REST API - update

vcenter identity providers: update

Update a vCenter Server identity provider. This operation was added in vSphere API 7.0.0.0.

Request:

HTTP request

PATCH https://{server}/rest/vcenter/identity/providers/{provider}

Path Parameters

Name	Type	Description
Required
provider	string	the identifier of the provider to update.

Request Body Structure:

{
    "spec" : {
        "idm_protocol" : "REST",
        "reset_upn_claim" : true,
        "config_tag" : "Oauth2",
        "org_ids" : [
            "string",
            "string"
        ],
        "upn_claim" : "string",
        "oauth2" : {
            "authentication_method" : "CLIENT_SECRET_BASIC",
            "public_key_uri" : "http://myurl.com",
            "claim_map" : [
                {
                    "value" : [
                        {
                            "value" : [
                                "string",
                                "string"
                            ],
                            "key" : "string"
                        }
                    ],
                    "key" : "string"
                }
            ],
            "auth_endpoint" : "http://myurl.com",
            "client_secret" : "string",
            "auth_query_params" : [
                {
                    "value" : [
                        "string",
                        "string"
                    ],
                    "key" : "string"
                }
            ],
            "client_id" : "string",
            "issuer" : "string",
            "token_endpoint" : "http://myurl.com"
        },
        "auth_query_params" : [
            {
                "value" : [
                    "string",
                    "string"
                ],
                "key" : "string"
            }
        ],
        "oidc" : {
            "claim_map" : [
                {
                    "value" : [
                        {
                            "value" : [
                                "string",
                                "string"
                            ],
                            "key" : "string"
                        }
                    ],
                    "key" : "string"
                }
            ],
            "client_secret" : "string",
            "discovery_endpoint" : "http://myurl.com",
            "client_id" : "string"
        },
        "idm_endpoints" : [
            "http://myurl.com",
            "http://myurl.com"
        ],
        "domain_names" : [
            "string",
            "string"
        ],
        "make_default" : true,
        "reset_groups_claim" : true,
        "groups_claim" : "string",
        "active_directory_over_ldap" : {
            "groups_base_dn" : "string",
            "password" : "secret string",
            "user_name" : "string",
            "users_base_dn" : "string",
            "server_endpoints" : [
                "http://myurl.com",
                "http://myurl.com"
            ],
            "cert_chain" : {
                "cert_chain" : [
                    "string",
                    "string"
                ]
            }
        },
        "name" : "string"
    }
}

Request Body Parameters:

