Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Azure Native v2
  3. API Docs
  4. web
  5. WebAppAuthSettingsSlot
These are the docs for Azure Native v2. We recommenend using the latest version, Azure Native v3.
Azure Native v2 v2.90.0 published on Thursday, Mar 27, 2025 by Pulumi
pulumi/pulumi-azure-native

azure-native-v2.web.WebAppAuthSettingsSlot

Explore with Pulumi AI

These are the docs for Azure Native v2. We recommenend using the latest version, Azure Native v3.
Azure Native v2 v2.90.0 published on Thursday, Mar 27, 2025 by Pulumi
pulumi/pulumi-azure-native

Configuration settings for the Azure App Service Authentication / Authorization feature. Azure REST API version: 2022-09-01. Prior API version in Azure Native 1.x: 2020-12-01.

Other available API versions: 2020-10-01, 2023-01-01, 2023-12-01, 2024-04-01.

Import

An existing resource can be imported using its type token, name, and identifier, e.g.

$ pulumi import azure-native:web:WebAppAuthSettingsSlot myresource1 /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/config/authsettings
Copy

Create WebAppAuthSettingsSlot Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new WebAppAuthSettingsSlot(name: string, args: WebAppAuthSettingsSlotArgs, opts?: CustomResourceOptions);
@overload
def WebAppAuthSettingsSlot(resource_name: str,
                           args: WebAppAuthSettingsSlotArgs,
                           opts: Optional[ResourceOptions] = None)

@overload
def WebAppAuthSettingsSlot(resource_name: str,
                           opts: Optional[ResourceOptions] = None,
                           name: Optional[str] = None,
                           slot: Optional[str] = None,
                           resource_group_name: Optional[str] = None,
                           google_client_id: Optional[str] = None,
                           token_store_enabled: Optional[bool] = None,
                           client_id: Optional[str] = None,
                           client_secret: Optional[str] = None,
                           client_secret_certificate_thumbprint: Optional[str] = None,
                           client_secret_setting_name: Optional[str] = None,
                           config_version: Optional[str] = None,
                           default_provider: Optional[BuiltInAuthenticationProvider] = None,
                           enabled: Optional[bool] = None,
                           facebook_app_id: Optional[str] = None,
                           facebook_app_secret: Optional[str] = None,
                           facebook_app_secret_setting_name: Optional[str] = None,
                           facebook_o_auth_scopes: Optional[Sequence[str]] = None,
                           google_o_auth_scopes: Optional[Sequence[str]] = None,
                           git_hub_client_secret: Optional[str] = None,
                           git_hub_client_secret_setting_name: Optional[str] = None,
                           git_hub_o_auth_scopes: Optional[Sequence[str]] = None,
                           aad_claims_authorization: Optional[str] = None,
                           unauthenticated_client_action: Optional[UnauthenticatedClientAction] = None,
                           auth_file_path: Optional[str] = None,
                           git_hub_client_id: Optional[str] = None,
                           is_auth_from_file: Optional[str] = None,
                           issuer: Optional[str] = None,
                           kind: Optional[str] = None,
                           microsoft_account_client_id: Optional[str] = None,
                           microsoft_account_client_secret: Optional[str] = None,
                           microsoft_account_client_secret_setting_name: Optional[str] = None,
                           microsoft_account_o_auth_scopes: Optional[Sequence[str]] = None,
                           allowed_external_redirect_urls: Optional[Sequence[str]] = None,
                           allowed_audiences: Optional[Sequence[str]] = None,
                           runtime_version: Optional[str] = None,
                           additional_login_params: Optional[Sequence[str]] = None,
                           token_refresh_extension_hours: Optional[float] = None,
                           google_client_secret_setting_name: Optional[str] = None,
                           twitter_consumer_key: Optional[str] = None,
                           twitter_consumer_secret: Optional[str] = None,
                           twitter_consumer_secret_setting_name: Optional[str] = None,
                           google_client_secret: Optional[str] = None,
                           validate_issuer: Optional[bool] = None)
func NewWebAppAuthSettingsSlot(ctx *Context, name string, args WebAppAuthSettingsSlotArgs, opts ...ResourceOption) (*WebAppAuthSettingsSlot, error)
public WebAppAuthSettingsSlot(string name, WebAppAuthSettingsSlotArgs args, CustomResourceOptions? opts = null)
public WebAppAuthSettingsSlot(String name, WebAppAuthSettingsSlotArgs args)
public WebAppAuthSettingsSlot(String name, WebAppAuthSettingsSlotArgs args, CustomResourceOptions options)

