From 1ca8587e9841659dcef480bdb40845eb8697a71b Mon Sep 17 00:00:00 2001 From: Bharath Gajjala <120367134+bgajjala8@users.noreply.github.com> Date: Fri, 25 Sep 2026 11:15:22 -0500 Subject: [PATCH] =?UTF-8?q?feat(oidc):=20add=20provider=5Ftype=20support?= =?UTF-8?q?=20to=20boundary=5Fauth=5Fmethod=5Foidc=20re=E2=80=A6=20(#845)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * chore(deps): bump Boundary, API, and SDK modules to latest main * feat(oidc): add provider_type support to boundary_auth_method_oidc resource --- .go-version | 2 +- docs/resources/auth_method_oidc.md | 13 +++++ .../boundary_auth_method_oidc/resource.tf | 12 +++++ go.mod | 22 ++++---- go.sum | 52 +++++++++---------- .../provider/resource_auth_method_oidc.go | 28 ++++++++++ .../resource_auth_method_oidc_test.go | 3 ++ 7 files changed, 94 insertions(+), 38 deletions(-) diff --git a/.go-version b/.go-version index ea0928ce..8fe00a57 100644 --- a/.go-version +++ b/.go-version @@ -1 +1 @@ -1.26.4 +1.26.5 diff --git a/docs/resources/auth_method_oidc.md b/docs/resources/auth_method_oidc.md index a92a9d41..ced08e0d 100644 --- a/docs/resources/auth_method_oidc.md +++ b/docs/resources/auth_method_oidc.md @@ -55,6 +55,18 @@ resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" { prompts = ["consent", "select_account"] type = "oidc" } + +resource "boundary_auth_method_oidc" "oidc_with_azure_provider_type" { + api_url_prefix = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200" + client_id = "eieio" + client_secret = "hvo_secret_XO" + description = "My Boundary OIDC Auth Method For Azure Entra ID" + issuer = "https://sts.windows.net/TENANT_ID/" + scope_id = "global" + signing_algorithms = ["RS256"] + provider_type = "azure" + type = "oidc" +} ``` @@ -82,6 +94,7 @@ resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" { - `max_age` (Number) The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again. A value of 0 sets an immediate requirement for all users to reauthenticate, and an unset maxAge results in a Terraform value of -1 and the default TTL of the chosen OIDC will be used. - `name` (String) The auth method name. Defaults to the resource name. - `prompts` (List of String) The prompts passed to the identity provider to determine whether to prompt the end-user for reauthentication, account selection or consent. Please note the values passed are case-sensitive. The valid values are: `none`, `login`, `consent` and `select_account`. +- `provider_type` (String) The provider type that identifies the provider associated with the auth method. When set, it enables provider specific behavior during authentication. When unset, no provider specific behavior is applied. Please note the value passed is case-sensitive. The valid values are: `azure`. - `signing_algorithms` (List of String) Allowed signing algorithms for the provider's issued tokens. - `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Currently automatically set to active-public. - `type` (String) The type of auth method; hardcoded. diff --git a/examples/resources/boundary_auth_method_oidc/resource.tf b/examples/resources/boundary_auth_method_oidc/resource.tf index ddd0227d..bf9e0912 100644 --- a/examples/resources/boundary_auth_method_oidc/resource.tf +++ b/examples/resources/boundary_auth_method_oidc/resource.tf @@ -40,3 +40,15 @@ resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" { prompts = ["consent", "select_account"] type = "oidc" } + +resource "boundary_auth_method_oidc" "oidc_with_azure_provider_type" { + api_url_prefix = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200" + client_id = "eieio" + client_secret = "hvo_secret_XO" + description = "My Boundary OIDC Auth Method For Azure Entra ID" + issuer = "https://sts.windows.net/TENANT_ID/" + scope_id = "global" + signing_algorithms = ["RS256"] + provider_type = "azure" + type = "oidc" +} diff --git a/go.mod b/go.mod index 6ef29e1b..87f37f6c 100644 --- a/go.mod +++ b/go.mod @@ -1,12 +1,12 @@ module github.com/hashicorp/terraform-provider-boundary -go 1.26.4 +go 1.26.5 require ( github.com/YakDriver/regexache v0.25.0 - github.com/hashicorp/boundary v0.18.1-0.20260708165146-a1e2c87b8a14 - github.com/hashicorp/boundary/api v0.0.62 - github.com/hashicorp/boundary/sdk v0.0.60 + github.com/hashicorp/boundary v0.18.1-0.20260922135637-edfad8971a54 + github.com/hashicorp/boundary/api v0.0.63-0.20260922135637-edfad8971a54 + github.com/hashicorp/boundary/sdk v0.0.61-0.20260922135637-edfad8971a54 github.com/hashicorp/cap v0.13.0 github.com/hashicorp/cap/ldap v0.0.0-20240206183135-ed8f24513744 github.com/hashicorp/go-cty v1.5.0 @@ -193,16 +193,16 @@ require ( go.abhg.dev/goldmark/frontmatter v0.2.0 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect - go.opentelemetry.io/otel v1.41.0 // indirect - go.opentelemetry.io/otel/metric v1.41.0 // indirect - go.opentelemetry.io/otel/trace v1.41.0 // indirect + go.opentelemetry.io/otel v1.44.0 // indirect + go.opentelemetry.io/otel/metric v1.44.0 // indirect + go.opentelemetry.io/otel/trace v1.44.0 // indirect go.uber.org/atomic v1.11.0 // indirect go.yaml.in/yaml/v2 v2.4.2 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6 // indirect golang.org/x/mod v0.38.0 // indirect golang.org/x/net v0.57.0 // indirect - golang.org/x/oauth2 v0.35.0 // indirect + golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.22.0 // indirect golang.org/x/sys v0.47.0 // indirect golang.org/x/term v0.45.0 // indirect @@ -211,9 +211,9 @@ require ( golang.org/x/tools v0.48.0 // indirect google.golang.org/appengine v1.6.8 // indirect google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 // indirect - google.golang.org/grpc v1.79.3 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect + google.golang.org/grpc v1.82.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/go.sum b/go.sum index dd5b0fd8..8becf69f 100644 --- a/go.sum +++ b/go.sum @@ -198,12 +198,12 @@ github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDa github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8= github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.8 h1:NpbJl/eVbvrGE0MJ6X16X9SAifesl6Fwxg/YmCvubRI= github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.8/go.mod h1:mi7YA+gCzVem12exXy46ZespvGtX/lZmD/RLnQhVW7U= -github.com/hashicorp/boundary v0.18.1-0.20260708165146-a1e2c87b8a14 h1:4zB+2UGKBctxTQCuaFeF3rt6tuOQTNNlABnU/f1xthc= -github.com/hashicorp/boundary v0.18.1-0.20260708165146-a1e2c87b8a14/go.mod h1:pk4FfScqRhnaMP0nRJxLHN9lU1M3xzQSHDSYeojpdg4= -github.com/hashicorp/boundary/api v0.0.62 h1:51DQYH8vQfVsaZFu+IprOsPKIeHfiFUFVHlz68OYbcc= -github.com/hashicorp/boundary/api v0.0.62/go.mod h1:dRbtSbRvw/2mECJ1rqglN/S+iYMDu2c2JviXLRnoKIU= -github.com/hashicorp/boundary/sdk v0.0.60 h1:eepnmeLtkUwgyrlEUrW5rmAWBmMHGC2MpSPITXz9aaI= -github.com/hashicorp/boundary/sdk v0.0.60/go.mod h1:7jN9+KFApYsKV2UujFrPVV5+50mJnIGUfhoh+eJApzI= +github.com/hashicorp/boundary v0.18.1-0.20260922135637-edfad8971a54 h1:Rde1ke8dfNS7tcMORc1mgwnV7ddQDFM8eWm+9LPlxXc= +github.com/hashicorp/boundary v0.18.1-0.20260922135637-edfad8971a54/go.mod h1:o/4z7Gw+m72FuLdCAmCs6ILcmXLy/8Mo/W2asqyBxjE= +github.com/hashicorp/boundary/api v0.0.63-0.20260922135637-edfad8971a54 h1:FvrPXYRo+Spbph5W7j2quLI1c0l/1IiaZJEfvnqQY/I= +github.com/hashicorp/boundary/api v0.0.63-0.20260922135637-edfad8971a54/go.mod h1:8a4R5RZ0qDfNQGRdtz0oJfIMeEVwjt4ksZDDX+UfM2c= +github.com/hashicorp/boundary/sdk v0.0.61-0.20260922135637-edfad8971a54 h1:HyWTzuokbS+GM+xvL2qPLmbvg5w8+8SBpn1/2Lj6SWc= +github.com/hashicorp/boundary/sdk v0.0.61-0.20260922135637-edfad8971a54/go.mod h1:SLV16Bt353ef/YLvZqPkeZXurffr3WS2y6B5TKiu6HY= github.com/hashicorp/cap