-- `azure_blob` (Map of String)
-- `azure_sb` (Map of String)
-- `box` (Map of String)
-- `cloudbees` (Map of String)
-- `concur` (Map of String)
-- `dropbox` (Map of String)
-- `echosign` (Map of String)
-- `egnyte` (Map of String)
-- `firebase` (Map of String)
-- `layer` (Map of String)
-- `mscrm` (Map of String)
-- `newrelic` (Map of String)
-- `office365` (Map of String)
-- `rms` (Map of String)
-- `salesforce` (Map of String)
-- `salesforce_api` (Map of String)
-- `salesforce_sandbox_api` (Map of String)
+- `aws` (Block List, Max: 1) AWS Addon configuration. (see [below for nested schema](#nestedblock--addons--aws))
+- `azure_blob` (Block List, Max: 1) Azure Blob Storage Addon configuration. (see [below for nested schema](#nestedblock--addons--azure_blob))
+- `azure_sb` (Block List, Max: 1) Azure Storage Bus Addon configuration. (see [below for nested schema](#nestedblock--addons--azure_sb))
+- `box` (Block List, Max: 1) Box SSO indicator (no configuration settings needed for Box SSO). (see [below for nested schema](#nestedblock--addons--box))
+- `cloudbees` (Block List, Max: 1) CloudBees SSO indicator (no configuration settings needed for CloudBees SSO). (see [below for nested schema](#nestedblock--addons--cloudbees))
+- `concur` (Block List, Max: 1) Concur SSO indicator (no configuration settings needed for Concur SSO). (see [below for nested schema](#nestedblock--addons--concur))
+- `dropbox` (Block List, Max: 1) Dropbox SSO indicator (no configuration settings needed for Dropbox SSO). (see [below for nested schema](#nestedblock--addons--dropbox))
+- `echosign` (Block List, Max: 1) Adobe EchoSign SSO configuration. (see [below for nested schema](#nestedblock--addons--echosign))
+- `egnyte` (Block List, Max: 1) Egnyte SSO configuration. (see [below for nested schema](#nestedblock--addons--egnyte))
+- `firebase` (Block List, Max: 1) Google Firebase addon configuration. (see [below for nested schema](#nestedblock--addons--firebase))
+- `layer` (Block List, Max: 1) Layer addon configuration. (see [below for nested schema](#nestedblock--addons--layer))
+- `mscrm` (Block List, Max: 1) Microsoft Dynamics CRM SSO configuration. (see [below for nested schema](#nestedblock--addons--mscrm))
+- `newrelic` (Block List, Max: 1) New Relic SSO configuration. (see [below for nested schema](#nestedblock--addons--newrelic))
+- `office365` (Block List, Max: 1) Microsoft Office 365 SSO configuration. (see [below for nested schema](#nestedblock--addons--office365))
+- `rms` (Block List, Max: 1) Active Directory Rights Management Service SSO configuration. (see [below for nested schema](#nestedblock--addons--rms))
+- `salesforce` (Block List, Max: 1) Salesforce SSO configuration. (see [below for nested schema](#nestedblock--addons--salesforce))
+- `salesforce_api` (Block List, Max: 1) Salesforce API addon configuration. (see [below for nested schema](#nestedblock--addons--salesforce_api))
+- `salesforce_sandbox_api` (Block List, Max: 1) Salesforce Sandbox addon configuration. (see [below for nested schema](#nestedblock--addons--salesforce_sandbox_api))
- `samlp` (Block List, Max: 1) Configuration settings for a SAML add-on. (see [below for nested schema](#nestedblock--addons--samlp))
-- `sap_api` (Map of String)
-- `sentry` (Map of String)
-- `sharepoint` (Map of String)
-- `slack` (Map of String)
-- `springcm` (Map of String)
-- `wams` (Map of String)
-- `wsfed` (Map of String) WS-Fed (WIF) addon indicator. Actual configuration is stored in callback and `client_aliases` properties on the client.