type: azure-native:web:WebAppAuthSettingsSlot
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args This property is required. WebAppAuthSettingsSlotArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args This property is required. WebAppAuthSettingsSlotArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args This property is required. WebAppAuthSettingsSlotArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args This property is required. WebAppAuthSettingsSlotArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. WebAppAuthSettingsSlotArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var webAppAuthSettingsSlotResource = new AzureNative.Web.WebAppAuthSettingsSlot("webAppAuthSettingsSlotResource", new()
{
    Name = "string",
    Slot = "string",
    ResourceGroupName = "string",
    GoogleClientId = "string",
    TokenStoreEnabled = false,
    ClientId = "string",
    ClientSecret = "string",
    ClientSecretCertificateThumbprint = "string",
    ClientSecretSettingName = "string",
    ConfigVersion = "string",
    DefaultProvider = "AzureActiveDirectory",
    Enabled = false,
    FacebookAppId = "string",
    FacebookAppSecret = "string",
    FacebookAppSecretSettingName = "string",
    FacebookOAuthScopes = new[]
    {
        "string",
    },
    GoogleOAuthScopes = new[]
    {
        "string",
    },
    GitHubClientSecret = "string",
    GitHubClientSecretSettingName = "string",
    GitHubOAuthScopes = new[]
    {
        "string",
    },
    AadClaimsAuthorization = "string",
    UnauthenticatedClientAction = "RedirectToLoginPage",
    AuthFilePath = "string",
    GitHubClientId = "string",
    IsAuthFromFile = "string",
    Issuer = "string",
    Kind = "string",
    MicrosoftAccountClientId = "string",
    MicrosoftAccountClientSecret = "string",
    MicrosoftAccountClientSecretSettingName = "string",
    MicrosoftAccountOAuthScopes = new[]
    {
        "string",
    },
    AllowedExternalRedirectUrls = new[]
    {
        "string",
    },
    AllowedAudiences = new[]
    {
        "string",
    },
    RuntimeVersion = "string",
    AdditionalLoginParams = new[]
    {
        "string",
    },
    TokenRefreshExtensionHours = 0,
    GoogleClientSecretSettingName = "string",
    TwitterConsumerKey = "string",
    TwitterConsumerSecret = "string",
    TwitterConsumerSecretSettingName = "string",
    GoogleClientSecret = "string",
    ValidateIssuer = false,
});
Copy
example, err := web.NewWebAppAuthSettingsSlot(ctx, "webAppAuthSettingsSlotResource", &web.WebAppAuthSettingsSlotArgs{
	Name:                              "string",
	Slot:                              "string",
	ResourceGroupName:                 "string",
	GoogleClientId:                    "string",
	TokenStoreEnabled:                 false,
	ClientId:                          "string",
	ClientSecret:                      "string",
	ClientSecretCertificateThumbprint: "string",
	ClientSecretSettingName:           "string",
	ConfigVersion:                     "string",
	DefaultProvider:                   "AzureActiveDirectory",
	Enabled:                           false,
	FacebookAppId:                     "string",
	FacebookAppSecret:                 "string",
	FacebookAppSecretSettingName:      "string",
	FacebookOAuthScopes: []string{
		"string",
	},
	GoogleOAuthScopes: []string{
		"string",
	},
	GitHubClientSecret:            "string",
	GitHubClientSecretSettingName: "string",
	GitHubOAuthScopes: []string{
		"string",
	},
	AadClaimsAuthorization:                  "string",
	UnauthenticatedClientAction:             "RedirectToLoginPage",
	AuthFilePath:                            "string",
	GitHubClientId:                          "string",
	IsAuthFromFile:                          "string",
	Issuer:                                  "string",
	Kind:                                    "string",
	MicrosoftAccountClientId:                "string",
	MicrosoftAccountClientSecret:            "string",
	MicrosoftAccountClientSecretSettingName: "string",
	MicrosoftAccountOAuthScopes: []string{
		"string",
	},
	AllowedExternalRedirectUrls: []string{
		"string",
	},
	AllowedAudiences: []string{
		"string",
	},
	RuntimeVersion: "string",
	AdditionalLoginParams: []string{
		"string",
	},
	TokenRefreshExtensionHours:       0,
	GoogleClientSecretSettingName:    "string",
	TwitterConsumerKey:               "string",
	TwitterConsumerSecret:            "string",
	TwitterConsumerSecretSettingName: "string",
	GoogleClientSecret:               "string",
	ValidateIssuer:                   false,
})
Copy
var webAppAuthSettingsSlotResource = new WebAppAuthSettingsSlot("webAppAuthSettingsSlotResource", WebAppAuthSettingsSlotArgs.builder()
    .name("string")
    .slot("string")
    .resourceGroupName("string")
    .googleClientId("string")
    .tokenStoreEnabled(false)
    .clientId("string")
    .clientSecret("string")
    .clientSecretCertificateThumbprint("string")
    .clientSecretSettingName("string")
    .configVersion("string")
    .defaultProvider("AzureActiveDirectory")
    .enabled(false)
    .facebookAppId("string")
    .facebookAppSecret("string")
    .facebookAppSecretSettingName("string")
    .facebookOAuthScopes("string")
    .googleOAuthScopes("string")
    .gitHubClientSecret("string")
    .gitHubClientSecretSettingName("string")
    .gitHubOAuthScopes("string")
    .aadClaimsAuthorization("string")