v0.13.0 h1:bzLS1er9am6hOiw//TEjmwZ3t975iFfRfvXY6VRLKEw= github.com/hashicorp/cap v0.13.0/go.mod h1:Kbu5owAOJzQ/HH4Ba/76wsIXN2tRiJgToJKBO2MAEFE= github.com/hashicorp/cap/ldap v0.0.0-20240206183135-ed8f24513744 h1:6cU01ORaCUxRXRS0YYnmm4tMfAvFRjamhjgMrgmoWZs= @@ -547,16 +547,16 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q= -go.opentelemetry.io/otel v1.41.0 h1:YlEwVsGAlCvczDILpUXpIpPSL/VPugt7zHThEMLce1c= -go.opentelemetry.io/otel v1.41.0/go.mod h1:Yt4UwgEKeT05QbLwbyHXEwhnjxNO6D8L5PQP51/46dE= -go.opentelemetry.io/otel/metric v1.41.0 h1:rFnDcs4gRzBcsO9tS8LCpgR0dxg4aaxWlJxCno7JlTQ= -go.opentelemetry.io/otel/metric v1.41.0/go.mod h1:xPvCwd9pU0VN8tPZYzDZV/BMj9CM9vs00GuBjeKhJps= -go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18= -go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE= -go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8= -go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew= -go.opentelemetry.io/otel/trace v1.41.0 h1:Vbk2co6bhj8L59ZJ6/xFTskY+tGAbOnCtQGVVa9TIN0= -go.opentelemetry.io/otel/trace v1.41.0/go.mod h1:U1NU4ULCoxeDKc09yCWdWe+3QoyweJcISEVa1RBzOis= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= +go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= +go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw= +go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= @@ -613,8 +613,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= -golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ= -golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= +golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= +golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -687,8 +687,8 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= -gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= +gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= +gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM= @@ -698,17 +698,17 @@ google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98 google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4= google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s= -google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 h1:JLQynH/LBHfCTSbDWl+py8C+Rg/k1OVH3xfcaiANuF0= -google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:kSJwQxqmFXeo79zOmbrALdflXQeAYcUbgS7PbpMknCY= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 h1:mWPCjDEyshlQYzBpMNHaEof6UX1PmHcaUODUywQ0uac= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ= +google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec= +google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg= google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY= google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= -google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE= -google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ= +google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= +google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= diff --git a/internal/provider/resource_auth_method_oidc.go b/internal/provider/resource_auth_method_oidc.go index 88f64c4e..3f8b0a8c 100644 --- a/internal/provider/resource_auth_method_oidc.go +++ b/internal/provider/resource_auth_method_oidc.go @@ -30,6 +30,7 @@ const ( authmethodOidcAccountClaimMapsKey = "account_claim_maps" authmethodOidcClaimsScopesKey = "claims_scopes" authmethodOidcPromptsKey = "prompts" + authmethodOidcProviderTypeKey = "provider_type" // computed-only parameters authmethodOidcCallbackUrlKey = "callback_url" @@ -157,6 +158,12 @@ func resourceAuthMethodOidc() *schema.Resource { }, Optional: true, }, + authmethodOidcProviderTypeKey: { + Description: "The provider type that identifies the provider associated with the auth method. When set, it enables provider specific behavior during authentication. " + + "When unset, no provider specific behavior is applied. Please note the value passed is case-sensitive. The valid values are: `azure`.", + Type: schema.TypeString, + Optional: true, + }, // OIDC specific immutable and computed parameters authmethodOidcClientSecretHmacKey: { @@ -253,6 +260,14 @@ func setFromOidcAuthMethodResponseMap(d *schema.ResourceData, raw map[string]int if val, ok := attrs[authmethodOidcPromptsKey]; ok { d.Set(authmethodOidcPromptsKey, val.