The unique identifier tied to the provider's domain used for TLS verification. In OAuth, this is the JWT **iss** property. For SAML, specify the **Entity ID** in this property.", 'type': 'string', 'nullable': True, 'minLength': 0, 'maxLength': 128}, 'providerCertificate': {'description': "The Provider's SAML public certificate which can be used to verify the signature in signed SAML assertions from the provider.", 'type': 'string', 'nullable': True, 'minLength': 0, 'maxLength': 4096}, 'clientId': {'description': "Provider's client ID used to verify the token", 'type': 'string', 'nullable': True, 'minLength': 0, 'maxLength': 128}, 'clientSecretId': {'description': "Provider's client secret identifier used to identify the client secret within your account. Some provider require this property.", 'type': 'string', 'nullable': True, 'minLength': 0, 'maxLength': 32}, 'clientSecret': {'description': "Provider's client secret used to verify the token", 'type': 'string', 'nullable': True, 'minLength': 0, 'maxLength': 2048}, 'userDataConfiguration': {'$ref': '#/components/schemas/ConnectionUserDataConfiguration'}, 'data': {'type': 'object', 'nullable': True, 'additionalProperties': False, 'properties': {'developerAccountId': {'nullable': True, 'description': 'The Developer Account ID associated with the credentials. This is necessary for some providers, such as Apple Login.', 'type': 'string', 'minLength': 0, 'maxLength': 32}, 'name': {'description': 'The name of this connection when displayed in the Authress management portal', 'type': 'string', 'nullable': True, 'minLength': 0, 'maxLength': 64}, 'supportedContentType': {'description': "URL encode OAuth token parameters - Some authentication APIs don't support JSON, in these cases enable the url encoded form data parameters.", 'type': 'string', 'nullable': True, 'default': 'application/json', 'enum': ['application/json', 'application/x-www-form-urlencoded']}, 'userIdExpression': {'description': 'By default, the **sub** claim of the JWT is used to identify the user from this provider. However, not all providers are OpenID compliant. Here you can provide an optional user expression to identify a new user ID from available properties found from the oidcUserEndpointUrl. (The default is **{sub}**, any claims may be used.)', 'type': 'string', 'default': '{sub}', 'nullable': True, 'minLength': 0, 'maxLength': 128}, 'trustIdentityUserId': {'description': 'Authress generates unique user IDs for every user, however if you trust your identity provider to handle unique ID generate across **ALL customers**, then it is safe to reuse the user ID from the provider.', 'type': 'boolean', 'nullable': True, 'default': False}}}, 'defaultConnectionProperties': {'type': 'object', 'nullable': True, 'properties': {'scope': {'description': 'Default OAuth scopes to use for every request (leave blank to remove scopes).', 'type': 'string', 'nullable': True, 'default': 'profile email openid', 'maxLength': 384}}, 'additionalProperties': {'type': 'string', 'maxLength': 128}}, 'conditions': {'description': 'Conditions are custom restrictions on connections that prevent the connection from being used when it should not be, or limits its usability for increased security.', 'type': 'object', 'nullable': True, 'additionalProperties': False, 'properties': {'requireBusinessAccount': {'description': 'Require the user logging in with this connect to be using a business account. When possible Authress will block user login and request that they select a different account. Enabling this may prevent some users from being able to sign up with this identity connection.', 'type': 'boolean', 'nullable': True, 'default': False, 'example': False}, 'authenticationLeewayDuration': {'description': 'The maximum duration to wait between the the instant a user begins the authentication flow, to the moment login has completed. Lower values increase security by limiting attack time, longer times allow for slower connections and async login flows to complete. Authentication requests that do not complete within this duration are rejected with the Expired error. The default is 5 minutes. The minimum is one minute `PT1M` and the max is 1 hour `PT1H`. This value must conform to the ISO8601 format.', 'type': 'string', 'format': 'duration', 'nullable': True, 'default': 'PT5M', 'example': 'PT5M', 'pattern': '^P(?!$)(\\d+Y)?(\\d+M)?(\\d+W)?(\\d+D)?(T(?=\\d+[HMS])(\\d+H)?(\\d+M)?(\\d+S)?)?$'}}}, 'tenantConfiguration': {'description': 'Configures how tenant assignments for users are created during user authentication.', 'type': 'object', 'nullable': True, 'additionalProperties': False, 'properties': {'assignmentType': {'description': 'Specify the type of tenant configuration used for assigning tenants user during login. Only connections that provide reliable email_verified identity properties can enable this setting.

DEFAULT - A user will only be associated with a tenant, when the tenant is specified in the loginClient.authenticate() flow.
TRUSTED_DOMAIN_FALLBACK - When no tenant is specified, also attempt to look up the tenant utilizing the email domain of the user from their identity provider.
PASSTHROUGH - When no tenant is specified, use the tenant specified by the identity provider. This will automatically create a tenant resource in Authress if one does not exist for the tenant yet.

', 'type': 'string', 'nullable': True, 'default': 'DEFAULT', 'example': 'DEFAULT', 'enum': [None, 'DEFAULT', 'TRUSTED_DOMAIN_FALLBACK', 'PASSTHROUGH']}}}, 'linkingConfiguration': {'description': 'Linking configuration enables users to connect identities from different connections together, so that they can log in with either connection.', 'type': 'object', 'nullable': True, 'additionalProperties': False, 'properties': {'type': {'description': 'Specify the type of linking supported by this connection. The default configuration is DISABLED, meaning that users cannot link their identity from one connection to another connection. Both connections must allow for linking for a link to be successful. By default linking is disabled because it comes with security implications, users can potentially use linking through malicious connections to steal identities from other users.

EXPLICIT - Users can use the linking API to link accounts.
AUTOMATIC - When a user signs up with a new account, if the verified email address matches an existing account, the two accounts will be automatically linked.
Set to null or leave unspecified to disable identity linking.

', 'type': 'string', 'nullable': True, 'example': 'EXPLICIT', 'enum': [None, 'EXPLICIT', 'AUTOMATIC']}}}, 'createdTime': {'readOnly': True, 'type': 'string', 'format': 'date-time'}, 'lastUpdated': {'readOnly': True, 'type': 'string', 'format': 'date-time'}, 'isActiveConnection': {'readOnly': True, 'type': 'boolean'}, 'tags': {'$ref': '#/components/schemas/Tags'}}} is not valid under any of the given schemas