    .unauthenticatedClientAction("RedirectToLoginPage")
    .authFilePath("string")
    .gitHubClientId("string")
    .isAuthFromFile("string")
    .issuer("string")
    .kind("string")
    .microsoftAccountClientId("string")
    .microsoftAccountClientSecret("string")
    .microsoftAccountClientSecretSettingName("string")
    .microsoftAccountOAuthScopes("string")
    .allowedExternalRedirectUrls("string")
    .allowedAudiences("string")
    .runtimeVersion("string")
    .additionalLoginParams("string")
    .tokenRefreshExtensionHours(0)
    .googleClientSecretSettingName("string")
    .twitterConsumerKey("string")
    .twitterConsumerSecret("string")
    .twitterConsumerSecretSettingName("string")
    .googleClientSecret("string")
    .validateIssuer(false)
    .build());
Copy
web_app_auth_settings_slot_resource = azure_native.web.WebAppAuthSettingsSlot("webAppAuthSettingsSlotResource",
    name=string,
    slot=string,
    resource_group_name=string,
    google_client_id=string,
    token_store_enabled=False,
    client_id=string,
    client_secret=string,
    client_secret_certificate_thumbprint=string,
    client_secret_setting_name=string,
    config_version=string,
    default_provider=AzureActiveDirectory,
    enabled=False,
    facebook_app_id=string,
    facebook_app_secret=string,
    facebook_app_secret_setting_name=string,
    facebook_o_auth_scopes=[string],
    google_o_auth_scopes=[string],
    git_hub_client_secret=string,
    git_hub_client_secret_setting_name=string,
    git_hub_o_auth_scopes=[string],
    aad_claims_authorization=string,
    unauthenticated_client_action=RedirectToLoginPage,
    auth_file_path=string,
    git_hub_client_id=string,
    is_auth_from_file=string,
    issuer=string,
    kind=string,
    microsoft_account_client_id=string,
    microsoft_account_client_secret=string,
    microsoft_account_client_secret_setting_name=string,
    microsoft_account_o_auth_scopes=[string],
    allowed_external_redirect_urls=[string],
    allowed_audiences=[string],
    runtime_version=string,
    additional_login_params=[string],
    token_refresh_extension_hours=0,
    google_client_secret_setting_name=string,
    twitter_consumer_key=string,
    twitter_consumer_secret=string,
    twitter_consumer_secret_setting_name=string,
    google_client_secret=string,
    validate_issuer=False)
Copy
const webAppAuthSettingsSlotResource = new azure_native.web.WebAppAuthSettingsSlot("webAppAuthSettingsSlotResource", {
    name: "string",
    slot: "string",
    resourceGroupName: "string",
    googleClientId: "string",
    tokenStoreEnabled: false,
    clientId: "string",
    clientSecret: "string",
    clientSecretCertificateThumbprint: "string",
    clientSecretSettingName: "string",
    configVersion: "string",
    defaultProvider: "AzureActiveDirectory",
    enabled: false,
    facebookAppId: "string",
    facebookAppSecret: "string",
    facebookAppSecretSettingName: "string",
    facebookOAuthScopes: ["string"],
    googleOAuthScopes: ["string"],
    gitHubClientSecret: "string",
    gitHubClientSecretSettingName: "string",
    gitHubOAuthScopes: ["string"],
    aadClaimsAuthorization: "string",
    unauthenticatedClientAction: "RedirectToLoginPage",
    authFilePath: "string",
    gitHubClientId: "string",
    isAuthFromFile: "string",
    issuer: "string",
    kind: "string",
    microsoftAccountClientId: "string",
    microsoftAccountClientSecret: "string",
    microsoftAccountClientSecretSettingName: "string",
    microsoftAccountOAuthScopes: ["string"],
    allowedExternalRedirectUrls: ["string"],
    allowedAudiences: ["string"],
    runtimeVersion: "string",
    additionalLoginParams: ["string"],
    tokenRefreshExtensionHours: 0,
    googleClientSecretSettingName: "string",
    twitterConsumerKey: "string",
    twitterConsumerSecret: "string",
    twitterConsumerSecretSettingName: "string",
    googleClientSecret: "string",
    validateIssuer: false,
});
Copy
type: azure-native:web:WebAppAuthSettingsSlot
properties:
    aadClaimsAuthorization: string
    additionalLoginParams:
        - string
    allowedAudiences:
        - string
    allowedExternalRedirectUrls:
        - string
    authFilePath: string
    clientId: string
    clientSecret: string
    clientSecretCertificateThumbprint: string
    clientSecretSettingName: string
    configVersion: string
    defaultProvider: AzureActiveDirectory
    enabled: false
    facebookAppId: string
    facebookAppSecret: string
    facebookAppSecretSettingName: string
    facebookOAuthScopes:
        - string
    gitHubClientId: string
    gitHubClientSecret: string
    gitHubClientSecretSettingName: string
    gitHubOAuthScopes:
        - string
    googleClientId: string
    googleClientSecret: string
    googleClientSecretSettingName: string
    googleOAuthScopes:
        - string
    isAuthFromFile: string
    issuer: string
    kind: string
    microsoftAccountClientId: string
    microsoftAccountClientSecret: string
    microsoftAccountClientSecretSettingName: string
    microsoftAccountOAuthScopes:
        - string
    name: string
    resourceGroupName: string
    runtimeVersion: string
    slot: string
    tokenRefreshExtensionHours: 0
    tokenStoreEnabled: false
    twitterConsumerKey: string
    twitterConsumerSecret: string
    twitterConsumerSecretSettingName: string
    unauthenticatedClientAction: RedirectToLoginPage
    validateIssuer: false
Copy

