Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Michael Milton
|
1a83d0e4d1 | ||
  
|
96c688b879 |
No files matched your search
@@ -0,0 +1,24 @@
|
||||
# Copyright (c) HashiCorp, Inc.
|
||||
# SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
version: 2.1
|
||||
jobs:
|
||||
build:
|
||||
resource_class: large
|
||||
machine:
|
||||
image: 'ubuntu-2004:202107-02'
|
||||
working_directory: ~/terraform-provider-watchtower
|
||||
steps:
|
||||
- checkout
|
||||
- run:
|
||||
name: "Install go"
|
||||
command: |
|
||||
unset GOPATH # ci image has done strange things with GOPATH, unset it so install-go can fix it
|
||||
make install-go
|
||||
source ~/.bashrc
|
||||
go mod download
|
||||
- run:
|
||||
name: "Run Acceptance Tests"
|
||||
command: |
|
||||
source ~/.bashrc
|
||||
make testacc-ci
|
||||
+2
-2
@@ -10,7 +10,7 @@ project {
|
||||
# files or folders should be ignored
|
||||
# Default: []
|
||||
header_ignore = [
|
||||
"examples/**/*.tf",
|
||||
"examples/**/*.sh",
|
||||
"examples/**.tf",
|
||||
"examples/**.sh",
|
||||
]
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
name: Lint GitHub Actions workflows
|
||||
on: push
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
actionlint:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Check workflow files
|
||||
uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint@sha256:02ccb6d91e4cb4a7b21eb99d5274d257e81ae667688d730e89d7ea0d6d35db91
|
||||
with:
|
||||
args: -color
|
||||
+11
-14
@@ -9,9 +9,6 @@ on:
|
||||
|
||||
name: Jira Sync
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
sync:
|
||||
runs-on: ubuntu-latest
|
||||
@@ -21,19 +18,19 @@ jobs:
|
||||
if: github.event.action == 'opened'
|
||||
id: boundary-team-role
|
||||
run: |
|
||||
TEAM="boundary"
|
||||
TEAM=boundary
|
||||
ROLE="$(hub api orgs/hashicorp/teams/${TEAM}/memberships/${{ github.actor }} | jq -r '.role | select(.!=null)')"
|
||||
if [[ -n "${ROLE}" ]]; then
|
||||
if [[ -n ${ROLE} ]]; then
|
||||
echo "Actor ${{ github.actor }} is a ${TEAM} team member, skipping ticket creation"
|
||||
else
|
||||
echo "Actor ${{ github.actor }} is not a ${TEAM} team member"
|
||||
fi
|
||||
echo "name=role::${ROLE}" >> "$GITHUB_OUTPUT"
|
||||
echo "::set-output name=role::${ROLE}"
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.JIRA_SYNC_GITHUB_TOKEN }}
|
||||
|
||||
- name: Login
|
||||
uses: atlassian/gajira-login@45fd029b9f1d6d8926c6f04175aa80c0e42c9026 # v3.0.1
|
||||
uses: atlassian/gajira-login@v3.0.1
|
||||
env:
|
||||
JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
|
||||
JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
|
||||
@@ -44,14 +41,14 @@ jobs:
|
||||
id: set-ticket-type
|
||||
run: |
|
||||
if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
|
||||
echo "name=type::PR" >> "$GITHUB_OUTPUT"
|
||||
echo "::set-output name=type::PR"
|
||||
else
|
||||
echo "name=type::ISS" >> "$GITHUB_OUTPUT"
|
||||
echo "::set-output name=type::ISS"
|
||||
fi
|
||||
|
||||
- name: Create ticket
|
||||
if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
|
||||
uses: tomhjp/gh-action-jira-create@3ed1789cad3521292e591a7cfa703215ec1348bf # v0.2.1
|
||||
uses: tomhjp/gh-action-jira-create@v0.2.0
|
||||
with:
|
||||
project: ICU
|
||||
issuetype: "GH Issue"
|
||||
@@ -63,28 +60,28 @@ jobs:
|
||||
- name: Search
|
||||
if: github.event.action != 'opened'
|
||||
id: search
|
||||
uses: tomhjp/gh-action-jira-search@04700b457f317c3e341ce90da5a3ff4ce058f2fa # v0.2.2
|
||||
uses: tomhjp/gh-action-jira-search@v0.2.1
|
||||
with:
|
||||
# cf[10089] is Issue Link custom field
|
||||
jql: 'issuetype = "GH Issue" and cf[10089]="${{ github.event.issue.html_url || github.event.pull_request.html_url }}"'
|
||||
|
||||
- name: Sync comment
|
||||
if: github.event.action == 'created' && steps.search.outputs.issue
|
||||
uses: tomhjp/gh-action-jira-comment@6eb6b9ead70221916b6badd118c24535ed220bd9 # v0.2.0
|
||||
uses: tomhjp/gh-action-jira-comment@v0.2.0
|
||||
with:
|
||||
issue: ${{ steps.search.outputs.issue }}
|
||||
comment: "${{ github.actor }} ${{ github.event.review.state || 'commented' }}:\n\n${{ github.event.comment.body || github.event.review.body }}\n\n${{ github.event.comment.html_url || github.event.review.html_url }}"
|
||||
|
||||
- name: Close ticket
|
||||
if: (github.event.action == 'closed' || github.event.action == 'deleted') && steps.search.outputs.issue
|
||||
uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3.0.1
|
||||
uses: atlassian/gajira-transition@v3.0.1
|
||||
with:
|
||||
issue: ${{ steps.search.outputs.issue }}
|
||||
transition: Done
|
||||
|
||||
- name: Reopen ticket
|
||||
if: github.event.action == 'reopened' && steps.search.outputs.issue
|
||||
uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3.0.1
|
||||
uses: atlassian/gajira-transition@v3.0.1
|
||||
with:
|
||||
issue: ${{ steps.search.outputs.issue }}
|
||||
transition: "To Do"
|
||||
@@ -1,43 +0,0 @@
|
||||
name: "make-gen-delta"
|
||||
on:
|
||||
- workflow_dispatch
|
||||
- push
|
||||
- pull_request
|
||||
- workflow_call
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
make-gen-delta:
|
||||
name: "Check for uncommitted changes from make gen"
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
with:
|
||||
fetch-depth: '0'
|
||||
- name: Determine Go version
|
||||
id: get-go-version
|
||||
# We use .go-version as our source of truth for current Go
|
||||
# version, because "goenv" can react to it automatically.
|
||||
run: |
|
||||
echo "Building with Go $(cat .go-version)"
|
||||
echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
|
||||
with:
|
||||
go-version: "${{ steps.get-go-version.outputs.go-version }}"
|
||||
- name: Running go mod tidy
|
||||
run: |
|
||||
go mod tidy
|
||||
- name: Install Dependencies
|
||||
run: |
|
||||
make tools
|
||||
- name: Running make gen
|
||||
run: |
|
||||
make gen
|
||||
- name: Check for changes
|
||||
run: |
|
||||
git diff --exit-code
|
||||
git status --porcelain
|
||||
test -z "$(git status --porcelain)"
|
||||
@@ -12,24 +12,20 @@ jobs:
|
||||
go-version:
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
version: ${{ steps.go-version.outputs.go-version }}
|
||||
version: ${{ steps.go-version.outputs.version }}
|
||||
steps:
|
||||
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- uses: actions/checkout@v3
|
||||
- id: go-version
|
||||
# We use .go-version as our source of truth for current Go
|
||||
# version, because "goenv" can react to it automatically.
|
||||
run: |
|
||||
echo "Building with Go $(cat .go-version)"
|
||||
echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
|
||||
run: echo "::set-output name=version::$(cat ./.go-version)"
|
||||
release-notes:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- uses: actions/checkout@v3
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Generate Release Notes
|
||||
run: sed -n -e "1{/# /d;}" -e "2{/^$/d;}" -e "/# $(git describe --abbrev=0 --exclude="$(git describe --abbrev=0 --match='v*.*.*' --tags)" --match='v*.*.*' --tags | tr -d v)/q;p" CHANGELOG.md > release-notes.txt
|
||||
- uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
|
||||
- uses: actions/upload-artifact@v3
|
||||
with:
|
||||
name: release-notes
|
||||
path: release-notes.txt
|
||||
@@ -37,7 +33,7 @@ jobs:
|
||||
terraform-provider-release:
|
||||
name: 'Terraform Provider Release'
|
||||
needs: [go-version, release-notes]
|
||||
uses: hashicorp/ghaction-terraform-provider-release/.github/workflows/hashicorp.yml@v3
|
||||
uses: hashicorp/ghaction-terraform-provider-release/.github/workflows/hashicorp.yml@v2
|
||||
secrets:
|
||||
hc-releases-github-token: '${{ secrets.HASHI_RELEASES_GITHUB_TOKEN }}'
|
||||
hc-releases-host-staging: '${{ secrets.HC_RELEASES_HOST_STAGING }}'
|
||||
|
||||
@@ -1,45 +0,0 @@
|
||||
name: test
|
||||
|
||||
on:
|
||||
- push
|
||||
- pull_request
|
||||
- workflow_dispatch
|
||||
- workflow_call
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Determine go version
|
||||
id: get-go-version
|
||||
# We use .go-version as our source of truth for current Go
|
||||
# version, because "goenv" can react to it automatically.
|
||||
run: |
|
||||
echo "Building with Go $(cat .go-version)"
|
||||
echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
|
||||
with:
|
||||
go-version: "${{ steps.get-go-version.outputs.go-version }}"
|
||||
cache: false
|
||||
- name: Determine Go cache paths
|
||||
id: go-cache-paths
|
||||
run: |
|
||||
echo "go-build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
|
||||
echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
|
||||
- name: Set up Go modules cache
|
||||
uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
|
||||
with:
|
||||
path: |
|
||||
${{ steps.go-cache-paths.outputs.go-build }}
|
||||
${{ steps.go-cache-paths.outputs.go-mod }}
|
||||
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-go
|
||||
- name: Acceptance Tests
|
||||
run: |
|
||||
make testacc
|
||||
+1
-1
@@ -1 +1 @@
|
||||
1.21.5
|
||||
1.20
|
||||
Vendored
-22
@@ -1,22 +0,0 @@
|
||||
{
|
||||
// Use IntelliSense to learn about possible attributes.
|
||||
// Hover to view descriptions of existing attributes.
|
||||
// For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
|
||||
"version": "0.2.0",
|
||||
"configurations": [
|
||||
{
|
||||
"name": "Launch a test function",
|
||||
"type": "go",
|
||||
"request": "launch",
|
||||
"mode": "auto",
|
||||
"program": "${fileDirname}",
|
||||
"args": [
|
||||
"-test.v",
|
||||
"-test.run",
|
||||
"^${selectedText}$"
|
||||
],
|
||||
"showLog": true,
|
||||
"envFile": "${workspaceFolder}/.vscode/private.env"
|
||||
}
|
||||
]
|
||||
}
|
||||
Vendored
-3
@@ -1,3 +0,0 @@
|
||||
TF_ACC=1
|
||||
TF_LOG=INFO
|
||||
GOFLAGS='-mod=readonly'
|
||||
+4
-100
@@ -2,98 +2,6 @@
|
||||
|
||||
Canonical reference for changes, improvements, and bugfixes for the Boundary Terraform provider.
|
||||
|
||||
## 1.1.13 (February 1, 2024)
|
||||
|
||||
### New and Improved
|
||||
|
||||
* Allow dynamic credentials when configuring storage buckets.
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/549))
|
||||
|
||||
## 1.1.12 (January 8, 2024)
|
||||
|
||||
### New and Improved
|
||||
|
||||
* Add support to configure valid_principals with Vault SSH Certificate Credential Library
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/512))
|
||||
|
||||
## 1.1.11 (December 13, 2023)
|
||||
|
||||
### New and Improved
|
||||
|
||||
* Add support for OIDC prompts. Using prompts, the Relying Party (RP) can customize the authentication and authorization flow to suit their specific needs and improve the user experience. [OIDC Authentication request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest) server.