([]interface{})) } + + if val, ok := attrs[authmethodOidcProviderTypeKey]; ok { + d.Set(authmethodOidcProviderTypeKey, val.(string)) + } else { + // provider_type is omitted from the response when unset, so an absent key + // means "no provider type". Reset it to the zero value. + d.Set(authmethodOidcProviderTypeKey, "") + } } d.SetId(raw["id"].(string)) @@ -343,6 +358,10 @@ func resourceAuthMethodOidcCreate(ctx context.Context, d *schema.ResourceData, m opts = append(opts, authmethods.WithOidcAuthMethodPrompts(promptList)) } + if providerType, ok := d.GetOk(authmethodOidcProviderTypeKey); ok { + opts = append(opts, authmethods.WithOidcAuthMethodProviderType(providerType.(string))) + } + nameVal, ok := d.GetOk(NameKey) if ok { nameStr := nameVal.(string) @@ -567,6 +586,15 @@ func resourceAuthMethodOidcUpdate(ctx context.Context, d *schema.ResourceData, m opts = append(opts, authmethods.WithOidcAuthMethodPrompts(promptsList)) } } + if d.HasChange(authmethodOidcProviderTypeKey) { + if providerType, ok := d.GetOk(authmethodOidcProviderTypeKey); ok { + opts = append(opts, authmethods.WithOidcAuthMethodProviderType(providerType.(string))) + } else { + // We need to reset provider_type when removed from configuration + // omitting the option would leave the existing value unchanged. + opts = append(opts, authmethods.DefaultOidcAuthMethodProviderType()) + } + } if len(opts) > 0 { opts = append(opts, authmethods.WithAutomaticVersioning(true)) diff --git a/internal/provider/resource_auth_method_oidc_test.go b/internal/provider/resource_auth_method_oidc_test.go index 13a3c3e3..8c62d88b 100644 --- a/internal/provider/resource_auth_method_oidc_test.go +++ b/internal/provider/resource_auth_method_oidc_test.go @@ -69,6 +69,7 @@ EOT account_claim_maps = ["oid=sub"] claims_scopes = ["profile"] prompts = ["select_account"] + provider_type = "azure" }` fooAuthMethodOidcUpdate = ` @@ -124,6 +125,7 @@ func TestAccAuthMethodOidc(t *testing.T) { resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcIssuerKey, tp.Addr()), resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcClientIdKey, "foo_id"), resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcMaxAgeKey, "0"), + resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcProviderTypeKey, "azure"), testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcIdpCaCertsKey, []string{tpCert}), testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAllowedAudiencesKey, []string{"foo_aud"}), testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcSigningAlgorithmsKey, []string{"ES256"}), @@ -144,6 +146,7 @@ func TestAccAuthMethodOidc(t *testing.T) { resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcIssuerKey, "https://test-update.com"), resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcClientIdKey, "foo_id_update"), resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcMaxAgeKey, "-1"), + resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcProviderTypeKey, ""), testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcIdpCaCertsKey, []string{fooAuthMethodOidcCaCerts}), testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAllowedAudiencesKey, []string{"foo_aud_update"}), testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcPromptsKey, []string{"consent", "select_account"}),