feat (auth/ldap): support for new ldap fields (#453)
This commit is contained in:
5 files changed
+194
-968
No files matched your search
@@ -30,6 +30,7 @@ The LDAP auth method resource allows you to configure a Boundary auth_method_lda
|
||||
- `client_certificate` (String) PEM-encoded X.509 client certificate in ASN.1 DER form that can be used to authenticate against an LDAP server(optional).
|
||||
- `client_certificate_key` (String) PEM-encoded X.509 client certificate key in PKCS #8, ASN.1 DER form used with the client certificate (optional).
|
||||
- `client_certificate_key_hmac` (String) The HMAC of the client certificate key returned by the Boundary controller, which is used for comparison after initial setting of the value.
|
||||
- `dereference_aliases` (String) Control how aliases are dereferenced when performing the search. Can be one of: NeverDerefAliases, DerefInSearching, DerefFindingBaseObj, and DerefAlways (optional).
|
||||
- `description` (String) The auth method description.
|
||||
- `discover_dn` (Boolean) Use anon bind to discover the bind DN of a user (optional).
|
||||
- `enable_groups` (Boolean) Find the authenticated user's groups during authentication (optional).
|
||||
@@ -38,6 +39,7 @@ The LDAP auth method resource allows you to configure a Boundary auth_method_lda
|
||||
- `group_filter` (String) A go template used to construct a LDAP group search filter (optional).
|
||||
- `insecure_tls` (Boolean) Skip the LDAP server SSL certificate validation (optional) - insecure and use with caution.
|
||||
- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an LDAP account.
|
||||
- `maximum_page_size` (Number) MaximumPageSize specifies a maximum search result size to use when retrieving the authenticated user's groups (optional).
|
||||
- `name` (String) The auth method name. Defaults to the resource name.
|
||||
- `start_tls` (Boolean) Issue StartTLS command after connecting (optional).
|
||||
- `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Defaults to active-public.
|
||||
|
||||
@@ -1,13 +1,15 @@
|
||||
module github.com/hashicorp/terraform-provider-boundary
|
||||
|
||||
go 1.20
|
||||
go 1.21
|
||||
|
||||
toolchain go1.21.0
|
||||
|
||||
require (
|
||||
github.com/hashicorp/boundary v0.13.0
|
||||
github.com/hashicorp/boundary/api v0.0.39
|
||||
github.com/hashicorp/boundary/sdk v0.0.35
|
||||
github.com/hashicorp/boundary v0.13.1-0.20230926190735-857be69f27d9
|
||||
github.com/hashicorp/boundary/api v0.0.41
|
||||
github.com/hashicorp/boundary/sdk v0.0.37
|
||||
github.com/hashicorp/cap v0.4.0
|
||||
github.com/hashicorp/cap/ldap v0.0.0-20230420150311-6d1e00a6c5e0
|
||||
github.com/hashicorp/cap/ldap v0.0.0-20230918191608-899e3f8e8cd6
|
||||
github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637
|
||||
github.com/hashicorp/go-kms-wrapping/v2 v2.0.13
|
||||
github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.10
|
||||
@@ -55,32 +57,32 @@ require (
|
||||
github.com/dvsekhvalnov/jose2go v1.5.0 // indirect
|
||||
github.com/fatih/color v1.15.0 // indirect
|
||||
github.com/fatih/structs v1.1.0 // indirect
|
||||
github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
|
||||
github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
|
||||
github.com/go-jose/go-jose/v3 v3.0.0 // indirect
|
||||
github.com/go-ldap/ldap/v3 v3.4.4 // indirect
|
||||
github.com/go-ldap/ldap/v3 v3.4.6 // indirect
|
||||
github.com/godbus/dbus/v5 v5.1.0 // indirect
|
||||
github.com/gogo/protobuf v1.3.2 // indirect
|
||||
github.com/golang-migrate/migrate/v4 v4.15.1 // indirect
|
||||
github.com/golang-migrate/migrate/v4 v4.16.2 // indirect
|
||||
github.com/golang/protobuf v1.5.3 // indirect
|
||||
github.com/google/go-cmp v0.5.9 // indirect
|
||||
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
|
||||
github.com/google/uuid v1.3.0 // indirect
|
||||
github.com/google/uuid v1.3.1 // indirect
|
||||
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
|
||||
github.com/hashicorp/dbassert v0.0.0-20230405175854-2d88acd5134b // indirect
|
||||
github.com/hashicorp/dbassert v0.0.0-20230622135851-cc4c0f18f4a7 // indirect