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/519))
|
||||
* Add boundary_auth_method data source
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/505))
|
||||
* Add boundary_group data source
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/503))
|
||||
* Add boundary_account data source
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/493))
|
||||
* Add boundary_user data source
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/468))
|
||||
|
||||
### Bug Fix
|
||||
* Fix boundary_worker overwriting worker generated auth token during
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/461))
|
||||
|
||||
## 1.1.10 (October 11, 2023)
|
||||
|
||||
### New and Improved
|
||||
|
||||
* Add support for Scope datasource
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/474))
|
||||
* LDAP: Add support for maximum_page_size and dereference_aliases
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/453))
|
||||
|
||||
|
||||
## 1.1.9 (July 19, 2023)
|
||||
|
||||
### New and Improved
|
||||
|
||||
* Add support for a storage bucket as a resource
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/417))
|
||||
* Add option to enable session recording on a target resource
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/421))
|
||||
* Update docs for host set plugin filters examples
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/420))
|
||||
|
||||
## 1.1.8 (June 13, 2023)
|
||||
|
||||
### New and Improved
|
||||
|
||||
* Add support for target default client port
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/379))
|
||||
* Add support for using ldap primary auth method
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/392))
|
||||
|
||||
### Deprecations/Changes
|
||||
|
||||
* Deprecate `password_auth_method_login_name` & `password_auth_method_password` for Terraform Provider.
|
||||
`password_auth_method_login_name` & `password_auth_method_password` fields have been set to deprecated
|
||||
with a recommendation to use `auth_method_login_name` & `auth_method_password` fields instead.
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/392))
|
||||
* Deprecate type field for `boundary_account_password`
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/396))
|
||||
* Deprecate type field for `boundary_account_ldap`
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/400))
|
||||
|
||||
## 1.1.7 (May 12, 2023)
|
||||
|
||||
### Bug Fix
|
||||
* Fix default auth method with recovery kms
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/406))
|
||||
|
||||
## 1.1.6 (May 5, 2023)
|
||||
|
||||
### New and Improved
|
||||
* Add support for using default auth method if no auth method ID is provided for provider
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/385))
|
||||
* Fix typo in Managed Group resource page
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/370))
|
||||
|
||||
### Bug Fix
|
||||
* Force new resource on credential_type change
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/389))
|
||||
|
||||
## 1.1.5 (April 21, 2023)
|
||||
|
||||
### New and Improved
|
||||
@@ -105,13 +13,9 @@ Canonical reference for changes, improvements, and bugfixes for the Boundary Ter
|
||||
## 1.1.4 (February 15, 2023)
|
||||
|
||||
### New and Improved
|
||||
|
||||
* Add support for worker egress and ingress filters
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/319))
|
||||
* Add support for vault ssh certificate credential libraries
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/320))
|
||||
* Add support for targets with address configurations
|
||||
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/308))
|
||||
* Add support for worker egress and ingress filters ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/319))
|
||||
* Add support for vault ssh certificate credential libraries ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/320))
|
||||
* Add support for targets with address configurations ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/308))
|
||||
|
||||
## 1.1.3 (November 29, 2022)
|
||||
|
||||
@@ -318,4 +222,4 @@ Update provider to handle new domain errors ([PR](https://github.com/hashicorp/t
|
||||
|
||||
## 0.1.0 (October 14, 2020)
|
||||
|
||||
Initial release!
|
||||
Initial release!
|
||||
@@ -1,4 +0,0 @@
|
||||
# These owners will be the default owners for everything in
|
||||
# the repo, unless a later match takes precedence.
|
||||
|
||||
@hashicorp/boundary
|
||||
@@ -18,12 +18,14 @@ DOCKER_ARGS ?= -d
|
||||
PG_OPTS ?=
|
||||
TEST_DB_PORT ?= 5432
|
||||
BOUNDARY_VERSION = $(shell go mod edit -json | jq -r '.["Require"][] | select(.Path=="github.com/hashicorp/boundary") | .["Version"]')
|
||||
GOPATH ?= $(abspath ~/go)
|
||||
GOPATH ?= ~/go
|
||||
GOMODCACHE ?= $(GOPATH)/pkg/mod
|
||||
|
||||
tools:
|
||||
go generate -tags tools tools/tools.go
|
||||
go install github.com/hashicorp/copywrite@v0.15.0
|
||||
|
||||
fmtcheck:
|
||||
echo "Placeholder"
|
||||
|
||||
test:
|
||||
echo "Placeholder"
|
||||
@@ -32,6 +34,15 @@ test:
|
||||
testacc:
|
||||
TF_ACC=1 go test ./... -v $(TESTARGS) -timeout 120m
|
||||
|
||||
testacc-ci:
|
||||
git config --global --add url."git@github.com:".insteadOf "https://github.com/"
|
||||
TF_ACC=1 ~/.go/bin/go test ./... -v $(TESTARGS) -timeout 120m
|
||||
|
||||
install-go: ~/.go/bin/go
|
||||
|
||||
~/.go/bin/go:
|
||||
./ci/goinstall.sh
|
||||
|
||||
dev:
|
||||
GOOS=${GOOS} GOARCH=${GOARCH} ./scripts/plugins.sh
|
||||
mkdir -p $(INSTALL_PATH)
|
||||
@@ -79,14 +90,3 @@ test-database-down:
|
||||
docker rm -v boundary-sql-tests || true
|
||||
|
||||
.PHONY: testacc tools docs test-database-up test-database-down
|
||||
|
||||
.PHONY: copywrite
|
||||
copywrite:
|
||||
copywrite headers
|
||||
|
||||
.PHONY: fmt
|
||||
fmt:
|
||||
gofumpt -w $$(find . -name '*.go')
|
||||
|
||||
.PHONY: gen
|
||||
gen: docs copywrite fmt
|
||||
@@ -1,15 +1,18 @@
|
||||
|
||||
|
||||
# Terraform Provider Boundary
|
||||
Terraform Provider Boundary
|
||||
==================
|
||||
|
||||
Available in the [Terraform Registry](https://registry.terraform.io/providers/hashicorp/boundary/latest).
|
||||
|
||||
## Requirements
|
||||
Requirements
|
||||
------------
|
||||
|
||||
- [Terraform](https://www.terraform.io/downloads.html) >= 0.13.x
|
||||
- [Go](https://golang.org/doc/install) >= 1.21
|
||||
- [Terraform](https://www.terraform.io/downloads.html) >= 0.12.x
|
||||
- [Go](https://golang.org/doc/install) >= 1.20
|
||||
|
||||
## Building The Provider
|
||||
Building The Provider
|
||||
---------------------
|
||||
|
||||
1. Clone the repository
|
||||
1. Enter the repository directory
|
||||
@@ -19,30 +22,32 @@ You'll need to ensure that your Terraform file contains the information necessar
|
||||
|
||||
```hcl
|
||||
terraform {
|
||||
required_providers {
|
||||
boundary = {
|
||||
source = "localhost/providers/boundary"
|
||||
version = "0.0.1"
|
||||
}
|
||||
}
|
||||
required_providers {
|
||||
boundary = {
|
||||
source = "localhost/providers/boundary"
|
||||
version = "0.0.1"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Adding Dependencies
|
||||
Adding Dependencies
|
||||
---------------------
|
||||
|
||||
This provider uses [Go modules](https://github.com/golang/go/wiki/Modules).
|
||||
Please see the Go documentation for the most up to date information about using Go modules.
|
||||
|
||||
To add a new dependency `github.com/author/dependency` to your Terraform provider:
|
||||
|
||||
```shell
|
||||
```
|
||||
go get github.com/author/dependency
|
||||
go mod tidy
|
||||
```
|
||||
|
||||
Then commit the changes to `go.mod` and `go.sum`.
|
||||
|
||||
## Developing the Provider
|
||||
Developing the Provider
|
||||
---------------------------
|
||||
|
||||
If you wish to work on the provider, you'll first need [Go](http://www.golang.org) installed on your machine (see [Requirements](#requirements) above).
|
||||
|
||||
@@ -67,32 +72,17 @@ $ make testacc
|
||||
For more details on the docker image and troubleshooting see the
|
||||
[boundary testing doc](https://github.com/hashicorp/boundary/blob/main/CONTRIBUTING.md#testing).
|
||||
|
||||
## Debugging the provider
|
||||
|
||||
If you're using vscode, this provider has delve debugging baked into the [.vscode](https://github.com/hashicorp/terraform-provider-boundary/tree/main/.vscode) directory. To debug you can find instructions [here.](https://dev.to/drewmullen/vscode-terraform-provider-development-setup-debugging-6bn#usage)
|
||||
|
||||
## Generating Docs
|
||||
|
||||
This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. Each resource and data source requires a set of examples [examples](https://github.com/hashicorp/terraform-provider-boundary/tree/main/examples) then you execute a binary to generate the docs which are placed in [./docs](https://github.com/hashicorp/terraform-provider-boundary/tree/main/docs). Optionally, you can specify your own [templates](https://github.com/hashicorp/terraform-provider-boundary/tree/main/templates) for a resource or data source if you want to add custom information (example: [data "boundary_scope"](https://github.com/hashicorp/terraform-provider-boundary/blob/main/templates/data-sources/scope.md.tmpl#L11))
|
||||
|
||||
### New Resources & Data Sources (documentation templates)
|
||||
|
||||
If you're adding a new resource or a data source, you must include a documentation template for your new R/DS in [./templates](https://github.com/hashicorp/terraform-provider-boundary/tree/main/templates) directory. This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. For full details see the link.
|
||||
|
||||
### Documentation Examples for Resources & Data Sources
|
||||
|
||||
Examples are required for all resources and data sources. This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. To add examples, add a new file to the [./examples](https://github.com/hashicorp/terraform-provider-boundary/tree/main/examples) directory or update the existing files. Next make sure the corresponding template in [./templates](https://github.com/hashicorp/terraform-provider-boundary/tree/main/templates) directory references this example.
|
||||
|
||||
### Generating
|
||||
Generating Docs
|
||||
----------------------
|
||||
|
||||
From the root of the repo run:
|
||||
|
||||
```shell
|
||||
```
|
||||
go run github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs
|
||||
```
|
||||
|
||||
## Using the provider
|
||||
|
||||
Using the provider
|
||||
----------------------
|
||||
Please see our detailed docs for individual resource usage. Below is a complex example using the Boundary provider to configure all resource types available:
|
||||
|
||||
```hcl
|
||||
@@ -150,7 +140,7 @@ resource "boundary_user" "users" {
|
||||
scope_id = boundary_scope.corp.id
|
||||
}
|
||||
|
||||
// organization level group for readonly users
|
||||
// organization level group for readonly users
|
||||
resource "boundary_group" "readonly" {
|
||||
name = "readonly"
|
||||
description = "Organization group for readonly users"
|
||||
@@ -163,7 +153,7 @@ resource "boundary_role" "organization_readonly" {
|
||||
name = "readonly"
|
||||
description = "Read-only role"
|
||||
principal_ids = [boundary_group.readonly_users.id]
|
||||
grant_strings = ["ids=*;type=*;actions=read"]
|
||||
grant_strings = ["id=*;type=*;actions=read"]
|
||||
scope_id = boundary_scope.corp.id
|
||||
}
|
||||
|
||||
@@ -174,7 +164,7 @@ resource "boundary_role" "organization_admin" {
|
||||
principal_ids = concat(
|
||||
[for user in boundary_user.user: user.id]
|
||||
)
|
||||
grant_strings = ["ids=*;type=*;actions=create,read,update,delete"]
|
||||
grant_strings = ["id=*;type=*;actions=create,read,update,delete"]