WebAppAuthSettingsSlot Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The WebAppAuthSettingsSlot resource accepts the following input properties:

Name
This property is required.
Changes to this property will trigger replacement.
string
Name of web app.
ResourceGroupName
This property is required.
Changes to this property will trigger replacement.
string
Name of the resource group to which the resource belongs.
Slot
This property is required.
Changes to this property will trigger replacement.
string
Name of web app slot. If not specified then will default to production slot.
AadClaimsAuthorization string
Gets a JSON string containing the Azure AD Acl settings.
AdditionalLoginParams List<string>
Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form "key=value".
AllowedAudiences List<string>
Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the ClientID value is always considered an allowed audience, regardless of this setting.
AllowedExternalRedirectUrls List<string>
External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed.
AuthFilePath string
The path of the config file containing auth settings. If the path is relative, base will the site's root directory.
ClientId string
The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
ClientSecret string
The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
ClientSecretCertificateThumbprint string
An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret. It is also optional.
ClientSecretSettingName string
The app setting name that contains the client secret of the relying party application.
ConfigVersion string
The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization.
DefaultProvider Pulumi.AzureNative.Web.BuiltInAuthenticationProvider
The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to "RedirectToLoginPage".
Enabled bool
true if the Authentication / Authorization feature is enabled for the current app; otherwise, false.
FacebookAppId string
The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
FacebookAppSecret string
The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
FacebookAppSecretSettingName string
The app setting name that contains the app secret used for Facebook Login.
FacebookOAuthScopes List<string>
The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
GitHubClientId string
The Client Id of the GitHub app used for login. This setting is required for enabling Github login
GitHubClientSecret string
The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login.
GitHubClientSecretSettingName string
The app setting name that contains the client secret of the Github app used for GitHub Login.
GitHubOAuthScopes List<string>
The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication. This setting is optional
GoogleClientId string
The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
GoogleClientSecret string
The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
GoogleClientSecretSettingName string
The app setting name that contains the client secret associated with the Google web application.
GoogleOAuthScopes List<string>
The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, "openid", "profile", and "email" are used as default scopes. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
IsAuthFromFile string
"true" if the auth config settings should be read from a file, "false" otherwise
Issuer string
The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html
Kind string
Kind of resource.
MicrosoftAccountClientId string
The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
MicrosoftAccountClientSecret string
The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
MicrosoftAccountClientSecretSettingName string
The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication.
MicrosoftAccountOAuthScopes List<string>
The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, "wl.basic" is used as the default scope. Microsoft Account Scopes and permissions documentation: https://msdn.microsoft.com/en-us/library/dn631845.aspx
RuntimeVersion string
The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module.
TokenRefreshExtensionHours double
The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours.
TokenStoreEnabled bool
true to durably store platform-specific security tokens that are obtained during login flows; otherwise, false. The default is false.
TwitterConsumerKey string
The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
TwitterConsumerSecret string
The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
TwitterConsumerSecretSettingName string
The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in.
UnauthenticatedClientAction Pulumi.AzureNative.Web.UnauthenticatedClientAction
The action to take when an unauthenticated client attempts to access the app.
ValidateIssuer bool
Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such.
Name
This property is required.
Changes to this property will trigger replacement.
string
Name of web app.
ResourceGroupName
This property is required.
Changes to this property will trigger replacement.
string
Name of the resource group to which the resource belongs.
Slot
This property is required.
Changes to this property will trigger replacement.
string
Name of web app slot. If not specified then will default to production slot.
AadClaimsAuthorization string
Gets a JSON string containing the Azure AD Acl settings.
AdditionalLoginParams []string
Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form "key=value".
AllowedAudiences []string
Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the ClientID value is always considered an allowed audience, regardless of this setting.
AllowedExternalRedirectUrls []string
External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed.
AuthFilePath string
The path of the config file containing auth settings. If the path is relative, base will the site's root directory.
ClientId string
The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
ClientSecret string
The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
ClientSecretCertificateThumbprint string
An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret. It is also optional.
ClientSecretSettingName string
The app setting name that contains the client secret of the relying party application.
ConfigVersion string
The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization.
DefaultProvider BuiltInAuthenticationProvider
The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to "RedirectToLoginPage".
Enabled bool
true if the Authentication / Authorization feature is enabled for the current app; otherwise, false.
FacebookAppId string
The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
FacebookAppSecret string
The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
FacebookAppSecretSettingName string
The app setting name that contains the app secret used for Facebook Login.
FacebookOAuthScopes []string
The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
GitHubClientId string
The Client Id of the GitHub app used for login. This setting is required for enabling Github login
GitHubClientSecret string
The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login.
