Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Konnect Provider
  3. API Docs
  4. GatewayPluginJwtSigner
konnect 2.4.1 published on Thursday, Mar 13, 2025 by kong
kong/terraform-provider-konnect

konnect.GatewayPluginJwtSigner

Explore with Pulumi AI

konnect logo
konnect 2.4.1 published on Thursday, Mar 13, 2025 by kong
kong/terraform-provider-konnect

    GatewayPluginJwtSigner Resource

    Example Usage

    Coming soon!

    Coming soon!

    Coming soon!

    Coming soon!

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.konnect.GatewayPluginJwtSigner;
import com.pulumi.konnect.GatewayPluginJwtSignerArgs;
import com.pulumi.konnect.inputs.GatewayPluginJwtSignerConfigArgs;
import com.pulumi.konnect.inputs.GatewayPluginJwtSignerOrderingArgs;
import com.pulumi.konnect.inputs.GatewayPluginJwtSignerOrderingAfterArgs;
import com.pulumi.konnect.inputs.GatewayPluginJwtSignerOrderingBeforeArgs;
import com.pulumi.konnect.inputs.GatewayPluginJwtSignerRouteArgs;
import com.pulumi.konnect.inputs.GatewayPluginJwtSignerServiceArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var myGatewaypluginjwtsigner = new GatewayPluginJwtSigner("myGatewaypluginjwtsigner", GatewayPluginJwtSignerArgs.builder()
            .config(GatewayPluginJwtSignerConfigArgs.builder()
                .access_token_consumer_by("custom_id")
                .access_token_consumer_claim("...")
                .access_token_introspection_authorization("...my_access_token_introspection_authorization...")
                .access_token_introspection_body_args("...my_access_token_introspection_body_args...")
                .access_token_introspection_consumer_by("custom_id")
                .access_token_introspection_consumer_claim("...")
                .access_token_introspection_endpoint("...my_access_token_introspection_endpoint...")
                .access_token_introspection_hint("...my_access_token_introspection_hint...")
                .access_token_introspection_jwt_claim("...")
                .access_token_introspection_leeway(6.18)
                .access_token_introspection_scopes_claim("...")
                .access_token_introspection_scopes_required("...")
                .access_token_introspection_timeout(4.24)
                .access_token_issuer("...my_access_token_issuer...")
                .access_token_jwks_uri("...my_access_token_jwks_uri...")
                .access_token_jwks_uri_client_certificate("...my_access_token_jwks_uri_client_certificate...")
                .access_token_jwks_uri_client_password("...my_access_token_jwks_uri_client_password...")
                .access_token_jwks_uri_client_username("...my_access_token_jwks_uri_client_username...")
                .access_token_jwks_uri_rotate_period(0.18)
                .access_token_keyset("...my_access_token_keyset...")
                .access_token_keyset_client_certificate("...my_access_token_keyset_client_certificate...")
                .access_token_keyset_client_password("...my_access_token_keyset_client_password...")
                .access_token_keyset_client_username("...my_access_token_keyset_client_username...")
                .access_token_keyset_rotate_period(4.53)
                .access_token_leeway(0.51)
                .access_token_optional(false)
                .access_token_request_header("...my_access_token_request_header...")
                .access_token_scopes_claim("...")
                .access_token_scopes_required("...")
                .access_token_signing_algorithm("PS384")
                .access_token_upstream_header("...my_access_token_upstream_header...")
                .access_token_upstream_leeway(1.88)
                .add_access_token_claims(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                .add_channel_token_claims(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                .add_claims(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                .cache_access_token_introspection(false)
                .cache_channel_token_introspection(true)
                .channel_token_consumer_by("id")
                .channel_token_consumer_claim("...")
                .channel_token_introspection_authorization("...my_channel_token_introspection_authorization...")
                .channel_token_introspection_body_args("...my_channel_token_introspection_body_args...")
                .channel_token_introspection_consumer_by("custom_id")
                .channel_token_introspection_consumer_claim("...")
                .channel_token_introspection_endpoint("...my_channel_token_introspection_endpoint...")
                .channel_token_introspection_hint("...my_channel_token_introspection_hint...")
                .channel_token_introspection_jwt_claim("...")
                .channel_token_introspection_leeway(4.31)
                .channel_token_introspection_scopes_claim("...")
                .channel_token_introspection_scopes_required("...")
                .channel_token_introspection_timeout(6.9)
                .channel_token_issuer("...my_channel_token_issuer...")
                .channel_token_jwks_uri("...my_channel_token_jwks_uri...")
                .channel_token_jwks_uri_client_certificate("...my_channel_token_jwks_uri_client_certificate...")
                .channel_token_jwks_uri_client_password("...my_channel_token_jwks_uri_client_password...")
                .channel_token_jwks_uri_client_username("...my_channel_token_jwks_uri_client_username...")
                .channel_token_jwks_uri_rotate_period(9.27)
                .channel_token_keyset("...my_channel_token_keyset...")
                .channel_token_keyset_client_certificate("...my_channel_token_keyset_client_certificate...")
                .channel_token_keyset_client_password("...my_channel_token_keyset_client_password...")
                .channel_token_keyset_client_username("...my_channel_token_keyset_client_username...")
                .channel_token_keyset_rotate_period(0.98)
                .channel_token_leeway(4.86)
                .channel_token_optional(false)
                .channel_token_request_header("...my_channel_token_request_header...")
                .channel_token_scopes_claim("...")
                .channel_token_scopes_required("...")
                .channel_token_signing_algorithm("PS512")
                .channel_token_upstream_header("...my_channel_token_upstream_header...")
                .channel_token_upstream_leeway(5.01)
                .enable_access_token_introspection(false)
                .enable_channel_token_introspection(true)
                .enable_hs_signatures(false)
                .enable_instrumentation(true)
                .original_access_token_upstream_header("...my_original_access_token_upstream_header...")
                .original_channel_token_upstream_header("...my_original_channel_token_upstream_header...")
                .realm("...my_realm...")
                .remove_access_token_claims("...")
                .remove_channel_token_claims("...")
                .set_access_token_claims(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                .set_channel_token_claims(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                .set_claims(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                .trust_access_token_introspection(true)
                .trust_channel_token_introspection(false)
                .verify_access_token_expiry(true)
                .verify_access_token_introspection_expiry(false)
                .verify_access_token_introspection_scopes(false)
                .verify_access_token_scopes(false)
                .verify_access_token_signature(true)
                .verify_channel_token_expiry(false)
                .verify_channel_token_introspection_expiry(false)
                .verify_channel_token_introspection_scopes(true)
                .verify_channel_token_scopes(false)
                .verify_channel_token_signature(false)
                .build())
            .controlPlaneId("9524ec7d-36d9-465d-a8c5-83a3c9390458")
            .enabled(false)
            .gatewayPluginJwtSignerId("...my_id...")
            .instanceName("...my_instance_name...")
            .ordering(GatewayPluginJwtSignerOrderingArgs.builder()
                .after(GatewayPluginJwtSignerOrderingAfterArgs.builder()
                    .access("...")
                    .build())
                .before(GatewayPluginJwtSignerOrderingBeforeArgs.builder()
                    .access("...")
                    .build())
                .build())
            .protocols("https")
            .route(GatewayPluginJwtSignerRouteArgs.builder()
                .id("...my_id...")
                .build())
            .service(GatewayPluginJwtSignerServiceArgs.builder()
                .id("...my_id...")
                .build())
            .tags("...")
            .build());

    }
}

    resources:
  myGatewaypluginjwtsigner:
    type: konnect:GatewayPluginJwtSigner
    properties:
      config:
        access_token_consumer_by:
          - custom_id
        access_token_consumer_claim:
          - '...'
        access_token_introspection_authorization: '...my_access_token_introspection_authorization...'
        access_token_introspection_body_args: '...my_access_token_introspection_body_args...'
        access_token_introspection_consumer_by:
          - custom_id
        access_token_introspection_consumer_claim:
          - '...'
        access_token_introspection_endpoint: '...my_access_token_introspection_endpoint...'
        access_token_introspection_hint: '...my_access_token_introspection_hint...'
        access_token_introspection_jwt_claim:
          - '...'
        access_token_introspection_leeway: 6.18
        access_token_introspection_scopes_claim:
          - '...'
        access_token_introspection_scopes_required:
          - '...'
        access_token_introspection_timeout: 4.24
        access_token_issuer: '...my_access_token_issuer...'
        access_token_jwks_uri: '...my_access_token_jwks_uri...'
        access_token_jwks_uri_client_certificate: '...my_access_token_jwks_uri_client_certificate...'
        access_token_jwks_uri_client_password: '...my_access_token_jwks_uri_client_password...'
        access_token_jwks_uri_client_username: '...my_access_token_jwks_uri_client_username...'
        access_token_jwks_uri_rotate_period: 0.18
        access_token_keyset: '...my_access_token_keyset...'
        access_token_keyset_client_certificate: '...my_access_token_keyset_client_certificate...'
        access_token_keyset_client_password: '...my_access_token_keyset_client_password...'
        access_token_keyset_client_username: '...my_access_token_keyset_client_username...'
        access_token_keyset_rotate_period: 4.53
        access_token_leeway: 0.51
        access_token_optional: false
        access_token_request_header: '...my_access_token_request_header...'
        access_token_scopes_claim:
          - '...'
        access_token_scopes_required:
          - '...'
        access_token_signing_algorithm: PS384
        access_token_upstream_header: '...my_access_token_upstream_header...'
        access_token_upstream_leeway: 1.88
        add_access_token_claims:
          key:
            fn::toJSON: value
        add_channel_token_claims:
          key:
            fn::toJSON: value
        add_claims:
          key:
            fn::toJSON: value
        cache_access_token_introspection: false
        cache_channel_token_introspection: true
        channel_token_consumer_by:
          - id
        channel_token_consumer_claim:
          - '...'
        channel_token_introspection_authorization: '...my_channel_token_introspection_authorization...'
        channel_token_introspection_body_args: '...my_channel_token_introspection_body_args...'
        channel_token_introspection_consumer_by:
          - custom_id
        channel_token_introspection_consumer_claim:
          - '...'
        channel_token_introspection_endpoint: '...my_channel_token_introspection_endpoint...'
        channel_token_introspection_hint: '...my_channel_token_introspection_hint...'
        channel_token_introspection_jwt_claim:
          - '...'
        channel_token_introspection_leeway: 4.31
        channel_token_introspection_scopes_claim:
          - '...'
        channel_token_introspection_scopes_required:
          - '...'
        channel_token_introspection_timeout: 6.9
        channel_token_issuer: '...my_channel_token_issuer...'
        channel_token_jwks_uri: '...my_channel_token_jwks_uri...'
        channel_token_jwks_uri_client_certificate: '...my_channel_token_jwks_uri_client_certificate...'
        channel_token_jwks_uri_client_password: '...my_channel_token_jwks_uri_client_password...'
        channel_token_jwks_uri_client_username: '...my_channel_token_jwks_uri_client_username...'
        channel_token_jwks_uri_rotate_period: 9.27
        channel_token_keyset: '...my_channel_token_keyset...'
        channel_token_keyset_client_certificate: '...my_channel_token_keyset_client_certificate...'
        channel_token_keyset_client_password: '...my_channel_token_keyset_client_password...'
        channel_token_keyset_client_username: '...my_channel_token_keyset_client_username...'
        channel_token_keyset_rotate_period: 0.98
        channel_token_leeway: 4.86
        channel_token_optional: false
        channel_token_request_header: '...my_channel_token_request_header...'
        channel_token_scopes_claim:
          - '...'
        channel_token_scopes_required:
          - '...'
        channel_token_signing_algorithm: PS512
        channel_token_upstream_header: '...my_channel_token_upstream_header...'
        channel_token_upstream_leeway: 5.01
        enable_access_token_introspection: false
        enable_channel_token_introspection: true
        enable_hs_signatures: false
        enable_instrumentation: true
        original_access_token_upstream_header: '...my_original_access_token_upstream_header...'
        original_channel_token_upstream_header: '...my_original_channel_token_upstream_header...'
        realm: '...my_realm...'
        remove_access_token_claims:
          - '...'
        remove_channel_token_claims:
          - '...'
        set_access_token_claims:
          key:
            fn::toJSON: value
        set_channel_token_claims:
          key:
            fn::toJSON: value
        set_claims:
          key:
            fn::toJSON: value
        trust_access_token_introspection: true
        trust_channel_token_introspection: false
        verify_access_token_expiry: true
        verify_access_token_introspection_expiry: false
        verify_access_token_introspection_scopes: false
        verify_access_token_scopes: false
        verify_access_token_signature: true
        verify_channel_token_expiry: false
        verify_channel_token_introspection_expiry: false
        verify_channel_token_introspection_scopes: true
        verify_channel_token_scopes: false
        verify_channel_token_signature: false
      controlPlaneId: 9524ec7d-36d9-465d-a8c5-83a3c9390458
      enabled: false
      gatewayPluginJwtSignerId: '...my_id...'
      instanceName: '...my_instance_name...'
      ordering:
        after:
          access:
            - '...'
        before:
          access:
            - '...'
      protocols:
        - https
      route:
        id: '...my_id...'
      service:
        id: '...my_id...'
      tags:
        - '...'

    Create GatewayPluginJwtSigner Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new GatewayPluginJwtSigner(name: string, args: GatewayPluginJwtSignerArgs, opts?: CustomResourceOptions);
    @overload
def GatewayPluginJwtSigner(resource_name: str,
                           args: GatewayPluginJwtSignerArgs,
                           opts: Optional[ResourceOptions] = None)

@overload
def GatewayPluginJwtSigner(resource_name: str,
                           opts: Optional[ResourceOptions] = None,
                           config: Optional[GatewayPluginJwtSignerConfigArgs] = None,
                           control_plane_id: Optional[str] = None,
                           enabled: Optional[bool] = None,
                           gateway_plugin_jwt_signer_id: Optional[str] = None,
                           instance_name: Optional[str] = None,
                           ordering: Optional[GatewayPluginJwtSignerOrderingArgs] = None,
                           protocols: Optional[Sequence[str]] = None,
                           route: Optional[GatewayPluginJwtSignerRouteArgs] = None,
                           service: Optional[GatewayPluginJwtSignerServiceArgs] = None,
                           tags: Optional[Sequence[str]] = None)
    func NewGatewayPluginJwtSigner(ctx *Context, name string, args GatewayPluginJwtSignerArgs, opts ...ResourceOption) (*GatewayPluginJwtSigner, error)
    public GatewayPluginJwtSigner(string name, GatewayPluginJwtSignerArgs args, CustomResourceOptions? opts = null)
    public GatewayPluginJwtSigner(String name, GatewayPluginJwtSignerArgs args)
public GatewayPluginJwtSigner(String name, GatewayPluginJwtSignerArgs args, CustomResourceOptions options)

    type: konnect:GatewayPluginJwtSigner
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args GatewayPluginJwtSignerArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args GatewayPluginJwtSignerArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args GatewayPluginJwtSignerArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args GatewayPluginJwtSignerArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args GatewayPluginJwtSignerArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var gatewayPluginJwtSignerResource = new Konnect.GatewayPluginJwtSigner("gatewayPluginJwtSignerResource", new()
{
    Config = new Konnect.Inputs.GatewayPluginJwtSignerConfigArgs
    {
        AccessTokenConsumerBies = new[]
        {
            "string",
        },
        AccessTokenConsumerClaims = new[]
        {
            "string",
        },
        AccessTokenIntrospectionAuthorization = "string",
        AccessTokenIntrospectionBodyArgs = "string",
        AccessTokenIntrospectionConsumerBies = new[]
        {
            "string",
        },
        AccessTokenIntrospectionConsumerClaims = new[]
        {
            "string",
        },
        AccessTokenIntrospectionEndpoint = "string",
        AccessTokenIntrospectionHint = "string",
        AccessTokenIntrospectionJwtClaims = new[]
        {
            "string",
        },
        AccessTokenIntrospectionLeeway = 0,
        AccessTokenIntrospectionScopesClaims = new[]
        {
            "string",
        },
        AccessTokenIntrospectionScopesRequireds = new[]
        {
            "string",
        },
        AccessTokenIntrospectionTimeout = 0,
        AccessTokenIssuer = "string",
        AccessTokenJwksUri = "string",
        AccessTokenJwksUriClientCertificate = "string",
        AccessTokenJwksUriClientPassword = "string",
        AccessTokenJwksUriClientUsername = "string",
        AccessTokenJwksUriRotatePeriod = 0,
        AccessTokenKeyset = "string",
        AccessTokenKeysetClientCertificate = "string",
        AccessTokenKeysetClientPassword = "string",
        AccessTokenKeysetClientUsername = "string",
        AccessTokenKeysetRotatePeriod = 0,
        AccessTokenLeeway = 0,
        AccessTokenOptional = false,
        AccessTokenRequestHeader = "string",
        AccessTokenScopesClaims = new[]
        {
            "string",
        },
        AccessTokenScopesRequireds = new[]
        {
            "string",
        },
        AccessTokenSigningAlgorithm = "string",
        AccessTokenUpstreamHeader = "string",
        AccessTokenUpstreamLeeway = 0,
        AddAccessTokenClaims = 
        {
            { "string", "string" },
        },
        AddChannelTokenClaims = 
        {
            { "string", "string" },
        },
        AddClaims = 
        {
            { "string", "string" },
        },
        CacheAccessTokenIntrospection = false,
        CacheChannelTokenIntrospection = false,
        ChannelTokenConsumerBies = new[]
        {
            "string",
        },
        ChannelTokenConsumerClaims = new[]
        {
            "string",
        },
        ChannelTokenIntrospectionAuthorization = "string",
        ChannelTokenIntrospectionBodyArgs = "string",
        ChannelTokenIntrospectionConsumerBies = new[]
        {
            "string",
        },
        ChannelTokenIntrospectionConsumerClaims = new[]
        {
            "string",
        },
        ChannelTokenIntrospectionEndpoint = "string",
        ChannelTokenIntrospectionHint = "string",
        ChannelTokenIntrospectionJwtClaims = new[]
        {
            "string",
        },
        ChannelTokenIntrospectionLeeway = 0,
        ChannelTokenIntrospectionScopesClaims = new[]
        {
            "string",
        },
        ChannelTokenIntrospectionScopesRequireds = new[]
        {
            "string",
        },
        ChannelTokenIntrospectionTimeout = 0,
        ChannelTokenIssuer = "string",
        ChannelTokenJwksUri = "string",
        ChannelTokenJwksUriClientCertificate = "string",
        ChannelTokenJwksUriClientPassword = "string",
        ChannelTokenJwksUriClientUsername = "string",
        ChannelTokenJwksUriRotatePeriod = 0,
        ChannelTokenKeyset = "string",
        ChannelTokenKeysetClientCertificate = "string",
        ChannelTokenKeysetClientPassword = "string",
        ChannelTokenKeysetClientUsername = "string",
        ChannelTokenKeysetRotatePeriod = 0,
        ChannelTokenLeeway = 0,
        ChannelTokenOptional = false,
        ChannelTokenRequestHeader = "string",
        ChannelTokenScopesClaims = new[]
        {
            "string",
        },
        ChannelTokenScopesRequireds = new[]
        {
            "string",
        },
        ChannelTokenSigningAlgorithm = "string",
        ChannelTokenUpstreamHeader = "string",
        ChannelTokenUpstreamLeeway = 0,
        EnableAccessTokenIntrospection = false,
        EnableChannelTokenIntrospection = false,
        EnableHsSignatures = false,
        EnableInstrumentation = false,
        OriginalAccessTokenUpstreamHeader = "string",
        OriginalChannelTokenUpstreamHeader = "string",
        Realm = "string",
        RemoveAccessTokenClaims = new[]
        {
            "string",
        },
        RemoveChannelTokenClaims = new[]
        {
            "string",
        },
        SetAccessTokenClaims = 
        {
            { "string", "string" },
        },
        SetChannelTokenClaims = 
        {
            { "string", "string" },
        },
        SetClaims = 
        {
            { "string", "string" },
        },
        TrustAccessTokenIntrospection = false,
        TrustChannelTokenIntrospection = false,
        VerifyAccessTokenExpiry = false,
        VerifyAccessTokenIntrospectionExpiry = false,
        VerifyAccessTokenIntrospectionScopes = false,
        VerifyAccessTokenScopes = false,
        VerifyAccessTokenSignature = false,
        VerifyChannelTokenExpiry = false,
        VerifyChannelTokenIntrospectionExpiry = false,
        VerifyChannelTokenIntrospectionScopes = false,
        VerifyChannelTokenScopes = false,
        VerifyChannelTokenSignature = false,
    },
    ControlPlaneId = "string",
    Enabled = false,
    GatewayPluginJwtSignerId = "string",
    InstanceName = "string",
    Ordering = new Konnect.Inputs.GatewayPluginJwtSignerOrderingArgs
    {
        After = new Konnect.Inputs.GatewayPluginJwtSignerOrderingAfterArgs
        {
            Accesses = new[]
            {
                "string",
            },
        },
        Before = new Konnect.Inputs.GatewayPluginJwtSignerOrderingBeforeArgs
        {
            Accesses = new[]
            {
                "string",
            },
        },
    },
    Protocols = new[]
    {
        "string",
    },
    Route = new Konnect.Inputs.GatewayPluginJwtSignerRouteArgs
    {
        Id = "string",
    },
    Service = new Konnect.Inputs.GatewayPluginJwtSignerServiceArgs
    {
        Id = "string",
    },
    Tags = new[]
    {
        "string",
    },
});