-- `zendesk` (Map of String)
-- `zoom` (Map of String)
+- `sap_api` (Block List, Max: 1) SAP API addon configuration. (see [below for nested schema](#nestedblock--addons--sap_api))
+- `sentry` (Block List, Max: 1) Sentry SSO configuration. (see [below for nested schema](#nestedblock--addons--sentry))
+- `sharepoint` (Block List, Max: 1) SharePoint SSO configuration. (see [below for nested schema](#nestedblock--addons--sharepoint))
+- `slack` (Block List, Max: 1) Slack team or workspace name usually first segment in your Slack URL, for example `https://acme-org.slack.com` would be `acme-org`. (see [below for nested schema](#nestedblock--addons--slack))
+- `springcm` (Block List, Max: 1) SpringCM SSO configuration. (see [below for nested schema](#nestedblock--addons--springcm))
+- `sso_integration` (Block List, Max: 1) Generic SSO configuration. (see [below for nested schema](#nestedblock--addons--sso_integration))
+- `wams` (Block List, Max: 1) Windows Azure Mobile Services addon configuration. (see [below for nested schema](#nestedblock--addons--wams))
+- `wsfed` (Block List, Max: 1) WS-Fed (WIF) addon indicator. Actual configuration is stored in `callback` and `client_aliases` properties on the client. (see [below for nested schema](#nestedblock--addons--wsfed))
+- `zendesk` (Block List, Max: 1) Zendesk SSO configuration. (see [below for nested schema](#nestedblock--addons--zendesk))
+- `zoom` (Block List, Max: 1) Zoom SSO configuration. (see [below for nested schema](#nestedblock--addons--zoom))
+
+
+### Nested Schema for `addons.aws`
+
+Optional:
+
+- `lifetime_in_seconds` (Number) AWS token lifetime in seconds.
+- `principal` (String) AWS principal ARN, for example `arn:aws:iam::010616021751:saml-provider/idpname`.
+- `role` (String) AWS role ARN, for example `arn:aws:iam::010616021751:role/foo`.
+
+
+
+### Nested Schema for `addons.azure_blob`
+
+Optional:
+
+- `account_name` (String) Your Azure storage account name. Usually first segment in your Azure storage URL, for example `https://acme-org.blob.core.windows.net` would be the account name `acme-org`.
+- `blob_delete` (Boolean) Indicates if the issued token has permission to delete the blob.
+- `blob_name` (String) Entity to request a token for, such as `my-blob`. If blank the computed SAS will apply to the entire storage container.
+- `blob_read` (Boolean) Indicates if the issued token has permission to read the content, properties, metadata and block list. Use the blob as the source of a copy operation.
+- `blob_write` (Boolean) Indicates if the issued token has permission to create or write content, properties, metadata, or block list. Snapshot or lease the blob. Resize the blob (page blob only). Use the blob as the destination of a copy operation within the same account.
+- `container_delete` (Boolean) Indicates if issued token has permission to delete any blob in the container.
+- `container_list` (Boolean) Indicates if the issued token has permission to list blobs in the container.
+- `container_name` (String) Container to request a token for, such as `my-container`.
+- `container_read` (Boolean) Indicates if the issued token has permission to read the content, properties, metadata or block list of any blob in the container. Use any blob in the container as the source of a copy operation.
+- `container_write` (Boolean) Indicates that for any blob in the container if the issued token has permission to create or write content, properties, metadata, or block list. Snapshot or lease the blob. Resize the blob (page blob only). Use the blob as the destination of a copy operation within the same account.
+- `expiration` (Number) Expiration in minutes for the generated token (default of 5 minutes).
+- `signed_identifier` (String) Shared access policy identifier defined in your storage account resource.
+- `storage_access_key` (String, Sensitive) Access key associated with this storage account.