|
||||
scope_id = boundary_scope.corp.id
|
||||
}
|
||||
|
||||
|
||||
Executable
+121
@@ -0,0 +1,121 @@
|
||||
#!/bin/bash
|
||||
# Copyright (c) HashiCorp, Inc.
|
||||
# SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
set -e
|
||||
|
||||
VERSION="1.19.1"
|
||||
|
||||
[ -z "$GOROOT" ] && GOROOT="$HOME/.go"
|
||||
[ -z "$GOPATH" ] && GOPATH="$HOME/go"
|
||||
|
||||
OS="$(uname -s)"
|
||||
ARCH="$(uname -m)"
|
||||
|
||||
case $OS in
|
||||
"Linux")
|
||||
case $ARCH in
|
||||
"x86_64")
|
||||
ARCH=amd64
|
||||
;;
|
||||
"aarch64")
|
||||
ARCH=arm64
|
||||
;;
|
||||
"armv6")
|
||||
ARCH=armv6l
|
||||
;;
|
||||
"armv8")
|
||||
ARCH=arm64
|
||||
;;
|
||||
.*386.*)
|
||||
ARCH=386
|
||||
;;
|
||||
esac
|
||||
PLATFORM="linux-$ARCH"
|
||||
;;
|
||||
"Darwin")
|
||||
PLATFORM="darwin-amd64"
|
||||
;;
|
||||
esac
|
||||
|
||||
print_help() {
|
||||
echo "Usage: bash goinstall.sh OPTIONS"
|
||||
echo -e "\nOPTIONS:"
|
||||
echo -e " --remove\tRemove currently installed version"
|
||||
echo -e " --version\tSpecify a version number to install"
|
||||
}
|
||||
|
||||
if [ -n "`$SHELL -c 'echo $ZSH_VERSION'`" ]; then
|
||||
shell_profile="zshrc"
|
||||
elif [ -n "`$SHELL -c 'echo $BASH_VERSION'`" ]; then
|
||||
shell_profile="bashrc"
|
||||
fi
|
||||
|
||||
if [ "$1" == "--remove" ]; then
|
||||
rm -rf "$GOROOT"
|
||||
if [ "$OS" == "Darwin" ]; then
|
||||
sed -i "" '/# GoLang/d' "$HOME/.${shell_profile}"
|
||||
sed -i "" '/export GOROOT/d' "$HOME/.${shell_profile}"
|
||||
sed -i "" '/$GOROOT\/bin/d' "$HOME/.${shell_profile}"
|
||||
sed -i "" '/export GOPATH/d' "$HOME/.${shell_profile}"
|
||||
sed -i "" '/$GOPATH\/bin/d' "$HOME/.${shell_profile}"
|
||||
else
|
||||
sed -i '/# GoLang/d' "$HOME/.${shell_profile}"
|
||||
sed -i '/export GOROOT/d' "$HOME/.${shell_profile}"
|
||||
sed -i '/$GOROOT\/bin/d' "$HOME/.${shell_profile}"
|
||||
sed -i '/export GOPATH/d' "$HOME/.${shell_profile}"
|
||||
sed -i '/$GOPATH\/bin/d' "$HOME/.${shell_profile}"
|
||||
fi
|
||||
echo "Go removed."
|
||||
exit 0
|
||||
elif [ "$1" == "--help" ]; then
|
||||
print_help
|
||||
exit 0
|
||||
elif [ "$1" == "--version" ]; then
|
||||
if [ -z "$2" ]; then # Check if --version has a second positional parameter
|
||||
echo "Please provide a version number for: $1"
|
||||
else
|
||||
VERSION=$2
|
||||
fi
|
||||
elif [ ! -z "$1" ]; then
|
||||
echo "Unrecognized option: $1"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -d "$GOROOT" ]; then
|
||||
echo "The Go install directory ($GOROOT) already exists. Exiting."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
PACKAGE_NAME="go$VERSION.$PLATFORM.tar.gz"
|
||||
TEMP_DIRECTORY=$(mktemp -d)
|
||||
|
||||
echo "Downloading $PACKAGE_NAME ..."
|
||||
if hash wget 2>/dev/null; then
|
||||
wget https://storage.googleapis.com/golang/$PACKAGE_NAME -O "$TEMP_DIRECTORY/go.tar.gz"
|
||||
else
|
||||
curl -o "$TEMP_DIRECTORY/go.tar.gz" https://storage.googleapis.com/golang/$PACKAGE_NAME
|
||||
fi
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Download failed! Exiting."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Extracting File..."
|
||||
mkdir -p "$GOROOT"
|
||||
tar -C "$GOROOT" --strip-components=1 -xzf "$TEMP_DIRECTORY/go.tar.gz"
|
||||
touch "$HOME/.${shell_profile}"
|
||||
{
|
||||
echo '# GoLang'
|
||||
echo "export GOROOT=${GOROOT}"
|
||||
echo 'export PATH=$GOROOT/bin:$PATH'
|
||||
echo "export GOPATH=$GOPATH"
|
||||
echo 'export PATH=$GOPATH/bin:$PATH'
|
||||
} >> "$HOME/.${shell_profile}"
|
||||
|
||||
mkdir -p $GOPATH/{src,pkg,bin}
|
||||
echo -e "\nGo $VERSION was installed into $GOROOT.\nMake sure to relogin into your shell or run:"
|
||||
echo -e "\n\tsource $HOME/.${shell_profile}\n\nto update your environment variables."
|
||||
echo "Tip: Opening a new terminal window usually just works. :)"
|
||||
rm -f "$TEMP_DIRECTORY/go.tar.gz"
|
||||
@@ -1,47 +0,0 @@
|
||||
---
|
||||
# generated by https://github.com/hashicorp/terraform-plugin-docs
|
||||
page_title: "boundary_account Data Source - terraform-provider-boundary"
|
||||
subcategory: ""
|
||||
description: |-
|
||||
The boundary_account data source allows you to find a Boundary account.
|
||||
---
|
||||
|
||||
# boundary_account (Data Source)
|
||||
|
||||
The boundary_account data source allows you to find a Boundary account.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```terraform
|
||||
# Retrieve the ID of a Boundary account
|
||||
data "boundary_account" "admin" {
|
||||
name = "admin"
|
||||
auth_method_id = "ampw_1234567890"
|
||||
}
|
||||
```
|
||||
|
||||
<!-- schema generated by tfplugindocs -->
|
||||
## Schema
|
||||
|
||||
### Required
|
||||
|
||||
- `auth_method_id` (String) The auth method ID that will be queried for the account.
|
||||
- `name` (String) The name of the account to retrieve.
|
||||
|
||||
### Read-Only
|
||||
|
||||
- `description` (String) The description of the retrieved account.
|
||||
- `id` (String) The ID of the retrieved account.
|
||||
- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
|
||||
- `type` (String) The type of the account
|
||||
|
||||
<a id="nestedatt--scope"></a>
|
||||
### Nested Schema for `scope`
|
||||
|
||||
Read-Only:
|
||||
|
||||
- `description` (String)
|
||||
- `id` (String)
|
||||
- `name` (String)
|
||||
- `parent_scope_id` (String)
|
||||
- `type` (String)
|
||||
@@ -1,60 +0,0 @@
|
||||
---
|
||||
# generated by https://github.com/hashicorp/terraform-plugin-docs
|
||||
page_title: "boundary_auth_method Data Source - terraform-provider-boundary"
|
||||
subcategory: ""
|
||||
description: |-
|
||||
The boundaryauthmethod data source allows you to find a Boundary auth method.
|
||||
---
|
||||
|
||||
# boundary_auth_method (Data Source)
|
||||
|
||||
The boundary_auth_method data source allows you to find a Boundary auth method.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```terraform
|
||||
# Retrieve an auth method from the global scope
|
||||
data "boundary_auth_method" "auth_method" {
|
||||
name = "password_auth_method"
|
||||
}
|
||||
|
||||
# Auth method from a org scope
|
||||
data "boundary_scope" "org" {
|
||||
name = "my-org"
|
||||
scope_id = "global"
|
||||
}
|
||||
|
||||
data "boundary_auth_method" "auth_method" {
|
||||
name = "password_auth_method"
|
||||
scope_id = data.boundary_scope.org.id
|
||||
}
|
||||
```
|
||||
|
||||
<!-- schema generated by tfplugindocs -->
|
||||
## Schema
|
||||
|
||||
### Required
|
||||
|
||||
- `name` (String) The name of the auth method to retrieve.
|
||||
|
||||
### Optional
|
||||
|
||||
- `scope_id` (String) The scope ID in which the resource is created. Defaults `global` if unset.
|
||||
|
||||
### Read-Only
|
||||
|
||||
- `description` (String) The description of the retrieved auth method.
|
||||
- `id` (String) The ID of the retrieved auth method.
|
||||
- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
|
||||
- `type` (String) The type of the auth method
|
||||
|
||||
<a id="nestedatt--scope"></a>
|
||||
### Nested Schema for `scope`
|
||||
|
||||
Read-Only:
|
||||
|
||||
- `description` (String)
|
||||
- `id` (String)
|
||||
- `name` (String)
|
||||
- `parent_scope_id` (String)
|
||||
- `type` (String)
|
||||
@@ -1,60 +0,0 @@
|
||||
---
|
||||
# generated by https://github.com/hashicorp/terraform-plugin-docs
|
||||
page_title: "boundary_group Data Source - terraform-provider-boundary"
|
||||
subcategory: ""
|
||||
description: |-
|
||||
The boundary_group data source allows you to find a Boundary group.
|
||||
---
|
||||
|
||||
# boundary_group (Data Source)
|
||||
|
||||
The boundary_group data source allows you to find a Boundary group.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```terraform
|
||||
# Retrieve a user from the global scope
|
||||
data "boundary_group" "global_group" {
|
||||
name = "admin"
|
||||
}
|
||||
|
||||
# User from an org scope
|
||||
data "boundary_scope" "org" {
|
||||
name = "org"
|
||||
scope_id = "global"
|
||||
}
|
||||
|
||||
data "boundary_group" "org_group" {
|
||||
name = "username"
|
||||
scope_id = data.boundary_scope.org.id
|
||||
}
|
||||
```
|
||||
|
||||
<!-- schema generated by tfplugindocs -->
|
||||
## Schema
|
||||
|
||||
### Required
|
||||
|
||||
- `name` (String) The name of the group to retrieve.
|
||||
|
||||
### Optional
|
||||
|
||||
- `scope_id` (String) The scope ID in which the resource is created. Defaults `global` if unset.
|
||||
|
||||
### Read-Only
|
||||
|
||||
- `description` (String) The description of the retrieved group.
|
||||
- `id` (String) The ID of the retrieved group.
|
||||
- `member_ids` (Set of String) Resource IDs for group members, these are most likely boundary users.
|
||||
- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
|
||||
|
||||
<a id="nestedatt--scope"></a>
|
||||
### Nested Schema for `scope`
|
||||
|
||||
Read-Only:
|
||||
|
||||
- `description` (String)
|
||||
- `id` (String)
|
||||
- `name` (String)
|
||||
- `parent_scope_id` (String)
|
||||
- `type` (String)
|
||||
@@ -1,39 +0,0 @@
|
||||
---
|
||||
page_title: "boundary_scope Data Source - terraform-provider-boundary"
|
||||
subcategory: ""
|
||||
description: |-
|
||||
The scope data source allows you to discover an existing Boundary scope by name.
|
||||
---
|
||||
|
||||
# boundary_scope (Data Source)
|
||||
|
||||
The scope data source allows you to discover an existing Boundary scope by name.
|
||||
Please note that the Global scope will always have an id of "global", and does not need to be discovered with this data source.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```terraform
|
||||
# Retrieve the ID of a Boundary project
|
||||
data "boundary_scope" "org" {
|
||||
name = "SecOps"
|
||||
scope_id = "global"
|
||||
}
|
||||
|
||||
data "boundary_scope" "project" {
|
||||
name = "2111"
|
||||
scope_id = data.boundary_scope.id
|
||||
}
|
||||
```
|
||||
|
||||
<!-- schema generated by tfplugindocs -->
|
||||
## Schema
|
||||
|
||||
### Required
|
||||
|
||||
- `name` (String) The name of the scope to retrieve.
|
||||
- `scope_id` (String) The parent scope ID that will be queried for the scope.
|
||||
|
||||
### Read-Only
|
||||
|
||||
- `description` (String) The description of the retrieved scope.
|
||||
- `id` (String) The ID of the retrieved scope.
|
||||
@@ -1,63 +0,0 @@
|
||||
---
|
||||
# generated by https://github.com/hashicorp/terraform-plugin-docs
|
||||
page_title: "boundary_user Data Source - terraform-provider-boundary"
|
||||
subcategory: ""
|
||||
description: |-
|
||||
The user data source allows you to find a Boundary user.