    example, err := konnect.NewGatewayPluginJwtSigner(ctx, "gatewayPluginJwtSignerResource", &konnect.GatewayPluginJwtSignerArgs{
Config: &.GatewayPluginJwtSignerConfigArgs{
AccessTokenConsumerBies: pulumi.StringArray{
pulumi.String("string"),
},
AccessTokenConsumerClaims: pulumi.StringArray{
pulumi.String("string"),
},
AccessTokenIntrospectionAuthorization: pulumi.String("string"),
AccessTokenIntrospectionBodyArgs: pulumi.String("string"),
AccessTokenIntrospectionConsumerBies: pulumi.StringArray{
pulumi.String("string"),
},
AccessTokenIntrospectionConsumerClaims: pulumi.StringArray{
pulumi.String("string"),
},
AccessTokenIntrospectionEndpoint: pulumi.String("string"),
AccessTokenIntrospectionHint: pulumi.String("string"),
AccessTokenIntrospectionJwtClaims: pulumi.StringArray{
pulumi.String("string"),
},
AccessTokenIntrospectionLeeway: pulumi.Float64(0),
AccessTokenIntrospectionScopesClaims: pulumi.StringArray{
pulumi.String("string"),
},
AccessTokenIntrospectionScopesRequireds: pulumi.StringArray{
pulumi.String("string"),
},
AccessTokenIntrospectionTimeout: pulumi.Float64(0),
AccessTokenIssuer: pulumi.String("string"),
AccessTokenJwksUri: pulumi.String("string"),
AccessTokenJwksUriClientCertificate: pulumi.String("string"),
AccessTokenJwksUriClientPassword: pulumi.String("string"),
AccessTokenJwksUriClientUsername: pulumi.String("string"),
AccessTokenJwksUriRotatePeriod: pulumi.Float64(0),
AccessTokenKeyset: pulumi.String("string"),
AccessTokenKeysetClientCertificate: pulumi.String("string"),
AccessTokenKeysetClientPassword: pulumi.String("string"),
AccessTokenKeysetClientUsername: pulumi.String("string"),
AccessTokenKeysetRotatePeriod: pulumi.Float64(0),
AccessTokenLeeway: pulumi.Float64(0),
AccessTokenOptional: pulumi.Bool(false),
AccessTokenRequestHeader: pulumi.String("string"),
AccessTokenScopesClaims: pulumi.StringArray{
pulumi.String("string"),
},
AccessTokenScopesRequireds: pulumi.StringArray{
pulumi.String("string"),
},
AccessTokenSigningAlgorithm: pulumi.String("string"),
AccessTokenUpstreamHeader: pulumi.String("string"),
AccessTokenUpstreamLeeway: pulumi.Float64(0),
AddAccessTokenClaims: pulumi.StringMap{
"string": pulumi.String("string"),
},
AddChannelTokenClaims: pulumi.StringMap{
"string": pulumi.String("string"),
},
AddClaims: pulumi.StringMap{
"string": pulumi.String("string"),
},
CacheAccessTokenIntrospection: pulumi.Bool(false),
CacheChannelTokenIntrospection: pulumi.Bool(false),
ChannelTokenConsumerBies: pulumi.StringArray{
pulumi.String("string"),
},
ChannelTokenConsumerClaims: pulumi.StringArray{
pulumi.String("string"),
},
ChannelTokenIntrospectionAuthorization: pulumi.String("string"),
ChannelTokenIntrospectionBodyArgs: pulumi.String("string"),
ChannelTokenIntrospectionConsumerBies: pulumi.StringArray{
pulumi.String("string"),
},
ChannelTokenIntrospectionConsumerClaims: pulumi.StringArray{
pulumi.String("string"),
},
ChannelTokenIntrospectionEndpoint: pulumi.String("string"),
ChannelTokenIntrospectionHint: pulumi.String("string"),
ChannelTokenIntrospectionJwtClaims: pulumi.StringArray{
pulumi.String("string"),
},
ChannelTokenIntrospectionLeeway: pulumi.Float64(0),
ChannelTokenIntrospectionScopesClaims: pulumi.StringArray{
pulumi.String("string"),
},
ChannelTokenIntrospectionScopesRequireds: pulumi.StringArray{
pulumi.String("string"),
},
ChannelTokenIntrospectionTimeout: pulumi.Float64(0),
ChannelTokenIssuer: pulumi.String("string"),
ChannelTokenJwksUri: pulumi.String("string"),
ChannelTokenJwksUriClientCertificate: pulumi.String("string"),
ChannelTokenJwksUriClientPassword: pulumi.String("string"),
ChannelTokenJwksUriClientUsername: pulumi.String("string"),
ChannelTokenJwksUriRotatePeriod: pulumi.Float64(0),
ChannelTokenKeyset: pulumi.String("string"),
ChannelTokenKeysetClientCertificate: pulumi.String("string"),
ChannelTokenKeysetClientPassword: pulumi.String("string"),
ChannelTokenKeysetClientUsername: pulumi.String("string"),
ChannelTokenKeysetRotatePeriod: pulumi.Float64(0),
ChannelTokenLeeway: pulumi.Float64(0),
ChannelTokenOptional: pulumi.Bool(false),
ChannelTokenRequestHeader: pulumi.String("string"),
ChannelTokenScopesClaims: pulumi.StringArray{
pulumi.String("string"),
},
ChannelTokenScopesRequireds: pulumi.StringArray{
pulumi.String("string"),
},
ChannelTokenSigningAlgorithm: pulumi.String("string"),
ChannelTokenUpstreamHeader: pulumi.String("string"),
ChannelTokenUpstreamLeeway: pulumi.Float64(0),
EnableAccessTokenIntrospection: pulumi.Bool(false),
EnableChannelTokenIntrospection: pulumi.Bool(false),
EnableHsSignatures: pulumi.Bool(false),
EnableInstrumentation: pulumi.Bool(false),
OriginalAccessTokenUpstreamHeader: pulumi.String("string"),
OriginalChannelTokenUpstreamHeader: pulumi.String("string"),
Realm: pulumi.String("string"),
RemoveAccessTokenClaims: pulumi.StringArray{
pulumi.String("string"),
},
RemoveChannelTokenClaims: pulumi.StringArray{
pulumi.String("string"),
},
SetAccessTokenClaims: pulumi.StringMap{
"string": pulumi.String("string"),
},
SetChannelTokenClaims: pulumi.StringMap{
"string": pulumi.String("string"),
},
SetClaims: pulumi.StringMap{
"string": pulumi.String("string"),
},
TrustAccessTokenIntrospection: pulumi.Bool(false),
TrustChannelTokenIntrospection: pulumi.Bool(false),
VerifyAccessTokenExpiry: pulumi.Bool(false),
VerifyAccessTokenIntrospectionExpiry: pulumi.Bool(false),
VerifyAccessTokenIntrospectionScopes: pulumi.Bool(false),
VerifyAccessTokenScopes: pulumi.Bool(false),
VerifyAccessTokenSignature: pulumi.Bool(false),
VerifyChannelTokenExpiry: pulumi.Bool(false),
VerifyChannelTokenIntrospectionExpiry: pulumi.Bool(false),
VerifyChannelTokenIntrospectionScopes: pulumi.Bool(false),
VerifyChannelTokenScopes: pulumi.Bool(false),
VerifyChannelTokenSignature: pulumi.Bool(false),
},
ControlPlaneId: pulumi.String("string"),
Enabled: pulumi.Bool(false),
GatewayPluginJwtSignerId: pulumi.String("string"),
InstanceName: pulumi.String("string"),
Ordering: &.GatewayPluginJwtSignerOrderingArgs{
After: &.GatewayPluginJwtSignerOrderingAfterArgs{
Accesses: pulumi.StringArray{
pulumi.String("string"),
},
},
Before: &.GatewayPluginJwtSignerOrderingBeforeArgs{
Accesses: pulumi.StringArray{
pulumi.String("string"),
},
},
},
Protocols: pulumi.StringArray{
pulumi.String("string"),
},
Route: &.GatewayPluginJwtSignerRouteArgs{
Id: pulumi.String("string"),
},
Service: &.GatewayPluginJwtSignerServiceArgs{
Id: pulumi.String("string"),
},
Tags: pulumi.StringArray{
pulumi.String("string"),
},
})

    var gatewayPluginJwtSignerResource = new GatewayPluginJwtSigner("gatewayPluginJwtSignerResource", GatewayPluginJwtSignerArgs.builder()
    .config(GatewayPluginJwtSignerConfigArgs.builder()
        .accessTokenConsumerBies("string")
        .accessTokenConsumerClaims("string")
        .accessTokenIntrospectionAuthorization("string")
        .accessTokenIntrospectionBodyArgs("string")
        .accessTokenIntrospectionConsumerBies("string")
        .accessTokenIntrospectionConsumerClaims("string")
        .accessTokenIntrospectionEndpoint("string")
        .accessTokenIntrospectionHint("string")
        .accessTokenIntrospectionJwtClaims("string")
        .accessTokenIntrospectionLeeway(0)
        .accessTokenIntrospectionScopesClaims("string")
        .accessTokenIntrospectionScopesRequireds("string")
        .accessTokenIntrospectionTimeout(0)
        .accessTokenIssuer("string")
        .accessTokenJwksUri("string")
        .accessTokenJwksUriClientCertificate("string")
        .accessTokenJwksUriClientPassword("string")
        .accessTokenJwksUriClientUsername("string")
        .accessTokenJwksUriRotatePeriod(0)
        .accessTokenKeyset("string")
        .accessTokenKeysetClientCertificate("string")
        .accessTokenKeysetClientPassword("string")
        .accessTokenKeysetClientUsername("string")
        .accessTokenKeysetRotatePeriod(0)
        .accessTokenLeeway(0)
        .accessTokenOptional(false)
        .accessTokenRequestHeader("string")
        .accessTokenScopesClaims("string")
        .accessTokenScopesRequireds("string")
        .accessTokenSigningAlgorithm("string")
        .accessTokenUpstreamHeader("string")
        .accessTokenUpstreamLeeway(0)
        .addAccessTokenClaims(Map.of("string", "string"))
        .addChannelTokenClaims(Map.of("string", "string"))
        .addClaims(Map.of("string", "string"))
        .cacheAccessTokenIntrospection(false)
        .cacheChannelTokenIntrospection(false)
        .channelTokenConsumerBies("string")
        .channelTokenConsumerClaims("string")
        .channelTokenIntrospectionAuthorization("string")
        .channelTokenIntrospectionBodyArgs("string")
        .channelTokenIntrospectionConsumerBies("string")
        .channelTokenIntrospectionConsumerClaims("string")
        .channelTokenIntrospectionEndpoint("string")
        .channelTokenIntrospectionHint("string")
        .channelTokenIntrospectionJwtClaims("string")
        .channelTokenIntrospectionLeeway(0)
        .channelTokenIntrospectionScopesClaims("string")
        .channelTokenIntrospectionScopesRequireds("string")
        .channelTokenIntrospectionTimeout(0)
        .channelTokenIssuer("string")
        .channelTokenJwksUri("string")
        .channelTokenJwksUriClientCertificate("string")
        .channelTokenJwksUriClientPassword("string")
        .channelTokenJwksUriClientUsername("string")
        .channelTokenJwksUriRotatePeriod(0)
        .channelTokenKeyset("string")
        .channelTokenKeysetClientCertificate("string")
        .channelTokenKeysetClientPassword("string")
        .channelTokenKeysetClientUsername("string")
        .channelTokenKeysetRotatePeriod(0)
        .channelTokenLeeway(0)
        .channelTokenOptional(false)
        .channelTokenRequestHeader("string")
        .channelTokenScopesClaims("string")
        .channelTokenScopesRequireds("string")
        .channelTokenSigningAlgorithm("string")
        .channelTokenUpstreamHeader("string")
        .channelTokenUpstreamLeeway(0)
        .enableAccessTokenIntrospection(false)
        .enableChannelTokenIntrospection(false)
        .enableHsSignatures(false)
        .enableInstrumentation(false)
        .originalAccessTokenUpstreamHeader("string")
        .originalChannelTokenUpstreamHeader("string")
        .realm("string")
        .removeAccessTokenClaims("string")
        .removeChannelTokenClaims("string")
        .setAccessTokenClaims(Map.of("string", "string"))
        .setChannelTokenClaims(Map.of("string", "string"))
        .setClaims(Map.of("string", "string"))
        .trustAccessTokenIntrospection(false)
        .trustChannelTokenIntrospection(false)
        .verifyAccessTokenExpiry(false)
        .verifyAccessTokenIntrospectionExpiry(false)
        .verifyAccessTokenIntrospectionScopes(false)
        .verifyAccessTokenScopes(false)
        .verifyAccessTokenSignature(false)
        .verifyChannelTokenExpiry(false)
        .verifyChannelTokenIntrospectionExpiry(false)
        .verifyChannelTokenIntrospectionScopes(false)
        .verifyChannelTokenScopes(false)
        .verifyChannelTokenSignature(false)
        .build())
    .controlPlaneId("string")
    .enabled(false)
    .gatewayPluginJwtSignerId("string")
    .instanceName("string")
    .ordering(GatewayPluginJwtSignerOrderingArgs.builder()
        .after(GatewayPluginJwtSignerOrderingAfterArgs.builder()
            .accesses("string")
            .build())
        .before(GatewayPluginJwtSignerOrderingBeforeArgs.builder()
            .accesses("string")
            .build())
        .build())
    .protocols("string")
    .route(GatewayPluginJwtSignerRouteArgs.builder()
        .id("string")
        .build())
    .service(GatewayPluginJwtSignerServiceArgs.builder()
        .id("string")
        .build())
    .tags("string")
    .build());

    gateway_plugin_jwt_signer_resource = konnect.GatewayPluginJwtSigner("gatewayPluginJwtSignerResource",
    config={
        "access_token_consumer_bies": ["string"],
        "access_token_consumer_claims": ["string"],
        "access_token_introspection_authorization": "string",
        "access_token_introspection_body_args": "string",
        "access_token_introspection_consumer_bies": ["string"],
        "access_token_introspection_consumer_claims": ["string"],
        "access_token_introspection_endpoint": "string",
        "access_token_introspection_hint": "string",
        "access_token_introspection_jwt_claims": ["string"],
        "access_token_introspection_leeway": 0,
        "access_token_introspection_scopes_claims": ["string"],
        "access_token_introspection_scopes_requireds": ["string"],
        "access_token_introspection_timeout": 0,
        "access_token_issuer": "string",
        "access_token_jwks_uri": "string",
        "access_token_jwks_uri_client_certificate": "string",
        "access_token_jwks_uri_client_password": "string",
        "access_token_jwks_uri_client_username": "string",
        "access_token_jwks_uri_rotate_period": 0,
        "access_token_keyset": "string",
        "access_token_keyset_client_certificate": "string",
        "access_token_keyset_client_password": "string",
        "access_token_keyset_client_username": "string",
        "access_token_keyset_rotate_period": 0,
        "access_token_leeway": 0,
        "access_token_optional": False,
        "access_token_request_header": "string",
        "access_token_scopes_claims": ["string"],
        "access_token_scopes_requireds": ["string"],
        "access_token_signing_algorithm": "string",
        "access_token_upstream_header": "string",
        "access_token_upstream_leeway": 0,
        "add_access_token_claims": {
            "string": "string",
        },
        "add_channel_token_claims": {
            "string": "string",
        },
        "add_claims": {
            "string": "string",
        },
        "cache_access_token_introspection": False,
        "cache_channel_token_introspection": False,
        "channel_token_consumer_bies": ["string"],
        "channel_token_consumer_claims": ["string"],
        "channel_token_introspection_authorization": "string",
        "channel_token_introspection_body_args": "string",
        "channel_token_introspection_consumer_bies": ["string"],
        "channel_token_introspection_consumer_claims": ["string"],
        "channel_token_introspection_endpoint": "string",
        "channel_token_introspection_hint": "string",
        "channel_token_introspection_jwt_claims": ["string"],
        "channel_token_introspection_leeway": 0,
        "channel_token_introspection_scopes_claims": ["string"],
        "channel_token_introspection_scopes_requireds": ["string"],
        "channel_token_introspection_timeout": 0,
        "channel_token_issuer": "string",
        "channel_token_jwks_uri": "string",
        "channel_token_jwks_uri_client_certificate": "string",
        "channel_token_jwks_uri_client_password": "string",
        "channel_token_jwks_uri_client_username": "string",
        "channel_token_jwks_uri_rotate_period": 0,
        "channel_token_keyset": "string",
        "channel_token_keyset_client_certificate": "string",
        "channel_token_keyset_client_password": "string",
        "channel_token_keyset_client_username": "string",
        "channel_token_keyset_rotate_period": 0,
        "channel_token_leeway": 0,
        "channel_token_optional": False,
        "channel_token_request_header": "string",
        "channel_token_scopes_claims": ["string"],
        "channel_token_scopes_requireds": ["string"],
        "channel_token_signing_algorithm": "string",
        "channel_token_upstream_header": "string",
        "channel_token_upstream_leeway": 0,
        "enable_access_token_introspection": False,
        "enable_channel_token_introspection": False,
        "enable_hs_signatures": False,
        "enable_instrumentation": False,
        "original_access_token_upstream_header": "string",
        "original_channel_token_upstream_header": "string",
        "realm": "string",
        "remove_access_token_claims": ["string"],
        "remove_channel_token_claims": ["string"],
        "set_access_token_claims": {
            "string": "string",
        },
        "set_channel_token_claims": {
            "string": "string",
        },
        "set_claims": {
            "string": "string",
        },
        "trust_access_token_introspection": False,
        "trust_channel_token_introspection": False,
        "verify_access_token_expiry": False,
        "verify_access_token_introspection_expiry": False,
        "verify_access_token_introspection_scopes": False,
        "verify_access_token_scopes": False,
        "verify_access_token_signature": False,
        "verify_channel_token_expiry": False,
        "verify_channel_token_introspection_expiry": False,
        "verify_channel_token_introspection_scopes": False,
        "verify_channel_token_scopes": False,
        "verify_channel_token_signature": False,
    },
    control_plane_id="string",
    enabled=False,
    gateway_plugin_jwt_signer_id="string",
    instance_name="string",
    ordering={
        "after": {
            "accesses": ["string"],
        },
        "before": {
            "accesses": ["string"],
        },
    },
    protocols=["string"],
    route={
        "id": "string",
    },
    service={
        "id": "string",
    },
    tags=["string"])