|
||||
github.com/hashicorp/errwrap v1.1.0 // indirect
|
||||
github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24 // indirect
|
||||
github.com/hashicorp/eventlogger v0.2.5 // indirect
|
||||
github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24 // indirect
|
||||
github.com/hashicorp/go-bexpr v0.1.12 // indirect
|
||||
github.com/hashicorp/go-checkpoint v0.5.0 // indirect
|
||||
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
||||
github.com/hashicorp/go-dbw v0.0.0-20230605211904-d40e5c9d5995 // indirect
|
||||
github.com/hashicorp/go-dbw v0.1.0 // indirect
|
||||
github.com/hashicorp/go-hclog v1.5.0 // indirect
|
||||
github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20221122211539-47c893099f13 // indirect
|
||||
github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20230902160534-7a966e6313fd // indirect
|
||||
github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.4 // indirect
|
||||
github.com/hashicorp/go-multierror v1.1.1 // indirect
|
||||
github.com/hashicorp/go-plugin v1.5.1 // indirect
|
||||
github.com/hashicorp/go-retryablehttp v0.7.2 // indirect
|
||||
github.com/hashicorp/go-retryablehttp v0.7.4 // indirect
|
||||
github.com/hashicorp/go-rootcerts v1.0.2 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1 // indirect
|
||||
@@ -90,14 +92,14 @@ require (
|
||||
github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2 // indirect
|
||||
github.com/hashicorp/go-sockaddr v1.0.2 // indirect
|
||||
github.com/hashicorp/go-sockaddr v1.0.5 // indirect
|
||||
github.com/hashicorp/go-uuid v1.0.3 // indirect
|
||||
github.com/hashicorp/go-version v1.6.0 // indirect
|
||||
github.com/hashicorp/hc-install v0.6.0 // indirect
|
||||
github.com/hashicorp/hcl v1.0.0 // indirect
|
||||
github.com/hashicorp/hcl/v2 v2.18.0 // indirect
|
||||
github.com/hashicorp/logutils v1.0.0 // indirect
|
||||
github.com/hashicorp/nodeenrollment v0.2.4 // indirect
|
||||
github.com/hashicorp/nodeenrollment v0.2.6 // indirect
|
||||
github.com/hashicorp/terraform-exec v0.19.0 // indirect
|
||||
github.com/hashicorp/terraform-json v0.17.1 // indirect
|
||||
github.com/hashicorp/terraform-plugin-go v0.19.0 // indirect
|
||||
@@ -110,14 +112,14 @@ require (
|
||||
github.com/huandu/xstrings v1.4.0 // indirect
|
||||
github.com/imdario/mergo v0.3.15 // indirect
|
||||
github.com/jackc/chunkreader/v2 v2.0.1 // indirect
|
||||
github.com/jackc/pgconn v1.14.0 // indirect
|
||||
github.com/jackc/pgconn v1.14.1 // indirect
|
||||
github.com/jackc/pgio v1.0.0 // indirect
|
||||
github.com/jackc/pgpassfile v1.0.0 // indirect
|
||||
github.com/jackc/pgproto3/v2 v2.3.2 // indirect
|
||||
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
|
||||
github.com/jackc/pgtype v1.14.0 // indirect
|
||||
github.com/jackc/pgx/v4 v4.18.1 // indirect
|
||||
github.com/jackc/pgx/v5 v5.3.1 // indirect
|
||||
github.com/jackc/pgx/v5 v5.4.3 // indirect
|
||||
github.com/jefferai/go-libsecret v0.0.0-20210525195240-b53481abef97 // indirect
|
||||
github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f // indirect
|
||||
github.com/jefferai/keyring v1.1.7-0.20220316160357-58a74bb55891 // indirect
|
||||
@@ -125,7 +127,7 @@ require (
|
||||
github.com/jinzhu/inflection v1.0.0 // indirect
|
||||
github.com/jinzhu/now v1.1.5 // indirect
|
||||
github.com/kr/text v0.2.0 // indirect
|
||||
github.com/lib/pq v1.10.7 // indirect
|
||||
github.com/lib/pq v1.10.9 // indirect
|
||||
github.com/mattn/go-colorable v0.1.13 // indirect
|
||||
github.com/mattn/go-isatty v0.0.19 // indirect
|
||||
github.com/mattn/go-sqlite3 v2.0.3+incompatible // indirect
|
||||
@@ -138,7 +140,7 @@ require (
|
||||
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
||||
github.com/mitchellh/pointerstructure v1.2.1 // indirect
|
||||
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
||||
github.com/moby/term v0.0.0-20221205130635-1aeaba878587 // indirect
|
||||
github.com/moby/term v0.5.0 // indirect
|
||||
github.com/mr-tron/base58 v1.2.0 // indirect
|
||||
github.com/mtibben/percent v0.2.1 // indirect
|
||||
github.com/oklog/run v1.1.0 // indirect