GitHubClientSecretSettingName string
The app setting name that contains the client secret of the Github app used for GitHub Login.
GitHubOAuthScopes []string
The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication. This setting is optional
GoogleClientId string
The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
GoogleClientSecret string
The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
GoogleClientSecretSettingName string
The app setting name that contains the client secret associated with the Google web application.
GoogleOAuthScopes []string
The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, "openid", "profile", and "email" are used as default scopes. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
IsAuthFromFile string
"true" if the auth config settings should be read from a file, "false" otherwise
Issuer string
The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html
Kind string
Kind of resource.
MicrosoftAccountClientId string
The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
MicrosoftAccountClientSecret string
The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
MicrosoftAccountClientSecretSettingName string
The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication.
MicrosoftAccountOAuthScopes []string
The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, "wl.basic" is used as the default scope. Microsoft Account Scopes and permissions documentation: https://msdn.microsoft.com/en-us/library/dn631845.aspx
RuntimeVersion string
The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module.
TokenRefreshExtensionHours float64
The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours.
TokenStoreEnabled bool
true to durably store platform-specific security tokens that are obtained during login flows; otherwise, false. The default is false.
TwitterConsumerKey string
The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
TwitterConsumerSecret string
The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
TwitterConsumerSecretSettingName string
The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in.
UnauthenticatedClientAction UnauthenticatedClientAction
The action to take when an unauthenticated client attempts to access the app.
ValidateIssuer bool
Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such.
name
This property is required.
Changes to this property will trigger replacement.
String
Name of web app.
resourceGroupName
This property is required.
Changes to this property will trigger replacement.
String
Name of the resource group to which the resource belongs.
slot
This property is required.
Changes to this property will trigger replacement.
String
Name of web app slot. If not specified then will default to production slot.
aadClaimsAuthorization String
Gets a JSON string containing the Azure AD Acl settings.
additionalLoginParams List<String>
Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form "key=value".
allowedAudiences List<String>
Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the ClientID value is always considered an allowed audience, regardless of this setting.
allowedExternalRedirectUrls List<String>
External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed.
authFilePath String
The path of the config file containing auth settings. If the path is relative, base will the site's root directory.
clientId String
The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
clientSecret String
The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
clientSecretCertificateThumbprint String
An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret. It is also optional.
clientSecretSettingName String
The app setting name that contains the client secret of the relying party application.
configVersion String
The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization.
defaultProvider BuiltInAuthenticationProvider
The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to "RedirectToLoginPage".
enabled Boolean
true if the Authentication / Authorization feature is enabled for the current app; otherwise, false.
facebookAppId String
The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
facebookAppSecret String
The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
facebookAppSecretSettingName String
The app setting name that contains the app secret used for Facebook Login.
facebookOAuthScopes List<String>
The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
gitHubClientId String
The Client Id of the GitHub app used for login. This setting is required for enabling Github login
gitHubClientSecret String
The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login.
gitHubClientSecretSettingName String
The app setting name that contains the client secret of the Github app used for GitHub Login.
gitHubOAuthScopes List<String>
The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication. This setting is optional
googleClientId String
The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
googleClientSecret String
The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
googleClientSecretSettingName String
The app setting name that contains the client secret associated with the Google web application.
googleOAuthScopes List<String>
The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, "openid", "profile", and "email" are used as default scopes. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
isAuthFromFile String
"true" if the auth config settings should be read from a file, "false" otherwise
issuer String
The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html
kind String
Kind of resource.
microsoftAccountClientId String
The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
microsoftAccountClientSecret String
The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
microsoftAccountClientSecretSettingName String
The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication.
microsoftAccountOAuthScopes List<String>
The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, "wl.basic" is used as the default scope. Microsoft Account Scopes and permissions documentation: https://msdn.microsoft.com/en-us/library/dn631845.aspx
runtimeVersion String
The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module.
tokenRefreshExtensionHours Double
The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours.
tokenStoreEnabled Boolean
true to durably store platform-specific security tokens that are obtained during login flows; otherwise, false. The default is false.
twitterConsumerKey String
The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
twitterConsumerSecret String
The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
twitterConsumerSecretSettingName String
The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in.
unauthenticatedClientAction UnauthenticatedClientAction
The action to take when an unauthenticated client attempts to access the app.
validateIssuer Boolean
Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such.
name
This property is required.
Changes to this property will trigger replacement.
string
Name of web app.
resourceGroupName