    const gatewayPluginJwtSignerResource = new konnect.GatewayPluginJwtSigner("gatewayPluginJwtSignerResource", {
    config: {
        accessTokenConsumerBies: ["string"],
        accessTokenConsumerClaims: ["string"],
        accessTokenIntrospectionAuthorization: "string",
        accessTokenIntrospectionBodyArgs: "string",
        accessTokenIntrospectionConsumerBies: ["string"],
        accessTokenIntrospectionConsumerClaims: ["string"],
        accessTokenIntrospectionEndpoint: "string",
        accessTokenIntrospectionHint: "string",
        accessTokenIntrospectionJwtClaims: ["string"],
        accessTokenIntrospectionLeeway: 0,
        accessTokenIntrospectionScopesClaims: ["string"],
        accessTokenIntrospectionScopesRequireds: ["string"],
        accessTokenIntrospectionTimeout: 0,
        accessTokenIssuer: "string",
        accessTokenJwksUri: "string",
        accessTokenJwksUriClientCertificate: "string",
        accessTokenJwksUriClientPassword: "string",
        accessTokenJwksUriClientUsername: "string",
        accessTokenJwksUriRotatePeriod: 0,
        accessTokenKeyset: "string",
        accessTokenKeysetClientCertificate: "string",
        accessTokenKeysetClientPassword: "string",
        accessTokenKeysetClientUsername: "string",
        accessTokenKeysetRotatePeriod: 0,
        accessTokenLeeway: 0,
        accessTokenOptional: false,
        accessTokenRequestHeader: "string",
        accessTokenScopesClaims: ["string"],
        accessTokenScopesRequireds: ["string"],
        accessTokenSigningAlgorithm: "string",
        accessTokenUpstreamHeader: "string",
        accessTokenUpstreamLeeway: 0,
        addAccessTokenClaims: {
            string: "string",
        },
        addChannelTokenClaims: {
            string: "string",
        },
        addClaims: {
            string: "string",
        },
        cacheAccessTokenIntrospection: false,
        cacheChannelTokenIntrospection: false,
        channelTokenConsumerBies: ["string"],
        channelTokenConsumerClaims: ["string"],
        channelTokenIntrospectionAuthorization: "string",
        channelTokenIntrospectionBodyArgs: "string",
        channelTokenIntrospectionConsumerBies: ["string"],
        channelTokenIntrospectionConsumerClaims: ["string"],
        channelTokenIntrospectionEndpoint: "string",
        channelTokenIntrospectionHint: "string",
        channelTokenIntrospectionJwtClaims: ["string"],
        channelTokenIntrospectionLeeway: 0,
        channelTokenIntrospectionScopesClaims: ["string"],
        channelTokenIntrospectionScopesRequireds: ["string"],
        channelTokenIntrospectionTimeout: 0,
        channelTokenIssuer: "string",
        channelTokenJwksUri: "string",
        channelTokenJwksUriClientCertificate: "string",
        channelTokenJwksUriClientPassword: "string",
        channelTokenJwksUriClientUsername: "string",
        channelTokenJwksUriRotatePeriod: 0,
        channelTokenKeyset: "string",
        channelTokenKeysetClientCertificate: "string",
        channelTokenKeysetClientPassword: "string",
        channelTokenKeysetClientUsername: "string",
        channelTokenKeysetRotatePeriod: 0,
        channelTokenLeeway: 0,
        channelTokenOptional: false,
        channelTokenRequestHeader: "string",
        channelTokenScopesClaims: ["string"],
        channelTokenScopesRequireds: ["string"],
        channelTokenSigningAlgorithm: "string",
        channelTokenUpstreamHeader: "string",
        channelTokenUpstreamLeeway: 0,
        enableAccessTokenIntrospection: false,
        enableChannelTokenIntrospection: false,
        enableHsSignatures: false,
        enableInstrumentation: false,
        originalAccessTokenUpstreamHeader: "string",
        originalChannelTokenUpstreamHeader: "string",
        realm: "string",
        removeAccessTokenClaims: ["string"],
        removeChannelTokenClaims: ["string"],
        setAccessTokenClaims: {
            string: "string",
        },
        setChannelTokenClaims: {
            string: "string",
        },
        setClaims: {
            string: "string",
        },
        trustAccessTokenIntrospection: false,
        trustChannelTokenIntrospection: false,
        verifyAccessTokenExpiry: false,
        verifyAccessTokenIntrospectionExpiry: false,
        verifyAccessTokenIntrospectionScopes: false,
        verifyAccessTokenScopes: false,
        verifyAccessTokenSignature: false,
        verifyChannelTokenExpiry: false,
        verifyChannelTokenIntrospectionExpiry: false,
        verifyChannelTokenIntrospectionScopes: false,
        verifyChannelTokenScopes: false,
        verifyChannelTokenSignature: false,
    },
    controlPlaneId: "string",
    enabled: false,
    gatewayPluginJwtSignerId: "string",
    instanceName: "string",
    ordering: {
        after: {
            accesses: ["string"],
        },
        before: {
            accesses: ["string"],
        },
    },
    protocols: ["string"],
    route: {
        id: "string",
    },
    service: {
        id: "string",
    },
    tags: ["string"],
});

    type: konnect:GatewayPluginJwtSigner
properties:
    config:
        accessTokenConsumerBies:
            - string
        accessTokenConsumerClaims:
            - string
        accessTokenIntrospectionAuthorization: string
        accessTokenIntrospectionBodyArgs: string
        accessTokenIntrospectionConsumerBies:
            - string
        accessTokenIntrospectionConsumerClaims:
            - string
        accessTokenIntrospectionEndpoint: string
        accessTokenIntrospectionHint: string
        accessTokenIntrospectionJwtClaims:
            - string
        accessTokenIntrospectionLeeway: 0
        accessTokenIntrospectionScopesClaims:
            - string
        accessTokenIntrospectionScopesRequireds:
            - string
        accessTokenIntrospectionTimeout: 0
        accessTokenIssuer: string
        accessTokenJwksUri: string
        accessTokenJwksUriClientCertificate: string
        accessTokenJwksUriClientPassword: string
        accessTokenJwksUriClientUsername: string
        accessTokenJwksUriRotatePeriod: 0
        accessTokenKeyset: string
        accessTokenKeysetClientCertificate: string
        accessTokenKeysetClientPassword: string
        accessTokenKeysetClientUsername: string
        accessTokenKeysetRotatePeriod: 0
        accessTokenLeeway: 0
        accessTokenOptional: false
        accessTokenRequestHeader: string
        accessTokenScopesClaims:
            - string
        accessTokenScopesRequireds:
            - string
        accessTokenSigningAlgorithm: string
        accessTokenUpstreamHeader: string
        accessTokenUpstreamLeeway: 0
        addAccessTokenClaims:
            string: string
        addChannelTokenClaims:
            string: string
        addClaims:
            string: string
        cacheAccessTokenIntrospection: false
        cacheChannelTokenIntrospection: false
        channelTokenConsumerBies:
            - string
        channelTokenConsumerClaims:
            - string
        channelTokenIntrospectionAuthorization: string
        channelTokenIntrospectionBodyArgs: string
        channelTokenIntrospectionConsumerBies:
            - string
        channelTokenIntrospectionConsumerClaims:
            - string
        channelTokenIntrospectionEndpoint: string
        channelTokenIntrospectionHint: string
        channelTokenIntrospectionJwtClaims:
            - string
        channelTokenIntrospectionLeeway: 0
        channelTokenIntrospectionScopesClaims:
            - string
        channelTokenIntrospectionScopesRequireds:
            - string
        channelTokenIntrospectionTimeout: 0
        channelTokenIssuer: string
        channelTokenJwksUri: string
        channelTokenJwksUriClientCertificate: string
        channelTokenJwksUriClientPassword: string
        channelTokenJwksUriClientUsername: string
        channelTokenJwksUriRotatePeriod: 0
        channelTokenKeyset: string
        channelTokenKeysetClientCertificate: string
        channelTokenKeysetClientPassword: string
        channelTokenKeysetClientUsername: string
        channelTokenKeysetRotatePeriod: 0
        channelTokenLeeway: 0
        channelTokenOptional: false
        channelTokenRequestHeader: string
        channelTokenScopesClaims:
            - string
        channelTokenScopesRequireds:
            - string
        channelTokenSigningAlgorithm: string
        channelTokenUpstreamHeader: string
        channelTokenUpstreamLeeway: 0
        enableAccessTokenIntrospection: false
        enableChannelTokenIntrospection: false
        enableHsSignatures: false
        enableInstrumentation: false
        originalAccessTokenUpstreamHeader: string
        originalChannelTokenUpstreamHeader: string
        realm: string
        removeAccessTokenClaims:
            - string
        removeChannelTokenClaims:
            - string
        setAccessTokenClaims:
            string: string
        setChannelTokenClaims:
            string: string
        setClaims:
            string: string
        trustAccessTokenIntrospection: false
        trustChannelTokenIntrospection: false
        verifyAccessTokenExpiry: false
        verifyAccessTokenIntrospectionExpiry: false
        verifyAccessTokenIntrospectionScopes: false
        verifyAccessTokenScopes: false
        verifyAccessTokenSignature: false
        verifyChannelTokenExpiry: false
        verifyChannelTokenIntrospectionExpiry: false
        verifyChannelTokenIntrospectionScopes: false
        verifyChannelTokenScopes: false
        verifyChannelTokenSignature: false
    controlPlaneId: string
    enabled: false
    gatewayPluginJwtSignerId: string
    instanceName: string
    ordering:
        after:
            accesses:
                - string
        before:
            accesses:
                - string
    protocols:
        - string
    route:
        id: string
    service:
        id: string
    tags:
        - string

    GatewayPluginJwtSigner Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The GatewayPluginJwtSigner resource accepts the following input properties:

    Config GatewayPluginJwtSignerConfig
    ControlPlaneId string
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    Enabled bool
    Whether the plugin is applied.
    GatewayPluginJwtSignerId string
    The ID of this resource.
    InstanceName string
    Ordering GatewayPluginJwtSignerOrdering
    Protocols List<string>
    A set of strings representing HTTP protocols.
    Route GatewayPluginJwtSignerRoute
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    Service GatewayPluginJwtSignerService
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    Tags List<string>
    An optional set of strings associated with the Plugin for grouping and filtering.
    Config GatewayPluginJwtSignerConfigArgs
    ControlPlaneId string
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    Enabled bool
    Whether the plugin is applied.
    GatewayPluginJwtSignerId string
    The ID of this resource.
    InstanceName string
    Ordering GatewayPluginJwtSignerOrderingArgs
    Protocols []string
    A set of strings representing HTTP protocols.
    Route GatewayPluginJwtSignerRouteArgs
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    Service GatewayPluginJwtSignerServiceArgs
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    Tags []string
    An optional set of strings associated with the Plugin for grouping and filtering.
    config GatewayPluginJwtSignerConfig
    controlPlaneId String
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    enabled Boolean
    Whether the plugin is applied.
    gatewayPluginJwtSignerId String
    The ID of this resource.
    instanceName String
    ordering GatewayPluginJwtSignerOrdering
    protocols List<String>
    A set of strings representing HTTP protocols.
    route GatewayPluginJwtSignerRoute
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service GatewayPluginJwtSignerService
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags List<String>
    An optional set of strings associated with the Plugin for grouping and filtering.
    config GatewayPluginJwtSignerConfig
    controlPlaneId string
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    enabled boolean
    Whether the plugin is applied.
    gatewayPluginJwtSignerId string
    The ID of this resource.
    instanceName string
    ordering GatewayPluginJwtSignerOrdering
    protocols string[]
    A set of strings representing HTTP protocols.
    route GatewayPluginJwtSignerRoute
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service GatewayPluginJwtSignerService
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags string[]
    An optional set of strings associated with the Plugin for grouping and filtering.
    config GatewayPluginJwtSignerConfigArgs
    control_plane_id str
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    enabled bool
    Whether the plugin is applied.
    gateway_plugin_jwt_signer_id str
    The ID of this resource.
    instance_name str
    ordering GatewayPluginJwtSignerOrderingArgs
    protocols Sequence[str]
    A set of strings representing HTTP protocols.
    route GatewayPluginJwtSignerRouteArgs
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service GatewayPluginJwtSignerServiceArgs
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags Sequence[str]
    An optional set of strings associated with the Plugin for grouping and filtering.
    config Property Map
    controlPlaneId String
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    enabled Boolean
    Whether the plugin is applied.
    gatewayPluginJwtSignerId String
    The ID of this resource.
    instanceName String
    ordering Property Map
    protocols List<String>
    A set of strings representing HTTP protocols.
    route Property Map
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service Property Map
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags List<String>
    An optional set of strings associated with the Plugin for grouping and filtering.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the GatewayPluginJwtSigner resource produces the following output properties:

    CreatedAt double
    Unix epoch when the resource was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    UpdatedAt double
    Unix epoch when the resource was last updated.
    CreatedAt float64
    Unix epoch when the resource was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    UpdatedAt float64
    Unix epoch when the resource was last updated.
    createdAt Double
    Unix epoch when the resource was created.
    id String
    The provider-assigned unique ID for this managed resource.
    updatedAt Double
    Unix epoch when the resource was last updated.
    createdAt number
    Unix epoch when the resource was created.
    id string
    The provider-assigned unique ID for this managed resource.
    updatedAt number
    Unix epoch when the resource was last updated.
    created_at float
    Unix epoch when the resource was created.
    id str
    The provider-assigned unique ID for this managed resource.
    updated_at float
    Unix epoch when the resource was last updated.
    createdAt Number
    Unix epoch when the resource was created.
    id String
    The provider-assigned unique ID for this managed resource.
    updatedAt Number
    Unix epoch when the resource was last updated.

    Look up Existing GatewayPluginJwtSigner Resource

    Get an existing GatewayPluginJwtSigner resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: GatewayPluginJwtSignerState, opts?: CustomResourceOptions): GatewayPluginJwtSigner
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        config: Optional[GatewayPluginJwtSignerConfigArgs] = None,
        control_plane_id: Optional[str] = None,
        created_at: Optional[float] = None,
        enabled: Optional[bool] = None,
        gateway_plugin_jwt_signer_id: Optional[str] = None,
        instance_name: Optional[str] = None,
        ordering: Optional[GatewayPluginJwtSignerOrderingArgs] = None,
        protocols: Optional[Sequence[str]] = None,
        route: Optional[GatewayPluginJwtSignerRouteArgs] = None,
        service: Optional[GatewayPluginJwtSignerServiceArgs] = None,
        tags: Optional[Sequence[str]] = None,
        updated_at: Optional[float] = None) -> GatewayPluginJwtSigner
    func GetGatewayPluginJwtSigner(ctx *Context, name string, id IDInput, state *GatewayPluginJwtSignerState, opts ...ResourceOption) (*GatewayPluginJwtSigner, error)
    public static GatewayPluginJwtSigner Get(string name, Input<string> id, GatewayPluginJwtSignerState? state, CustomResourceOptions? opts = null)
    public static GatewayPluginJwtSigner get(String name, Output<String> id, GatewayPluginJwtSignerState state, CustomResourceOptions options)
    resources:  _:    type: konnect:GatewayPluginJwtSigner    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Config GatewayPluginJwtSignerConfig
    ControlPlaneId string
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    CreatedAt double
    Unix epoch when the resource was created.
    Enabled bool
    Whether the plugin is applied.
    GatewayPluginJwtSignerId string
    The ID of this resource.
    InstanceName string
    Ordering GatewayPluginJwtSignerOrdering
    Protocols List<string>
    A set of strings representing HTTP protocols.
    Route GatewayPluginJwtSignerRoute
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    Service GatewayPluginJwtSignerService
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    Tags List<string>
    An optional set of strings associated with the Plugin for grouping and filtering.
    UpdatedAt double
    Unix epoch when the resource was last updated.
    Config GatewayPluginJwtSignerConfigArgs
    ControlPlaneId string
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    CreatedAt float64
    Unix epoch when the resource was created.
    Enabled bool
    Whether the plugin is applied.
    GatewayPluginJwtSignerId string
    The ID of this resource.
    InstanceName string
    Ordering GatewayPluginJwtSignerOrderingArgs
    Protocols []string
    A set of strings representing HTTP protocols.
    Route GatewayPluginJwtSignerRouteArgs
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    Service GatewayPluginJwtSignerServiceArgs
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    Tags []string
    An optional set of strings associated with the Plugin for grouping and filtering.
    UpdatedAt float64
    Unix epoch when the resource was last updated.
    config GatewayPluginJwtSignerConfig
    controlPlaneId String
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    createdAt Double
    Unix epoch when the resource was created.
    enabled Boolean
    Whether the plugin is applied.
    gatewayPluginJwtSignerId String
    The ID of this resource.
    instanceName String
    ordering GatewayPluginJwtSignerOrdering
    protocols List<String>
    A set of strings representing HTTP protocols.
    route GatewayPluginJwtSignerRoute
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service GatewayPluginJwtSignerService
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags List<String>
    An optional set of strings associated with the Plugin for grouping and filtering.
    updatedAt Double
    Unix epoch when the resource was last updated.
    config GatewayPluginJwtSignerConfig
    controlPlaneId string
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    createdAt number
    Unix epoch when the resource was created.
    enabled boolean
    Whether the plugin is applied.
    gatewayPluginJwtSignerId string
    The ID of this resource.
    instanceName string
    ordering GatewayPluginJwtSignerOrdering
    protocols string[]
    A set of strings representing HTTP protocols.
    route GatewayPluginJwtSignerRoute
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service GatewayPluginJwtSignerService
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags string[]
    An optional set of strings associated with the Plugin for grouping and filtering.
    updatedAt number
    Unix epoch when the resource was last updated.
    config GatewayPluginJwtSignerConfigArgs
    control_plane_id str
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    created_at float
    Unix epoch when the resource was created.
    enabled bool
    Whether the plugin is applied.
    gateway_plugin_jwt_signer_id str
    The ID of this resource.
    instance_name str
    ordering GatewayPluginJwtSignerOrderingArgs
    protocols Sequence[str]
    A set of strings representing HTTP protocols.
    route GatewayPluginJwtSignerRouteArgs
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service GatewayPluginJwtSignerServiceArgs
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags Sequence[str]
    An optional set of strings associated with the Plugin for grouping and filtering.
    updated_at float
    Unix epoch when the resource was last updated.
    config Property Map
    controlPlaneId String
    The UUID of your control plane. This variable is available in the Konnect manager. Requires replacement if changed.
    createdAt Number
    Unix epoch when the resource was created.
    enabled Boolean
    Whether the plugin is applied.
    gatewayPluginJwtSignerId String
    The ID of this resource.
    instanceName String
    ordering Property Map
    protocols List<String>
    A set of strings representing HTTP protocols.
    route Property Map
    If set, the plugin will only activate when receiving requests via the specified route. Leave unset for the plugin to activate regardless of the route being used.
    service Property Map
    If set, the plugin will only activate when receiving requests via one of the routes belonging to the specified Service. Leave unset for the plugin to activate regardless of the Service being matched.
    tags List<String>
    An optional set of strings associated with the Plugin for grouping and filtering.
    updatedAt Number
    Unix epoch when the resource was last updated.