|
||||
---
|
||||
|
||||
# boundary_user (Data Source)
|
||||
|
||||
The user data source allows you to find a Boundary user.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```terraform
|
||||
# Retrieve a user from the global scope
|
||||
data "boundary_user" "global_scope_admin" {
|
||||
name = "admin"
|
||||
}
|
||||
|
||||
# User from a org scope
|
||||
data "boundary_user" "org_user" {
|
||||
name = "username"
|
||||
scope_id = data.boundary_scope.org.id
|
||||
}
|
||||
|
||||
data "boundary_scope" "org" {
|
||||
name = "my-org"
|
||||
scope_id = data.boundary_scope.org.id
|
||||
}
|
||||
```
|
||||
|
||||
<!-- schema generated by tfplugindocs -->
|
||||
## Schema
|
||||
|
||||
### Required
|
||||
|
||||
- `name` (String) The username to search for.
|
||||
|
||||
### Optional
|
||||
|
||||
- `scope_id` (String) The scope ID in which the resource is created. Defaults `global` if unset.
|
||||
|
||||
### Read-Only
|
||||
|
||||
- `account_ids` (Set of String) Account ID's to associate with this user resource.
|
||||
- `authorized_actions` (List of String) A list of actions that the worker is entitled to perform.
|
||||
- `description` (String) The user description.
|
||||
- `id` (String) The ID of the user.
|
||||
- `login_name` (String) Login name for user.
|
||||
- `primary_account_id` (String) Primary account ID.
|
||||
- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
|
||||
|
||||
<a id="nestedatt--scope"></a>
|
||||
### Nested Schema for `scope`
|
||||
|
||||
Read-Only:
|
||||
|
||||
- `description` (String)
|
||||
- `id` (String)
|
||||
- `name` (String)
|
||||
- `parent_scope_id` (String)
|
||||
- `type` (String)
|
||||
+3
-19
@@ -20,19 +20,6 @@ provider "boundary" {
|
||||
password_auth_method_login_name = "myuser" # changeme
|
||||
password_auth_method_password = "passpass" # changeme
|
||||
}
|
||||
|
||||
provider "boundary" {
|
||||
addr = "http://127.0.0.1:9200"
|
||||
password_auth_method_login_name = "myuser"
|
||||
password_auth_method_password = "passpass"
|
||||
}
|
||||
|
||||
provider "boundary" {
|
||||
addr = "http://127.0.0.1:9200"
|
||||
password_auth_method_login_name = "myuser"
|
||||
password_auth_method_password = "passpass"
|
||||
scope_id = "s_1234567890"
|
||||
}
|
||||
```
|
||||
|
||||
<!-- schema generated by tfplugindocs -->
|
||||
@@ -44,13 +31,10 @@ provider "boundary" {
|
||||
|
||||
### Optional
|
||||
|
||||
- `auth_method_id` (String) The auth method ID e.g. ampw_1234567890. If not set, the default auth method for the given scope ID will be used.
|
||||
- `auth_method_login_name` (String) The auth method login name for password-style or ldap-style auth methods
|
||||
- `auth_method_password` (String) The auth method password for password-style or ldap-style auth methods
|
||||
- `password_auth_method_login_name` (String, Deprecated) The auth method login name for password-style auth methods
|
||||
- `password_auth_method_password` (String, Deprecated) The auth method password for password-style auth methods
|
||||
- `auth_method_id` (String) The auth method ID e.g. ampw_1234567890
|
||||
- `password_auth_method_login_name` (String) The auth method login name for password-style auth methods
|
||||
- `password_auth_method_password` (String) The auth method password for password-style auth methods
|
||||
- `plugin_execution_dir` (String) Specifies a directory that the Boundary provider can use to write and execute its built-in plugins.
|
||||
- `recovery_kms_hcl` (String) Can be a heredoc string or a path on disk. If set, the string/file will be parsed as HCL and used with the recovery KMS mechanism. While this is set, it will override any other authentication information; the KMS mechanism will always be used. See Boundary's KMS docs for examples: https://boundaryproject.io/docs/configuration/kms
|
||||
- `scope_id` (String) The scope ID for the default auth method.
|
||||
- `tls_insecure` (Boolean) When set to true, does not validate the Boundary API endpoint certificate
|
||||
- `token` (String) The Boundary token to use, as a string or path on disk containing just the string. If set, the token read here will be used in place of authenticating with the auth method specified in "auth_method_id", although the recovery KMS mechanism will still override this. Can also be set with the BOUNDARY_TOKEN environment variable.
|
||||
@@ -30,3 +30,5 @@ Deprecated: use `boundary_account_password` instead.
|
||||
### Read-Only
|
||||
|
||||
- `id` (String) The ID of the account.
|
||||
|
||||
|
||||
@@ -1,76 +0,0 @@
|
||||
---
|
||||
# generated by https://github.com/hashicorp/terraform-plugin-docs
|
||||
page_title: "boundary_account_ldap Resource - terraform-provider-boundary"
|
||||
subcategory: ""
|
||||
description: |-
|
||||
The account resource allows you to configure a Boundary account.
|
||||
---
|
||||
|
||||
# boundary_account_ldap (Resource)
|
||||
|
||||
The account resource allows you to configure a Boundary account.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```terraform
|
||||
resource "boundary_scope" "org" {
|
||||
name = "organization_one"
|
||||
description = "My first scope!"
|
||||
scope_id = "global"
|
||||
auto_create_admin_role = true
|
||||
auto_create_default_role = true
|
||||
}
|
||||
|
||||
resource "boundary_auth_method_ldap" "forumsys_ldap" {
|
||||
name = "forumsys public LDAP"
|
||||
scope_id = "global" # add the new auth method to the global scope
|
||||
urls = ["ldap://ldap.forumsys.com"] # the addr of the LDAP server
|
||||
user_dn = "dc=example,dc=com" # the basedn for users
|
||||
user_attr = "uid" # the user attribute
|
||||
group_dn = "dc=example,dc=com" # the basedn for groups
|
||||
bind_dn = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
|
||||
bind_password = "password" # passwd to use when binding
|
||||
state = "active-public" # make sure the new auth-method is available to everyone
|
||||
enable_groups = true # this turns-on the discovery of a user's groups
|
||||
discover_dn = true # this turns-on the discovery of an authenticating user's dn
|
||||
}
|
||||
|
||||
resource "boundary_account_ldap" "einstein" {
|
||||
auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id
|
||||
login_name = "einstein"
|
||||
name = "einstein"
|
||||
}
|
||||
|
||||
resource "boundary_user" "einstein" {
|
||||
name = "einstein"
|
||||
description = "User resource for einstein"
|
||||
scope_id = "global"
|
||||
account_ids = [boundary_account_ldap.einstein.id]
|
||||
}
|
||||
```
|
||||
|
||||
<!-- schema generated by tfplugindocs -->
|
||||
## Schema
|
||||
|
||||
### Required
|
||||
|
||||
- `auth_method_id` (String) The resource ID for the auth method.
|
||||
|
||||
### Optional
|
||||
|
||||
- `description` (String) The account description.
|
||||
- `login_name` (String) The login name for this account.
|
||||
- `name` (String) The account name. Defaults to the resource name.
|
||||
- `type` (String, Deprecated) The resource type.
|
||||
|
||||
### Read-Only
|
||||
|
||||
- `id` (String) The ID of the account.
|
||||
|
||||
## Import
|
||||
|
||||
Import is supported using the following syntax:
|
||||
|
||||
```shell
|
||||
terraform import boundary_account_ldap.foo <my-id>
|
||||
```
|
||||
@@ -29,3 +29,5 @@ The account resource allows you to configure a Boundary account.
|
||||
### Read-Only
|
||||
|
||||
- `id` (String) The ID of the account.
|
||||
|
||||
|
||||
@@ -28,6 +28,7 @@ resource "boundary_auth_method" "password" {
|
||||
|
||||
resource "boundary_account_password" "jeff" {
|
||||
auth_method_id = boundary_auth_method.password.id
|
||||
type = "password"
|
||||
login_name = "jeff"
|
||||
password = "$uper$ecure"
|
||||
}
|
||||
@@ -39,6 +40,7 @@ resource "boundary_account_password" "jeff" {
|
||||
### Required
|
||||
|
||||
- `auth_method_id` (String) The resource ID for the auth method.
|
||||
- `type` (String) The resource type.
|
||||
|
||||
### Optional
|
||||
|
||||
@@ -46,7 +48,6 @@ resource "boundary_account_password" "jeff" {
|
||||
- `login_name` (String) The login name for this account.
|
||||
- `name` (String) The account name. Defaults to the resource name.
|
||||
- `password` (String, Sensitive) The account password. Only set on create, changes will not be reflected when updating account.
|
||||
- `type` (String, Deprecated) The resource type.
|
||||
|
||||
### Read-Only
|
||||
|
||||
|
||||
@@ -1,88 +0,0 @@
|
||||
---
|
||||
# generated by https://github.com/hashicorp/terraform-plugin-docs
|
||||
page_title: "boundary_auth_method_ldap Resource - terraform-provider-boundary"
|
||||
subcategory: ""
|
||||
description: |-
|
||||
The LDAP auth method resource allows you to configure a Boundary authmethodldap.
|
||||
---
|
||||
|
||||
# boundary_auth_method_ldap (Resource)
|
||||
|
||||
The LDAP auth method resource allows you to configure a Boundary auth_method_ldap.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```terraform
|
||||
resource "boundary_scope" "org" {
|
||||
name = "organization_one"
|
||||
description = "My first scope!"
|
||||
scope_id = "global"
|
||||
auto_create_admin_role = true
|
||||
auto_create_default_role = true
|
||||
}
|
||||
|
||||
resource "boundary_auth_method_ldap" "forumsys_ldap" {
|
||||
name = "forumsys public LDAP"
|
||||
scope_id = "global" # add the new auth method to the global scope
|
||||
urls = ["ldap://ldap.forumsys.com"] # the addr of the LDAP server
|
||||
user_dn = "dc=example,dc=com" # the basedn for users
|
||||
user_attr = "uid" # the user attribute
|
||||
group_dn = "dc=example,dc=com" # the basedn for groups
|
||||
bind_dn = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
|
||||
bind_password = "password" # passwd to use when binding
|
||||
state = "active-public" # make sure the new auth-method is available to everyone
|
||||
enable_groups = true # this turns-on the discovery of a user's groups
|
||||
discover_dn = true # this turns-on the discovery of an authenticating user's dn
|
||||
}
|
||||
```
|
||||
|
||||
<!-- schema generated by tfplugindocs -->
|
||||
## Schema
|
||||
|
||||
### Required
|
||||
|
||||
- `scope_id` (String) The scope ID.
|
||||
|
||||
### Optional
|
||||
|
||||
- `account_attribute_maps` (List of String) Account attribute maps fullname and email.
|
||||
- `anon_group_search` (Boolean) Use anon bind when performing LDAP group searches (optional).
|
||||
- `bind_dn` (String) The distinguished name of entry to bind when performing user and group searches (optional).
|
||||
- `bind_password` (String) The password to use along with bind-dn performing user and group searches (optional).
|
||||
- `bind_password_hmac` (String) The HMAC of the bind password returned by the Boundary controller, which is used for comparison after initial setting of the value.
|
||||
- `certificates` (List of String) PEM-encoded X.509 CA certificate in ASN.1 DER form that can be used as a trust anchor when connecting to an LDAP server(optional). This may be specified multiple times
|
||||
- `client_certificate` (String) PEM-encoded X.509 client certificate in ASN.1 DER form that can be used to authenticate against an LDAP server(optional).
|
||||
- `client_certificate_key` (String) PEM-encoded X.509 client certificate key in PKCS #8, ASN.1 DER form used with the client certificate (optional).
|
||||
- `client_certificate_key_hmac` (String) The HMAC of the client certificate key returned by the Boundary controller, which is used for comparison after initial setting of the value.
|
||||
- `dereference_aliases` (String) Control how aliases are dereferenced when performing the search. Can be one of: NeverDerefAliases, DerefInSearching, DerefFindingBaseObj, and DerefAlways (optional).
