The config_type structure contains the possible types of vCenter Server identity providers. This enumeration was added in vSphere API 7.0.0.0. Value is one of:
Oauth2: Config for OAuth2. This constant was added in vSphere API 7.0.0.0.
Oidc: Config for OIDC. This constant was added in vSphere API 7.0.0.0.

Object with element values of type object.

The oauth2_authentication_method structure contains the possible types of OAuth2 authentication methods. This enumeration was added in vSphere API 7.0.0.0. Value is one of:
CLIENT_SECRET_BASIC: Clients that have received a client_secret value from the Authorization Server, authenticate with the Authorization Server in accordance with Section 3.2.1 of OAuth 2.0 [RFC6749] using the HTTP Basic authentication scheme. This constant was added in vSphere API 7.0.0.0.
CLIENT_SECRET_POST: Clients that have received a client_secret value from the Authorization Server, authenticate with the Authorization Server in accordance with Section 3.2.1 of OAuth 2.0 [RFC6749] by including the Client Credentials in the request body. This constant was added in vSphere API 7.0.0.0.
CLIENT_SECRET_JWT: Clients that have received a client_secret value from the Authorization Server, create a JWT using an HMAC SHA algorithm, such as HMAC SHA-256. The HMAC (Hash-based Message Authentication Code) is calculated using the octets of the UTF-8 representation of the client_secret as the shared key. This constant was added in vSphere API 7.0.0.0.
PRIVATE_KEY_JWT: Clients that have registered a public key sign a JWT using that key. The client authenticates in accordance with JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants [OAuth.JWT] and Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants [OAuth.Assertions]. This constant was added in vSphere API 7.0.0.0.

Object with element values of type object.

Optional. A unique id will be generated if not given.When clients pass a value of this structure as a parameter, the field must be an identifier for the resource type: com.vmware.vcenter.identity.Providers. When operations return a value of this structure as a result, the field will be an identifier for the resource type: com.vmware.vcenter.identity.Providers.

Optional. It is only relevant when config_tag has value Oauth2. This field is optional and it is only relevant when the value of config_tag is oauth2.

key/value pairs that are to be appended to the authEndpoint request.

How to append to authEndpoint request:

• If the value contains only one string, then the key is added with "k=v".
• If the value is an empty list, then the key is added without a "=v".
• If the value contains multiple strings, then the key is repeated in the query-string for each string in the value.

Optional. If unset, the map will be empty.

Optional. It is only relevant when config_tag has value Oidc. This field is optional and it is only relevant when the value of config_tag is oidc.

Optional. If unset, the set will be empty.

Optional. If unset the provider will be the default provider if it is the first provider that is created, and will not be the default provider otherwise.

Optional. If unset, the name will be the empty string.

Optional. If unset, domainNames will be the empty set and the domain validation behavior at login with this identity provider will be as follows: the user's domain will be parsed from the User Principal Name (UPN) value that is found in the tokens returned by the identity provider. This domain will then be implicitly trusted and used to filter any groups that are also provided in the tokens.

key/value pairs that are to be appended to the authEndpoint request.

How to append to authEndpoint request:

• If the value contains only one string, then the key is added with "k=v".
• If the value is an empty list, then the key is added without a "=v".
• If the value contains multiple strings, then the key is repeated in the query-string for each string in the value.

Optional. If unset, the map will be empty.

Optional. If unset, no communication protocol will be configured for the identity provider.

Optional. It is only relevant when idm_protocol has value [REST, SCIM, SCIM2_0]. This field is optional and it is only relevant when the value of idm_protocol is one of REST, SCIM, or scim2_0.

Optional. It is only relevant when idm_protocol has value LDAP. This field is optional and it is only relevant when the value of idm_protocol is LDAP.

Optional. This field can be unset only, if all the active directory server endpoints use the LDAP (not LDAPS) protocol.

Optional. If unset, the claim named 'acct' will be used to provide backwards compatibility with CSP.

Optional. If unset, the default behavior will be CSP backwards compatiblility. The groups for the subject will be comprised of the groups in 'group_names' and 'group_ids' claims.