    Supporting Types

    GatewayPluginJwtSignerConfig, GatewayPluginJwtSignerConfigArgs

    AccessTokenConsumerBies List<string>
    When the plugin tries to apply an access token to a Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of alues. Valid values are id, username, and custom_id.
    AccessTokenConsumerClaims List<string>
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (for example, sub or username) in an access token to Kong consumer entity.
    AccessTokenIntrospectionAuthorization string
    If the introspection endpoint requires client authentication (client being the JWT Signer plugin), you can specify the Authorization header's value with this configuration parameter.
    AccessTokenIntrospectionBodyArgs string
    This parameter allows you to pass URL encoded request body arguments. For example: resource= or a=1&b=&c.
    AccessTokenIntrospectionConsumerBies List<string>
    When the plugin tries to do access token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values.
    AccessTokenIntrospectionConsumerClaims List<string>
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (such as sub or username) in access token introspection results to the Kong consumer entity.
    AccessTokenIntrospectionEndpoint string
    When you use opaque access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter.
    AccessTokenIntrospectionHint string
    If you need to give hint parameter when introspecting an access token, use this parameter to specify the value. By default, the plugin sends hint=access_token.
    AccessTokenIntrospectionJwtClaims List<string>
    If your introspection endpoint returns an access token in one of the keys (or claims) within the introspection results (JSON). If the key cannot be found, the plugin responds with 401 Unauthorized. Also if the key is found but cannot be decoded as JWT, it also responds with 401 Unauthorized.
    AccessTokenIntrospectionLeeway double
    Adjusts clock skew between the token issuer introspection results and Kong. The value is added to introspection results (JSON) exp claim/property before checking token expiry against Kong servers current time in seconds. You can disable access token introspection expiry verification altogether with config.verify_access_token_introspection_expiry.
    AccessTokenIntrospectionScopesClaims List<string>
    Specify the claim/property in access token introspection results (JSON) to be verified against values of config.access_token_introspection_scopes_required. This supports nested claims. For example, with Keycloak you could use [ "realm_access", "roles" ], hich can be given as realm_access,roles (form post). If the claim is not found in access token introspection results, and you have specified config.access_token_introspection_scopes_required, the plugin responds with 403 Forbidden.
    AccessTokenIntrospectionScopesRequireds List<string>
    Specify the required values (or scopes) that are checked by an introspection claim/property specified by config.access_token_introspection_scopes_claim.
    AccessTokenIntrospectionTimeout double
    Timeout in milliseconds for an introspection request. The plugin tries to introspect twice if the first request fails for some reason. If both requests timeout, then the plugin runs two times the config.access_token_introspection_timeout on access token introspection.
    AccessTokenIssuer string
    The iss claim of a signed or re-signed access token is set to this value. Original iss claim of the incoming token (possibly introspected) is stored in original_iss claim of the newly signed access token.
    AccessTokenJwksUri string
    Specify the URI where the plugin can fetch the public keys (JWKS) to verify the signature of the access token.
    AccessTokenJwksUriClientCertificate string
    The client certificate that will be used to authenticate Kong if access_token_jwks_uri is an https uri that requires mTLS Auth.
    AccessTokenJwksUriClientPassword string
    The client password that will be used to authenticate Kong if access_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with access_token_jwks_uri_client_username
    AccessTokenJwksUriClientUsername string
    The client username that will be used to authenticate Kong if access_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with access_token_jwks_uri_client_password
    AccessTokenJwksUriRotatePeriod double
    Specify the period (in seconds) to auto-rotate the jwks for access_token_jwks_uri. The default value 0 means no auto-rotation.
    AccessTokenKeyset string
    The name of the keyset containing signing keys.
    AccessTokenKeysetClientCertificate string
    The client certificate that will be used to authenticate Kong if access_token_keyset is an https uri that requires mTLS Auth.
    AccessTokenKeysetClientPassword string
    The client password that will be used to authenticate Kong if access_token_keyset is a uri that requires Basic Auth. Should be configured together with access_token_keyset_client_username
    AccessTokenKeysetClientUsername string
    The client username that will be used to authenticate Kong if access_token_keyset is a uri that requires Basic Auth. Should be configured together with access_token_keyset_client_password
    AccessTokenKeysetRotatePeriod double
    Specify the period (in seconds) to auto-rotate the jwks for access_token_keyset. The default value 0 means no auto-rotation.
    AccessTokenLeeway double
    Adjusts clock skew between the token issuer and Kong. The value is added to the token's exp claim before checking token expiry against Kong servers' current time in seconds. You can disable access token expiry verification altogether with config.verify_access_token_expiry.
    AccessTokenOptional bool
    If an access token is not provided or no config.access_token_request_header is specified, the plugin cannot verify the access token. In that case, the plugin normally responds with 401 Unauthorized (client didn't send a token) or 500 Unexpected (a configuration error). Use this parameter to allow the request to proceed even when there is no token to check. If the token is provided, then this parameter has no effect
    AccessTokenRequestHeader string
    This parameter tells the name of the header where to look for the access token.
    AccessTokenScopesClaims List<string>
    Specify the claim in an access token to verify against values of config.access_token_scopes_required.
    AccessTokenScopesRequireds List<string>
    Specify the required values (or scopes) that are checked by a claim specified by config.access_token_scopes_claim.
    AccessTokenSigningAlgorithm string
    When this plugin sets the upstream header as specified with config.access_token_upstream_header, re-signs the original access token using the private keys of the JWT Signer plugin. Specify the algorithm that is used to sign the token. The config.access_token_issuer specifies which keyset is used to sign the new token issued by Kong using the specified signing algorithm. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS512"]
    AccessTokenUpstreamHeader string
    Removes the config.access_token_request_header from the request after reading its value. With config.access_token_upstream_header, you can specify the upstream header where the plugin adds the Kong signed token. If you don't specify a value, such as use null or "" (empty string), the plugin does not even try to sign or re-sign the token.
    AccessTokenUpstreamLeeway double
    If you want to add or subtract (using a negative value) expiry time (in seconds) of the original access token, you can specify a value that is added to the original access token's exp claim.
    AddAccessTokenClaims Dictionary<string, string>
    Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    AddChannelTokenClaims Dictionary<string, string>
    Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    AddClaims Dictionary<string, string>
    Add customized claims to both tokens if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    CacheAccessTokenIntrospection bool
    Whether to cache access token introspection results.
    CacheChannelTokenIntrospection bool
    Whether to cache channel token introspection results.
    ChannelTokenConsumerBies List<string>
    When the plugin tries to do channel token to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of valid values: id, username, and custom_id.
    ChannelTokenConsumerClaims List<string>
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter. Kong consumers have an id, a username, and a custom_id. If this parameter is enabled but the mapping fails, such as when there's a non-existent Kong consumer, the plugin responds with 403 Forbidden.
    ChannelTokenIntrospectionAuthorization string
    When using opaque channel tokens, and you want to turn on channel token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise the plugin will not try introspection, and instead returns 401 Unauthorized when using opaque channel tokens.
    ChannelTokenIntrospectionBodyArgs string
    If you need to pass additional body arguments to introspection endpoint when the plugin introspects the opaque channel token, you can use this config parameter to specify them. You should URL encode the value. For example: resource= or a=1&b=&c.
    ChannelTokenIntrospectionConsumerBies List<string>
    When the plugin tries to do channel token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values. Valid values are id, username and custom_id.
    ChannelTokenIntrospectionConsumerClaims List<string>
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (such as sub or username) in channel token introspection results to Kong consumer entity
    ChannelTokenIntrospectionEndpoint string
    When you use opaque access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise, the plugin does not try introspection and returns 401 Unauthorized instead.
    ChannelTokenIntrospectionHint string
    If you need to give hint parameter when introspecting a channel token, you can use this parameter to specify the value of such parameter. By default, a hint isn't sent with channel token introspection.
    ChannelTokenIntrospectionJwtClaims List<string>
    If your introspection endpoint returns a channel token in one of the keys (or claims) in the introspection results (JSON), the plugin can use that value instead of the introspection results when doing expiry verification and signing of the new token issued by Kong.
    ChannelTokenIntrospectionLeeway double
    You can use this parameter to adjust clock skew between the token issuer introspection results and Kong. The value will be added to introspection results (JSON) exp claim/property before checking token expiry against Kong servers current time (in seconds). You can disable channel token introspection expiry verification altogether with config.verify_channel_token_introspection_expiry.
    ChannelTokenIntrospectionScopesClaims List<string>
    Use this parameter to specify the claim/property in channel token introspection results (JSON) to be verified against values of config.channel_token_introspection_scopes_required. This supports nested claims.
    ChannelTokenIntrospectionScopesRequireds List<string>
    Use this parameter to specify the required values (or scopes) that are checked by an introspection claim/property specified by config.channel_token_introspection_scopes_claim.
    ChannelTokenIntrospectionTimeout double
    Timeout in milliseconds for an introspection request. The plugin tries to introspect twice if the first request fails for some reason. If both requests timeout, then the plugin runs two times the config.access_token_introspection_timeout on channel token introspection.
    ChannelTokenIssuer string
    The iss claim of the re-signed channel token is set to this value, which is kong by default. The original iss claim of the incoming token (possibly introspected) is stored in the original_iss claim of the newly signed channel token.
    ChannelTokenJwksUri string
    If you want to use config.verify_channel_token_signature, you must specify the URI where the plugin can fetch the public keys (JWKS) to verify the signature of the channel token. If you don't specify a URI and you pass a JWT token to the plugin, then the plugin responds with 401 Unauthorized.
    ChannelTokenJwksUriClientCertificate string
    The client certificate that will be used to authenticate Kong if access_token_jwks_uri is an https uri that requires mTLS Auth.
    ChannelTokenJwksUriClientPassword string
    The client password that will be used to authenticate Kong if channel_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with channel_token_jwks_uri_client_username
    ChannelTokenJwksUriClientUsername string
    The client username that will be used to authenticate Kong if channel_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with channel_token_jwks_uri_client_password
    ChannelTokenJwksUriRotatePeriod double
    Specify the period (in seconds) to auto-rotate the jwks for channel_token_jwks_uri. The default value 0 means no auto-rotation.
    ChannelTokenKeyset string
    The name of the keyset containing signing keys.
    ChannelTokenKeysetClientCertificate string
    The client certificate that will be used to authenticate Kong if channel_token_keyset is an https uri that requires mTLS Auth.
    ChannelTokenKeysetClientPassword string
    The client password that will be used to authenticate Kong if channel_token_keyset is a uri that requires Basic Auth. Should be configured together with channel_token_keyset_client_username
    ChannelTokenKeysetClientUsername string
    The client username that will be used to authenticate Kong if channel_token_keyset is a uri that requires Basic Auth. Should be configured together with channel_token_keyset_client_password
    ChannelTokenKeysetRotatePeriod double
    Specify the period (in seconds) to auto-rotate the jwks for channel_token_keyset. The default value 0 means no auto-rotation.
    ChannelTokenLeeway double
    Adjusts clock skew between the token issuer and Kong. The value will be added to token's exp claim before checking token expiry against Kong servers current time in seconds. You can disable channel token expiry verification altogether with config.verify_channel_token_expiry.
    ChannelTokenOptional bool
    If a channel token is not provided or no config.channel_token_request_header is specified, the plugin cannot verify the channel token. In that case, the plugin normally responds with 401 Unauthorized (client didn't send a token) or 500 Unexpected (a configuration error). Enable this parameter to allow the request to proceed even when there is no channel token to check. If the channel token is provided, then this parameter has no effect
    ChannelTokenRequestHeader string
    This parameter tells the name of the header where to look for the channel token. If you don't want to do anything with the channel token, then you can set this to null or "" (empty string).
    ChannelTokenScopesClaims List<string>
    Specify the claim in a channel token to verify against values of config.channel_token_scopes_required. This supports nested claims.
    ChannelTokenScopesRequireds List<string>
    Specify the required values (or scopes) that are checked by a claim specified by config.channel_token_scopes_claim.
    ChannelTokenSigningAlgorithm string
    When this plugin sets the upstream header as specified with config.channel_token_upstream_header, it also re-signs the original channel token using private keys of this plugin. Specify the algorithm that is used to sign the token. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS512"]
    ChannelTokenUpstreamHeader string
    This plugin removes the config.channel_token_request_header from the request after reading its value.
    ChannelTokenUpstreamLeeway double
    If you want to add or perhaps subtract (using negative value) expiry time of the original channel token, you can specify a value that is added to the original channel token's exp claim.
    EnableAccessTokenIntrospection bool
    If you don't want to support opaque access tokens, change this configuration parameter to false to disable introspection.
    EnableChannelTokenIntrospection bool
    If you don't want to support opaque channel tokens, disable introspection by changing this configuration parameter to false.
    EnableHsSignatures bool
    Tokens signed with HMAC algorithms such as HS256, HS384, or HS512 are not accepted by default. If you need to accept such tokens for verification, enable this setting.
    EnableInstrumentation bool
    Writes log entries with some added information using ngx.CRIT (CRITICAL) level.
    OriginalAccessTokenUpstreamHeader string
    The HTTP header name used to store the original access token.
    OriginalChannelTokenUpstreamHeader string
    The HTTP header name used to store the original channel token.
    Realm string
    When authentication or authorization fails, or there is an unexpected error, the plugin sends an WWW-Authenticate header with the realm attribute value.
    RemoveAccessTokenClaims List<string>
    remove claims. It should be an array, and each element is a claim key string.
    RemoveChannelTokenClaims List<string>
    remove claims. It should be an array, and each element is a claim key string.
    SetAccessTokenClaims Dictionary<string, string>
    Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    SetChannelTokenClaims Dictionary<string, string>
    Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    SetClaims Dictionary<string, string>
    Set customized claims to both tokens. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    TrustAccessTokenIntrospection bool
    Use this parameter to enable and disable further checks on a payload before the new token is signed. If you set this to true, the expiry or scopes are not checked on a payload.
    TrustChannelTokenIntrospection bool
    Providing an opaque channel token for plugin introspection, and verifying expiry and scopes on introspection results may make further payload checks unnecessary before the plugin signs a new token. This also applies when using a JWT token with introspection JSON as per config.channeltokenintrospectionjwtclaim. Use this parameter to manage additional payload checks before signing a new token. With true (default), payload's expiry or scopes aren't checked.
    VerifyAccessTokenExpiry bool
    Quickly turn access token expiry verification off and on as needed.
    VerifyAccessTokenIntrospectionExpiry bool
    Quickly turn access token introspection expiry verification off and on as needed.
    VerifyAccessTokenIntrospectionScopes bool
    Quickly turn off and on the access token introspection scopes verification, specified with config.access_token_introspection_scopes_required.
    VerifyAccessTokenScopes bool
    Quickly turn off and on the access token required scopes verification, specified with config.access_token_scopes_required.
    VerifyAccessTokenSignature bool
    Quickly turn access token signature verification off and on as needed.
    VerifyChannelTokenExpiry bool
    VerifyChannelTokenIntrospectionExpiry bool
    Quickly turn on/off the channel token introspection expiry verification.
    VerifyChannelTokenIntrospectionScopes bool
    Quickly turn on/off the channel token introspection scopes verification specified with config.channel_token_introspection_scopes_required.
    VerifyChannelTokenScopes bool
    Quickly turn on/off the channel token required scopes verification specified with config.channel_token_scopes_required.
    VerifyChannelTokenSignature bool
    Quickly turn on/off the channel token signature verification.
    AccessTokenConsumerBies []string
    When the plugin tries to apply an access token to a Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of alues. Valid values are id, username, and custom_id.
    AccessTokenConsumerClaims []string
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (for example, sub or username) in an access token to Kong consumer entity.
    AccessTokenIntrospectionAuthorization string
    If the introspection endpoint requires client authentication (client being the JWT Signer plugin), you can specify the Authorization header's value with this configuration parameter.
    AccessTokenIntrospectionBodyArgs string
    This parameter allows you to pass URL encoded request body arguments. For example: resource= or a=1&b=&c.
    AccessTokenIntrospectionConsumerBies []string
    When the plugin tries to do access token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values.
    AccessTokenIntrospectionConsumerClaims []string
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (such as sub or username) in access token introspection results to the Kong consumer entity.
    AccessTokenIntrospectionEndpoint string
    When you use opaque access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter.
    AccessTokenIntrospectionHint string
    If you need to give hint parameter when introspecting an access token, use this parameter to specify the value. By default, the plugin sends hint=access_token.
    AccessTokenIntrospectionJwtClaims []string
    If your introspection endpoint returns an access token in one of the keys (or claims) within the introspection results (JSON). If the key cannot be found, the plugin responds with 401 Unauthorized. Also if the key is found but cannot be decoded as JWT, it also responds with 401 Unauthorized.
    AccessTokenIntrospectionLeeway float64
    Adjusts clock skew between the token issuer introspection results and Kong. The value is added to introspection results (JSON) exp claim/property before checking token expiry against Kong servers current time in seconds. You can disable access token introspection expiry verification altogether with config.verify_access_token_introspection_expiry.
    AccessTokenIntrospectionScopesClaims []string
    Specify the claim/property in access token introspection results (JSON) to be verified against values of config.access_token_introspection_scopes_required. This supports nested claims. For example, with Keycloak you could use [ "realm_access", "roles" ], hich can be given as realm_access,roles (form post). If the claim is not found in access token introspection results, and you have specified config.access_token_introspection_scopes_required, the plugin responds with 403 Forbidden.
    AccessTokenIntrospectionScopesRequireds []string
    Specify the required values (or scopes) that are checked by an introspection claim/property specified by config.access_token_introspection_scopes_claim.
    AccessTokenIntrospectionTimeout float64
    Timeout in milliseconds for an introspection request. The plugin tries to introspect twice if the first request fails for some reason. If both requests timeout, then the plugin runs two times the config.access_token_introspection_timeout on access token introspection.
    AccessTokenIssuer string
    The iss claim of a signed or re-signed access token is set to this value. Original iss claim of the incoming token (possibly introspected) is stored in original_iss claim of the newly signed access token.
    AccessTokenJwksUri string
    Specify the URI where the plugin can fetch the public keys (JWKS) to verify the signature of the access token.
    AccessTokenJwksUriClientCertificate string
    The client certificate that will be used to authenticate Kong if access_token_jwks_uri is an https uri that requires mTLS Auth.
    AccessTokenJwksUriClientPassword string
    The client password that will be used to authenticate Kong if access_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with access_token_jwks_uri_client_username
    AccessTokenJwksUriClientUsername string
    The client username that will be used to authenticate Kong if access_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with access_token_jwks_uri_client_password
    AccessTokenJwksUriRotatePeriod float64
    Specify the period (in seconds) to auto-rotate the jwks for access_token_jwks_uri. The default value 0 means no auto-rotation.
    AccessTokenKeyset string
    The name of the keyset containing signing keys.
    AccessTokenKeysetClientCertificate string
    The client certificate that will be used to authenticate Kong if access_token_keyset is an https uri that requires mTLS Auth.
    AccessTokenKeysetClientPassword string
    The client password that will be used to authenticate Kong if access_token_keyset is a uri that requires Basic Auth. Should be configured together with access_token_keyset_client_username
    AccessTokenKeysetClientUsername string
    The client username that will be used to authenticate Kong if access_token_keyset is a uri that requires Basic Auth. Should be configured together with access_token_keyset_client_password
    AccessTokenKeysetRotatePeriod float64
    Specify the period (in seconds) to auto-rotate the jwks for access_token_keyset. The default value 0 means no auto-rotation.
    AccessTokenLeeway float64
    Adjusts clock skew between the token issuer and Kong. The value is added to the token's exp claim before checking token expiry against Kong servers' current time in seconds. You can disable access token expiry verification altogether with config.verify_access_token_expiry.
    AccessTokenOptional bool
    If an access token is not provided or no config.access_token_request_header is specified, the plugin cannot verify the access token. In that case, the plugin normally responds with 401 Unauthorized (client didn't send a token) or 500 Unexpected (a configuration error). Use this parameter to allow the request to proceed even when there is no token to check. If the token is provided, then this parameter has no effect
    AccessTokenRequestHeader string
    This parameter tells the name of the header where to look for the access token.
    AccessTokenScopesClaims []string
    Specify the claim in an access token to verify against values of config.access_token_scopes_required.
    AccessTokenScopesRequireds []string
    Specify the required values (or scopes) that are checked by a claim specified by config.access_token_scopes_claim.
    AccessTokenSigningAlgorithm string
    When this plugin sets the upstream header as specified with config.access_token_upstream_header, re-signs the original access token using the private keys of the JWT Signer plugin. Specify the algorithm that is used to sign the token. The config.access_token_issuer specifies which keyset is used to sign the new token issued by Kong using the specified signing algorithm. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS512"]
    AccessTokenUpstreamHeader string
    Removes the config.access_token_request_header from the request after reading its value. With config.access_token_upstream_header, you can specify the upstream header where the plugin adds the Kong signed token. If you don't specify a value, such as use null or "" (empty string), the plugin does not even try to sign or re-sign the token.
    AccessTokenUpstreamLeeway float64
    If you want to add or subtract (using a negative value) expiry time (in seconds) of the original access token, you can specify a value that is added to the original access token's exp claim.
    AddAccessTokenClaims map[string]string
    Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    AddChannelTokenClaims map[string]string
    Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    AddClaims map[string]string
    Add customized claims to both tokens if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    CacheAccessTokenIntrospection bool
    Whether to cache access token introspection results.
    CacheChannelTokenIntrospection bool
    Whether to cache channel token introspection results.
    ChannelTokenConsumerBies []string
    When the plugin tries to do channel token to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of valid values: id, username, and custom_id.
    ChannelTokenConsumerClaims []string
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter. Kong consumers have an id, a username, and a custom_id. If this parameter is enabled but the mapping fails, such as when there's a non-existent Kong consumer, the plugin responds with 403 Forbidden.
    ChannelTokenIntrospectionAuthorization string
    When using opaque channel tokens, and you want to turn on channel token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise the plugin will not try introspection, and instead returns 401 Unauthorized when using opaque channel tokens.
    ChannelTokenIntrospectionBodyArgs string
    If you need to pass additional body arguments to introspection endpoint when the plugin introspects the opaque channel token, you can use this config parameter to specify them. You should URL encode the value. For example: resource= or a=1&b=&c.
    ChannelTokenIntrospectionConsumerBies []string
    When the plugin tries to do channel token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values. Valid values are id, username and custom_id.
    ChannelTokenIntrospectionConsumerClaims []string
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (such as sub or username) in channel token introspection results to Kong consumer entity
    ChannelTokenIntrospectionEndpoint string
    When you use opaque access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise, the plugin does not try introspection and returns 401 Unauthorized instead.
    ChannelTokenIntrospectionHint string
    If you need to give hint parameter when introspecting a channel token, you can use this parameter to specify the value of such parameter. By default, a hint isn't sent with channel token introspection.