This property is required.
Changes to this property will trigger replacement.
string
Name of the resource group to which the resource belongs.
slot
This property is required.
Changes to this property will trigger replacement.
string
Name of web app slot. If not specified then will default to production slot.
aadClaimsAuthorization string
Gets a JSON string containing the Azure AD Acl settings.
additionalLoginParams string[]
Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form "key=value".
allowedAudiences string[]
Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the ClientID value is always considered an allowed audience, regardless of this setting.
allowedExternalRedirectUrls string[]
External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed.
authFilePath string
The path of the config file containing auth settings. If the path is relative, base will the site's root directory.
clientId string
The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
clientSecret string
The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
clientSecretCertificateThumbprint string
An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret. It is also optional.
clientSecretSettingName string
The app setting name that contains the client secret of the relying party application.
configVersion string
The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization.
defaultProvider BuiltInAuthenticationProvider
The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to "RedirectToLoginPage".
enabled boolean
true if the Authentication / Authorization feature is enabled for the current app; otherwise, false.
facebookAppId string
The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
facebookAppSecret string
The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
facebookAppSecretSettingName string
The app setting name that contains the app secret used for Facebook Login.
facebookOAuthScopes string[]
The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
gitHubClientId string
The Client Id of the GitHub app used for login. This setting is required for enabling Github login
gitHubClientSecret string
The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login.
gitHubClientSecretSettingName string
The app setting name that contains the client secret of the Github app used for GitHub Login.
gitHubOAuthScopes string[]
The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication. This setting is optional
googleClientId string
The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
googleClientSecret string
The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
googleClientSecretSettingName string
The app setting name that contains the client secret associated with the Google web application.
googleOAuthScopes string[]
The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, "openid", "profile", and "email" are used as default scopes. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
isAuthFromFile string
"true" if the auth config settings should be read from a file, "false" otherwise
issuer string
The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html
kind string
Kind of resource.
microsoftAccountClientId string
The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
microsoftAccountClientSecret string
The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
microsoftAccountClientSecretSettingName string
The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication.
microsoftAccountOAuthScopes string[]
The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, "wl.basic" is used as the default scope. Microsoft Account Scopes and permissions documentation: https://msdn.microsoft.com/en-us/library/dn631845.aspx
runtimeVersion string
The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module.
tokenRefreshExtensionHours number
The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours.
tokenStoreEnabled boolean
true to durably store platform-specific security tokens that are obtained during login flows; otherwise, false. The default is false.
twitterConsumerKey string
The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
twitterConsumerSecret string
The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
twitterConsumerSecretSettingName string
The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in.
unauthenticatedClientAction UnauthenticatedClientAction
The action to take when an unauthenticated client attempts to access the app.
validateIssuer boolean
Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such.
name
This property is required.
Changes to this property will trigger replacement.
str
Name of web app.
resource_group_name
This property is required.
Changes to this property will trigger replacement.
str
Name of the resource group to which the resource belongs.
slot
This property is required.
Changes to this property will trigger replacement.
str
Name of web app slot. If not specified then will default to production slot.
aad_claims_authorization str
Gets a JSON string containing the Azure AD Acl settings.
additional_login_params Sequence[str]
Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form "key=value".
allowed_audiences Sequence[str]
Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the ClientID value is always considered an allowed audience, regardless of this setting.
allowed_external_redirect_urls Sequence[str]
External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed.
auth_file_path str
The path of the config file containing auth settings. If the path is relative, base will the site's root directory.
client_id str
The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
client_secret str
The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
client_secret_certificate_thumbprint str
An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret. It is also optional.
client_secret_setting_name str
The app setting name that contains the client secret of the relying party application.
config_version str
The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization.
default_provider BuiltInAuthenticationProvider
The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to "RedirectToLoginPage".
enabled bool
true if the Authentication / Authorization feature is enabled for the current app; otherwise, false.
facebook_app_id str
The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
facebook_app_secret str
The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
facebook_app_secret_setting_name str
The app setting name that contains the app secret used for Facebook Login.
facebook_o_auth_scopes Sequence[str]
The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
git_hub_client_id str
The Client Id of the GitHub app used for login. This setting is required for enabling Github login
git_hub_client_secret str
The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login.
git_hub_client_secret_setting_name str
The app setting name that contains the client secret of the Github app used for GitHub Login.
git_hub_o_auth_scopes Sequence[str]
The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication. This setting is optional
google_client_id str