+
+
+
+### Nested Schema for `addons.azure_sb`
+
+Optional:
+
+- `entity_path` (String) Entity you want to request a token for, such as `my-queue`.
+- `expiration` (Number) Optional expiration in minutes for the generated token. Defaults to 5 minutes.
+- `namespace` (String) Your Azure Service Bus namespace. Usually the first segment of your Service Bus URL (for example `https://acme-org.servicebus.windows.net` would be `acme-org`).
+- `sas_key` (String, Sensitive) Primary Key associated with your shared access policy.
+- `sas_key_name` (String) Your shared access policy name defined in your Service Bus entity.
+
+
+
+### Nested Schema for `addons.box`
+
+
+
+### Nested Schema for `addons.cloudbees`
+
+
+
+### Nested Schema for `addons.concur`
+
+
+
+### Nested Schema for `addons.dropbox`
+
+
+
+### Nested Schema for `addons.echosign`
+
+Optional:
+
+- `domain` (String) Your custom domain found in your EchoSign URL, for example `https://acme-org.echosign.com` would be `acme-org`.
+
+
+
+### Nested Schema for `addons.egnyte`
+
+Optional:
+
+- `domain` (String) Your custom domain found in your Egnyte URL, for example `https://acme-org.echosign.com` would be `acme-org`.
+
+
+
+### Nested Schema for `addons.firebase`
+
+Optional:
+
+- `client_email` (String) ID of the Service Account you have created (shown as `client_email` in the generated JSON file, SDK v3+ tokens only).
+- `lifetime_in_seconds` (Number) Optional expiration in seconds for the generated token. Defaults to 3600 seconds (SDK v3+ tokens only).
+- `private_key` (String, Sensitive) Private Key for signing the token (SDK v3+ tokens only).
+- `private_key_id` (String, Sensitive) Optional ID of the private key to obtain the `kid` header claim from the issued token (SDK v3+ tokens only).
+- `secret` (String, Sensitive) Google Firebase Secret. (SDK v2 only).
+
+
+
+### Nested Schema for `addons.layer`
+
+Required:
+
+- `key_id` (String, Sensitive) Authentication Key identifier used to sign the Layer token.
+- `private_key` (String, Sensitive) Private key for signing the Layer token.
+- `provider_id` (String) Provider ID of your Layer account.
+
+Optional:
+
+- `expiration` (Number) Optional expiration in minutes for the generated token. Defaults to 5 minutes.
+- `principal` (String) Name of the property used as the unique user ID in Layer. If not specified `user_id` is used.
+
+
+
+### Nested Schema for `addons.mscrm`
+
+Optional:
+
+- `url` (String) Microsoft Dynamics CRM application URL.
+
+
+
+### Nested Schema for `addons.newrelic`
+
+Optional:
+
+- `account` (String) Your New Relic Account ID found in your New Relic URL after the `/accounts/` path, for example `https://rpm.newrelic.com/accounts/123456/query` would be `123456`.
+
+
+
+### Nested Schema for `addons.office365`
+
+Optional:
+
+- `connection` (String) Optional Auth0 database connection for testing an already-configured Office 365 tenant.
+- `domain` (String) Your Office 365 domain name, for example `acme-org.com`.
+
+
+
+### Nested Schema for `addons.rms`
+
+Optional:
+
+- `url` (String) URL of your Rights Management Server. It can be internal or external, but users will have to be able to reach it.
+
+
+
+### Nested Schema for `addons.salesforce`
+
+Optional:
+
+- `entity_id` (String) Arbitrary logical URL that identifies the Saleforce resource, for example `https://acme-org.com`.
+
+
+
+### Nested Schema for `addons.salesforce_api`
+
+Optional:
+
+- `client_id` (String, Sensitive) Consumer Key assigned by Salesforce to the Connected App.
+- `community_name` (String) Community name.
+- `community_url_section` (String) Community URL section.
+- `principal` (String, Sensitive) Name of the property in the user object that maps to a Salesforce username, for example `email`.