    ChannelTokenIntrospectionJwtClaims []string
    If your introspection endpoint returns a channel token in one of the keys (or claims) in the introspection results (JSON), the plugin can use that value instead of the introspection results when doing expiry verification and signing of the new token issued by Kong.
    ChannelTokenIntrospectionLeeway float64
    You can use this parameter to adjust clock skew between the token issuer introspection results and Kong. The value will be added to introspection results (JSON) exp claim/property before checking token expiry against Kong servers current time (in seconds). You can disable channel token introspection expiry verification altogether with config.verify_channel_token_introspection_expiry.
    ChannelTokenIntrospectionScopesClaims []string
    Use this parameter to specify the claim/property in channel token introspection results (JSON) to be verified against values of config.channel_token_introspection_scopes_required. This supports nested claims.
    ChannelTokenIntrospectionScopesRequireds []string
    Use this parameter to specify the required values (or scopes) that are checked by an introspection claim/property specified by config.channel_token_introspection_scopes_claim.
    ChannelTokenIntrospectionTimeout float64
    Timeout in milliseconds for an introspection request. The plugin tries to introspect twice if the first request fails for some reason. If both requests timeout, then the plugin runs two times the config.access_token_introspection_timeout on channel token introspection.
    ChannelTokenIssuer string
    The iss claim of the re-signed channel token is set to this value, which is kong by default. The original iss claim of the incoming token (possibly introspected) is stored in the original_iss claim of the newly signed channel token.
    ChannelTokenJwksUri string
    If you want to use config.verify_channel_token_signature, you must specify the URI where the plugin can fetch the public keys (JWKS) to verify the signature of the channel token. If you don't specify a URI and you pass a JWT token to the plugin, then the plugin responds with 401 Unauthorized.
    ChannelTokenJwksUriClientCertificate string
    The client certificate that will be used to authenticate Kong if access_token_jwks_uri is an https uri that requires mTLS Auth.
    ChannelTokenJwksUriClientPassword string
    The client password that will be used to authenticate Kong if channel_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with channel_token_jwks_uri_client_username
    ChannelTokenJwksUriClientUsername string
    The client username that will be used to authenticate Kong if channel_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with channel_token_jwks_uri_client_password
    ChannelTokenJwksUriRotatePeriod float64
    Specify the period (in seconds) to auto-rotate the jwks for channel_token_jwks_uri. The default value 0 means no auto-rotation.
    ChannelTokenKeyset string
    The name of the keyset containing signing keys.
    ChannelTokenKeysetClientCertificate string
    The client certificate that will be used to authenticate Kong if channel_token_keyset is an https uri that requires mTLS Auth.
    ChannelTokenKeysetClientPassword string
    The client password that will be used to authenticate Kong if channel_token_keyset is a uri that requires Basic Auth. Should be configured together with channel_token_keyset_client_username
    ChannelTokenKeysetClientUsername string
    The client username that will be used to authenticate Kong if channel_token_keyset is a uri that requires Basic Auth. Should be configured together with channel_token_keyset_client_password
    ChannelTokenKeysetRotatePeriod float64
    Specify the period (in seconds) to auto-rotate the jwks for channel_token_keyset. The default value 0 means no auto-rotation.
    ChannelTokenLeeway float64
    Adjusts clock skew between the token issuer and Kong. The value will be added to token's exp claim before checking token expiry against Kong servers current time in seconds. You can disable channel token expiry verification altogether with config.verify_channel_token_expiry.
    ChannelTokenOptional bool
    If a channel token is not provided or no config.channel_token_request_header is specified, the plugin cannot verify the channel token. In that case, the plugin normally responds with 401 Unauthorized (client didn't send a token) or 500 Unexpected (a configuration error). Enable this parameter to allow the request to proceed even when there is no channel token to check. If the channel token is provided, then this parameter has no effect
    ChannelTokenRequestHeader string
    This parameter tells the name of the header where to look for the channel token. If you don't want to do anything with the channel token, then you can set this to null or "" (empty string).
    ChannelTokenScopesClaims []string
    Specify the claim in a channel token to verify against values of config.channel_token_scopes_required. This supports nested claims.
    ChannelTokenScopesRequireds []string
    Specify the required values (or scopes) that are checked by a claim specified by config.channel_token_scopes_claim.
    ChannelTokenSigningAlgorithm string
    When this plugin sets the upstream header as specified with config.channel_token_upstream_header, it also re-signs the original channel token using private keys of this plugin. Specify the algorithm that is used to sign the token. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS512"]
    ChannelTokenUpstreamHeader string
    This plugin removes the config.channel_token_request_header from the request after reading its value.
    ChannelTokenUpstreamLeeway float64
    If you want to add or perhaps subtract (using negative value) expiry time of the original channel token, you can specify a value that is added to the original channel token's exp claim.
    EnableAccessTokenIntrospection bool
    If you don't want to support opaque access tokens, change this configuration parameter to false to disable introspection.
    EnableChannelTokenIntrospection bool
    If you don't want to support opaque channel tokens, disable introspection by changing this configuration parameter to false.
    EnableHsSignatures bool
    Tokens signed with HMAC algorithms such as HS256, HS384, or HS512 are not accepted by default. If you need to accept such tokens for verification, enable this setting.
    EnableInstrumentation bool
    Writes log entries with some added information using ngx.CRIT (CRITICAL) level.
    OriginalAccessTokenUpstreamHeader string
    The HTTP header name used to store the original access token.
    OriginalChannelTokenUpstreamHeader string
    The HTTP header name used to store the original channel token.
    Realm string
    When authentication or authorization fails, or there is an unexpected error, the plugin sends an WWW-Authenticate header with the realm attribute value.
    RemoveAccessTokenClaims []string
    remove claims. It should be an array, and each element is a claim key string.
    RemoveChannelTokenClaims []string
    remove claims. It should be an array, and each element is a claim key string.
    SetAccessTokenClaims map[string]string
    Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    SetChannelTokenClaims map[string]string
    Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    SetClaims map[string]string
    Set customized claims to both tokens. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    TrustAccessTokenIntrospection bool
    Use this parameter to enable and disable further checks on a payload before the new token is signed. If you set this to true, the expiry or scopes are not checked on a payload.
    TrustChannelTokenIntrospection bool
    Providing an opaque channel token for plugin introspection, and verifying expiry and scopes on introspection results may make further payload checks unnecessary before the plugin signs a new token. This also applies when using a JWT token with introspection JSON as per config.channeltokenintrospectionjwtclaim. Use this parameter to manage additional payload checks before signing a new token. With true (default), payload's expiry or scopes aren't checked.
    VerifyAccessTokenExpiry bool
    Quickly turn access token expiry verification off and on as needed.
    VerifyAccessTokenIntrospectionExpiry bool
    Quickly turn access token introspection expiry verification off and on as needed.
    VerifyAccessTokenIntrospectionScopes bool
    Quickly turn off and on the access token introspection scopes verification, specified with config.access_token_introspection_scopes_required.
    VerifyAccessTokenScopes bool
    Quickly turn off and on the access token required scopes verification, specified with config.access_token_scopes_required.
    VerifyAccessTokenSignature bool
    Quickly turn access token signature verification off and on as needed.
    VerifyChannelTokenExpiry bool
    VerifyChannelTokenIntrospectionExpiry bool
    Quickly turn on/off the channel token introspection expiry verification.
    VerifyChannelTokenIntrospectionScopes bool
    Quickly turn on/off the channel token introspection scopes verification specified with config.channel_token_introspection_scopes_required.
    VerifyChannelTokenScopes bool
    Quickly turn on/off the channel token required scopes verification specified with config.channel_token_scopes_required.
    VerifyChannelTokenSignature bool
    Quickly turn on/off the channel token signature verification.
    accessTokenConsumerBies List<String>
    When the plugin tries to apply an access token to a Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of alues. Valid values are id, username, and custom_id.
    accessTokenConsumerClaims List<String>
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (for example, sub or username) in an access token to Kong consumer entity.
    accessTokenIntrospectionAuthorization String
    If the introspection endpoint requires client authentication (client being the JWT Signer plugin), you can specify the Authorization header's value with this configuration parameter.
    accessTokenIntrospectionBodyArgs String
    This parameter allows you to pass URL encoded request body arguments. For example: resource= or a=1&b=&c.
    accessTokenIntrospectionConsumerBies List<String>
    When the plugin tries to do access token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values.
    accessTokenIntrospectionConsumerClaims List<String>
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (such as sub or username) in access token introspection results to the Kong consumer entity.
    accessTokenIntrospectionEndpoint String
    When you use opaque access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter.
    accessTokenIntrospectionHint String
    If you need to give hint parameter when introspecting an access token, use this parameter to specify the value. By default, the plugin sends hint=access_token.
    accessTokenIntrospectionJwtClaims List<String>
    If your introspection endpoint returns an access token in one of the keys (or claims) within the introspection results (JSON). If the key cannot be found, the plugin responds with 401 Unauthorized. Also if the key is found but cannot be decoded as JWT, it also responds with 401 Unauthorized.
    accessTokenIntrospectionLeeway Double
    Adjusts clock skew between the token issuer introspection results and Kong. The value is added to introspection results (JSON) exp claim/property before checking token expiry against Kong servers current time in seconds. You can disable access token introspection expiry verification altogether with config.verify_access_token_introspection_expiry.
    accessTokenIntrospectionScopesClaims List<String>
    Specify the claim/property in access token introspection results (JSON) to be verified against values of config.access_token_introspection_scopes_required. This supports nested claims. For example, with Keycloak you could use [ "realm_access", "roles" ], hich can be given as realm_access,roles (form post). If the claim is not found in access token introspection results, and you have specified config.access_token_introspection_scopes_required, the plugin responds with 403 Forbidden.
    accessTokenIntrospectionScopesRequireds List<String>
    Specify the required values (or scopes) that are checked by an introspection claim/property specified by config.access_token_introspection_scopes_claim.
    accessTokenIntrospectionTimeout Double
    Timeout in milliseconds for an introspection request. The plugin tries to introspect twice if the first request fails for some reason. If both requests timeout, then the plugin runs two times the config.access_token_introspection_timeout on access token introspection.
    accessTokenIssuer String
    The iss claim of a signed or re-signed access token is set to this value. Original iss claim of the incoming token (possibly introspected) is stored in original_iss claim of the newly signed access token.
    accessTokenJwksUri String
    Specify the URI where the plugin can fetch the public keys (JWKS) to verify the signature of the access token.
    accessTokenJwksUriClientCertificate String
    The client certificate that will be used to authenticate Kong if access_token_jwks_uri is an https uri that requires mTLS Auth.
    accessTokenJwksUriClientPassword String
    The client password that will be used to authenticate Kong if access_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with access_token_jwks_uri_client_username
    accessTokenJwksUriClientUsername String
    The client username that will be used to authenticate Kong if access_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with access_token_jwks_uri_client_password
    accessTokenJwksUriRotatePeriod Double
    Specify the period (in seconds) to auto-rotate the jwks for access_token_jwks_uri. The default value 0 means no auto-rotation.
    accessTokenKeyset String
    The name of the keyset containing signing keys.
    accessTokenKeysetClientCertificate String
    The client certificate that will be used to authenticate Kong if access_token_keyset is an https uri that requires mTLS Auth.
    accessTokenKeysetClientPassword String
    The client password that will be used to authenticate Kong if access_token_keyset is a uri that requires Basic Auth. Should be configured together with access_token_keyset_client_username
    accessTokenKeysetClientUsername String
    The client username that will be used to authenticate Kong if access_token_keyset is a uri that requires Basic Auth. Should be configured together with access_token_keyset_client_password
    accessTokenKeysetRotatePeriod Double
    Specify the period (in seconds) to auto-rotate the jwks for access_token_keyset. The default value 0 means no auto-rotation.
    accessTokenLeeway Double
    Adjusts clock skew between the token issuer and Kong. The value is added to the token's exp claim before checking token expiry against Kong servers' current time in seconds. You can disable access token expiry verification altogether with config.verify_access_token_expiry.
    accessTokenOptional Boolean
    If an access token is not provided or no config.access_token_request_header is specified, the plugin cannot verify the access token. In that case, the plugin normally responds with 401 Unauthorized (client didn't send a token) or 500 Unexpected (a configuration error). Use this parameter to allow the request to proceed even when there is no token to check. If the token is provided, then this parameter has no effect
    accessTokenRequestHeader String
    This parameter tells the name of the header where to look for the access token.
    accessTokenScopesClaims List<String>
    Specify the claim in an access token to verify against values of config.access_token_scopes_required.
    accessTokenScopesRequireds List<String>
    Specify the required values (or scopes) that are checked by a claim specified by config.access_token_scopes_claim.
    accessTokenSigningAlgorithm String
    When this plugin sets the upstream header as specified with config.access_token_upstream_header, re-signs the original access token using the private keys of the JWT Signer plugin. Specify the algorithm that is used to sign the token. The config.access_token_issuer specifies which keyset is used to sign the new token issued by Kong using the specified signing algorithm. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS512"]
    accessTokenUpstreamHeader String
    Removes the config.access_token_request_header from the request after reading its value. With config.access_token_upstream_header, you can specify the upstream header where the plugin adds the Kong signed token. If you don't specify a value, such as use null or "" (empty string), the plugin does not even try to sign or re-sign the token.
    accessTokenUpstreamLeeway Double
    If you want to add or subtract (using a negative value) expiry time (in seconds) of the original access token, you can specify a value that is added to the original access token's exp claim.
    addAccessTokenClaims Map<String,String>
    Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    addChannelTokenClaims Map<String,String>
    Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    addClaims Map<String,String>
    Add customized claims to both tokens if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    cacheAccessTokenIntrospection Boolean
    Whether to cache access token introspection results.
    cacheChannelTokenIntrospection Boolean
    Whether to cache channel token introspection results.
    channelTokenConsumerBies List<String>
    When the plugin tries to do channel token to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of valid values: id, username, and custom_id.
    channelTokenConsumerClaims List<String>
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter. Kong consumers have an id, a username, and a custom_id. If this parameter is enabled but the mapping fails, such as when there's a non-existent Kong consumer, the plugin responds with 403 Forbidden.
    channelTokenIntrospectionAuthorization String
    When using opaque channel tokens, and you want to turn on channel token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise the plugin will not try introspection, and instead returns 401 Unauthorized when using opaque channel tokens.
    channelTokenIntrospectionBodyArgs String
    If you need to pass additional body arguments to introspection endpoint when the plugin introspects the opaque channel token, you can use this config parameter to specify them. You should URL encode the value. For example: resource= or a=1&b=&c.
    channelTokenIntrospectionConsumerBies List<String>
    When the plugin tries to do channel token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values. Valid values are id, username and custom_id.
    channelTokenIntrospectionConsumerClaims List<String>
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (such as sub or username) in channel token introspection results to Kong consumer entity
    channelTokenIntrospectionEndpoint String
    When you use opaque access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise, the plugin does not try introspection and returns 401 Unauthorized instead.
    channelTokenIntrospectionHint String
    If you need to give hint parameter when introspecting a channel token, you can use this parameter to specify the value of such parameter. By default, a hint isn't sent with channel token introspection.
    channelTokenIntrospectionJwtClaims List<String>
    If your introspection endpoint returns a channel token in one of the keys (or claims) in the introspection results (JSON), the plugin can use that value instead of the introspection results when doing expiry verification and signing of the new token issued by Kong.
    channelTokenIntrospectionLeeway Double
    You can use this parameter to adjust clock skew between the token issuer introspection results and Kong. The value will be added to introspection results (JSON) exp claim/property before checking token expiry against Kong servers current time (in seconds). You can disable channel token introspection expiry verification altogether with config.verify_channel_token_introspection_expiry.
    channelTokenIntrospectionScopesClaims List<String>
    Use this parameter to specify the claim/property in channel token introspection results (JSON) to be verified against values of config.channel_token_introspection_scopes_required. This supports nested claims.
    channelTokenIntrospectionScopesRequireds List<String>
    Use this parameter to specify the required values (or scopes) that are checked by an introspection claim/property specified by config.channel_token_introspection_scopes_claim.
    channelTokenIntrospectionTimeout Double
    Timeout in milliseconds for an introspection request. The plugin tries to introspect twice if the first request fails for some reason. If both requests timeout, then the plugin runs two times the config.access_token_introspection_timeout on channel token introspection.
    channelTokenIssuer String
    The iss claim of the re-signed channel token is set to this value, which is kong by default. The original iss claim of the incoming token (possibly introspected) is stored in the original_iss claim of the newly signed channel token.
    channelTokenJwksUri String
    If you want to use config.verify_channel_token_signature, you must specify the URI where the plugin can fetch the public keys (JWKS) to verify the signature of the channel token. If you don't specify a URI and you pass a JWT token to the plugin, then the plugin responds with 401 Unauthorized.
    channelTokenJwksUriClientCertificate String
    The client certificate that will be used to authenticate Kong if access_token_jwks_uri is an https uri that requires mTLS Auth.
    channelTokenJwksUriClientPassword String
    The client password that will be used to authenticate Kong if channel_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with channel_token_jwks_uri_client_username
    channelTokenJwksUriClientUsername String
    The client username that will be used to authenticate Kong if channel_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with channel_token_jwks_uri_client_password
    channelTokenJwksUriRotatePeriod Double
    Specify the period (in seconds) to auto-rotate the jwks for channel_token_jwks_uri. The default value 0 means no auto-rotation.
    channelTokenKeyset String
    The name of the keyset containing signing keys.
    channelTokenKeysetClientCertificate String
    The client certificate that will be used to authenticate Kong if channel_token_keyset is an https uri that requires mTLS Auth.
    channelTokenKeysetClientPassword String
    The client password that will be used to authenticate Kong if channel_token_keyset is a uri that requires Basic Auth. Should be configured together with channel_token_keyset_client_username
    channelTokenKeysetClientUsername String
    The client username that will be used to authenticate Kong if channel_token_keyset is a uri that requires Basic Auth. Should be configured together with channel_token_keyset_client_password
    channelTokenKeysetRotatePeriod Double
    Specify the period (in seconds) to auto-rotate the jwks for channel_token_keyset. The default value 0 means no auto-rotation.
    channelTokenLeeway Double
    Adjusts clock skew between the token issuer and Kong. The value will be added to token's exp claim before checking token expiry against Kong servers current time in seconds. You can disable channel token expiry verification altogether with config.verify_channel_token_expiry.
    channelTokenOptional Boolean
    If a channel token is not provided or no config.channel_token_request_header is specified, the plugin cannot verify the channel token. In that case, the plugin normally responds with 401 Unauthorized (client didn't send a token) or 500 Unexpected (a configuration error). Enable this parameter to allow the request to proceed even when there is no channel token to check. If the channel token is provided, then this parameter has no effect
    channelTokenRequestHeader String
    This parameter tells the name of the header where to look for the channel token. If you don't want to do anything with the channel token, then you can set this to null or "" (empty string).
    channelTokenScopesClaims List<String>
    Specify the claim in a channel token to verify against values of config.channel_token_scopes_required. This supports nested claims.
    channelTokenScopesRequireds List<String>
    Specify the required values (or scopes) that are checked by a claim specified by config.channel_token_scopes_claim.
    channelTokenSigningAlgorithm String
    When this plugin sets the upstream header as specified with config.channel_token_upstream_header, it also re-signs the original channel token using private keys of this plugin. Specify the algorithm that is used to sign the token. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS512"]
    channelTokenUpstreamHeader String
    This plugin removes the config.channel_token_request_header from the request after reading its value.
    channelTokenUpstreamLeeway Double
    If you want to add or perhaps subtract (using negative value) expiry time of the original channel token, you can specify a value that is added to the original channel token's exp claim.
    enableAccessTokenIntrospection Boolean
    If you don't want to support opaque access tokens, change this configuration parameter to false to disable introspection.
    enableChannelTokenIntrospection Boolean
    If you don't want to support opaque channel tokens, disable introspection by changing this configuration parameter to false.
    enableHsSignatures Boolean
    Tokens signed with HMAC algorithms such as HS256, HS384, or HS512 are not accepted by default. If you need to accept such tokens for verification, enable this setting.
    enableInstrumentation Boolean
    Writes log entries with some added information using ngx.CRIT (CRITICAL) level.
    originalAccessTokenUpstreamHeader String
    The HTTP header name used to store the original access token.
    originalChannelTokenUpstreamHeader String
    The HTTP header name used to store the original channel token.
    realm String
    When authentication or authorization fails, or there is an unexpected error, the plugin sends an WWW-Authenticate header with the realm attribute value.
    removeAccessTokenClaims List<String>
    remove claims. It should be an array, and each element is a claim key string.
    removeChannelTokenClaims List<String>
    remove claims. It should be an array, and each element is a claim key string.
    setAccessTokenClaims Map<String,String>
    Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    setChannelTokenClaims Map<String,String>
    Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    setClaims Map<String,String>
    Set customized claims to both tokens. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    trustAccessTokenIntrospection Boolean
    Use this parameter to enable and disable further checks on a payload before the new token is signed. If you set this to true, the expiry or scopes are not checked on a payload.
    trustChannelTokenIntrospection Boolean
    Providing an opaque channel token for plugin introspection, and verifying expiry and scopes on introspection results may make further payload checks unnecessary before the plugin signs a new token. This also applies when using a JWT token with introspection JSON as per config.channeltokenintrospectionjwtclaim. Use this parameter to manage additional payload checks before signing a new token. With true (default), payload's expiry or scopes aren't checked.
    verifyAccessTokenExpiry Boolean
    Quickly turn access token expiry verification off and on as needed.
    verifyAccessTokenIntrospectionExpiry Boolean
    Quickly turn access token introspection expiry verification off and on as needed.
    verifyAccessTokenIntrospectionScopes Boolean
    Quickly turn off and on the access token introspection scopes verification, specified with config.access_token_introspection_scopes_required.
    verifyAccessTokenScopes Boolean
    Quickly turn off and on the access token required scopes verification, specified with config.access_token_scopes_required.
    verifyAccessTokenSignature Boolean
    Quickly turn access token signature verification off and on as needed.
    verifyChannelTokenExpiry Boolean
    verifyChannelTokenIntrospectionExpiry Boolean
    Quickly turn on/off the channel token introspection expiry verification.
    verifyChannelTokenIntrospectionScopes Boolean
    Quickly turn on/off the channel token introspection scopes verification specified with config.channel_token_introspection_scopes_required.
    verifyChannelTokenScopes Boolean
    Quickly turn on/off the channel token required scopes verification specified with config.channel_token_scopes_required.
    verifyChannelTokenSignature Boolean
    Quickly turn on/off the channel token signature verification.
    accessTokenConsumerBies string[]
    When the plugin tries to apply an access token to a Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of alues. Valid values are id, username, and custom_id.
    accessTokenConsumerClaims string[]
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (for example, sub or username) in an access token to Kong consumer entity.