The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
google_client_secret str
The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
google_client_secret_setting_name str
The app setting name that contains the client secret associated with the Google web application.
google_o_auth_scopes Sequence[str]
The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, "openid", "profile", and "email" are used as default scopes. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
is_auth_from_file str
"true" if the auth config settings should be read from a file, "false" otherwise
issuer str
The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html
kind str
Kind of resource.
microsoft_account_client_id str
The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
microsoft_account_client_secret str
The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
microsoft_account_client_secret_setting_name str
The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication.
microsoft_account_o_auth_scopes Sequence[str]
The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, "wl.basic" is used as the default scope. Microsoft Account Scopes and permissions documentation: https://msdn.microsoft.com/en-us/library/dn631845.aspx
runtime_version str
The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module.
token_refresh_extension_hours float
The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours.
token_store_enabled bool
true to durably store platform-specific security tokens that are obtained during login flows; otherwise, false. The default is false.
twitter_consumer_key str
The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
twitter_consumer_secret str
The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
twitter_consumer_secret_setting_name str
The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in.
unauthenticated_client_action UnauthenticatedClientAction
The action to take when an unauthenticated client attempts to access the app.
validate_issuer bool
Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such.
name
This property is required.
Changes to this property will trigger replacement.
String
Name of web app.
resourceGroupName
This property is required.
Changes to this property will trigger replacement.
String
Name of the resource group to which the resource belongs.
slot
This property is required.
Changes to this property will trigger replacement.
String
Name of web app slot. If not specified then will default to production slot.
aadClaimsAuthorization String
Gets a JSON string containing the Azure AD Acl settings.
additionalLoginParams List<String>
Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form "key=value".
allowedAudiences List<String>
Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the ClientID value is always considered an allowed audience, regardless of this setting.
allowedExternalRedirectUrls List<String>
External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed.
authFilePath String
The path of the config file containing auth settings. If the path is relative, base will the site's root directory.
clientId String
The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
clientSecret String
The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on OpenID Connect: http://openid.net/specs/openid-connect-core-1_0.html
clientSecretCertificateThumbprint String
An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret. It is also optional.
clientSecretSettingName String
The app setting name that contains the client secret of the relying party application.
configVersion String
The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization.
defaultProvider "AzureActiveDirectory" | "Facebook" | "Google" | "MicrosoftAccount" | "Twitter" | "Github"
The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to "RedirectToLoginPage".
enabled Boolean
true if the Authentication / Authorization feature is enabled for the current app; otherwise, false.
facebookAppId String
The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
facebookAppSecret String
The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
facebookAppSecretSettingName String
The app setting name that contains the app secret used for Facebook Login.
facebookOAuthScopes List<String>
The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login documentation: https://developers.facebook.com/docs/facebook-login
gitHubClientId String
The Client Id of the GitHub app used for login. This setting is required for enabling Github login
gitHubClientSecret String
The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login.
gitHubClientSecretSettingName String
The app setting name that contains the client secret of the Github app used for GitHub Login.
gitHubOAuthScopes List<String>
The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication. This setting is optional
googleClientId String
The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
googleClientSecret String
The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
googleClientSecretSettingName String
The app setting name that contains the client secret associated with the Google web application.
googleOAuthScopes List<String>
The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, "openid", "profile", and "email" are used as default scopes. Google Sign-In documentation: https://developers.google.com/identity/sign-in/web/
isAuthFromFile String
"true" if the auth config settings should be read from a file, "false" otherwise
issuer String
The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on OpenID Connect Discovery: http://openid.net/specs/openid-connect-discovery-1_0.html
kind String
Kind of resource.
microsoftAccountClientId String
The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
microsoftAccountClientSecret String
The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth documentation: https://dev.onedrive.com/auth/msa_oauth.htm
microsoftAccountClientSecretSettingName String
The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication.
microsoftAccountOAuthScopes List<String>
The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, "wl.basic" is used as the default scope. Microsoft Account Scopes and permissions documentation: https://msdn.microsoft.com/en-us/library/dn631845.aspx
runtimeVersion String
The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module.
tokenRefreshExtensionHours Number
The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours.
tokenStoreEnabled Boolean
true to durably store platform-specific security tokens that are obtained during login flows; otherwise, false. The default is false.
twitterConsumerKey String
The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
twitterConsumerSecret String
The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In documentation: https://dev.twitter.com/web/sign-in
twitterConsumerSecretSettingName String
The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in.
unauthenticatedClientAction "RedirectToLoginPage" | "AllowAnonymous"
The action to take when an unauthenticated client attempts to access the app.
validateIssuer Boolean
Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such.