|
||||
@@ -159,7 +161,7 @@ require (
|
||||
github.com/ryanuber/go-glob v1.0.0 // indirect
|
||||
github.com/sethvargo/go-diceware v0.3.0 // indirect
|
||||
github.com/shopspring/decimal v1.3.1 // indirect
|
||||
github.com/sirupsen/logrus v1.9.0 // indirect
|
||||
github.com/sirupsen/logrus v1.9.2 // indirect
|
||||
github.com/spf13/cast v1.5.0 // indirect
|
||||
github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
|
||||
github.com/vmihailenco/msgpack/v5 v5.3.5 // indirect
|
||||
@@ -167,29 +169,29 @@ require (
|
||||
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
|
||||
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
|
||||
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
|
||||
github.com/xo/dburl v0.14.2 // indirect
|
||||
github.com/xo/dburl v0.16.0 // indirect
|
||||
github.com/zalando/go-keyring v0.2.3 // indirect
|
||||
github.com/zclconf/go-cty v1.14.0 // indirect
|
||||
go.uber.org/atomic v1.9.0 // indirect
|
||||
go.uber.org/atomic v1.11.0 // indirect
|
||||
golang.org/x/exp v0.0.0-20230626212559-97b1e661b5df // indirect
|
||||
golang.org/x/mod v0.12.0 // indirect
|
||||
golang.org/x/net v0.13.0 // indirect
|
||||
golang.org/x/oauth2 v0.8.0 // indirect
|
||||
golang.org/x/net v0.15.0 // indirect
|
||||
golang.org/x/oauth2 v0.10.0 // indirect
|
||||
golang.org/x/sys v0.12.0 // indirect
|
||||
golang.org/x/term v0.12.0 // indirect
|
||||
golang.org/x/text v0.13.0 // indirect
|
||||
golang.org/x/time v0.3.0 // indirect
|
||||
golang.org/x/tools v0.6.0 // indirect
|
||||
golang.org/x/tools v0.9.1 // indirect
|
||||
google.golang.org/appengine v1.6.7 // indirect
|
||||
google.golang.org/genproto v0.0.0-20230526203410-71b5a4ffd15e // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc // indirect
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect
|
||||
google.golang.org/grpc v1.57.0 // indirect
|
||||
google.golang.org/genproto v0.0.0-20230711160842-782d3b101e98 // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20230711160842-782d3b101e98 // indirect
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 // indirect
|
||||
google.golang.org/grpc v1.58.2 // indirect
|
||||
google.golang.org/protobuf v1.31.0 // indirect
|
||||
gopkg.in/square/go-jose.v2 v2.6.0 // indirect
|
||||
gopkg.in/yaml.v2 v2.4.0 // indirect
|
||||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||
gorm.io/driver/postgres v1.5.2 // indirect
|
||||
gorm.io/driver/sqlite v1.5.1 // indirect
|
||||
gorm.io/gorm v1.25.1 // indirect
|
||||
gorm.io/driver/sqlite v1.5.3 // indirect
|
||||
gorm.io/gorm v1.25.4 // indirect
|
||||
)
|
||||
@@ -5,6 +5,7 @@ package provider
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
|
||||
"github.com/hashicorp/boundary/api"
|
||||
@@ -38,6 +39,8 @@ const (
|
||||
authMethodLdapAccountAttrMapsField = "account_attribute_maps"
|
||||
authMethodLdapPrimaryAuthMethodForScopeField = "is_primary_for_scope"
|
||||
authMethodLdapStateField = "state"
|
||||
authMethodLdapMaxPageSizeField = "maximum_page_size"
|
||||
authMethodLdapDerefAliasesField = "dereference_aliases"
|
||||
|
||||
// computed-only parameters
|
||||
authMethodLdapClientCertKeyHmacKey = "client_certificate_key_hmac"
|
||||
@@ -195,6 +198,17 @@ func resourceAuthMethodLdap() *schema.Resource {
|
||||
Optional: true,
|
||||
Computed: true,
|
||||
},
|
||||
authMethodLdapMaxPageSizeField: {
|
||||
Description: "MaximumPageSize specifies a maximum search result size to use when retrieving the authenticated user's groups (optional).",
|
||||
Type: schema.TypeInt,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapDerefAliasesField: {
|
||||
Description: "Control how aliases are dereferenced when performing the search. Can be one of: NeverDerefAliases, DerefInSearching, DerefFindingBaseObj, and DerefAlways (optional).",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
Computed: true,
|
||||
},
|
||||
|
||||
// LDAP specific immutable and computed parameters
|
||||
authMethodLdapClientCertKeyHmacKey: {
|
||||
@@ -401,6 +415,18 @@ func setFromLdapAuthMethodResponseMap(d *schema.ResourceData, raw map[string]int
