diff --git a/CHANGELOG.md b/CHANGELOG.md index e97afb72..47e3f225 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,11 @@ Canonical reference for changes, improvements, and bugfixes for the Boundary Terraform provider. +## Next + +### Bug Fix +* Allow users to set OIDC maxAge value to 0 to require immediate reauth ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/364)) + ## 1.1.4 (February 15, 2023) ### New and Improved diff --git a/docs/resources/auth_method_oidc.md b/docs/resources/auth_method_oidc.md index 446dc2af..982f8f3c 100644 --- a/docs/resources/auth_method_oidc.md +++ b/docs/resources/auth_method_oidc.md @@ -32,9 +32,9 @@ The OIDC auth method resource allows you to configure a Boundary auth_method_oid - `description` (String) The auth method description. - `disable_discovered_config_validation` (Boolean) Disables validation logic ensuring that the OIDC provider's information from its discovery endpoint matches the information here. The validation is only performed at create or update time. - `idp_ca_certs` (List of String) A list of CA certificates to trust when validating the IdP's token signatures. -- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an OIDC account. +- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the user will be automatically created when they login using an OIDC account. - `issuer` (String) The issuer corresponding to the provider, which must match the issuer field in generated tokens. -- `max_age` (Number) The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again. +- `max_age` (Number) The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again. A value of 0 sets an immediate requirement for all users to reauthenticate, and an unset maxAge results in a Terraform value of -1 and the default TTL of the chosen OIDC will be used. - `name` (String) The auth method name. Defaults to the resource name. - `signing_algorithms` (List of String) Allowed signing algorithms for the provider's issued tokens. - `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Currently automatically set to active-public. diff --git a/internal/provider/resource_auth_method_oidc.go b/internal/provider/resource_auth_method_oidc.go index b777993a..090dd817 100644 --- a/internal/provider/resource_auth_method_oidc.go +++ b/internal/provider/resource_auth_method_oidc.go @@ -115,9 +115,11 @@ func resourceAuthMethodOidc() *schema.Resource { Optional: true, }, authmethodOidcMaxAgeKey: { - Description: "The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again.", - Type: schema.TypeInt, - Optional: true, + Description: `The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again. ` + + `A value of 0 sets an immediate requirement for all users to reauthenticate, and an unset maxAge results in a Terraform value of -1 and the default TTL of the chosen OIDC will be used.`, + Type: schema.TypeInt, + Optional: true, + Default: -1, }, authmethodOidcSigningAlgorithmsKey: { Description: "Allowed signing algorithms for the provider's issued tokens.", @@ -166,7 +168,7 @@ func resourceAuthMethodOidc() *schema.Resource { Computed: true, }, authmethodOidcIsPrimaryAuthMethodForScope: { - Description: "When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an OIDC account.", + Description: "When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the user will be automatically created when they login using an OIDC account.", Type: schema.TypeBool, Optional: true, }, @@ -267,8 +269,12 @@ func resourceAuthMethodOidcCreate(ctx context.Context, d *schema.ResourceData, m if clientSecret, ok := d.GetOk(authmethodOidcClientSecretKey); ok { opts = append(opts, authmethods.WithOidcAuthMethodClientSecret(clientSecret.(string))) } - if maxAge, ok := d.GetOk(authmethodOidcMaxAgeKey); ok { + // null values are not correctly recognized by the Terraform SDK, so we instead check here for maxAge value + // if maxAge is unset it will default and set the terraform state to -1 and clear the maxAge param in Boundary + if maxAge, _ := d.GetOk(authmethodOidcMaxAgeKey); maxAge.(int) >= 0 { opts = append(opts, authmethods.WithOidcAuthMethodMaxAge(uint32(maxAge.(int)))) + } else { + opts = append(opts, authmethods.DefaultOidcAuthMethodMaxAge()) } if prefix, ok := d.GetOk(authmethodOidcApiUrlPrefixKey); ok { opts = append(opts, authmethods.WithOidcAuthMethodApiUrlPrefix(prefix.(string))) @@ -471,8 +477,12 @@ func resourceAuthMethodOidcUpdate(ctx context.Context, d *schema.ResourceData, m } } if d.HasChange(authmethodOidcMaxAgeKey) { - if maxAge, ok := d.GetOk(authmethodOidcMaxAgeKey); ok { + // null values are not correctly recognized by the Terraform SDK, so we instead check here for maxAge value + // if maxAge is unset it will default and set the terraform state to -1 and clear the maxAge param in Boundary + if maxAge, _ := d.GetOk(authmethodOidcMaxAgeKey); maxAge.(int) >= 0 { opts = append(opts, authmethods.WithOidcAuthMethodMaxAge(uint32(maxAge.(int)))) + } else { + opts = append(opts, authmethods.DefaultOidcAuthMethodMaxAge()) } } if d.HasChange(authmethodOidcSigningAlgorithmsKey) { diff --git a/internal/provider/resource_auth_method_oidc_test.go b/internal/provider/resource_auth_method_oidc_test.go index 093b029c..d8473486 100644 --- a/internal/provider/resource_auth_method_oidc_test.go +++ b/internal/provider/resource_auth_method_oidc_test.go @@ -56,7 +56,7 @@ resource "boundary_auth_method_oidc" "foo" { issuer = "%s" client_id = "foo_id" client_secret = "foo_secret" - max_age = 10 + max_age = 0 api_url_prefix = "http://localhost:9200" idp_ca_certs = [ <