    accessTokenIntrospectionAuthorization string
    If the introspection endpoint requires client authentication (client being the JWT Signer plugin), you can specify the Authorization header's value with this configuration parameter.
    accessTokenIntrospectionBodyArgs string
    This parameter allows you to pass URL encoded request body arguments. For example: resource= or a=1&b=&c.
    accessTokenIntrospectionConsumerBies string[]
    When the plugin tries to do access token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values.
    accessTokenIntrospectionConsumerClaims string[]
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (such as sub or username) in access token introspection results to the Kong consumer entity.
    accessTokenIntrospectionEndpoint string
    When you use opaque access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter.
    accessTokenIntrospectionHint string
    If you need to give hint parameter when introspecting an access token, use this parameter to specify the value. By default, the plugin sends hint=access_token.
    accessTokenIntrospectionJwtClaims string[]
    If your introspection endpoint returns an access token in one of the keys (or claims) within the introspection results (JSON). If the key cannot be found, the plugin responds with 401 Unauthorized. Also if the key is found but cannot be decoded as JWT, it also responds with 401 Unauthorized.
    accessTokenIntrospectionLeeway number
    Adjusts clock skew between the token issuer introspection results and Kong. The value is added to introspection results (JSON) exp claim/property before checking token expiry against Kong servers current time in seconds. You can disable access token introspection expiry verification altogether with config.verify_access_token_introspection_expiry.
    accessTokenIntrospectionScopesClaims string[]
    Specify the claim/property in access token introspection results (JSON) to be verified against values of config.access_token_introspection_scopes_required. This supports nested claims. For example, with Keycloak you could use [ "realm_access", "roles" ], hich can be given as realm_access,roles (form post). If the claim is not found in access token introspection results, and you have specified config.access_token_introspection_scopes_required, the plugin responds with 403 Forbidden.
    accessTokenIntrospectionScopesRequireds string[]
    Specify the required values (or scopes) that are checked by an introspection claim/property specified by config.access_token_introspection_scopes_claim.
    accessTokenIntrospectionTimeout number
    Timeout in milliseconds for an introspection request. The plugin tries to introspect twice if the first request fails for some reason. If both requests timeout, then the plugin runs two times the config.access_token_introspection_timeout on access token introspection.
    accessTokenIssuer string
    The iss claim of a signed or re-signed access token is set to this value. Original iss claim of the incoming token (possibly introspected) is stored in original_iss claim of the newly signed access token.
    accessTokenJwksUri string
    Specify the URI where the plugin can fetch the public keys (JWKS) to verify the signature of the access token.
    accessTokenJwksUriClientCertificate string
    The client certificate that will be used to authenticate Kong if access_token_jwks_uri is an https uri that requires mTLS Auth.
    accessTokenJwksUriClientPassword string
    The client password that will be used to authenticate Kong if access_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with access_token_jwks_uri_client_username
    accessTokenJwksUriClientUsername string
    The client username that will be used to authenticate Kong if access_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with access_token_jwks_uri_client_password
    accessTokenJwksUriRotatePeriod number
    Specify the period (in seconds) to auto-rotate the jwks for access_token_jwks_uri. The default value 0 means no auto-rotation.
    accessTokenKeyset string
    The name of the keyset containing signing keys.
    accessTokenKeysetClientCertificate string
    The client certificate that will be used to authenticate Kong if access_token_keyset is an https uri that requires mTLS Auth.
    accessTokenKeysetClientPassword string
    The client password that will be used to authenticate Kong if access_token_keyset is a uri that requires Basic Auth. Should be configured together with access_token_keyset_client_username
    accessTokenKeysetClientUsername string
    The client username that will be used to authenticate Kong if access_token_keyset is a uri that requires Basic Auth. Should be configured together with access_token_keyset_client_password
    accessTokenKeysetRotatePeriod number
    Specify the period (in seconds) to auto-rotate the jwks for access_token_keyset. The default value 0 means no auto-rotation.
    accessTokenLeeway number
    Adjusts clock skew between the token issuer and Kong. The value is added to the token's exp claim before checking token expiry against Kong servers' current time in seconds. You can disable access token expiry verification altogether with config.verify_access_token_expiry.
    accessTokenOptional boolean
    If an access token is not provided or no config.access_token_request_header is specified, the plugin cannot verify the access token. In that case, the plugin normally responds with 401 Unauthorized (client didn't send a token) or 500 Unexpected (a configuration error). Use this parameter to allow the request to proceed even when there is no token to check. If the token is provided, then this parameter has no effect
    accessTokenRequestHeader string
    This parameter tells the name of the header where to look for the access token.
    accessTokenScopesClaims string[]
    Specify the claim in an access token to verify against values of config.access_token_scopes_required.
    accessTokenScopesRequireds string[]
    Specify the required values (or scopes) that are checked by a claim specified by config.access_token_scopes_claim.
    accessTokenSigningAlgorithm string
    When this plugin sets the upstream header as specified with config.access_token_upstream_header, re-signs the original access token using the private keys of the JWT Signer plugin. Specify the algorithm that is used to sign the token. The config.access_token_issuer specifies which keyset is used to sign the new token issued by Kong using the specified signing algorithm. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS512"]
    accessTokenUpstreamHeader string
    Removes the config.access_token_request_header from the request after reading its value. With config.access_token_upstream_header, you can specify the upstream header where the plugin adds the Kong signed token. If you don't specify a value, such as use null or "" (empty string), the plugin does not even try to sign or re-sign the token.
    accessTokenUpstreamLeeway number
    If you want to add or subtract (using a negative value) expiry time (in seconds) of the original access token, you can specify a value that is added to the original access token's exp claim.
    addAccessTokenClaims {[key: string]: string}
    Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    addChannelTokenClaims {[key: string]: string}
    Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    addClaims {[key: string]: string}
    Add customized claims to both tokens if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    cacheAccessTokenIntrospection boolean
    Whether to cache access token introspection results.
    cacheChannelTokenIntrospection boolean
    Whether to cache channel token introspection results.
    channelTokenConsumerBies string[]
    When the plugin tries to do channel token to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of valid values: id, username, and custom_id.
    channelTokenConsumerClaims string[]
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter. Kong consumers have an id, a username, and a custom_id. If this parameter is enabled but the mapping fails, such as when there's a non-existent Kong consumer, the plugin responds with 403 Forbidden.
    channelTokenIntrospectionAuthorization string
    When using opaque channel tokens, and you want to turn on channel token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise the plugin will not try introspection, and instead returns 401 Unauthorized when using opaque channel tokens.
    channelTokenIntrospectionBodyArgs string
    If you need to pass additional body arguments to introspection endpoint when the plugin introspects the opaque channel token, you can use this config parameter to specify them. You should URL encode the value. For example: resource= or a=1&b=&c.
    channelTokenIntrospectionConsumerBies string[]
    When the plugin tries to do channel token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values. Valid values are id, username and custom_id.
    channelTokenIntrospectionConsumerClaims string[]
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (such as sub or username) in channel token introspection results to Kong consumer entity
    channelTokenIntrospectionEndpoint string
    When you use opaque access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise, the plugin does not try introspection and returns 401 Unauthorized instead.
    channelTokenIntrospectionHint string
    If you need to give hint parameter when introspecting a channel token, you can use this parameter to specify the value of such parameter. By default, a hint isn't sent with channel token introspection.
    channelTokenIntrospectionJwtClaims string[]
    If your introspection endpoint returns a channel token in one of the keys (or claims) in the introspection results (JSON), the plugin can use that value instead of the introspection results when doing expiry verification and signing of the new token issued by Kong.
    channelTokenIntrospectionLeeway number
    You can use this parameter to adjust clock skew between the token issuer introspection results and Kong. The value will be added to introspection results (JSON) exp claim/property before checking token expiry against Kong servers current time (in seconds). You can disable channel token introspection expiry verification altogether with config.verify_channel_token_introspection_expiry.
    channelTokenIntrospectionScopesClaims string[]
    Use this parameter to specify the claim/property in channel token introspection results (JSON) to be verified against values of config.channel_token_introspection_scopes_required. This supports nested claims.
    channelTokenIntrospectionScopesRequireds string[]
    Use this parameter to specify the required values (or scopes) that are checked by an introspection claim/property specified by config.channel_token_introspection_scopes_claim.
    channelTokenIntrospectionTimeout number
    Timeout in milliseconds for an introspection request. The plugin tries to introspect twice if the first request fails for some reason. If both requests timeout, then the plugin runs two times the config.access_token_introspection_timeout on channel token introspection.
    channelTokenIssuer string
    The iss claim of the re-signed channel token is set to this value, which is kong by default. The original iss claim of the incoming token (possibly introspected) is stored in the original_iss claim of the newly signed channel token.
    channelTokenJwksUri string
    If you want to use config.verify_channel_token_signature, you must specify the URI where the plugin can fetch the public keys (JWKS) to verify the signature of the channel token. If you don't specify a URI and you pass a JWT token to the plugin, then the plugin responds with 401 Unauthorized.
    channelTokenJwksUriClientCertificate string
    The client certificate that will be used to authenticate Kong if access_token_jwks_uri is an https uri that requires mTLS Auth.
    channelTokenJwksUriClientPassword string
    The client password that will be used to authenticate Kong if channel_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with channel_token_jwks_uri_client_username
    channelTokenJwksUriClientUsername string
    The client username that will be used to authenticate Kong if channel_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with channel_token_jwks_uri_client_password
    channelTokenJwksUriRotatePeriod number
    Specify the period (in seconds) to auto-rotate the jwks for channel_token_jwks_uri. The default value 0 means no auto-rotation.
    channelTokenKeyset string
    The name of the keyset containing signing keys.
    channelTokenKeysetClientCertificate string
    The client certificate that will be used to authenticate Kong if channel_token_keyset is an https uri that requires mTLS Auth.
    channelTokenKeysetClientPassword string
    The client password that will be used to authenticate Kong if channel_token_keyset is a uri that requires Basic Auth. Should be configured together with channel_token_keyset_client_username
    channelTokenKeysetClientUsername string
    The client username that will be used to authenticate Kong if channel_token_keyset is a uri that requires Basic Auth. Should be configured together with channel_token_keyset_client_password
    channelTokenKeysetRotatePeriod number
    Specify the period (in seconds) to auto-rotate the jwks for channel_token_keyset. The default value 0 means no auto-rotation.
    channelTokenLeeway number
    Adjusts clock skew between the token issuer and Kong. The value will be added to token's exp claim before checking token expiry against Kong servers current time in seconds. You can disable channel token expiry verification altogether with config.verify_channel_token_expiry.
    channelTokenOptional boolean
    If a channel token is not provided or no config.channel_token_request_header is specified, the plugin cannot verify the channel token. In that case, the plugin normally responds with 401 Unauthorized (client didn't send a token) or 500 Unexpected (a configuration error). Enable this parameter to allow the request to proceed even when there is no channel token to check. If the channel token is provided, then this parameter has no effect
    channelTokenRequestHeader string
    This parameter tells the name of the header where to look for the channel token. If you don't want to do anything with the channel token, then you can set this to null or "" (empty string).
    channelTokenScopesClaims string[]
    Specify the claim in a channel token to verify against values of config.channel_token_scopes_required. This supports nested claims.
    channelTokenScopesRequireds string[]
    Specify the required values (or scopes) that are checked by a claim specified by config.channel_token_scopes_claim.
    channelTokenSigningAlgorithm string
    When this plugin sets the upstream header as specified with config.channel_token_upstream_header, it also re-signs the original channel token using private keys of this plugin. Specify the algorithm that is used to sign the token. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS512"]
    channelTokenUpstreamHeader string
    This plugin removes the config.channel_token_request_header from the request after reading its value.
    channelTokenUpstreamLeeway number
    If you want to add or perhaps subtract (using negative value) expiry time of the original channel token, you can specify a value that is added to the original channel token's exp claim.
    enableAccessTokenIntrospection boolean
    If you don't want to support opaque access tokens, change this configuration parameter to false to disable introspection.
    enableChannelTokenIntrospection boolean
    If you don't want to support opaque channel tokens, disable introspection by changing this configuration parameter to false.
    enableHsSignatures boolean
    Tokens signed with HMAC algorithms such as HS256, HS384, or HS512 are not accepted by default. If you need to accept such tokens for verification, enable this setting.
    enableInstrumentation boolean
    Writes log entries with some added information using ngx.CRIT (CRITICAL) level.
    originalAccessTokenUpstreamHeader string
    The HTTP header name used to store the original access token.
    originalChannelTokenUpstreamHeader string
    The HTTP header name used to store the original channel token.
    realm string
    When authentication or authorization fails, or there is an unexpected error, the plugin sends an WWW-Authenticate header with the realm attribute value.
    removeAccessTokenClaims string[]
    remove claims. It should be an array, and each element is a claim key string.
    removeChannelTokenClaims string[]
    remove claims. It should be an array, and each element is a claim key string.
    setAccessTokenClaims {[key: string]: string}
    Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    setChannelTokenClaims {[key: string]: string}
    Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    setClaims {[key: string]: string}
    Set customized claims to both tokens. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    trustAccessTokenIntrospection boolean
    Use this parameter to enable and disable further checks on a payload before the new token is signed. If you set this to true, the expiry or scopes are not checked on a payload.
    trustChannelTokenIntrospection boolean
    Providing an opaque channel token for plugin introspection, and verifying expiry and scopes on introspection results may make further payload checks unnecessary before the plugin signs a new token. This also applies when using a JWT token with introspection JSON as per config.channeltokenintrospectionjwtclaim. Use this parameter to manage additional payload checks before signing a new token. With true (default), payload's expiry or scopes aren't checked.
    verifyAccessTokenExpiry boolean
    Quickly turn access token expiry verification off and on as needed.
    verifyAccessTokenIntrospectionExpiry boolean
    Quickly turn access token introspection expiry verification off and on as needed.
    verifyAccessTokenIntrospectionScopes boolean
    Quickly turn off and on the access token introspection scopes verification, specified with config.access_token_introspection_scopes_required.
    verifyAccessTokenScopes boolean
    Quickly turn off and on the access token required scopes verification, specified with config.access_token_scopes_required.
    verifyAccessTokenSignature boolean
    Quickly turn access token signature verification off and on as needed.
    verifyChannelTokenExpiry boolean
    verifyChannelTokenIntrospectionExpiry boolean
    Quickly turn on/off the channel token introspection expiry verification.
    verifyChannelTokenIntrospectionScopes boolean
    Quickly turn on/off the channel token introspection scopes verification specified with config.channel_token_introspection_scopes_required.
    verifyChannelTokenScopes boolean
    Quickly turn on/off the channel token required scopes verification specified with config.channel_token_scopes_required.
    verifyChannelTokenSignature boolean
    Quickly turn on/off the channel token signature verification.
    access_token_consumer_bies Sequence[str]
    When the plugin tries to apply an access token to a Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of alues. Valid values are id, username, and custom_id.
    access_token_consumer_claims Sequence[str]
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (for example, sub or username) in an access token to Kong consumer entity.
    access_token_introspection_authorization str
    If the introspection endpoint requires client authentication (client being the JWT Signer plugin), you can specify the Authorization header's value with this configuration parameter.
    access_token_introspection_body_args str
    This parameter allows you to pass URL encoded request body arguments. For example: resource= or a=1&b=&c.
    access_token_introspection_consumer_bies Sequence[str]
    When the plugin tries to do access token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values.
    access_token_introspection_consumer_claims Sequence[str]
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (such as sub or username) in access token introspection results to the Kong consumer entity.
    access_token_introspection_endpoint str
    When you use opaque access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter.
    access_token_introspection_hint str
    If you need to give hint parameter when introspecting an access token, use this parameter to specify the value. By default, the plugin sends hint=access_token.
    access_token_introspection_jwt_claims Sequence[str]
    If your introspection endpoint returns an access token in one of the keys (or claims) within the introspection results (JSON). If the key cannot be found, the plugin responds with 401 Unauthorized. Also if the key is found but cannot be decoded as JWT, it also responds with 401 Unauthorized.
    access_token_introspection_leeway float
    Adjusts clock skew between the token issuer introspection results and Kong. The value is added to introspection results (JSON) exp claim/property before checking token expiry against Kong servers current time in seconds. You can disable access token introspection expiry verification altogether with config.verify_access_token_introspection_expiry.
    access_token_introspection_scopes_claims Sequence[str]
    Specify the claim/property in access token introspection results (JSON) to be verified against values of config.access_token_introspection_scopes_required. This supports nested claims. For example, with Keycloak you could use [ "realm_access", "roles" ], hich can be given as realm_access,roles (form post). If the claim is not found in access token introspection results, and you have specified config.access_token_introspection_scopes_required, the plugin responds with 403 Forbidden.
    access_token_introspection_scopes_requireds Sequence[str]
    Specify the required values (or scopes) that are checked by an introspection claim/property specified by config.access_token_introspection_scopes_claim.
    access_token_introspection_timeout float
    Timeout in milliseconds for an introspection request. The plugin tries to introspect twice if the first request fails for some reason. If both requests timeout, then the plugin runs two times the config.access_token_introspection_timeout on access token introspection.
    access_token_issuer str
    The iss claim of a signed or re-signed access token is set to this value. Original iss claim of the incoming token (possibly introspected) is stored in original_iss claim of the newly signed access token.
    access_token_jwks_uri str
    Specify the URI where the plugin can fetch the public keys (JWKS) to verify the signature of the access token.
    access_token_jwks_uri_client_certificate str
    The client certificate that will be used to authenticate Kong if access_token_jwks_uri is an https uri that requires mTLS Auth.
    access_token_jwks_uri_client_password str
    The client password that will be used to authenticate Kong if access_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with access_token_jwks_uri_client_username
    access_token_jwks_uri_client_username str
    The client username that will be used to authenticate Kong if access_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with access_token_jwks_uri_client_password
    access_token_jwks_uri_rotate_period float
    Specify the period (in seconds) to auto-rotate the jwks for access_token_jwks_uri. The default value 0 means no auto-rotation.
    access_token_keyset str
    The name of the keyset containing signing keys.
    access_token_keyset_client_certificate str
    The client certificate that will be used to authenticate Kong if access_token_keyset is an https uri that requires mTLS Auth.
    access_token_keyset_client_password str
    The client password that will be used to authenticate Kong if access_token_keyset is a uri that requires Basic Auth. Should be configured together with access_token_keyset_client_username
    access_token_keyset_client_username str
    The client username that will be used to authenticate Kong if access_token_keyset is a uri that requires Basic Auth. Should be configured together with access_token_keyset_client_password
    access_token_keyset_rotate_period float
    Specify the period (in seconds) to auto-rotate the jwks for access_token_keyset. The default value 0 means no auto-rotation.
    access_token_leeway float
    Adjusts clock skew between the token issuer and Kong. The value is added to the token's exp claim before checking token expiry against Kong servers' current time in seconds. You can disable access token expiry verification altogether with config.verify_access_token_expiry.
    access_token_optional bool
    If an access token is not provided or no config.access_token_request_header is specified, the plugin cannot verify the access token. In that case, the plugin normally responds with 401 Unauthorized (client didn't send a token) or 500 Unexpected (a configuration error). Use this parameter to allow the request to proceed even when there is no token to check. If the token is provided, then this parameter has no effect
    access_token_request_header str
    This parameter tells the name of the header where to look for the access token.
    access_token_scopes_claims Sequence[str]
    Specify the claim in an access token to verify against values of config.access_token_scopes_required.
    access_token_scopes_requireds Sequence[str]
    Specify the required values (or scopes) that are checked by a claim specified by config.access_token_scopes_claim.
    access_token_signing_algorithm str
    When this plugin sets the upstream header as specified with config.access_token_upstream_header, re-signs the original access token using the private keys of the JWT Signer plugin. Specify the algorithm that is used to sign the token. The config.access_token_issuer specifies which keyset is used to sign the new token issued by Kong using the specified signing algorithm. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS512"]
    access_token_upstream_header str
    Removes the config.access_token_request_header from the request after reading its value. With config.access_token_upstream_header, you can specify the upstream header where the plugin adds the Kong signed token. If you don't specify a value, such as use null or "" (empty string), the plugin does not even try to sign or re-sign the token.
    access_token_upstream_leeway float
    If you want to add or subtract (using a negative value) expiry time (in seconds) of the original access token, you can specify a value that is added to the original access token's exp claim.
    add_access_token_claims Mapping[str, str]
    Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    add_channel_token_claims Mapping[str, str]
    Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    add_claims Mapping[str, str]
    Add customized claims to both tokens if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    cache_access_token_introspection bool
    Whether to cache access token introspection results.
    cache_channel_token_introspection bool
    Whether to cache channel token introspection results.
    channel_token_consumer_bies Sequence[str]
    When the plugin tries to do channel token to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of valid values: id, username, and custom_id.
    channel_token_consumer_claims Sequence[str]
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter. Kong consumers have an id, a username, and a custom_id. If this parameter is enabled but the mapping fails, such as when there's a non-existent Kong consumer, the plugin responds with 403 Forbidden.
    channel_token_introspection_authorization str
    When using opaque channel tokens, and you want to turn on channel token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise the plugin will not try introspection, and instead returns 401 Unauthorized when using opaque channel tokens.
    channel_token_introspection_body_args str
    If you need to pass additional body arguments to introspection endpoint when the plugin introspects the opaque channel token, you can use this config parameter to specify them. You should URL encode the value. For example: resource= or a=1&b=&c.
    channel_token_introspection_consumer_bies Sequence[str]
    When the plugin tries to do channel token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values. Valid values are id, username and custom_id.
    channel_token_introspection_consumer_claims Sequence[str]
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (such as sub or username) in channel token introspection results to Kong consumer entity
    channel_token_introspection_endpoint str
    When you use opaque access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise, the plugin does not try introspection and returns 401 Unauthorized instead.
    channel_token_introspection_hint str
    If you need to give hint parameter when introspecting a channel token, you can use this parameter to specify the value of such parameter. By default, a hint isn't sent with channel token introspection.
    channel_token_introspection_jwt_claims Sequence[str]
    If your introspection endpoint returns a channel token in one of the keys (or claims) in the introspection results (JSON), the plugin can use that value instead of the introspection results when doing expiry verification and signing of the new token issued by Kong.
