Network.AWS.IAM.CreateOpenIdConnectProvider

Creates an IAM entity to describe an identity provider (IdP) that supports OpenID Connect (OIDC) .

The OIDC provider that you create with this operation can be used as a principal in a role's trust policy. Such a policy establishes a trust relationship between AWS and the OIDC provider.

When you create the IAM OIDC provider, you specify the following:

• The URL of the OIDC identity provider (IdP) to trust
• A list of client IDs (also known as audiences) that identify the application or applications that are allowed to authenticate using the OIDC provider
• A list of thumbprints of the server certificate(s) that the IdP uses.

You get all of this information from the OIDC IdP that you want to use to access AWS.

Creating a Request

createOpenIdConnectProvider

Arguments

:: Text

coicpURL

-> CreateOpenIdConnectProvider

Creates a value of CreateOpenIdConnectProvider with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• coicpClientIdList - A list of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that's sent as the client_id parameter on OAuth requests.) You can register multiple client IDs with the same provider. For example, you might have multiple applications that use the same OIDC provider. You cannot register more than 100 client IDs with a single IAM OIDC provider. There is no defined format for a client ID. The CreateOpenIDConnectProviderRequest operation accepts client IDs up to 255 characters long.
• coicpURL - The URL of the identity provider. The URL must begin with https:// and should correspond to the iss claim in the provider's OpenID Connect ID tokens. Per the OIDC standard, path components are allowed but query parameters are not. Typically the URL consists of only a hostname, like https://server.example.org or https://example.com . You cannot register the same provider multiple times in a single AWS account. If you try to submit a URL that has already been used for an OpenID Connect provider in the AWS account, you will get an error.
• coicpThumbprintList - A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificates. Typically this list includes only one entry. However, IAM lets you have up to five thumbprints for an OIDC provider. This lets you maintain multiple thumbprints if the identity provider is rotating certificates. The server certificate thumbprint is the hex-encoded SHA-1 hash value of the X.509 certificate used by the domain where the OpenID Connect provider makes its keys available. It is always a 40-character string. You must provide at least one thumbprint when creating an IAM OIDC provider. For example, assume that the OIDC provider is server.example.com and the provider stores its keys at https://keys.server.example.com/openid-connect. In that case, the thumbprint string would be the hex-encoded SHA-1 hash value of the certificate used by https://keys.server.example.com. For more information about obtaining the OIDC provider's thumbprint, see Obtaining the Thumbprint for an OpenID Connect Provider in the IAM User Guide .

data CreateOpenIdConnectProvider

See: createOpenIdConnectProvider smart constructor.

Instances

Eq CreateOpenIdConnectProvider

Methods

(==) :: CreateOpenIdConnectProvider -> CreateOpenIdConnectProvider -> Bool

(/=) :: CreateOpenIdConnectProvider -> CreateOpenIdConnectProvider -> Bool

Data CreateOpenIdConnectProvider

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> CreateOpenIdConnectProvider -> c CreateOpenIdConnectProvider

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c CreateOpenIdConnectProvider

toConstr :: CreateOpenIdConnectProvider -> Constr

dataTypeOf :: CreateOpenIdConnectProvider -> DataType

dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c CreateOpenIdConnectProvider)

dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c CreateOpenIdConnectProvider)

gmapT :: (forall b. Data b => b -> b) -> CreateOpenIdConnectProvider -> CreateOpenIdConnectProvider

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> CreateOpenIdConnectProvider -> r

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> CreateOpenIdConnectProvider -> r

gmapQ :: (forall d. Data d => d -> u) -> CreateOpenIdConnectProvider -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> CreateOpenIdConnectProvider -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> CreateOpenIdConnectProvider -> m CreateOpenIdConnectProvider

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> CreateOpenIdConnectProvider -> m CreateOpenIdConnectProvider

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> CreateOpenIdConnectProvider -> m CreateOpenIdConnectProvider

Read CreateOpenIdConnectProvider

Methods

readsPrec :: Int -> ReadS CreateOpenIdConnectProvider

readList :: ReadS [CreateOpenIdConnectProvider]

readPrec :: ReadPrec CreateOpenIdConnectProvider

readListPrec :: ReadPrec [CreateOpenIdConnectProvider]