+
+
+
+### Nested Schema for `addons.salesforce_sandbox_api`
+
+Optional:
+
+- `client_id` (String, Sensitive) Consumer Key assigned by Salesforce to the Connected App.
+- `community_name` (String) Community name.
+- `community_url_section` (String) Community URL section.
+- `principal` (String, Sensitive) Name of the property in the user object that maps to a Salesforce username, for example `email`.
+
### Nested Schema for `addons.samlp`
@@ -175,21 +337,114 @@ Optional:
- `create_upn_claim` (Boolean) Indicates whether a UPN claim should be created. Defaults to `true`.
- `destination` (String) Destination of the SAML Response. If not specified, it will be `AssertionConsumerUrl` of SAMLRequest or callback URL if there was no SAMLRequest.
- `digest_algorithm` (String) Algorithm used to calculate the digest of the SAML Assertion or response. Options include `sha1` and `sha256`. Defaults to `sha1`.
-- `include_attribute_name_format` (Boolean) Indicates whether or not we should infer the NameFormat based on the attribute name. If set to false, the attribute NameFormat is not set in the assertion. Defaults to `true`.
+- `include_attribute_name_format` (Boolean) Indicates whether or not we should infer the NameFormat based on the attribute name. If set to `false`, the attribute NameFormat is not set in the assertion. Defaults to `true`.
- `issuer` (String) Issuer of the SAML Assertion.
-- `lifetime_in_seconds` (Number) Number of seconds during which the token is valid.
-- `logout` (Map of String) Configuration settings for logout.
+- `lifetime_in_seconds` (Number) Number of seconds during which the token is valid. Defaults to `3600` seconds.
+- `logout` (Block List, Max: 1) Configuration settings for logout. (see [below for nested schema](#nestedblock--addons--samlp--logout))
- `map_identities` (Boolean) Indicates whether or not to add additional identity information in the token, such as the provider used and the `access_token`, if available. Defaults to `true`.
- `map_unknown_claims_as_is` (Boolean) Indicates whether to add a prefix of `http://schema.auth0.com` to any claims that are not mapped to the common profile when passed through in the output assertion. Defaults to `false`.
- `mappings` (Map of String) Mappings between the Auth0 user profile property name (`name`) and the output attributes on the SAML attribute in the assertion (`value`).
-- `name_identifier_format` (String) Format of the name identifier.
+- `name_identifier_format` (String) Format of the name identifier. Defaults to `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`.
- `name_identifier_probes` (List of String) Attributes that can be used for Subject/NameID. Auth0 will try each of the attributes of this array in order and use the first value it finds.
- `passthrough_claims_with_no_mapping` (Boolean) Indicates whether or not to passthrough claims that are not mapped to the common profile in the output assertion. Defaults to `true`.
- `recipient` (String) Recipient of the SAML Assertion (SubjectConfirmationData). Default is `AssertionConsumerUrl` on SAMLRequest or callback URL if no SAMLRequest was sent.
- `sign_response` (Boolean) Indicates whether or not the SAML Response should be signed instead of the SAML Assertion.
- `signature_algorithm` (String) Algorithm used to sign the SAML Assertion or response. Options include `rsa-sha1` and `rsa-sha256`. Defaults to `rsa-sha1`.
- `signing_cert` (String) Optionally indicates the public key certificate used to validate SAML requests. If set, SAML requests will be required to be signed. A sample value would be `-----BEGIN PUBLIC KEY-----\nMIGf...bpP/t3\n+JGNGIRMj1hF1rnb6QIDAQAB\n-----END PUBLIC KEY-----\n`.
-- `typed_attributes` (Boolean) Indicates whether or not we should infer the `xs:type` of the element. Types include `xs:string`, `xs:boolean`, `xs:double`, and `xs:anyType`. When set to false, all `xs:type` are `xs:anyType`. Defaults to `true`.