    channel_token_introspection_leeway float
    You can use this parameter to adjust clock skew between the token issuer introspection results and Kong. The value will be added to introspection results (JSON) exp claim/property before checking token expiry against Kong servers current time (in seconds). You can disable channel token introspection expiry verification altogether with config.verify_channel_token_introspection_expiry.
    channel_token_introspection_scopes_claims Sequence[str]
    Use this parameter to specify the claim/property in channel token introspection results (JSON) to be verified against values of config.channel_token_introspection_scopes_required. This supports nested claims.
    channel_token_introspection_scopes_requireds Sequence[str]
    Use this parameter to specify the required values (or scopes) that are checked by an introspection claim/property specified by config.channel_token_introspection_scopes_claim.
    channel_token_introspection_timeout float
    Timeout in milliseconds for an introspection request. The plugin tries to introspect twice if the first request fails for some reason. If both requests timeout, then the plugin runs two times the config.access_token_introspection_timeout on channel token introspection.
    channel_token_issuer str
    The iss claim of the re-signed channel token is set to this value, which is kong by default. The original iss claim of the incoming token (possibly introspected) is stored in the original_iss claim of the newly signed channel token.
    channel_token_jwks_uri str
    If you want to use config.verify_channel_token_signature, you must specify the URI where the plugin can fetch the public keys (JWKS) to verify the signature of the channel token. If you don't specify a URI and you pass a JWT token to the plugin, then the plugin responds with 401 Unauthorized.
    channel_token_jwks_uri_client_certificate str
    The client certificate that will be used to authenticate Kong if access_token_jwks_uri is an https uri that requires mTLS Auth.
    channel_token_jwks_uri_client_password str
    The client password that will be used to authenticate Kong if channel_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with channel_token_jwks_uri_client_username
    channel_token_jwks_uri_client_username str
    The client username that will be used to authenticate Kong if channel_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with channel_token_jwks_uri_client_password
    channel_token_jwks_uri_rotate_period float
    Specify the period (in seconds) to auto-rotate the jwks for channel_token_jwks_uri. The default value 0 means no auto-rotation.
    channel_token_keyset str
    The name of the keyset containing signing keys.
    channel_token_keyset_client_certificate str
    The client certificate that will be used to authenticate Kong if channel_token_keyset is an https uri that requires mTLS Auth.
    channel_token_keyset_client_password str
    The client password that will be used to authenticate Kong if channel_token_keyset is a uri that requires Basic Auth. Should be configured together with channel_token_keyset_client_username
    channel_token_keyset_client_username str
    The client username that will be used to authenticate Kong if channel_token_keyset is a uri that requires Basic Auth. Should be configured together with channel_token_keyset_client_password
    channel_token_keyset_rotate_period float
    Specify the period (in seconds) to auto-rotate the jwks for channel_token_keyset. The default value 0 means no auto-rotation.
    channel_token_leeway float
    Adjusts clock skew between the token issuer and Kong. The value will be added to token's exp claim before checking token expiry against Kong servers current time in seconds. You can disable channel token expiry verification altogether with config.verify_channel_token_expiry.
    channel_token_optional bool
    If a channel token is not provided or no config.channel_token_request_header is specified, the plugin cannot verify the channel token. In that case, the plugin normally responds with 401 Unauthorized (client didn't send a token) or 500 Unexpected (a configuration error). Enable this parameter to allow the request to proceed even when there is no channel token to check. If the channel token is provided, then this parameter has no effect
    channel_token_request_header str
    This parameter tells the name of the header where to look for the channel token. If you don't want to do anything with the channel token, then you can set this to null or "" (empty string).
    channel_token_scopes_claims Sequence[str]
    Specify the claim in a channel token to verify against values of config.channel_token_scopes_required. This supports nested claims.
    channel_token_scopes_requireds Sequence[str]
    Specify the required values (or scopes) that are checked by a claim specified by config.channel_token_scopes_claim.
    channel_token_signing_algorithm str
    When this plugin sets the upstream header as specified with config.channel_token_upstream_header, it also re-signs the original channel token using private keys of this plugin. Specify the algorithm that is used to sign the token. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS512"]
    channel_token_upstream_header str
    This plugin removes the config.channel_token_request_header from the request after reading its value.
    channel_token_upstream_leeway float
    If you want to add or perhaps subtract (using negative value) expiry time of the original channel token, you can specify a value that is added to the original channel token's exp claim.
    enable_access_token_introspection bool
    If you don't want to support opaque access tokens, change this configuration parameter to false to disable introspection.
    enable_channel_token_introspection bool
    If you don't want to support opaque channel tokens, disable introspection by changing this configuration parameter to false.
    enable_hs_signatures bool
    Tokens signed with HMAC algorithms such as HS256, HS384, or HS512 are not accepted by default. If you need to accept such tokens for verification, enable this setting.
    enable_instrumentation bool
    Writes log entries with some added information using ngx.CRIT (CRITICAL) level.
    original_access_token_upstream_header str
    The HTTP header name used to store the original access token.
    original_channel_token_upstream_header str
    The HTTP header name used to store the original channel token.
    realm str
    When authentication or authorization fails, or there is an unexpected error, the plugin sends an WWW-Authenticate header with the realm attribute value.
    remove_access_token_claims Sequence[str]
    remove claims. It should be an array, and each element is a claim key string.
    remove_channel_token_claims Sequence[str]
    remove claims. It should be an array, and each element is a claim key string.
    set_access_token_claims Mapping[str, str]
    Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    set_channel_token_claims Mapping[str, str]
    Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    set_claims Mapping[str, str]
    Set customized claims to both tokens. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    trust_access_token_introspection bool
    Use this parameter to enable and disable further checks on a payload before the new token is signed. If you set this to true, the expiry or scopes are not checked on a payload.
    trust_channel_token_introspection bool
    Providing an opaque channel token for plugin introspection, and verifying expiry and scopes on introspection results may make further payload checks unnecessary before the plugin signs a new token. This also applies when using a JWT token with introspection JSON as per config.channeltokenintrospectionjwtclaim. Use this parameter to manage additional payload checks before signing a new token. With true (default), payload's expiry or scopes aren't checked.
    verify_access_token_expiry bool
    Quickly turn access token expiry verification off and on as needed.
    verify_access_token_introspection_expiry bool
    Quickly turn access token introspection expiry verification off and on as needed.
    verify_access_token_introspection_scopes bool
    Quickly turn off and on the access token introspection scopes verification, specified with config.access_token_introspection_scopes_required.
    verify_access_token_scopes bool
    Quickly turn off and on the access token required scopes verification, specified with config.access_token_scopes_required.
    verify_access_token_signature bool
    Quickly turn access token signature verification off and on as needed.
    verify_channel_token_expiry bool
    verify_channel_token_introspection_expiry bool
    Quickly turn on/off the channel token introspection expiry verification.
    verify_channel_token_introspection_scopes bool
    Quickly turn on/off the channel token introspection scopes verification specified with config.channel_token_introspection_scopes_required.
    verify_channel_token_scopes bool
    Quickly turn on/off the channel token required scopes verification specified with config.channel_token_scopes_required.
    verify_channel_token_signature bool
    Quickly turn on/off the channel token signature verification.
    accessTokenConsumerBies List<String>
    When the plugin tries to apply an access token to a Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of alues. Valid values are id, username, and custom_id.
    accessTokenConsumerClaims List<String>
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (for example, sub or username) in an access token to Kong consumer entity.
    accessTokenIntrospectionAuthorization String
    If the introspection endpoint requires client authentication (client being the JWT Signer plugin), you can specify the Authorization header's value with this configuration parameter.
    accessTokenIntrospectionBodyArgs String
    This parameter allows you to pass URL encoded request body arguments. For example: resource= or a=1&b=&c.
    accessTokenIntrospectionConsumerBies List<String>
    When the plugin tries to do access token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values.
    accessTokenIntrospectionConsumerClaims List<String>
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (such as sub or username) in access token introspection results to the Kong consumer entity.
    accessTokenIntrospectionEndpoint String
    When you use opaque access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter.
    accessTokenIntrospectionHint String
    If you need to give hint parameter when introspecting an access token, use this parameter to specify the value. By default, the plugin sends hint=access_token.
    accessTokenIntrospectionJwtClaims List<String>
    If your introspection endpoint returns an access token in one of the keys (or claims) within the introspection results (JSON). If the key cannot be found, the plugin responds with 401 Unauthorized. Also if the key is found but cannot be decoded as JWT, it also responds with 401 Unauthorized.
    accessTokenIntrospectionLeeway Number
    Adjusts clock skew between the token issuer introspection results and Kong. The value is added to introspection results (JSON) exp claim/property before checking token expiry against Kong servers current time in seconds. You can disable access token introspection expiry verification altogether with config.verify_access_token_introspection_expiry.
    accessTokenIntrospectionScopesClaims List<String>
    Specify the claim/property in access token introspection results (JSON) to be verified against values of config.access_token_introspection_scopes_required. This supports nested claims. For example, with Keycloak you could use [ "realm_access", "roles" ], hich can be given as realm_access,roles (form post). If the claim is not found in access token introspection results, and you have specified config.access_token_introspection_scopes_required, the plugin responds with 403 Forbidden.
    accessTokenIntrospectionScopesRequireds List<String>
    Specify the required values (or scopes) that are checked by an introspection claim/property specified by config.access_token_introspection_scopes_claim.
    accessTokenIntrospectionTimeout Number
    Timeout in milliseconds for an introspection request. The plugin tries to introspect twice if the first request fails for some reason. If both requests timeout, then the plugin runs two times the config.access_token_introspection_timeout on access token introspection.
    accessTokenIssuer String
    The iss claim of a signed or re-signed access token is set to this value. Original iss claim of the incoming token (possibly introspected) is stored in original_iss claim of the newly signed access token.
    accessTokenJwksUri String
    Specify the URI where the plugin can fetch the public keys (JWKS) to verify the signature of the access token.
    accessTokenJwksUriClientCertificate String
    The client certificate that will be used to authenticate Kong if access_token_jwks_uri is an https uri that requires mTLS Auth.
    accessTokenJwksUriClientPassword String
    The client password that will be used to authenticate Kong if access_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with access_token_jwks_uri_client_username
    accessTokenJwksUriClientUsername String
    The client username that will be used to authenticate Kong if access_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with access_token_jwks_uri_client_password
    accessTokenJwksUriRotatePeriod Number
    Specify the period (in seconds) to auto-rotate the jwks for access_token_jwks_uri. The default value 0 means no auto-rotation.
    accessTokenKeyset String
    The name of the keyset containing signing keys.
    accessTokenKeysetClientCertificate String
    The client certificate that will be used to authenticate Kong if access_token_keyset is an https uri that requires mTLS Auth.
    accessTokenKeysetClientPassword String
    The client password that will be used to authenticate Kong if access_token_keyset is a uri that requires Basic Auth. Should be configured together with access_token_keyset_client_username
    accessTokenKeysetClientUsername String
    The client username that will be used to authenticate Kong if access_token_keyset is a uri that requires Basic Auth. Should be configured together with access_token_keyset_client_password
    accessTokenKeysetRotatePeriod Number
    Specify the period (in seconds) to auto-rotate the jwks for access_token_keyset. The default value 0 means no auto-rotation.
    accessTokenLeeway Number
    Adjusts clock skew between the token issuer and Kong. The value is added to the token's exp claim before checking token expiry against Kong servers' current time in seconds. You can disable access token expiry verification altogether with config.verify_access_token_expiry.
    accessTokenOptional Boolean
    If an access token is not provided or no config.access_token_request_header is specified, the plugin cannot verify the access token. In that case, the plugin normally responds with 401 Unauthorized (client didn't send a token) or 500 Unexpected (a configuration error). Use this parameter to allow the request to proceed even when there is no token to check. If the token is provided, then this parameter has no effect
    accessTokenRequestHeader String
    This parameter tells the name of the header where to look for the access token.
    accessTokenScopesClaims List<String>
    Specify the claim in an access token to verify against values of config.access_token_scopes_required.
    accessTokenScopesRequireds List<String>
    Specify the required values (or scopes) that are checked by a claim specified by config.access_token_scopes_claim.
    accessTokenSigningAlgorithm String
    When this plugin sets the upstream header as specified with config.access_token_upstream_header, re-signs the original access token using the private keys of the JWT Signer plugin. Specify the algorithm that is used to sign the token. The config.access_token_issuer specifies which keyset is used to sign the new token issued by Kong using the specified signing algorithm. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS512"]
    accessTokenUpstreamHeader String
    Removes the config.access_token_request_header from the request after reading its value. With config.access_token_upstream_header, you can specify the upstream header where the plugin adds the Kong signed token. If you don't specify a value, such as use null or "" (empty string), the plugin does not even try to sign or re-sign the token.
    accessTokenUpstreamLeeway Number
    If you want to add or subtract (using a negative value) expiry time (in seconds) of the original access token, you can specify a value that is added to the original access token's exp claim.
    addAccessTokenClaims Map<String>
    Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    addChannelTokenClaims Map<String>
    Add customized claims if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    addClaims Map<String>
    Add customized claims to both tokens if they are not present yet. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    cacheAccessTokenIntrospection Boolean
    Whether to cache access token introspection results.
    cacheChannelTokenIntrospection Boolean
    Whether to cache channel token introspection results.
    channelTokenConsumerBies List<String>
    When the plugin tries to do channel token to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of valid values: id, username, and custom_id.
    channelTokenConsumerClaims List<String>
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter. Kong consumers have an id, a username, and a custom_id. If this parameter is enabled but the mapping fails, such as when there's a non-existent Kong consumer, the plugin responds with 403 Forbidden.
    channelTokenIntrospectionAuthorization String
    When using opaque channel tokens, and you want to turn on channel token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise the plugin will not try introspection, and instead returns 401 Unauthorized when using opaque channel tokens.
    channelTokenIntrospectionBodyArgs String
    If you need to pass additional body arguments to introspection endpoint when the plugin introspects the opaque channel token, you can use this config parameter to specify them. You should URL encode the value. For example: resource= or a=1&b=&c.
    channelTokenIntrospectionConsumerBies List<String>
    When the plugin tries to do channel token introspection results to Kong consumer mapping, it tries to find a matching Kong consumer from properties defined using this configuration parameter. The parameter can take an array of values. Valid values are id, username and custom_id.
    channelTokenIntrospectionConsumerClaims List<String>
    When you set a value for this parameter, the plugin tries to map an arbitrary claim specified with this configuration parameter (such as sub or username) in channel token introspection results to Kong consumer entity
    channelTokenIntrospectionEndpoint String
    When you use opaque access tokens and you want to turn on access token introspection, you need to specify the OAuth 2.0 introspection endpoint URI with this configuration parameter. Otherwise, the plugin does not try introspection and returns 401 Unauthorized instead.
    channelTokenIntrospectionHint String
    If you need to give hint parameter when introspecting a channel token, you can use this parameter to specify the value of such parameter. By default, a hint isn't sent with channel token introspection.
    channelTokenIntrospectionJwtClaims List<String>
    If your introspection endpoint returns a channel token in one of the keys (or claims) in the introspection results (JSON), the plugin can use that value instead of the introspection results when doing expiry verification and signing of the new token issued by Kong.
    channelTokenIntrospectionLeeway Number
    You can use this parameter to adjust clock skew between the token issuer introspection results and Kong. The value will be added to introspection results (JSON) exp claim/property before checking token expiry against Kong servers current time (in seconds). You can disable channel token introspection expiry verification altogether with config.verify_channel_token_introspection_expiry.
    channelTokenIntrospectionScopesClaims List<String>
    Use this parameter to specify the claim/property in channel token introspection results (JSON) to be verified against values of config.channel_token_introspection_scopes_required. This supports nested claims.
    channelTokenIntrospectionScopesRequireds List<String>
    Use this parameter to specify the required values (or scopes) that are checked by an introspection claim/property specified by config.channel_token_introspection_scopes_claim.
    channelTokenIntrospectionTimeout Number
    Timeout in milliseconds for an introspection request. The plugin tries to introspect twice if the first request fails for some reason. If both requests timeout, then the plugin runs two times the config.access_token_introspection_timeout on channel token introspection.
    channelTokenIssuer String
    The iss claim of the re-signed channel token is set to this value, which is kong by default. The original iss claim of the incoming token (possibly introspected) is stored in the original_iss claim of the newly signed channel token.
    channelTokenJwksUri String
    If you want to use config.verify_channel_token_signature, you must specify the URI where the plugin can fetch the public keys (JWKS) to verify the signature of the channel token. If you don't specify a URI and you pass a JWT token to the plugin, then the plugin responds with 401 Unauthorized.
    channelTokenJwksUriClientCertificate String
    The client certificate that will be used to authenticate Kong if access_token_jwks_uri is an https uri that requires mTLS Auth.
    channelTokenJwksUriClientPassword String
    The client password that will be used to authenticate Kong if channel_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with channel_token_jwks_uri_client_username
    channelTokenJwksUriClientUsername String
    The client username that will be used to authenticate Kong if channel_token_jwks_uri is a uri that requires Basic Auth. Should be configured together with channel_token_jwks_uri_client_password
    channelTokenJwksUriRotatePeriod Number
    Specify the period (in seconds) to auto-rotate the jwks for channel_token_jwks_uri. The default value 0 means no auto-rotation.
    channelTokenKeyset String
    The name of the keyset containing signing keys.
    channelTokenKeysetClientCertificate String
    The client certificate that will be used to authenticate Kong if channel_token_keyset is an https uri that requires mTLS Auth.
    channelTokenKeysetClientPassword String
    The client password that will be used to authenticate Kong if channel_token_keyset is a uri that requires Basic Auth. Should be configured together with channel_token_keyset_client_username
    channelTokenKeysetClientUsername String
    The client username that will be used to authenticate Kong if channel_token_keyset is a uri that requires Basic Auth. Should be configured together with channel_token_keyset_client_password
    channelTokenKeysetRotatePeriod Number
    Specify the period (in seconds) to auto-rotate the jwks for channel_token_keyset. The default value 0 means no auto-rotation.
    channelTokenLeeway Number
    Adjusts clock skew between the token issuer and Kong. The value will be added to token's exp claim before checking token expiry against Kong servers current time in seconds. You can disable channel token expiry verification altogether with config.verify_channel_token_expiry.
    channelTokenOptional Boolean
    If a channel token is not provided or no config.channel_token_request_header is specified, the plugin cannot verify the channel token. In that case, the plugin normally responds with 401 Unauthorized (client didn't send a token) or 500 Unexpected (a configuration error). Enable this parameter to allow the request to proceed even when there is no channel token to check. If the channel token is provided, then this parameter has no effect
    channelTokenRequestHeader String
    This parameter tells the name of the header where to look for the channel token. If you don't want to do anything with the channel token, then you can set this to null or "" (empty string).
    channelTokenScopesClaims List<String>
    Specify the claim in a channel token to verify against values of config.channel_token_scopes_required. This supports nested claims.
    channelTokenScopesRequireds List<String>
    Specify the required values (or scopes) that are checked by a claim specified by config.channel_token_scopes_claim.
    channelTokenSigningAlgorithm String
    When this plugin sets the upstream header as specified with config.channel_token_upstream_header, it also re-signs the original channel token using private keys of this plugin. Specify the algorithm that is used to sign the token. must be one of ["ES256", "ES384", "ES512", "EdDSA", "HS256", "HS384", "HS512", "PS256", "PS384", "PS512", "RS256", "RS512"]
    channelTokenUpstreamHeader String
    This plugin removes the config.channel_token_request_header from the request after reading its value.
    channelTokenUpstreamLeeway Number
    If you want to add or perhaps subtract (using negative value) expiry time of the original channel token, you can specify a value that is added to the original channel token's exp claim.
    enableAccessTokenIntrospection Boolean
    If you don't want to support opaque access tokens, change this configuration parameter to false to disable introspection.
    enableChannelTokenIntrospection Boolean
    If you don't want to support opaque channel tokens, disable introspection by changing this configuration parameter to false.
    enableHsSignatures Boolean
    Tokens signed with HMAC algorithms such as HS256, HS384, or HS512 are not accepted by default. If you need to accept such tokens for verification, enable this setting.
    enableInstrumentation Boolean
    Writes log entries with some added information using ngx.CRIT (CRITICAL) level.
    originalAccessTokenUpstreamHeader String
    The HTTP header name used to store the original access token.
    originalChannelTokenUpstreamHeader String
    The HTTP header name used to store the original channel token.
    realm String
    When authentication or authorization fails, or there is an unexpected error, the plugin sends an WWW-Authenticate header with the realm attribute value.
    removeAccessTokenClaims List<String>
    remove claims. It should be an array, and each element is a claim key string.
    removeChannelTokenClaims List<String>
    remove claims. It should be an array, and each element is a claim key string.
    setAccessTokenClaims Map<String>
    Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    setChannelTokenClaims Map<String>
    Set customized claims. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    setClaims Map<String>
    Set customized claims to both tokens. If a claim is already present, it will be overwritten. Value can be a regular or JSON string; if JSON, decoded data is used as the claim's value.
    trustAccessTokenIntrospection Boolean
    Use this parameter to enable and disable further checks on a payload before the new token is signed. If you set this to true, the expiry or scopes are not checked on a payload.
    trustChannelTokenIntrospection Boolean
    Providing an opaque channel token for plugin introspection, and verifying expiry and scopes on introspection results may make further payload checks unnecessary before the plugin signs a new token. This also applies when using a JWT token with introspection JSON as per config.channeltokenintrospectionjwtclaim. Use this parameter to manage additional payload checks before signing a new token. With true (default), payload's expiry or scopes aren't checked.
    verifyAccessTokenExpiry Boolean
    Quickly turn access token expiry verification off and on as needed.
    verifyAccessTokenIntrospectionExpiry Boolean
    Quickly turn access token introspection expiry verification off and on as needed.
    verifyAccessTokenIntrospectionScopes Boolean
    Quickly turn off and on the access token introspection scopes verification, specified with config.access_token_introspection_scopes_required.
    verifyAccessTokenScopes Boolean
    Quickly turn off and on the access token required scopes verification, specified with config.access_token_scopes_required.
    verifyAccessTokenSignature Boolean
    Quickly turn access token signature verification off and on as needed.
    verifyChannelTokenExpiry Boolean
    verifyChannelTokenIntrospectionExpiry Boolean
    Quickly turn on/off the channel token introspection expiry verification.
    verifyChannelTokenIntrospectionScopes Boolean
    Quickly turn on/off the channel token introspection scopes verification specified with config.channel_token_introspection_scopes_required.
    verifyChannelTokenScopes Boolean
    Quickly turn on/off the channel token required scopes verification specified with config.channel_token_scopes_required.
    verifyChannelTokenSignature Boolean
    Quickly turn on/off the channel token signature verification.

