feat(oidc): add provider_type support to boundary_auth_method_oidc re… (#845)

* chore(deps): bump Boundary, API, and SDK modules to latest main

* feat(oidc): add provider_type support to boundary_auth_method_oidc resource

internal/provider/resource_auth_method_oidc.go

@@ -30,6 +30,7 @@ const (
 	authmethodOidcAccountClaimMapsKey                  = "account_claim_maps"
 	authmethodOidcClaimsScopesKey                      = "claims_scopes"
 	authmethodOidcPromptsKey                           = "prompts"
+	authmethodOidcProviderTypeKey                      = "provider_type"
 
 	// computed-only parameters
 	authmethodOidcCallbackUrlKey      = "callback_url"
@@ -157,6 +158,12 @@ func resourceAuthMethodOidc() *schema.Resource {
 				},
 				Optional: true,
 			},
+			authmethodOidcProviderTypeKey: {
+				Description: "The provider type that identifies the provider associated with the auth method. When set, it enables provider specific behavior during authentication. " +
+					"When unset, no provider specific behavior is applied. Please note the value passed is case-sensitive. The valid values are: `azure`.",
+				Type:     schema.TypeString,
+				Optional: true,
+			},
 
 			// OIDC specific immutable and computed parameters
 			authmethodOidcClientSecretHmacKey: {
@@ -253,6 +260,14 @@ func setFromOidcAuthMethodResponseMap(d *schema.ResourceData, raw map[string]int
 		if val, ok := attrs[authmethodOidcPromptsKey]; ok {
 			d.Set(authmethodOidcPromptsKey, val.([]interface{}))
 		}
+
+		if val, ok := attrs[authmethodOidcProviderTypeKey]; ok {
+			d.Set(authmethodOidcProviderTypeKey, val.(string))
+		} else {
+			// provider_type is omitted from the response when unset, so an absent key
+			// means "no provider type". Reset it to the zero value.
+			d.Set(authmethodOidcProviderTypeKey, "")
+		}
 	}
 
 	d.SetId(raw["id"].(string))
@@ -343,6 +358,10 @@ func resourceAuthMethodOidcCreate(ctx context.Context, d *schema.ResourceData, m
 		opts = append(opts, authmethods.WithOidcAuthMethodPrompts(promptList))
 	}
 
+	if providerType, ok := d.GetOk(authmethodOidcProviderTypeKey); ok {
+		opts = append(opts, authmethods.WithOidcAuthMethodProviderType(providerType.(string)))
+	}
+
 	nameVal, ok := d.GetOk(NameKey)
 	if ok {
 		nameStr := nameVal.(string)
@@ -567,6 +586,15 @@ func resourceAuthMethodOidcUpdate(ctx context.Context, d *schema.ResourceData, m
 			opts = append(opts, authmethods.WithOidcAuthMethodPrompts(promptsList))
 		}
 	}
+	if d.HasChange(authmethodOidcProviderTypeKey) {
+		if providerType, ok := d.GetOk(authmethodOidcProviderTypeKey); ok {
+			opts = append(opts, authmethods.WithOidcAuthMethodProviderType(providerType.(string)))
+		} else {
+			// We need to reset provider_type when removed from configuration
+			// omitting the option would leave the existing value unchanged.
+			opts = append(opts, authmethods.DefaultOidcAuthMethodProviderType())
+		}
+	}
 
 	if len(opts) > 0 {
 		opts = append(opts, authmethods.WithAutomaticVersioning(true))

internal/provider/resource_auth_method_oidc_test.go

@@ -69,6 +69,7 @@ EOT
 	account_claim_maps = ["oid=sub"]
 	claims_scopes = ["profile"]
 	prompts = ["select_account"]
+	provider_type = "azure"
 }`
 
 	fooAuthMethodOidcUpdate = `
@@ -124,6 +125,7 @@ func TestAccAuthMethodOidc(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcIssuerKey, tp.Addr()),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcClientIdKey, "foo_id"),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcMaxAgeKey, "0"),
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcProviderTypeKey, "azure"),
 					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcIdpCaCertsKey, []string{tpCert}),
 					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAllowedAudiencesKey, []string{"foo_aud"}),
 					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcSigningAlgorithmsKey, []string{"ES256"}),
@@ -144,6 +146,7 @@ func TestAccAuthMethodOidc(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcIssuerKey, "https://test-update.com"),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcClientIdKey, "foo_id_update"),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcMaxAgeKey, "-1"),
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcProviderTypeKey, ""),
 					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcIdpCaCertsKey, []string{fooAuthMethodOidcCaCerts}),
 					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAllowedAudiencesKey, []string{"foo_aud_update"}),
 					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcPromptsKey, []string{"consent", "select_account"}),