+- `typed_attributes` (Boolean) Indicates whether or not we should infer the `xs:type` of the element. Types include `xs:string`, `xs:boolean`, `xs:double`, and `xs:anyType`. When set to `false`, all `xs:type` are `xs:anyType`. Defaults to `true`.
+
+
+### Nested Schema for `addons.samlp.logout`
+
+Optional:
+
+- `callback` (String) The service provider (client application)'s Single Logout Service URL, where Auth0 will send logout requests and responses.
+- `slo_enabled` (Boolean) Controls whether Auth0 should notify service providers of session termination.
+
+
+
+
+### Nested Schema for `addons.sap_api`
+
+Optional:
+
+- `client_id` (String) If activated in the OAuth 2.0 client configuration (transaction `SOAUTH2) the SAML attribute `client_id` must be set and equal the `client_id` form parameter of the access token request.
+- `name_identifier_format` (String) NameID element of the Subject which can be used to express the user's identity. Defaults to `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`.
+- `scope` (String) Requested scope for SAP APIs.
+- `service_password` (String, Sensitive) Service account password to use to authenticate API calls to the token endpoint.
+- `token_endpoint_url` (String) The OAuth2 token endpoint URL of your SAP OData server.
+- `username_attribute` (String) Name of the property in the user object that maps to a SAP username, for example `email`.
+
+
+
+### Nested Schema for `addons.sentry`
+
+Optional:
+
+- `base_url` (String) URL prefix only if running Sentry Community Edition, otherwise leave empty.
+- `org_slug` (String) Generated slug for your Sentry organization. Found in your Sentry URL, for example `https://sentry.acme.com/acme-org/` would be `acme-org`.
+
+
+
+### Nested Schema for `addons.sharepoint`
+
+Optional:
+
+- `external_url` (List of String) External SharePoint application URLs if exposed to the Internet.
+- `url` (String) Internal SharePoint application URL.
+
+
+
+### Nested Schema for `addons.slack`
+
+Optional:
+
+- `team` (String) Slack team name.
+
+
+
+### Nested Schema for `addons.springcm`
+
+Optional:
+
+- `acs_url` (String) SpringCM ACS URL, for example `https://na11.springcm.com/atlas/sso/SSOEndpoint.ashx`.
+
+
+
+### Nested Schema for `addons.sso_integration`
+
+Optional:
+
+- `name` (String) SSO integration name.
+- `version` (String) SSO integration version installed.
+
+
+
+### Nested Schema for `addons.wams`
+
+Optional:
+
+- `master_key` (String, Sensitive) Your master key for Windows Azure Mobile Services.
+
+
+
+### Nested Schema for `addons.wsfed`
+
+
+
+### Nested Schema for `addons.zendesk`
+
+Optional:
+
+- `account_name` (String) Zendesk account name. Usually the first segment in your Zendesk URL, for example `https://acme-org.zendesk.com` would be `acme-org`.
+
+
+
+### Nested Schema for `addons.zoom`
+
+Optional:
+
+- `account` (String) Zoom account name. Usually the first segment of your Zoom URL, for example `https://acme-org.zoom.us` would be `acme-org`.
@@ -277,8 +532,8 @@ Optional:
Import is supported using the following syntax:
```shell
-# A client can be imported using the client's ID.
+# This resource can be imported by specifying the client ID.
#
# Example:
-terraform import auth0_client.my_client AaiyAPdpYdesoKnqjj8HJqRn4T5titww
+terraform import auth0_client.my_client "AaiyAPdpYdesoKnqjj8HJqRn4T5titww"
```
diff --git a/docs/resources/client_credentials.md b/docs/resources/client_credentials.md
index 88c8215b8..4a5c7eba1 100644
--- a/docs/resources/client_credentials.md
+++ b/docs/resources/client_credentials.md
@@ -125,10 +125,10 @@ Read-Only:
Import is supported using the following syntax:
```shell
-# A client credentials resource can be imported using the client's ID.
