AWS CDK Reference

Appearance

v2.275.0

AuthenticateOidcOptions Struct ​

Options for ListenerAction.authenciateOidc().

Source
aws-elasticloadbalancingv2/lib/alb/application-listener-action.ts
Type last changed
v2.79.0 · 10 May 2023

Example ​

ts
declare const listener: elbv2.ApplicationListener;
declare const myTargetGroup: elbv2.ApplicationTargetGroup;

listener.addAction('DefaultAction', {
  action: elbv2.ListenerAction.authenticateOidc({
    authorizationEndpoint: 'https://example.com/openid',
    // Other OIDC properties here
    clientId: '...',
    clientSecret: SecretValue.secretsManager('...'),
    issuer: '...',
    tokenEndpoint: '...',
    userInfoEndpoint: '...',

    // Next
    next: elbv2.ListenerAction.forward([myTargetGroup]),
  }),
});

Properties ​

allowHttpsOutboundoptionalbooleanallow_https_outboundoptionalboolallowHttpsOutboundoptionalBooleanAllowHttpsOutboundoptionalboolAllowHttpsOutboundoptional*bool= true#
Allow HTTPS outbound traffic to communicate with the IdP.

Set this property to false if the IP address used for the IdP endpoint is identifiable and you want to control outbound traffic. Then allow HTTPS outbound traffic to the IdP's IP address using the listener's connections property.

authenticationRequestExtraParamsoptional{ [key: string]: string }authentication_request_extra_paramsoptionaltyping.Mapping[str, str]authenticationRequestExtraParamsoptionalMap<String, String>AuthenticationRequestExtraParamsoptionalIDictionary<string, string>AuthenticationRequestExtraParamsoptional*map[string]*string#
The query parameters (up to 10) to include in the redirect request to the authorization endpoint.

Default: No extra parameters

authorizationEndpointstringauthorization_endpointstrauthorizationEndpointStringAuthorizationEndpointstringAuthorizationEndpoint*stringrequired#
The authorization endpoint of the IdP.

This must be a full URL, including the HTTPS protocol, the domain, and the path.

clientIdstringclient_idstrclientIdStringClientIdstringClientId*stringrequired#
The OAuth 2.0 client identifier.
clientSecretSecretValueclient_secretSecretValueclientSecretSecretValueClientSecretSecretValueClientSecretSecretValuerequired#
The OAuth 2.0 client secret.
issuerstringissuerstrissuerStringIssuerstringIssuer*stringrequired#
The OIDC issuer identifier of the IdP.

This must be a full URL, including the HTTPS protocol, the domain, and the path.

onUnauthenticatedRequestoptionalUnauthenticatedActionon_unauthenticated_requestoptionalUnauthenticatedActiononUnauthenticatedRequestoptionalUnauthenticatedActionOnUnauthenticatedRequestoptionalUnauthenticatedActionOnUnauthenticatedRequestoptionalUnauthenticatedAction#
The behavior if the user is not authenticated.

Default: UnauthenticatedAction.AUTHENTICATE

scopeoptionalstringscopeoptionalstrscopeoptionalStringScopeoptionalstringScopeoptional*string= "openid"#
The set of user claims to be requested from the IdP.

To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP.

sessionCookieNameoptionalstringsession_cookie_nameoptionalstrsessionCookieNameoptionalStringSessionCookieNameoptionalstringSessionCookieNameoptional*string= "AWSELBAuthSessionCookie"#
The name of the cookie used to maintain session information.
sessionTimeoutoptionalDurationsession_timeoutoptionalDurationsessionTimeoutoptionalDurationSessionTimeoutoptionalDurationSessionTimeoutoptionalDuration= Duration.days(7)#
The maximum duration of the authentication session.
tokenEndpointstringtoken_endpointstrtokenEndpointStringTokenEndpointstringTokenEndpoint*stringrequired#
The token endpoint of the IdP.

This must be a full URL, including the HTTPS protocol, the domain, and the path.

userInfoEndpointstringuser_info_endpointstruserInfoEndpointStringUserInfoEndpointstringUserInfoEndpoint*stringrequired#
The user info endpoint of the IdP.

This must be a full URL, including the HTTPS protocol, the domain, and the path.