{
  "description": "AtlasFederatedAuth is the Schema for the Atlasfederatedauth API",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "AtlasFederatedAuthSpec defines the target state of AtlasFederatedAuth.",
      "properties": {
        "connectionSecretRef": {
          "description": "Connection secret with API credentials for configuring the federation.\nThese credentials must have OrganizationOwner permissions.",
          "properties": {
            "name": {
              "description": "Name of the Kubernetes Resource",
              "type": "string"
            },
            "namespace": {
              "description": "Namespace of the Kubernetes Resource",
              "type": "string"
            }
          },
          "required": [
            "name"
          ],
          "type": "object",
          "additionalProperties": false
        },
        "dataAccessIdentityProviders": {
          "description": "The collection of unique ids representing the identity providers that can be used for data access in this organization.\nCurrently connected data access identity providers missing from this field will be disconnected.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "domainAllowList": {
          "description": "Approved domains that restrict users who can join the organization based on their email address.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "domainRestrictionEnabled": {
          "default": false,
          "description": "Prevent users in the federation from accessing organizations outside the federation, and creating new organizations.\nThis option applies to the entire federation.\nSee more information at https://www.mongodb.com/docs/atlas/security/federation-advanced-options/#restrict-user-membership-to-the-federation",
          "type": "boolean"
        },
        "enabled": {
          "default": false,
          "type": "boolean"
        },
        "postAuthRoleGrants": {
          "description": "Atlas roles that are granted to a user in this organization after authenticating.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "roleMappings": {
          "description": "Map IDP groups to Atlas roles.",
          "items": {
            "description": "RoleMapping maps an external group from an identity provider to roles within Atlas.",
            "properties": {
              "externalGroupName": {
                "description": "ExternalGroupName is the name of the IDP group to which this mapping applies.",
                "maxLength": 200,
                "minLength": 1,
                "type": "string"
              },
              "roleAssignments": {
                "description": "RoleAssignments define the roles within projects that should be given to members of the group.",
                "items": {
                  "properties": {
                    "projectName": {
                      "description": "The Atlas project in the same org in which the role should be given.",
                      "type": "string"
                    },
                    "role": {
                      "description": "The role in Atlas that should be given to group members.",
                      "enum": [
                        "ORG_MEMBER",
                        "ORG_READ_ONLY",
                        "ORG_BILLING_ADMIN",
                        "ORG_GROUP_CREATOR",
                        "ORG_OWNER",
                        "ORG_BILLING_READ_ONLY",
                        "GROUP_OWNER",
                        "GROUP_READ_ONLY",
                        "GROUP_DATA_ACCESS_ADMIN",
                        "GROUP_DATA_ACCESS_READ_ONLY",
                        "GROUP_DATA_ACCESS_READ_WRITE",
                        "GROUP_CLUSTER_MANAGER",
                        "GROUP_SEARCH_INDEX_EDITOR",
                        "GROUP_DATABASE_ACCESS_ADMIN",
                        "GROUP_BACKUP_MANAGER",
                        "GROUP_STREAM_PROCESSING_OWNER",
                        "ORG_STREAM_PROCESSING_ADMIN",
                        "GROUP_OBSERVABILITY_VIEWER"
                      ],
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "additionalProperties": false
                },
                "type": "array"
              }
            },
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "ssoDebugEnabled": {
          "default": false,
          "type": "boolean"
        }
      },
      "type": "object",
      "additionalProperties": false
    },
    "status": {
      "description": "AtlasFederatedAuthStatus defines the observed state of AtlasFederatedAuth.",
      "properties": {
        "conditions": {
          "description": "Conditions is the list of statuses showing the current state of the Atlas Custom Resource",
          "items": {
            "description": "Condition describes the state of an Atlas Custom Resource at a certain point.",
            "properties": {
              "lastTransitionTime": {
                "description": "Last time the condition transitioned from one status to another.\nRepresented in ISO 8601 format.",
                "format": "date-time",
                "type": "string"
              },
              "message": {
                "description": "A message providing details about the transition.",
                "type": "string"
              },
              "reason": {
                "description": "The reason for the condition's last transition.",
                "type": "string"
              },
              "status": {
                "description": "Status of the condition; one of True, False, Unknown.",
                "type": "string"
              },
              "type": {
                "description": "Type of Atlas Custom Resource condition.",
                "type": "string"
              }
            },
            "required": [
              "status",
              "type"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "observedGeneration": {
          "description": "ObservedGeneration indicates the generation of the resource specification of which the Atlas Operator is aware.\nThe Atlas Operator updates this field to the value of 'metadata.generation' as soon as it starts reconciliation of the resource.",
          "format": "int64",
          "type": "integer"
        }
      },
      "required": [
        "conditions"
      ],
      "type": "object",
      "additionalProperties": false
    }
  },
  "type": "object"
}