Outputs

All input properties are implicitly available as output properties. Additionally, the WebAppAuthSettingsSlot resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Type string
Resource type.
Id string
The provider-assigned unique ID for this managed resource.
Type string
Resource type.
id String
The provider-assigned unique ID for this managed resource.
type String
Resource type.
id string
The provider-assigned unique ID for this managed resource.
type string
Resource type.
id str
The provider-assigned unique ID for this managed resource.
type str
Resource type.
id String
The provider-assigned unique ID for this managed resource.
type String
Resource type.

Supporting Types

BuiltInAuthenticationProvider
, BuiltInAuthenticationProviderArgs

AzureActiveDirectory
AzureActiveDirectory
Facebook
Facebook
Google
Google
MicrosoftAccount
MicrosoftAccount
Twitter
Twitter
Github
Github
BuiltInAuthenticationProviderAzureActiveDirectory
AzureActiveDirectory
BuiltInAuthenticationProviderFacebook
Facebook
BuiltInAuthenticationProviderGoogle
Google
BuiltInAuthenticationProviderMicrosoftAccount
MicrosoftAccount
BuiltInAuthenticationProviderTwitter
Twitter
BuiltInAuthenticationProviderGithub
Github
AzureActiveDirectory
AzureActiveDirectory
Facebook
Facebook
Google
Google
MicrosoftAccount
MicrosoftAccount
Twitter
Twitter
Github
Github
AzureActiveDirectory
AzureActiveDirectory
Facebook
Facebook
Google
Google
MicrosoftAccount
MicrosoftAccount
Twitter
Twitter
Github
Github
AZURE_ACTIVE_DIRECTORY
AzureActiveDirectory
FACEBOOK
Facebook
GOOGLE
Google
MICROSOFT_ACCOUNT
MicrosoftAccount
TWITTER
Twitter
GITHUB
Github
"AzureActiveDirectory"
AzureActiveDirectory
"Facebook"
Facebook
"Google"
Google
"MicrosoftAccount"
MicrosoftAccount
"Twitter"
Twitter
"Github"
Github

UnauthenticatedClientAction
, UnauthenticatedClientActionArgs

RedirectToLoginPage
RedirectToLoginPage
AllowAnonymous
AllowAnonymous
UnauthenticatedClientActionRedirectToLoginPage
RedirectToLoginPage
UnauthenticatedClientActionAllowAnonymous
AllowAnonymous
RedirectToLoginPage
RedirectToLoginPage
AllowAnonymous
AllowAnonymous
RedirectToLoginPage
RedirectToLoginPage
AllowAnonymous
AllowAnonymous
REDIRECT_TO_LOGIN_PAGE
RedirectToLoginPage
ALLOW_ANONYMOUS
AllowAnonymous
"RedirectToLoginPage"
RedirectToLoginPage
"AllowAnonymous"
AllowAnonymous

Package Details

Repository
azure-native-v2 pulumi/pulumi-azure-native
License
Apache-2.0
These are the docs for Azure Native v2. We recommenend using the latest version, Azure Native v3.
Azure Native v2 v2.90.0 published on Thursday, Mar 27, 2025 by Pulumi
pulumi/pulumi-azure-native