Show CreateOpenIdConnectProvider

Methods

showsPrec :: Int -> CreateOpenIdConnectProvider -> ShowS

show :: CreateOpenIdConnectProvider -> String

showList :: [CreateOpenIdConnectProvider] -> ShowS

Generic CreateOpenIdConnectProvider

Associated Types

type Rep CreateOpenIdConnectProvider :: * -> *

Methods

from :: CreateOpenIdConnectProvider -> Rep CreateOpenIdConnectProvider x

to :: Rep CreateOpenIdConnectProvider x -> CreateOpenIdConnectProvider

Hashable CreateOpenIdConnectProvider

Methods

hashWithSalt :: Int -> CreateOpenIdConnectProvider -> Int

hash :: CreateOpenIdConnectProvider -> Int

NFData CreateOpenIdConnectProvider

Methods

rnf :: CreateOpenIdConnectProvider -> ()

AWSRequest CreateOpenIdConnectProvider

Associated Types

type Rs CreateOpenIdConnectProvider :: *

Methods

request :: CreateOpenIdConnectProvider -> Request CreateOpenIdConnectProvider

response :: (MonadResource m, MonadThrow m) => Logger -> Service -> Proxy * CreateOpenIdConnectProvider -> ClientResponse -> m (Response CreateOpenIdConnectProvider)

ToHeaders CreateOpenIdConnectProvider

Methods

toHeaders :: CreateOpenIdConnectProvider -> [Header]

ToPath CreateOpenIdConnectProvider

Methods

toPath :: CreateOpenIdConnectProvider -> ByteString

ToQuery CreateOpenIdConnectProvider

Methods

toQuery :: CreateOpenIdConnectProvider -> QueryString

type Rep CreateOpenIdConnectProvider

type Rep CreateOpenIdConnectProvider = D1 * (MetaData "CreateOpenIdConnectProvider" "Network.AWS.IAM.CreateOpenIdConnectProvider" "amazonka-iam-1.6.0-CI3f7XZIc4eD0Ehb04tNY7" False) (C1 * (MetaCons "CreateOpenIdConnectProvider'" PrefixI True) ((:*:) * (S1 * (MetaSel (Just Symbol "_coicpClientIdList") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 * (Maybe [Text]))) ((:*:) * (S1 * (MetaSel (Just Symbol "_coicpURL") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 * Text)) (S1 * (MetaSel (Just Symbol "_coicpThumbprintList") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 * [Text])))))

type Rs CreateOpenIdConnectProvider

type Rs CreateOpenIdConnectProvider = CreateOpenIdConnectProviderResponse

Request Lenses

coicpClientIdList :: Lens' CreateOpenIdConnectProvider [Text]

A list of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that's sent as the client_id parameter on OAuth requests.) You can register multiple client IDs with the same provider. For example, you might have multiple applications that use the same OIDC provider. You cannot register more than 100 client IDs with a single IAM OIDC provider. There is no defined format for a client ID. The CreateOpenIDConnectProviderRequest operation accepts client IDs up to 255 characters long.

coicpURL :: Lens' CreateOpenIdConnectProvider Text

The URL of the identity provider. The URL must begin with https:// and should correspond to the iss claim in the provider's OpenID Connect ID tokens. Per the OIDC standard, path components are allowed but query parameters are not. Typically the URL consists of only a hostname, like https://server.example.org or https://example.com . You cannot register the same provider multiple times in a single AWS account. If you try to submit a URL that has already been used for an OpenID Connect provider in the AWS account, you will get an error.

coicpThumbprintList :: Lens' CreateOpenIdConnectProvider [Text]

A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificates. Typically this list includes only one entry. However, IAM lets you have up to five thumbprints for an OIDC provider. This lets you maintain multiple thumbprints if the identity provider is rotating certificates. The server certificate thumbprint is the hex-encoded SHA-1 hash value of the X.509 certificate used by the domain where the OpenID Connect provider makes its keys available. It is always a 40-character string. You must provide at least one thumbprint when creating an IAM OIDC provider. For example, assume that the OIDC provider is server.example.com and the provider stores its keys at https://keys.server.example.com/openid-connect. In that case, the thumbprint string would be the hex-encoded SHA-1 hash value of the certificate used by https://keys.server.example.com. For more information about obtaining the OIDC provider's thumbprint, see Obtaining the Thumbprint for an OpenID Connect Provider in the IAM User Guide .

