# IdpAuthConfigurationProperty

External identity provider configuration for the Operator App.

- Source: Generated code
- Type last changed: v2.274.0 · 20 Oct 2026

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_devopsagent as devopsagent } from 'aws-cdk-lib';
const idpAuthConfigurationProperty: devopsagent.CfnAgentSpace.IdpAuthConfigurationProperty = {
  clientId: 'clientId',
  clientSecret: 'clientSecret',
  issuerUrl: 'issuerUrl',
  operatorAppRoleArn: 'operatorAppRoleArn',
  provider: 'provider',

  // the properties below are optional
  createdAt: 'createdAt',
  updatedAt: 'updatedAt',
  userIdClaim: 'userIdClaim',
};
```

## Properties

- `clientId`: string (required) — The OIDC client identifier for the external identity provider application.

- `clientSecret`: string (required) — The OIDC client secret for the external identity provider application.

  Use a Secrets Manager dynamic reference to avoid storing the secret in the template.

- `createdAt`: string

- `issuerUrl`: string (required) — The OIDC issuer URL for the external identity provider.

- `operatorAppRoleArn`: string (required) — The IAM role that Operator App users assume to access DevOps Agent APIs.

- `provider`: string (required) — The external identity provider type.

- `updatedAt`: string

- `userIdClaim`: string — The identity claim used to identify users.

  This value is selected by the service for the configured provider.