|
||||
- `description` (String) The auth method description.
|
||||
- `discover_dn` (Boolean) Use anon bind to discover the bind DN of a user (optional).
|
||||
- `enable_groups` (Boolean) Find the authenticated user's groups during authentication (optional).
|
||||
- `group_attr` (String) The attribute that enumerates a user's group membership from entries returned by a group search (optional).
|
||||
- `group_dn` (String) The base DN under which to perform group search.
|
||||
- `group_filter` (String) A go template used to construct a LDAP group search filter (optional).
|
||||
- `insecure_tls` (Boolean) Skip the LDAP server SSL certificate validation (optional) - insecure and use with caution.
|
||||
- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an LDAP account.
|
||||
- `maximum_page_size` (Number) MaximumPageSize specifies a maximum search result size to use when retrieving the authenticated user's groups (optional).
|
||||
- `name` (String) The auth method name. Defaults to the resource name.
|
||||
- `start_tls` (Boolean) Issue StartTLS command after connecting (optional).
|
||||
- `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Defaults to active-public.
|
||||
- `type` (String) The type of auth method; hardcoded.
|
||||
- `upn_domain` (String) The userPrincipalDomain used to construct the UPN string for the authenticating user (optional).
|
||||
- `urls` (List of String) The LDAP URLs that specify LDAP servers to connect to (required). May be specified multiple times.
|
||||
- `use_token_groups` (Boolean) Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships (optional).
|
||||
- `user_attr` (String) The attribute on user entry matching the username passed when authenticating (optional).
|
||||
- `user_dn` (String) The base DN under which to perform user search (optional).
|
||||
- `user_filter` (String) A go template used to construct a LDAP user search filter (optional).
|
||||
|
||||
### Read-Only
|
||||
|
||||
- `id` (String) The ID of the auth method.
|
||||
|
||||
## Import
|
||||
|
||||
Import is supported using the following syntax:
|
||||
|
||||
```shell
|
||||
terraform import boundary_auth_method_ldap.foo <my-id>
|
||||
```
|
||||
@@ -10,52 +10,7 @@ description: |-
|
||||
|
||||
The OIDC auth method resource allows you to configure a Boundary auth_method_oidc.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```terraform
|
||||
resource "boundary_scope" "org" {
|
||||
name = "organization_one"
|
||||
description = "My first scope!"
|
||||
scope_id = "global"
|
||||
auto_create_admin_role = true
|
||||
auto_create_default_role = true
|
||||
}
|
||||
|
||||
resource "boundary_auth_method_oidc" "vault" {
|
||||
api_url_prefix = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
|
||||
client_id = "eieio"
|
||||
client_secret = "hvo_secret_XO"
|
||||
description = "My Boundary OIDC Auth Method for Vault"
|
||||
issuer = "https://XO-XO-XO-XO-XOXOXO.vault.hashicorp.cloud:8200/v1/identity/oidc/provider/my-provider"
|
||||
scope_id = "global"
|
||||
signing_algorithms = ["RS256"]
|
||||
type = "oidc"
|
||||
}
|
||||
|
||||
resource "boundary_auth_method_oidc" "oidc_with_one_prompt" {
|
||||
api_url_prefix = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
|
||||
client_id = "eieio"
|
||||
client_secret = "hvo_secret_XO"
|
||||
description = "My Boundary OIDC Auth Method With Prompt"
|
||||
issuer = "https://sts.windows.net/TENANT_ID/"
|
||||
scope_id = "global"
|
||||
signing_algorithms = ["RS256"]
|
||||
prompts = ["select_account"]
|
||||
type = "oidc"
|
||||
}
|
||||
|
||||
resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
|
||||
api_url_prefix = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
|
||||
client_id = "eieio"
|
||||
client_secret = "hvo_secret_XO"
|
||||
description = "My Boundary OIDC Auth Method With Multiple Prompts"
|
||||
issuer = "https://sts.windows.net/TENANT_ID/"
|
||||
scope_id = "global"
|
||||
signing_algorithms = ["RS256"]
|
||||
prompts = ["consent", "select_account"]
|
||||
type = "oidc"
|
||||
}
|
||||
```
|
||||
|
||||
<!-- schema generated by tfplugindocs -->
|
||||
## Schema
|
||||
@@ -81,7 +36,6 @@ resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
|
||||
- `issuer` (String) The issuer corresponding to the provider, which must match the issuer field in generated tokens.
|
||||
- `max_age` (Number) The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again. A value of 0 sets an immediate requirement for all users to reauthenticate, and an unset maxAge results in a Terraform value of -1 and the default TTL of the chosen OIDC will be used.
|
||||
- `name` (String) The auth method name. Defaults to the resource name.
|
||||
- `prompts` (List of String) The prompts passed to the identity provider to determine whether to prompt the end-user for reauthentication, account selection or consent. Please note the values passed are case-sensitive. The valid values are: `none`, `login`, `consent` and `select_account`.
|
||||
- `signing_algorithms` (List of String) Allowed signing algorithms for the provider's issued tokens.
|
||||
- `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Currently automatically set to active-public.
|
||||
- `type` (String) The type of auth method; hardcoded.
|
||||
@@ -90,10 +44,4 @@ resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
|
||||
|
||||
- `id` (String) The ID of the auth method.
|
||||
|
||||
## Import
|
||||
|
||||
Import is supported using the following syntax:
|
||||
|
||||
```shell
|
||||
terraform import boundary_auth_method_oidc.foo <my-id>
|
||||
```
|
||||
@@ -30,3 +30,5 @@ The auth method resource allows you to configure a Boundary auth_method_password
|
||||
### Read-Only
|
||||
|
||||
- `id` (String) The ID of the account.
|
||||
|
||||
|
||||
@@ -96,7 +96,7 @@ resource "boundary_credential_library_vault" "quz" {
|
||||
### Optional
|
||||
|
||||
- `credential_mapping_overrides` (Map of String) The credential mapping override.
|
||||
- `credential_type` (String) The type of credential the library generates. Cannot be updated on an existing resource.
|
||||
- `credential_type` (String) The type of credential the library generates.
|
||||
- `description` (String) The Vault credential library description.
|
||||
- `http_method` (String) The HTTP method the library uses when requesting credentials from Vault. Defaults to 'GET'
|
||||
- `http_request_body` (String) The body of the HTTP request the library sends to Vault when requesting credentials. Only valid if `http_method` is set to `POST`.
|
||||
|
||||
@@ -89,7 +89,6 @@ resource "boundary_credential_library_vault_ssh_certificate" "baz" {
|
||||
|
||||
### Optional
|
||||
|
||||
- `additional_valid_principals` (List of String) Principals to be signed as "valid_principles" in addition to username.
|
||||
- `critical_options` (Map of String) Specifies a map of the critical options that the certificate should be signed for.
|
||||
- `description` (String) The Vault credential library description.
|
||||
- `extensions` (Map of String) Specifies a map of the extensions that the certificate should be signed for.
|
||||
|
||||
@@ -56,7 +56,6 @@ resource "boundary_credential_store_vault" "example" {
|
||||
- `namespace` (String) The namespace within Vault to use.
|
||||
- `tls_server_name` (String) Name to use as the SNI host when connecting to Vault via TLS.
|
||||
- `tls_skip_verify` (Boolean) Whether or not to skip TLS verification.
|
||||
- `worker_filter` (String) HCP Only. A filter used to control which PKI workers can handle Vault requests. This allows the use of private Vault instances with Boundary.
|
||||
|
||||
### Read-Only
|
||||
|
||||
|
||||
@@ -67,7 +67,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
|
||||
"client_id" = "ARM_CLIENT_ID"
|
||||
})
|
||||
|
||||
# recommended to pass in azure secrets using a file() or using environment variables
|
||||
# recommended to pass in aws secrets using a file() or using environment variables
|
||||
# the secrets below must be generated in azure by creating an ad application
|
||||
secrets_json = jsonencode({
|
||||
"secret_value" = "ARM_CLIENT_SECRET"
|
||||
|
||||
@@ -39,6 +39,7 @@ resource "boundary_host" "first" {
|
||||
description = "My first host!"
|
||||
address = "10.0.0.1"
|
||||
host_catalog_id = boundary_host_catalog.static.id
|
||||
scope_id = boundary_scope.project.id
|
||||
}
|
||||
|
||||
resource "boundary_host" "second" {
|
||||
@@ -47,6 +48,7 @@ resource "boundary_host" "second" {
|
||||
description = "My second host!"
|
||||
address = "10.0.0.2"
|
||||
host_catalog_id = boundary_host_catalog.static.id
|
||||
scope_id = boundary_scope.project.id
|
||||
}
|
||||
|
||||
resource "boundary_host_set" "web" {
|
||||
|
||||
@@ -51,7 +51,7 @@ resource "boundary_host_catalog_plugin" "aws_example" {
|
||||
resource "boundary_host_set_plugin" "web" {
|
||||
name = "My web host set plugin"
|
||||
host_catalog_id = boundary_host_catalog_plugin.aws_example.id
|
||||
attributes_json = jsonencode({ "filters" = ["tag:service-type=web"] })
|
||||
attributes_json = jsonencode({ "filters" = "tag:service-type=web" })
|
||||
}
|
||||
|
||||
resource "boundary_host_set_plugin" "foobar" {
|
||||
@@ -59,7 +59,8 @@ resource "boundary_host_set_plugin" "foobar" {
|
||||
host_catalog_id = boundary_host_catalog_plugin.aws_example.id
|
||||
preferred_endpoints = ["cidr:54.0.0.0/8"]
|
||||
attributes_json = jsonencode({
|
||||
"filters" = ["tag-key=foo", "tag-key=bar"]
|
||||
"filters" = "tag-key=foo",
|
||||
"filters" = "tag-key=bar"
|
||||
})
|
||||
}
|
||||
|
||||
@@ -68,7 +69,8 @@ resource "boundary_host_set_plugin" "launch" {
|
||||
host_catalog_id = boundary_host_catalog_plugin.aws_example.id
|
||||
sync_interval_seconds = 60
|
||||
attributes_json = jsonencode({
|
||||
"filters" = ["tag:development=prod,dev", "launch-time=2022-01-04T*"]
|
||||
"filters" = "tag:development=prod,dev",
|
||||
"filters" = "launch-time=2022-01-04T*"
|
||||
})
|
||||
}
|
||||
|
||||
@@ -91,7 +93,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
|
||||
"client_id" = "ARM_CLIENT_ID"
|
||||
})
|
||||
|
||||
# recommended to pass in azure secrets using a file() or using environment variables
|
||||
# recommended to pass in aws secrets using a file() or using environment variables
|
||||
# the secrets below must be generated in azure by creating an ad application
|
||||
secrets_json = jsonencode({
|
||||
"secret_value" = "ARM_CLIENT_SECRET"
|
||||
|
||||
@@ -28,3 +28,5 @@ The managed group resource allows you to configure a Boundary group.
|
||||
### Read-Only
|
||||
|
||||
- `id` (String) The ID of the group.
|
||||
|
||||
|
||||
@@ -1,69 +0,0 @@
|
||||
---
|
||||
# generated by https://github.com/hashicorp/terraform-plugin-docs
|
||||
page_title: "boundary_managed_group_ldap Resource - terraform-provider-boundary"
|
||||
subcategory: ""
|
||||
description: |-
|
||||
The managed group resource allows you to configure a Boundary group.
|
||||
---
|
||||
|
||||
# boundary_managed_group_ldap (Resource)
|
||||
|
||||
The managed group resource allows you to configure a Boundary group.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```terraform
|
||||
resource "boundary_scope" "org" {
|
||||
name = "organization_one"
|
||||
description = "My first scope!"
