# pylint: disable=line-too-long,useless-suppression
# coding=utf-8
# --------------------------------------------------------------------------
# Copyright (c) Microsoft Corporation. All rights reserved.
# Licensed under the MIT License. See License.txt in the project root for license information.
# Code generated by Microsoft (R) AutoRest Code Generator.
# Changes may cause incorrect behavior and will be lost if the code is regenerated.
# --------------------------------------------------------------------------

from azure.identity import DefaultAzureCredential

from azure.mgmt.containerservice import ContainerServiceClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-containerservice
# USAGE
    python jwt_authenticators_create_or_update.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = ContainerServiceClient(
        credential=DefaultAzureCredential(),
        subscription_id="00000000-0000-0000-0000-000000000000",
    )

    response = client.jwt_authenticators.begin_create_or_update(
        resource_group_name="rg1",
        resource_name="clustername1",
        jwt_authenticator_name="jwt1",
        parameters={
            "properties": {
                "claimMappings": {
                    "extra": [{"key": "example.com/extrakey", "valueExpression": "claims.customfield"}],
                    "groups": {"expression": "claims.groups.split(',').map(group, 'aks:jwt:' + group)"},
                    "username": {"expression": "'aks:jwt:' + claims.sub"},
                },
                "claimValidationRules": [
                    {"expression": "has(claims.sub)", "message": "Sub is required"},
                    {"expression": "claims.sub != ''", "message": "Sub cannot be empty"},
                ],
                "issuer": {
                    "audiences": ["https://example.com/audience1", "https://example.com/audience2"],
                    "url": "https://example.com",
                },
                "userValidationRules": [
                    {
                        "expression": "user.groups.all(group, group.startsWith('aks:jwt:admin:'))",
                        "message": "Must be in admin user group",
                    }
                ],
            }
        },
    ).result()
    print(response)


# x-ms-original-file: specification/containerservice/resource-manager/Microsoft.ContainerService/aks/preview/2025-10-02-preview/examples/JWTAuthenticators_Create_Or_Update.json
if __name__ == "__main__":
    main()