Name	Type	Description
bold = required
spec	update_spec	the UpdateSpec contains the information used to update the provider.
spec.config_tag	string	The config type of the identity provider. This attribute was added in vSphere API 7.0.0.0. The `config_type` structure contains the possible types of vCenter Server identity providers. This enumeration was added in vSphere API 7.0.0.0. Value is one of: Oauth2: Config for OAuth2. This constant was added in vSphere API 7.0.0.0. Oidc: Config for OIDC. This constant was added in vSphere API 7.0.0.0.
spec.oauth2	oauth2_update_spec	OAuth2 UpdateSpec. This attribute was added in vSphere API 7.0.0.0. Optional. It is only relevant when config_tag has value Oauth2. This field is optional and it is only relevant when the value of `config_tag` is oauth2.
spec.oauth2.auth_endpoint	URI	Authentication/authorization endpoint of the provider. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.oauth2.token_endpoint	URI	Token endpoint of the provider. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.oauth2.public_key_uri	URI	Endpoint to retrieve the provider public key for validation. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.oauth2.client_id	string	Client identifier to connect to the provider. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.oauth2.client_secret	string	Shared secret between identity provider and client. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.oauth2.claim_map	list	The map used to transform an OAuth2 claim to a corresponding claim that vCenter Server understands. Currently only the key "perms" is supported. The key "perms" is used for mapping the "perms" claim of incoming JWT. The value is another map with an external group as the key and a vCenter Server group as value. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.oauth2.claim_map[].key	string
spec.oauth2.claim_map[].value	list	List of {"key": string, "value": string[]}
spec.oauth2.claim_map[].value[].key	string
spec.oauth2.claim_map[].value[].value	string[]
spec.oauth2.issuer	string	The identity provider namespace. It is used to validate the issuer in the acquired OAuth2 token. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.oauth2.authentication_method	string	Authentication method used by the provider. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.oauth2.auth_query_params	list	key/value pairs that are to be appended to the authEndpoint request. How to append to authEndpoint request: If the map is not empty, a "?" is added to the endpoint URL, and combination of each k and each string in the v is added with an "&" delimiter. Details: If the value contains only one string, then the key is added with "k=v". If the value is an empty list, then the key is added without a "=v". If the value contains multiple strings, then the key is repeated in the query-string for each string in the value. If the map is empty, deletes all params. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.oidc	oidc_update_spec	OIDC UpdateSpec. This attribute was added in vSphere API 7.0.0.0. Optional. It is only relevant when config_tag has value Oidc. This field is optional and it is only relevant when the value of `config_tag` is oidc.
spec.oidc.discovery_endpoint	URI	Endpoint to retrieve the provider metadata. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.oidc.client_id	string	Client identifier to connect to the provider. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.oidc.client_secret	string	The secret shared between the client and the provider. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.oidc.claim_map	list	The map used to transform an OAuth2 claim to a corresponding claim that vCenter Server understands. Currently only the key "perms" is supported. The key "perms" is used for mapping the "perms" claim of incoming JWT. The value is another map with an external group as the key and a vCenter Server group as value. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.org_ids	string[]	The set orgIds as part of SDDC creation which provides the basis for tenancy. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.make_default	boolean	Specifies whether to make this the default provider. If `make_default` is set to true, this provider will be flagged as the default provider and any other providers that had previously been flagged as the default will be made non-default. If `make_default` is set to false, this provider's default flag will not be modified. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.name	string	The user friendly name for the provider. This name can be used for human-readable identification purposes, but it does not have to be unique, as the system will use internal UUIDs to differentiate providers. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.domain_names	string[]	Set of fully qualified domain names to trust when federating with this identity provider. Tokens from this identity provider will only be validated if the user belongs to one of these domains, and any domain-qualified groups in the tokens will be filtered to include only those groups that belong to one of these domains. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged. If domainNames is an empty set, domain validation behavior at login with this identity provider will be as follows: the user's domain will be parsed from the User Principal Name (UPN) value that is found in the tokens returned by the identity provider. This domain will then be implicitly trusted and used to filter any groups that are also provided in the tokens.
spec.auth_query_params	list	key/value pairs that are to be appended to the authEndpoint request. How to append to authEndpoint request: If the map is not empty, a "?" is added to the endpoint URL, and combination of each k and each string in the v is added with an "&" delimiter. Details: If the value contains only one string, then the key is added with "k=v". If the value is an empty list, then the key is added without a "=v". If the value contains multiple strings, then the key is repeated in the query-string for each string in the value. If the map is empty, deletes all params. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.idm_protocol	string	The protocol to communicate to the identity management endpoints. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leave value unchanged.
spec.idm_endpoints	URI[]	Identity management endpoints. When specified, at least one endpoint must be provided. This attribute was added in vSphere API 7.0.0.0. Optional. It is only relevant when idm_protocol has value [REST, SCIM, SCIM2_0]. This field is optional and it is only relevant when the value of `idm_protocol` is one of REST, SCIM, or scim2_0.
spec.active_directory_over_ldap	active_directory_over_ldap	Identity management configuration. If the protocol is LDAP, the configuration must be set, else InvalidArgument is thrown. This attribute was added in vSphere API 7.0.0.0. Optional. It is only relevant when idm_protocol has value LDAP. This field is optional and it is only relevant when the value of `idm_protocol` is LDAP.
spec.active_directory_over_ldap.user_name	string	User name to connect to the active directory server. This attribute was added in vSphere API 7.0.0.0.
spec.active_directory_over_ldap.password	secret	Password to connect to the active directory server. This attribute was added in vSphere API 7.0.0.0.
spec.active_directory_over_ldap.users_base_dn	string	Base distinguished name for users. This attribute was added in vSphere API 7.0.0.0.
spec.active_directory_over_ldap.groups_base_dn	string	Base distinguished name for groups. This attribute was added in vSphere API 7.0.0.0.
spec.active_directory_over_ldap.server_endpoints	URI[]	Active directory server endpoints. At least one active directory server endpoint must be set. This attribute was added in vSphere API 7.0.0.0.
spec.active_directory_over_ldap.cert_chain	x509_cert_chain	SSL certificate chain in base64 encoding. This attribute was added in vSphere API 7.0.0.0. Optional. This field can be unset only, if all the active directory server endpoints use the LDAP (not LDAPS) protocol.
spec.active_directory_over_ldap.cert_chain.cert_chain	string[]	Certificate chain in base64 format. This attribute was added in vSphere API 6.7.2.
spec.upn_claim	string	Specifies which claim provides the user principal name (UPN) for the subject of the token. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.reset_upn_claim	boolean	Flag indicating whether the user principal name (UPN) claim should be set back to its default value. If this field is set to `true`, the user principal name (UPN) claim will be set to 'acct', which is used for backwards compatibility with CSP. If this field is set to `false`, the existing user principal name (UPN) claim will be changed to the value specified in vcenter.identity.providers.update_spec.upn_claim, if any. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, the existing user principal name (UPN) claim will be changed to the value specified in vcenter.identity.providers.update_spec.upn_claim, if any.
spec.groups_claim	string	Specifies which claim provides the group membership for the token subject. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, leaves value unchanged.
spec.reset_groups_claim	boolean	Flag indicating whether any existing groups claim value should be removed. If this field is set to `true`, the existing groups claim value is removed which defaults to backwards compatibility with CSP. In this case, the groups for the subject will be comprised of the groups in 'group_names' and 'group_ids' claims. If this field is set to `false`, the existing groups claim will be changed to the value specified in vcenter.identity.providers.update_spec.groups_claim, if any. This attribute was added in vSphere API 7.0.0.0. Optional. If unset, the existing groups claim will be changed to the value specified in vcenter.identity.providers.update_spec.groups_claim, if any.

Response:

HTTP Status Code: 200

None

Errors:

HTTP Status Code	Type	Description
403	unauthorized	if authorization is not given to caller.
400	invalid_argument	if invalid arguments are provided in updateSpec.
404	not_found	if no provider found with the given provider identifier.