Destructuring the Response

createOpenIdConnectProviderResponse

Arguments

:: Int

coicprsResponseStatus

-> CreateOpenIdConnectProviderResponse

Creates a value of CreateOpenIdConnectProviderResponse with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• coicprsOpenIdConnectProviderARN - The Amazon Resource Name (ARN) of the new IAM OpenID Connect provider that is created. For more information, see OpenIDConnectProviderListEntry .
• coicprsResponseStatus - -- | The response status code.

data CreateOpenIdConnectProviderResponse

Contains the response to a successful CreateOpenIDConnectProvider request.

See: createOpenIdConnectProviderResponse smart constructor.

Instances

Eq CreateOpenIdConnectProviderResponse

Methods

(==) :: CreateOpenIdConnectProviderResponse -> CreateOpenIdConnectProviderResponse -> Bool

(/=) :: CreateOpenIdConnectProviderResponse -> CreateOpenIdConnectProviderResponse -> Bool

Data CreateOpenIdConnectProviderResponse

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> CreateOpenIdConnectProviderResponse -> c CreateOpenIdConnectProviderResponse

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c CreateOpenIdConnectProviderResponse

toConstr :: CreateOpenIdConnectProviderResponse -> Constr

dataTypeOf :: CreateOpenIdConnectProviderResponse -> DataType

dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c CreateOpenIdConnectProviderResponse)

dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c CreateOpenIdConnectProviderResponse)

gmapT :: (forall b. Data b => b -> b) -> CreateOpenIdConnectProviderResponse -> CreateOpenIdConnectProviderResponse

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> CreateOpenIdConnectProviderResponse -> r

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> CreateOpenIdConnectProviderResponse -> r

gmapQ :: (forall d. Data d => d -> u) -> CreateOpenIdConnectProviderResponse -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> CreateOpenIdConnectProviderResponse -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> CreateOpenIdConnectProviderResponse -> m CreateOpenIdConnectProviderResponse

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> CreateOpenIdConnectProviderResponse -> m CreateOpenIdConnectProviderResponse

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> CreateOpenIdConnectProviderResponse -> m CreateOpenIdConnectProviderResponse

Read CreateOpenIdConnectProviderResponse

Methods

readsPrec :: Int -> ReadS CreateOpenIdConnectProviderResponse

readList :: ReadS [CreateOpenIdConnectProviderResponse]

readPrec :: ReadPrec CreateOpenIdConnectProviderResponse

readListPrec :: ReadPrec [CreateOpenIdConnectProviderResponse]

Show CreateOpenIdConnectProviderResponse

Methods

showsPrec :: Int -> CreateOpenIdConnectProviderResponse -> ShowS

show :: CreateOpenIdConnectProviderResponse -> String

showList :: [CreateOpenIdConnectProviderResponse] -> ShowS

Generic CreateOpenIdConnectProviderResponse

Associated Types

type Rep CreateOpenIdConnectProviderResponse :: * -> *

Methods

from :: CreateOpenIdConnectProviderResponse -> Rep CreateOpenIdConnectProviderResponse x

to :: Rep CreateOpenIdConnectProviderResponse x -> CreateOpenIdConnectProviderResponse

NFData CreateOpenIdConnectProviderResponse

Methods

rnf :: CreateOpenIdConnectProviderResponse -> ()

type Rep CreateOpenIdConnectProviderResponse

type Rep CreateOpenIdConnectProviderResponse = D1 * (MetaData "CreateOpenIdConnectProviderResponse" "Network.AWS.IAM.CreateOpenIdConnectProvider" "amazonka-iam-1.6.0-CI3f7XZIc4eD0Ehb04tNY7" False) (C1 * (MetaCons "CreateOpenIdConnectProviderResponse'" PrefixI True) ((:*:) * (S1 * (MetaSel (Just Symbol "_coicprsOpenIdConnectProviderARN") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 * (Maybe Text))) (S1 * (MetaSel (Just Symbol "_coicprsResponseStatus") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 * Int))))

Response Lenses

coicprsOpenIdConnectProviderARN :: Lens' CreateOpenIdConnectProviderResponse (Maybe Text)

The Amazon Resource Name (ARN) of the new IAM OpenID Connect provider that is created. For more information, see OpenIDConnectProviderListEntry .

coicprsResponseStatus :: Lens' CreateOpenIdConnectProviderResponse Int

• - | The response status code.