    GatewayPluginJwtSignerOrdering, GatewayPluginJwtSignerOrderingArgs

    GatewayPluginJwtSignerOrderingAfter, GatewayPluginJwtSignerOrderingAfterArgs

    Accesses List<string>
    Accesses []string
    accesses List<String>
    accesses string[]
    accesses Sequence[str]
    accesses List<String>

    GatewayPluginJwtSignerOrderingBefore, GatewayPluginJwtSignerOrderingBeforeArgs

    Accesses List<string>
    Accesses []string
    accesses List<String>
    accesses string[]
    accesses Sequence[str]
    accesses List<String>

    GatewayPluginJwtSignerRoute, GatewayPluginJwtSignerRouteArgs

    Id string
    Id string
    id String
    id string
    id str
    id String

    GatewayPluginJwtSignerService, GatewayPluginJwtSignerServiceArgs

    Id string
    Id string
    id String
    id string
    id str
    id String

    Import

    $ pulumi import konnect:index/gatewayPluginJwtSigner:GatewayPluginJwtSigner my_konnect_gateway_plugin_jwt_signer "{ \"control_plane_id\": \"9524ec7d-36d9-465d-a8c5-83a3c9390458\", \"plugin_id\": \"3473c251-5b6c-4f45-b1ff-7ede735a366d\"}"

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    konnect kong/terraform-provider-konnect
    License
    Notes
    This Pulumi package is based on the konnect Terraform Provider.
    konnect logo
    konnect 2.4.1 published on Thursday, Mar 13, 2025 by kong
    kong/terraform-provider-konnect