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapMaxPageSizeField]; ok {
|
||||
if err := d.Set(authMethodLdapMaxPageSizeField, v.(json.Number)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapDerefAliasesField]; ok {
|
||||
if err := d.Set(authMethodLdapDerefAliasesField, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
d.SetId(raw["id"].(string))
|
||||
@@ -506,6 +532,14 @@ func resourceAuthMethodLdapCreate(ctx context.Context, d *schema.ResourceData, m
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodUseTokenGroups(useTokenGrps.(bool)))
|
||||
}
|
||||
|
||||
if maxPageSize, ok := d.GetOk(authMethodLdapMaxPageSizeField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodMaximumPageSize(uint32(maxPageSize.(int))))
|
||||
}
|
||||
|
||||
if derefAliases, ok := d.GetOk(authMethodLdapDerefAliasesField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodDereferenceAliases(derefAliases.(string)))
|
||||
}
|
||||
|
||||
if rawAccountAttrMaps, ok := d.GetOk(authMethodLdapAccountAttrMapsField); ok {
|
||||
accountAttrMaps := []string{}
|
||||
for _, u := range rawAccountAttrMaps.([]interface{}) {
|
||||
@@ -785,6 +819,20 @@ func resourceAuthMethodLdapUpdate(ctx context.Context, d *schema.ResourceData, m
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapMaxPageSizeField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodMaximumPageSize())
|
||||
if maxPageSize, ok := d.GetOk(authMethodLdapMaxPageSizeField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodMaximumPageSize(uint32(maxPageSize.(int))))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapDerefAliasesField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodDereferenceAliases())
|
||||
if derefAliases, ok := d.GetOk(authMethodLdapDerefAliasesField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodDereferenceAliases(derefAliases.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if len(opts) > 0 {
|
||||
opts = append(opts, authmethods.WithAutomaticVersioning(true))
|
||||
amur, err := amClient.Update(ctx, d.Id(), 0, opts...)
|
||||
|
||||
@@ -65,6 +65,8 @@ resource "boundary_auth_method_ldap" "test-ldap" {
|
||||
group_filter = "group-filter"
|
||||
bind_dn = "bind-dn"
|
||||
bind_password = "bind-password"
|
||||
maximum_page_size = 10
|
||||
dereference_aliases = "DerefAlways"
|
||||
use_token_groups = true
|
||||
certificates = [
|
||||
<<EOT
|
||||
@@ -112,6 +114,8 @@ resource "boundary_auth_method_ldap" "test-ldap" {
|
||||
bind_password = "bind-password-updated"
|
||||
use_token_groups = false
|
||||
state = "inactive"
|
||||
maximum_page_size = 100
|
||||
dereference_aliases = "NeverDerefAliases"
|
||||
certificates = [
|
||||
<<EOT
|
||||
%s
|
||||
@@ -160,6 +164,8 @@ func TestAccAuthMethodLdap(t *testing.T) {
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindDnField, "bind-dn"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindPasswordField, "bind-password"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUseTokenGrpsField, "true"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapMaxPageSizeField, "10"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapDerefAliasesField, "DerefAlways"),
|
||||
testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapCertificatesField, []string{tdCert}),
|
||||
),
|
||||
},
|
||||
@@ -187,6 +193,8 @@ func TestAccAuthMethodLdap(t *testing.T) {
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindDnField, "bind-dn-updated"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindPasswordField, "bind-password-updated"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUseTokenGrpsField, "false"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapMaxPageSizeField, "100"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapDerefAliasesField, "NeverDerefAliases"),
|
||||
testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapCertificatesField, []string{testAuthMethodLdapCert}),
|
||||
testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_ldap.test-ldap"),
|
||||
testAccIsPrimaryForScope(provider, "boundary_auth_method_ldap.test-ldap", true),
|
||||
|
||||
Reference in new issue
Block a user