+# This resource can be imported by specifying the client ID.
#
# Example:
-terraform import auth0_client_credentials.my_creds AaiyAPdpYdesoKnqjj8HJqRn4T5titww
+terraform import auth0_client_credentials.my_creds "AaiyAPdpYdesoKnqjj8HJqRn4T5titww"
```
~> Importing this resource when the `authentication_method` is set to `private_key_jwt` will force the resource to be recreated.
diff --git a/docs/resources/client_grant.md b/docs/resources/client_grant.md
index ac830c335..9e86bbde3 100644
--- a/docs/resources/client_grant.md
+++ b/docs/resources/client_grant.md
@@ -11,7 +11,7 @@ Auth0 uses various grant types, or methods by which you grant limited access to
## Example Usage
```terraform
-# The following example grants a client the "create:foo" permission (scope).
+# The following example grants a client the "create:foo" and "create:bar" permissions (scopes).
resource "auth0_client" "my_client" {
name = "Example Application - Client Grant (Managed by Terraform)"
@@ -35,7 +35,7 @@ resource "auth0_resource_server" "my_resource_server" {
resource "auth0_client_grant" "my_client_grant" {
client_id = auth0_client.my_client.id
audience = auth0_resource_server.my_resource_server.identifier
- scope = ["create:foo"]
+ scopes = ["create:foo", "create:bar"]
}
```
@@ -46,7 +46,7 @@ resource "auth0_client_grant" "my_client_grant" {
- `audience` (String) Audience or API Identifier for this grant.
- `client_id` (String) ID of the client for this grant.
-- `scope` (List of String) Permissions (scopes) included in this grant.
+- `scopes` (List of String) Permissions (scopes) included in this grant.
### Read-Only
@@ -57,10 +57,9 @@ resource "auth0_client_grant" "my_client_grant" {
Import is supported using the following syntax:
```shell
-# Client grants can be imported using the grant ID.
-#
-# Application -> APIs -> Expand the required API
+# This resource can be imported by specifying the client grant ID.
+# You can find this within the Management Dashboard in Application -> APIs -> Expand the required API.
#
# Example:
-terraform import auth0_client_grant.my_client_grant cgr_XXXXXXXXXXXXXXXX
+terraform import auth0_client_grant.my_client_grant "cgr_XXXXXXXXXXXXXXXX"
```
diff --git a/docs/resources/connection.md b/docs/resources/connection.md
index 4c1b1c841..1520d138f 100644
--- a/docs/resources/connection.md
+++ b/docs/resources/connection.md
@@ -807,8 +807,8 @@ Optional:
Import is supported using the following syntax:
```shell
-# Connections can be imported using their ID.
+# This resource can be imported by specifying the connection ID.
#
# Example:
-terraform import auth0_connection.google con_a17f21fdb24d48a0
+terraform import auth0_connection.google "con_a17f21fdb24d48a0"
```
diff --git a/docs/resources/connection_client.md b/docs/resources/connection_client.md
index 7d819f38e..8a78e7a45 100644
--- a/docs/resources/connection_client.md
+++ b/docs/resources/connection_client.md
@@ -53,8 +53,9 @@ Import is supported using the following syntax:
```shell
# This resource can be imported by specifying the
-# connection ID and client ID separated by ":".