|
||||
scope_id = "global"
|
||||
auto_create_admin_role = true
|
||||
auto_create_default_role = true
|
||||
}
|
||||
|
||||
resource "boundary_auth_method_ldap" "forumsys_ldap" {
|
||||
name = "forumsys public LDAP"
|
||||
scope_id = "global" # add the new auth method to the global scope
|
||||
urls = ["ldap://ldap.forumsys.com"] # the addr of the LDAP server
|
||||
user_dn = "dc=example,dc=com" # the basedn for users
|
||||
user_attr = "uid" # the user attribute
|
||||
group_dn = "dc=example,dc=com" # the basedn for groups
|
||||
bind_dn = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
|
||||
bind_password = "password" # passwd to use when binding
|
||||
state = "active-public" # make sure the new auth-method is available to everyone
|
||||
enable_groups = true # this turns-on the discovery of a user's groups
|
||||
discover_dn = true # this turns-on the discovery of an authenticating user's dn
|
||||
}
|
||||
|
||||
resource "boundary_managed_group_ldap" "forumsys_scientists" {
|
||||
name = "scientists"
|
||||
description = "forumsys scientists managed group"
|
||||
auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id
|
||||
group_names = ["Scientists"]
|
||||
}
|
||||
```
|
||||
|
||||
<!-- schema generated by tfplugindocs -->
|
||||
## Schema
|
||||
|
||||
### Required
|
||||
|
||||
- `auth_method_id` (String) The resource ID for the auth method.
|
||||
- `group_names` (List of String) The list of groups that make up the managed group.
|
||||
|
||||
### Optional
|
||||
|
||||
- `description` (String) The managed group description.
|
||||
- `name` (String) The managed group name. Defaults to the resource name.
|
||||
|
||||
### Read-Only
|
||||
|
||||
- `id` (String) The ID of the group.
|
||||
|
||||
## Import
|
||||
|
||||
Import is supported using the following syntax:
|
||||
|
||||
```shell
|
||||
terraform import boundary_managed_group_ldap.foo <my-id>
|
||||
```
|
||||
@@ -79,7 +79,7 @@ resource "boundary_role" "readonly" {
|
||||
name = "readonly"
|
||||
description = "A readonly role"
|
||||
principal_ids = [boundary_user.readonly.id]
|
||||
grant_strings = ["ids=*;type=*;actions=read"]
|
||||
grant_strings = ["id=*;type=*;actions=read"]
|
||||
scope_id = boundary_scope.org.id
|
||||
}
|
||||
```
|
||||
@@ -112,7 +112,7 @@ resource "boundary_role" "readonly" {
|
||||
name = "readonly"
|
||||
description = "A readonly role"
|
||||
principal_ids = [boundary_user.readonly.id]
|
||||
grant_strings = ["ids=*;type=*;actions=read"]
|
||||
grant_strings = ["id=*;type=*;actions=read"]
|
||||
scope_id = boundary_scope.project.id
|
||||
}
|
||||
```
|
||||
|
||||
@@ -55,7 +55,7 @@ resource "boundary_scope" "org" {
|
||||
resource "boundary_role" "org_admin" {
|
||||
scope_id = boundary_scope.global.id
|
||||
grant_scope_id = boundary_scope.org.id
|
||||
grant_strings = ["ids=*;type=*;actions=*"]
|
||||
grant_strings = ["id=*;type=*;actions=*"]
|
||||
principal_ids = ["u_auth"]
|
||||
}
|
||||
```
|
||||
|
||||
@@ -1,91 +0,0 @@
|
||||
---
|
||||
# generated by https://github.com/hashicorp/terraform-plugin-docs
|
||||
page_title: "boundary_storage_bucket Resource - terraform-provider-boundary"
|
||||
subcategory: ""
|
||||
description: |-
|
||||
The storage bucket resource allows you to configure a Boundary storage bucket. A storage bucket can only belong to the Global scope or an Org scope. At this time, the only supported storage for storage buckets is AWS S3. This feature requires Boundary Enterprise or Boundary HCP.
|
||||
---
|
||||
|
||||
# boundary_storage_bucket (Resource)
|
||||
|
||||
The storage bucket resource allows you to configure a Boundary storage bucket. A storage bucket can only belong to the Global scope or an Org scope. At this time, the only supported storage for storage buckets is AWS S3. This feature requires Boundary Enterprise or Boundary HCP.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```terraform
|
||||
resource "boundary_scope" "org" {
|
||||
name = "organization_one"
|
||||
description = "My first scope!"
|
||||
scope_id = boundary_scope.global.id
|
||||
auto_create_admin_role = true
|
||||
auto_create_default_role = true
|
||||
}
|
||||
|
||||
resource "boundary_storage_bucket" "aws_static_credentials_example" {
|
||||
name = "My aws storage bucket with static credentials"
|
||||
description = "My first storage bucket!"
|
||||
scope_id = boundary_scope.org.id
|
||||
plugin_name = "aws"
|
||||
bucket_name = "mybucket"
|
||||
attributes_json = jsonencode({ "region" = "us-east-1" })
|
||||
|
||||
# recommended to pass in aws secrets using a file() or using environment variables
|
||||
# the secrets below must be generated in aws by creating a aws iam user with programmatic access
|
||||
secrets_json = jsonencode({
|
||||
"access_key_id" = "aws_access_key_id_value",
|
||||
"secret_access_key" = "aws_secret_access_key_value"
|
||||
})
|
||||
worker_filter = "\"pki\" in \"/tags/type\""
|
||||
}
|
||||
|
||||
resource "boundary_storage_bucket" "aws_dynamic_credentials_example" {
|
||||
name = "My aws storage bucket with dynamic credentials"
|
||||
description = "My first storage bucket!"
|
||||
scope_id = boundary_scope.org.id
|
||||
plugin_name = "aws"
|
||||
bucket_name = "mybucket"
|
||||
|
||||
# the role_arn value should be the same arn used as the instance profile that is attached to the ec2 instance
|
||||
# https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html
|
||||
attributes_json = jsonencode({
|
||||
"region" = "us-east-1"
|
||||
"role_arn" = "arn:aws:iam::123456789012:role/S3Access"
|
||||
})
|
||||
worker_filter = "\"pki\" in \"/tags/type\""
|
||||
}
|
||||
```
|
||||
|
||||
<!-- schema generated by tfplugindocs -->
|
||||
## Schema
|
||||
|
||||
### Required
|
||||
|
||||
- `bucket_name` (String) The name of the bucket within the external object store service.
|
||||
- `scope_id` (String) The scope for this storage bucket.
|
||||
- `worker_filter` (String) Filters to the worker(s) that can handle requests for this storage bucket. The filter must match an existing worker in order to create a storage bucket.
|
||||
|
||||
### Optional
|
||||
|
||||
- `attributes_json` (String) The attributes for the storage bucket. The "region" attribute field is required when creating an AWS storage bucket. Values are either encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" or remove the block to clear all attributes in the storage bucket.
|
||||
- `bucket_prefix` (String) The prefix used to organize the data held within the external object store.
|
||||
- `description` (String) The storage bucket description.
|
||||
- `name` (String) The storage bucket name. Defaults to the resource name.
|
||||
- `plugin_id` (String) The ID of the plugin that should back the resource. This or plugin_name must be defined.
|
||||
- `plugin_name` (String) The name of the plugin that should back the resource. This or plugin_id must be defined.
|
||||
- `secrets_json` (String, Sensitive) The secrets for the storage bucket. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing this block will NOT clear secrets from the storage bucket; this allows injecting secrets for one call, then removing them for storage.
|
||||
|
||||
### Read-Only
|
||||
|
||||
- `id` (String) The ID of the storage bucket.
|
||||
- `internal_force_update` (String) Internal only. Used to force update so that we can always check the value of secrets.
|
||||
- `internal_hmac_used_for_secrets_config_hmac` (String) Internal only. The Boundary-provided HMAC used to calculate the current value of the HMAC'd config. Used for drift detection.
|
||||
- `internal_secrets_config_hmac` (String) Internal only. HMAC of (serverSecretsHmac + config secrets). Used for proper secrets handling.
|
||||
- `secrets_hmac` (String) The HMAC'd secrets value returned from the server.
|
||||
|
||||
## Import
|
||||
|
||||
Import is supported using the following syntax:
|
||||
|
||||
```shell
|
||||
terraform import boundary_storage_bucket.foo <my-id>
|
||||
```
|
||||
@@ -82,20 +82,6 @@ resource "boundary_host_set" "foo" {
|
||||
]
|
||||
}
|
||||
|
||||
resource "boundary_storage_bucket" "aws_example" {
|
||||
name = "My aws storage bucket"
|
||||
description = "My first storage bucket!"
|
||||
scope_id = boundary_scope.org.id
|
||||
plugin_name = "aws"
|
||||
bucket_name = "mybucket"
|
||||
attributes_json = jsonencode({ "region" = "us-east-1" })
|
||||
secrets_json = jsonencode({
|
||||
"access_key_id" = "aws_access_key_id_value",
|
||||
"secret_access_key" = "aws_secret_access_key_value"
|
||||
})
|
||||
worker_filter = "\"pki\" in \"/tags/type\""
|
||||
}
|
||||
|
||||
resource "boundary_target" "foo" {
|
||||
name = "foo"
|
||||
description = "Foo target"
|
||||
@@ -124,22 +110,6 @@ resource "boundary_target" "ssh_foo" {
|
||||
]
|
||||
}
|
||||
|
||||
resource "boundary_target" "ssh_session_recording_foo" {
|
||||
name = "ssh_foo"
|
||||
description = "Ssh target"
|
||||
type = "ssh"
|
||||
default_port = "22"
|
||||
scope_id = boundary_scope.project.id
|
||||
host_source_ids = [
|
||||
boundary_host_set.foo.id
|
||||
]
|
||||
injected_application_credential_source_ids = [
|
||||
boundary_credential_library_vault.foo.id
|
||||
]
|
||||
enable_session_recording = true
|
||||
storage_bucket_id = boundary_storage_bucket.aws_example
|
||||
}
|
||||
|
||||
resource "boundary_target" "address_foo" {
|
||||
name = "address_foo"
|
||||
description = "Foo target with an address"
|
||||
@@ -162,18 +132,15 @@ resource "boundary_target" "address_foo" {
|
||||
|
||||
- `address` (String) Optionally, a valid network address to connect to for this target. Cannot be used alongside host_source_ids.
|
||||
- `brokered_credential_source_ids` (Set of String) A list of brokered credential source ID's.
|
||||
- `default_client_port` (Number) The default client port for this target.
|
||||
- `default_port` (Number) The default port for this target.
|
||||
- `description` (String) The target description.
|
||||
- `egress_worker_filter` (String) Boolean expression to filter the workers used to access this target
|
||||
- `enable_session_recording` (Boolean) HCP/Ent Only. Enable sessions recording for this target. Only applicable for SSH targets.
|
||||
- `host_source_ids` (Set of String) A list of host source ID's. Cannot be used alongside address.
|
||||
- `ingress_worker_filter` (String) HCP Only. Boolean expression to filter the workers a user will connect to when initiating a session against this target
|
||||
- `injected_application_credential_source_ids` (Set of String) A list of injected application credential source ID's.
|
||||
- `name` (String) The target name. Defaults to the resource name.
|
||||
- `session_connection_limit` (Number)
|
||||
- `session_max_seconds` (Number)
|
||||
- `storage_bucket_id` (String) HCP/Ent Only. Storage bucket for this target. Only applicable for SSH targets.
|
||||
- `worker_filter` (String, Deprecated) Boolean expression to filter the workers for this target
|
||||
|
||||
### Read-Only
|
||||
|
||||
@@ -10,22 +10,7 @@ description: |-
|
||||
|
||||
The resource allows you to create a self-managed worker object.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```terraform
|
||||
resource "boundary_worker" "controller_led" {
|
||||
scope_id = "global"
|
||||
name = "worker 1"
|
||||
description = "self managed worker with controller led auth"
|
||||
}
|
||||
|
||||
resource "boundary_worker" "worker_led" {
|
||||
scope_id = "global"
|
||||
name = "worker 2"
|
||||
description = "self managed worker with worker led auth"
|
||||
worker_generated_auth_token = var.worker_generated_auth_token
|
||||
}
|
||||
```
|
||||
|
||||
<!-- schema generated by tfplugindocs -->
|
||||
## Schema
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
# Retrieve the ID of a Boundary account
|
||||
data "boundary_account" "admin" {
|
||||
name = "admin"
|
||||
auth_method_id = "ampw_1234567890"
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
# Retrieve an auth method from the global scope
|
||||
data "boundary_auth_method" "auth_method" {
|
||||
name = "password_auth_method"
|
||||
}
|
||||
|
||||
# Auth method from a org scope
|
||||
data "boundary_scope" "org" {
|
||||
name = "my-org"
|
||||
scope_id = "global"
|
||||
}
|
||||
|
||||
data "boundary_auth_method" "auth_method" {
|
||||
name = "password_auth_method"
|
||||
scope_id = data.boundary_scope.org.id
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
# Retrieve a user from the global scope
|
||||
data "boundary_group" "global_group" {
|
||||
name = "admin"
|
||||
}
|
||||
|
||||
# User from an org scope
|
||||
data "boundary_scope" "org" {
|
||||
name = "org"
|
||||
scope_id = "global"
|
||||
}
|
||||
|
||||
data "boundary_group" "org_group" {
|
||||
name = "username"
|
||||
scope_id = data.boundary_scope.org.id
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
# Retrieve the ID of a Boundary project
|
||||
data "boundary_scope" "org" {
|
||||
name = "SecOps"
|
||||
scope_id = "global"
|
||||
}
|
||||
|
||||
data "boundary_scope" "project" {
|
||||
name = "2111"
|
||||
scope_id = data.boundary_scope.id
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
# Retrieve a user from the global scope
|
||||
data "boundary_user" "global_scope_admin" {
|
||||
name = "admin"
|
||||
}
|
||||
|
||||
# User from a org scope
|
||||
data "boundary_user" "org_user" {
|
||||
name = "username"
|
||||
scope_id = data.boundary_scope.org.id
|
||||
}
|
||||
|
||||
data "boundary_scope" "org" {
|
||||
name = "my-org"
|
||||
scope_id = data.boundary_scope.org.id
|
||||
}
|
||||
@@ -4,16 +4,3 @@ provider "boundary" {
|
||||
password_auth_method_login_name = "myuser" # changeme
|
||||
password_auth_method_password = "passpass" # changeme
|
||||
}
|
||||
|
||||
provider "boundary" {
|
||||
addr = "http://127.0.0.1:9200"
|
||||
password_auth_method_login_name = "myuser"
|
||||
password_auth_method_password = "passpass"
|
||||
}
|
||||
|
||||
provider "boundary" {
|
||||
addr = "http://127.0.0.1:9200"
|
||||
password_auth_method_login_name = "myuser"
|
||||
password_auth_method_password = "passpass"
|
||||
scope_id = "s_1234567890"
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
terraform import boundary_account_ldap.foo <my-id>
|
||||
@@ -1,34 +0,0 @@
|
||||
resource "boundary_scope" "org" {
|
||||
name = "organization_one"
|
||||
description = "My first scope!"
|
||||
scope_id = "global"
|
||||
auto_create_admin_role = true
|
||||
auto_create_default_role = true
|
||||
}
|
||||
|
||||
resource "boundary_auth_method_ldap" "forumsys_ldap" {
|
||||
name = "forumsys public LDAP"
|
||||
scope_id = "global" # add the new auth method to the global scope
|
||||
urls = ["ldap://ldap.forumsys.com"] # the addr of the LDAP server
|
||||
user_dn = "dc=example,dc=com" # the basedn for users
|
||||
user_attr = "uid" # the user attribute
|
||||
group_dn = "dc=example,dc=com" # the basedn for groups
|
||||
bind_dn = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
|
||||
bind_password = "password" # passwd to use when binding
|
||||
state = "active-public" # make sure the new auth-method is available to everyone
|
||||
enable_groups = true # this turns-on the discovery of a user's groups
|
||||
discover_dn = true # this turns-on the discovery of an authenticating user's dn
|
||||
}
|
||||
|
||||
resource "boundary_account_ldap" "einstein" {
|
||||
auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id
|
||||
login_name = "einstein"
|
||||
name = "einstein"
|
||||
}
|
||||
|
||||
resource "boundary_user" "einstein" {
|
||||
name = "einstein"
|
||||
description = "User resource for einstein"
|
||||
scope_id = "global"
|
||||
account_ids = [boundary_account_ldap.einstein.id]
|
||||
}
|
||||
@@ -13,6 +13,7 @@ resource "boundary_auth_method" "password" {
|
||||
|
||||
resource "boundary_account_password" "jeff" {
|
||||
auth_method_id = boundary_auth_method.password.id
|
||||
type = "password"
|
||||
login_name = "jeff"
|
||||
password = "$uper$ecure"
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
terraform import boundary_auth_method_ldap.foo <my-id>
|
||||
@@ -1,21 +0,0 @@
|
||||
resource "boundary_scope" "org" {
|
||||
name = "organization_one"
|
||||
description = "My first scope!"
|
||||
scope_id = "global"
|
||||
auto_create_admin_role = true
|
||||
auto_create_default_role = true
|
||||
}
|
||||
|
||||
resource "boundary_auth_method_ldap" "forumsys_ldap" {
|
||||
name = "forumsys public LDAP"
|
||||
scope_id = "global" # add the new auth method to the global scope
|
||||
urls = ["ldap://ldap.forumsys.com"] # the addr of the LDAP server
|
||||
user_dn = "dc=example,dc=com" # the basedn for users
|
||||
user_attr = "uid" # the user attribute
|
||||
group_dn = "dc=example,dc=com" # the basedn for groups
|
||||
bind_dn = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
|
||||
bind_password = "password" # passwd to use when binding
|
||||
state = "active-public" # make sure the new auth-method is available to everyone
|
||||
enable_groups = true # this turns-on the discovery of a user's groups
|
||||
discover_dn = true # this turns-on the discovery of an authenticating user's dn
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
terraform import boundary_auth_method_oidc.foo <my-id>
|
||||
@@ -1,42 +0,0 @@
|
||||
resource "boundary_scope" "org" {
|
||||
name = "organization_one"
|
||||
description = "My first scope!"
|
||||
scope_id = "global"
|
||||
auto_create_admin_role = true
|
||||
auto_create_default_role = true
|
||||
}
|
||||
|
||||
resource "boundary_auth_method_oidc" "vault" {
|
||||
api_url_prefix = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
|
||||
client_id = "eieio"
|
||||
client_secret = "hvo_secret_XO"
|
||||
description = "My Boundary OIDC Auth Method for Vault"
|
||||
issuer = "https://XO-XO-XO-XO-XOXOXO.vault.hashicorp.cloud:8200/v1/identity/oidc/provider/my-provider"
|
||||
scope_id = "global"
|
||||
signing_algorithms = ["RS256"]
|
||||
type = "oidc"
|
||||
}
|
||||
|
||||
resource "boundary_auth_method_oidc" "oidc_with_one_prompt" {
|
||||
api_url_prefix = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
|
||||
client_id = "eieio"
|
||||
client_secret = "hvo_secret_XO"
|
||||
description = "My Boundary OIDC Auth Method With Prompt"
|
||||
issuer = "https://sts.windows.net/TENANT_ID/"
|
||||
scope_id = "global"
|
||||
signing_algorithms = ["RS256"]
|
||||
prompts = ["select_account"]
|
||||
type = "oidc"
|
||||
}
|
||||
|
||||
resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
|
||||
api_url_prefix = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
|
||||
client_id = "eieio"
|
||||
client_secret = "hvo_secret_XO"
|
||||
description = "My Boundary OIDC Auth Method With Multiple Prompts"
|
||||
issuer = "https://sts.windows.net/TENANT_ID/"
|
||||
scope_id = "global"
|
||||
signing_algorithms = ["RS256"]
|
||||
prompts = ["consent", "select_account"]
|
||||
type = "oidc"
|
||||
}
|
||||
@@ -52,7 +52,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
|
||||
"client_id" = "ARM_CLIENT_ID"
|
||||
})
|
||||
|
||||
# recommended to pass in azure secrets using a file() or using environment variables
|
||||
# recommended to pass in aws secrets using a file() or using environment variables
|
||||
# the secrets below must be generated in azure by creating an ad application
|
||||
secrets_json = jsonencode({
|
||||
"secret_value" = "ARM_CLIENT_SECRET"
|
||||
|
||||
@@ -24,6 +24,7 @@ resource "boundary_host" "first" {
|
||||
description = "My first host!"
|
||||
address = "10.0.0.1"
|
||||
host_catalog_id = boundary_host_catalog.static.id
|
||||
scope_id = boundary_scope.project.id
|
||||
}
|
||||
|
||||
resource "boundary_host" "second" {
|
||||
@@ -32,6 +33,7 @@ resource "boundary_host" "second" {
|
||||
description = "My second host!"
|
||||
address = "10.0.0.2"
|
||||
host_catalog_id = boundary_host_catalog.static.id
|
||||
scope_id = boundary_scope.project.id
|
||||
}
|
||||
|
||||
resource "boundary_host_set" "web" {
|
||||
|
||||
@@ -36,7 +36,7 @@ resource "boundary_host_catalog_plugin" "aws_example" {
|
||||
resource "boundary_host_set_plugin" "web" {
|
||||
name = "My web host set plugin"
|
||||
host_catalog_id = boundary_host_catalog_plugin.aws_example.id
|
||||
attributes_json = jsonencode({ "filters" = ["tag:service-type=web"] })
|
||||
attributes_json = jsonencode({ "filters" = "tag:service-type=web" })
|
||||
}
|
||||
|
||||
resource "boundary_host_set_plugin" "foobar" {
|
||||
@@ -44,7 +44,8 @@ resource "boundary_host_set_plugin" "foobar" {
|
||||
host_catalog_id = boundary_host_catalog_plugin.aws_example.id
|
||||
preferred_endpoints = ["cidr:54.0.0.0/8"]
|
||||
attributes_json = jsonencode({
|
||||
"filters" = ["tag-key=foo", "tag-key=bar"]
|
||||
"filters" = "tag-key=foo",
|
||||
"filters" = "tag-key=bar"
|
||||
})
|
||||
}
|
||||
|
||||
@@ -53,7 +54,8 @@ resource "boundary_host_set_plugin" "launch" {
|
||||
host_catalog_id = boundary_host_catalog_plugin.aws_example.id
|
||||
sync_interval_seconds = 60
|
||||
attributes_json = jsonencode({
|
||||
"filters" = ["tag:development=prod,dev", "launch-time=2022-01-04T*"]
|
||||
"filters" = "tag:development=prod,dev",
|
||||
"filters" = "launch-time=2022-01-04T*"
|
||||
})
|
||||
}
|
||||
|
||||
@@ -76,7 +78,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
|
||||
"client_id" = "ARM_CLIENT_ID"
|
||||
})
|
||||
|
||||
# recommended to pass in azure secrets using a file() or using environment variables
|
||||
# recommended to pass in aws secrets using a file() or using environment variables
|
||||
# the secrets below must be generated in azure by creating an ad application
|
||||
secrets_json = jsonencode({
|
||||
"secret_value" = "ARM_CLIENT_SECRET"
|
||||
@@ -98,4 +100,4 @@ resource "boundary_host_set_plugin" "foodev" {
|
||||
"filter" = "tagName eq 'tag-key' and tagValue eq 'foo'",
|
||||
"filter" = "tagName eq 'application' and tagValue eq 'dev'",
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
terraform import boundary_managed_group_ldap.foo <my-id>
|
||||
@@ -1,28 +0,0 @@
|
||||
resource "boundary_scope" "org" {
|
||||
name = "organization_one"
|
||||
description = "My first scope!"