+# connection ID and client ID separated by "::" (note the double colon)
+# ::
#
# Example:
-terraform import auth0_connection_client.my_conn_client_assoc con_XXXXX:XXXXXXXX
+terraform import auth0_connection_client.my_conn_client_assoc "con_XXXXX::XXXXXXXX"
```
diff --git a/docs/resources/connection_clients.md b/docs/resources/connection_clients.md
index cc36ede86..c99478dc5 100644
--- a/docs/resources/connection_clients.md
+++ b/docs/resources/connection_clients.md
@@ -62,5 +62,5 @@ Import is supported using the following syntax:
# This resource can be imported by specifying the Connection ID.
#
# Example:
-terraform import auth0_connection_clients.my_conn_clients_assoc con_XXXXX:
+terraform import auth0_connection_clients.my_conn_clients_assoc "con_XXXXX"
```
diff --git a/docs/resources/custom_domain.md b/docs/resources/custom_domain.md
index 602db5d24..3ecfbd337 100644
--- a/docs/resources/custom_domain.md
+++ b/docs/resources/custom_domain.md
@@ -56,5 +56,5 @@ Import is supported using the following syntax:
# https://auth0.com/docs/api/management/v2#!/Custom_Domains/get_custom_domains
#
# Example:
-terraform import auth0_custom_domain.my_custom_domain cd_XXXXXXXXXXXXXXXX
+terraform import auth0_custom_domain.my_custom_domain "cd_XXXXXXXXXXXXXXXX"
```
diff --git a/docs/resources/custom_domain_verification.md b/docs/resources/custom_domain_verification.md
index 483cd14fa..05c02a875 100644
--- a/docs/resources/custom_domain_verification.md
+++ b/docs/resources/custom_domain_verification.md
@@ -72,5 +72,5 @@ Import is supported using the following syntax:
# You can import this resource using the custom domain ID.
#
# Example:
-terraform import auth0_custom_domain_verification.my_custom_domain_verification cd_XXXXXXXXXXXXXXXX
+terraform import auth0_custom_domain_verification.my_custom_domain_verification "cd_XXXXXXXXXXXXXXXX"
```
diff --git a/docs/resources/email.md b/docs/resources/email.md
index c5c967595..74617c0c9 100644
--- a/docs/resources/email.md
+++ b/docs/resources/email.md
@@ -121,5 +121,5 @@ Import is supported using the following syntax:
# We recommend [Version 4 UUID](https://www.uuidgenerator.net/version4)
#
# Example:
-terraform import auth0_email.my_email_provider b4213dc2-2eed-42c3-9516-c6131a9ce0b0
+terraform import auth0_email.my_email_provider "b4213dc2-2eed-42c3-9516-c6131a9ce0b0"
```
diff --git a/docs/resources/email_template.md b/docs/resources/email_template.md
index 8ea14a6fb..c07698655 100644
--- a/docs/resources/email_template.md
+++ b/docs/resources/email_template.md
@@ -74,5 +74,5 @@ Import is supported using the following syntax:
# for legacy scenarios.
#
# Example:
-terraform import auth0_email_template.my_email_template welcome_email
+terraform import auth0_email_template.my_email_template "welcome_email"
```
diff --git a/docs/resources/global_client.md b/docs/resources/global_client.md
deleted file mode 100644
index 5f7dec4a0..000000000
--- a/docs/resources/global_client.md
+++ /dev/null
@@ -1,234 +0,0 @@
----
-page_title: "Resource: auth0_global_client"
-description: |-
- Use a tenant's global Auth0 Application client.
- !> This resource has been deprecated in favor of the newly introduced auth0_pages resource and it will be removed in a future version. Check the MIGRATION_GUIDE https://github.com/auth0/terraform-provider-auth0/blob/main/MIGRATION_GUIDE.md#global-client for more info.
----
-
-# Resource: auth0_global_client
-
-Use a tenant's global Auth0 Application client.
-
-!> This resource has been deprecated in favor of the newly introduced `auth0_pages` resource and it will be removed in a future version. Check the [MIGRATION_GUIDE](https://github.com/auth0/terraform-provider-auth0/blob/main/MIGRATION_GUIDE.md#global-client) for more info.
-
-## Example Usage
-
-```terraform
-resource "auth0_global_client" "global" {
- // Auth0 Universal Login - Custom Login Page
- custom_login_page_on = true
- custom_login_page = <
- My Custom Login Page
-
- I should probably have a login form here
-
-