|
||||
scope_id = "global"
|
||||
auto_create_admin_role = true
|
||||
auto_create_default_role = true
|
||||
}
|
||||
|
||||
resource "boundary_auth_method_ldap" "forumsys_ldap" {
|
||||
name = "forumsys public LDAP"
|
||||
scope_id = "global" # add the new auth method to the global scope
|
||||
urls = ["ldap://ldap.forumsys.com"] # the addr of the LDAP server
|
||||
user_dn = "dc=example,dc=com" # the basedn for users
|
||||
user_attr = "uid" # the user attribute
|
||||
group_dn = "dc=example,dc=com" # the basedn for groups
|
||||
bind_dn = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
|
||||
bind_password = "password" # passwd to use when binding
|
||||
state = "active-public" # make sure the new auth-method is available to everyone
|
||||
enable_groups = true # this turns-on the discovery of a user's groups
|
||||
discover_dn = true # this turns-on the discovery of an authenticating user's dn
|
||||
}
|
||||
|
||||
resource "boundary_managed_group_ldap" "forumsys_scientists" {
|
||||
name = "scientists"
|
||||
description = "forumsys scientists managed group"
|
||||
auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id
|
||||
group_names = ["Scientists"]
|
||||
}
|
||||
@@ -23,6 +23,6 @@ resource "boundary_role" "readonly" {
|
||||
name = "readonly"
|
||||
description = "A readonly role"
|
||||
principal_ids = [boundary_user.readonly.id]
|
||||
grant_strings = ["ids=*;type=*;actions=read"]
|
||||
grant_strings = ["id=*;type=*;actions=read"]
|
||||
scope_id = boundary_scope.project.id
|
||||
}
|
||||
@@ -16,6 +16,6 @@ resource "boundary_role" "readonly" {
|
||||
name = "readonly"
|
||||
description = "A readonly role"
|
||||
principal_ids = [boundary_user.readonly.id]
|
||||
grant_strings = ["ids=*;type=*;actions=read"]
|
||||
grant_strings = ["id=*;type=*;actions=read"]
|
||||
scope_id = boundary_scope.org.id
|
||||
}
|
||||
@@ -7,6 +7,6 @@ resource "boundary_scope" "org" {
|
||||
resource "boundary_role" "org_admin" {
|
||||
scope_id = boundary_scope.global.id
|
||||
grant_scope_id = boundary_scope.org.id
|
||||
grant_strings = ["ids=*;type=*;actions=*"]
|
||||
grant_strings = ["id=*;type=*;actions=*"]
|
||||
principal_ids = ["u_auth"]
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
terraform import boundary_storage_bucket.foo <my-id>
|
||||
@@ -1,40 +0,0 @@
|
||||
resource "boundary_scope" "org" {
|
||||
name = "organization_one"
|
||||
description = "My first scope!"
|
||||
scope_id = boundary_scope.global.id
|
||||
auto_create_admin_role = true
|
||||
auto_create_default_role = true
|
||||
}
|
||||
|
||||
resource "boundary_storage_bucket" "aws_static_credentials_example" {
|
||||
name = "My aws storage bucket with static credentials"
|
||||
description = "My first storage bucket!"
|
||||
scope_id = boundary_scope.org.id
|
||||
plugin_name = "aws"
|
||||
bucket_name = "mybucket"
|
||||
attributes_json = jsonencode({ "region" = "us-east-1" })
|
||||
|
||||
# recommended to pass in aws secrets using a file() or using environment variables
|
||||
# the secrets below must be generated in aws by creating a aws iam user with programmatic access
|
||||
secrets_json = jsonencode({
|
||||
"access_key_id" = "aws_access_key_id_value",
|
||||
"secret_access_key" = "aws_secret_access_key_value"
|
||||
})
|
||||
worker_filter = "\"pki\" in \"/tags/type\""
|
||||
}
|
||||
|
||||
resource "boundary_storage_bucket" "aws_dynamic_credentials_example" {
|
||||
name = "My aws storage bucket with dynamic credentials"
|
||||
description = "My first storage bucket!"
|
||||
scope_id = boundary_scope.org.id
|
||||
plugin_name = "aws"
|
||||
bucket_name = "mybucket"
|
||||
|
||||
# the role_arn value should be the same arn used as the instance profile that is attached to the ec2 instance
|
||||
# https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html
|
||||
attributes_json = jsonencode({
|
||||
"region" = "us-east-1"
|
||||
"role_arn" = "arn:aws:iam::123456789012:role/S3Access"
|
||||
})
|
||||
worker_filter = "\"pki\" in \"/tags/type\""
|
||||
}
|
||||
@@ -46,6 +46,7 @@ resource "boundary_host" "foo" {
|
||||
type = "static"
|
||||
name = "foo"
|
||||
host_catalog_id = boundary_host_catalog.foo.id
|
||||
scope_id = boundary_scope.project.id
|
||||
address = "10.0.0.1"
|
||||
}
|
||||
|
||||
@@ -53,6 +54,7 @@ resource "boundary_host" "bar" {
|
||||
type = "static"
|
||||
name = "bar"
|
||||
host_catalog_id = boundary_host_catalog.foo.id
|
||||
scope_id = boundary_scope.project.id
|
||||
address = "10.0.0.1"
|
||||
}
|
||||
|
||||
@@ -67,20 +69,6 @@ resource "boundary_host_set" "foo" {
|
||||
]
|
||||
}
|
||||
|
||||
resource "boundary_storage_bucket" "aws_example" {
|
||||
name = "My aws storage bucket"
|
||||
description = "My first storage bucket!"
|
||||
scope_id = boundary_scope.org.id
|
||||
plugin_name = "aws"
|
||||
bucket_name = "mybucket"
|
||||
attributes_json = jsonencode({ "region" = "us-east-1" })
|
||||
secrets_json = jsonencode({
|
||||
"access_key_id" = "aws_access_key_id_value",
|
||||
"secret_access_key" = "aws_secret_access_key_value"
|
||||
})
|
||||
worker_filter = "\"pki\" in \"/tags/type\""
|
||||
}
|
||||
|
||||
resource "boundary_target" "foo" {
|
||||
name = "foo"
|
||||
description = "Foo target"
|
||||
@@ -109,22 +97,6 @@ resource "boundary_target" "ssh_foo" {
|
||||
]
|
||||
}
|
||||
|
||||
resource "boundary_target" "ssh_session_recording_foo" {
|
||||
name = "ssh_foo"
|
||||
description = "Ssh target"
|
||||
type = "ssh"
|
||||
default_port = "22"
|
||||
scope_id = boundary_scope.project.id
|
||||
host_source_ids = [
|
||||
boundary_host_set.foo.id
|
||||
]
|
||||
injected_application_credential_source_ids = [
|
||||
boundary_credential_library_vault.foo.id
|
||||
]
|
||||
enable_session_recording = true
|
||||
storage_bucket_id = boundary_storage_bucket.aws_example
|
||||
}
|
||||
|
||||
resource "boundary_target" "address_foo" {
|
||||
name = "address_foo"
|
||||
description = "Foo target with an address"
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
resource "boundary_worker" "controller_led" {
|
||||
scope_id = "global"
|
||||
name = "worker 1"
|
||||
description = "self managed worker with controller-led auth"
|
||||
description = "self managed worker with controlled led auth"
|
||||
worker_generated_auth_token = var.worker_generated_auth_token
|
||||
}
|
||||
|
||||
resource "boundary_worker" "worker_led" {
|
||||
resource "boundary_self_managed_worker" "worker_led" {
|
||||
scope_id = "global"
|
||||
name = "worker 2"
|
||||
description = "self managed worker with worker-led auth"
|
||||
description = "self managed worker with controlled led auth"
|
||||
worker_generated_auth_token = var.worker_generated_auth_token
|
||||
}
|
||||
@@ -1,12 +0,0 @@
|
||||
resource "boundary_worker" "controller_led" {
|
||||
scope_id = "global"
|
||||
name = "worker 1"
|
||||
description = "self managed worker with controller led auth"
|
||||
}
|
||||
|
||||
resource "boundary_worker" "worker_led" {
|
||||
scope_id = "global"
|
||||
name = "worker 2"
|
||||
description = "self managed worker with worker led auth"
|
||||
worker_generated_auth_token = var.worker_generated_auth_token
|
||||
}
|
||||
@@ -1,144 +1,129 @@
|
||||
module github.com/hashicorp/terraform-provider-boundary
|
||||
|
||||
go 1.21.5
|
||||
go 1.20
|
||||
|
||||
require (
|
||||
github.com/YakDriver/regexache v0.23.0
|
||||
github.com/hashicorp/boundary v0.15.0
|
||||
github.com/hashicorp/boundary/api v0.0.45
|
||||
github.com/hashicorp/boundary/sdk v0.0.42
|
||||
github.com/hashicorp/cap v0.4.1
|
||||
github.com/hashicorp/cap/ldap v0.0.0-20231012003312-273118a6e3b8
|
||||
github.com/hashicorp/boundary v0.12.2
|
||||
github.com/hashicorp/boundary/api v0.0.34
|
||||
github.com/hashicorp/boundary/sdk v0.0.30
|
||||
github.com/hashicorp/cap v0.2.0
|
||||
github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637
|
||||
github.com/hashicorp/go-kms-wrapping/v2 v2.0.15
|
||||
github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.11
|
||||
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8
|
||||
github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.6
|
||||
github.com/hashicorp/terraform-plugin-docs v0.18.0
|
||||
github.com/hashicorp/terraform-plugin-sdk/v2 v2.31.0
|
||||
github.com/jimlambrt/gldap v0.1.9
|
||||
github.com/hashicorp/go-kms-wrapping/v2 v2.0.9-0.20230315135303-7bedb33a2280
|
||||
github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.7
|
||||
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7
|
||||
github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.3
|
||||
github.com/hashicorp/terraform-plugin-docs v0.14.1
|
||||
github.com/hashicorp/terraform-plugin-sdk/v2 v2.24.1
|
||||
github.com/kr/pretty v0.3.1
|
||||
github.com/mitchellh/go-homedir v1.1.0
|
||||
github.com/stretchr/testify v1.8.4
|
||||
golang.org/x/crypto v0.18.0
|
||||
mvdan.cc/gofumpt v0.5.0
|
||||
github.com/stretchr/testify v1.8.2
|
||||
golang.org/x/crypto v0.7.0
|
||||
)
|
||||
|
||||
require (
|
||||
github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
|
||||
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
|
||||
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
|
||||
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
|
||||
github.com/DATA-DOG/go-sqlmock v1.5.0 // indirect
|
||||
github.com/Kunde21/markdownfmt/v3 v3.1.0 // indirect
|
||||
github.com/Masterminds/goutils v1.1.1 // indirect
|
||||
github.com/Masterminds/semver/v3 v3.2.0 // indirect
|
||||
github.com/Masterminds/sprig/v3 v3.2.3 // indirect
|
||||
github.com/Microsoft/go-winio v0.6.1 // indirect
|
||||
github.com/Microsoft/go-winio v0.5.2 // indirect
|
||||
github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
|
||||
github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
|
||||
github.com/agext/levenshtein v1.2.2 // indirect
|
||||
github.com/alessio/shellescape v1.4.1 // indirect
|
||||
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
|
||||
github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
|
||||
github.com/armon/go-metrics v0.3.9 // indirect
|
||||
github.com/armon/go-radix v1.0.0 // indirect
|
||||
github.com/beorn7/perks v1.0.1 // indirect
|
||||
github.com/bgentry/speakeasy v0.1.0 // indirect
|
||||
github.com/cenkalti/backoff v2.2.1+incompatible // indirect
|
||||
github.com/cenkalti/backoff/v3 v3.0.0 // indirect
|
||||
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
|
||||
github.com/cenkalti/backoff/v4 v4.1.3 // indirect
|
||||
github.com/cespare/xxhash/v2 v2.2.0 // indirect
|
||||
github.com/cloudflare/circl v1.3.7 // indirect
|
||||
github.com/containerd/continuity v0.3.0 // indirect
|
||||
github.com/coreos/go-oidc/v3 v3.8.0 // indirect
|
||||
github.com/danieljoos/wincred v1.2.0 // indirect
|
||||
github.com/coreos/go-oidc/v3 v3.1.0 // indirect
|
||||
github.com/danieljoos/wincred v1.1.2 // indirect
|
||||
github.com/davecgh/go-spew v1.1.1 // indirect
|
||||
github.com/docker/cli v23.0.1+incompatible // indirect
|
||||
github.com/docker/docker v24.0.7+incompatible // indirect
|
||||
github.com/docker/cli v20.10.14+incompatible // indirect
|
||||
github.com/docker/docker v20.10.9+incompatible // indirect
|
||||
github.com/docker/go-connections v0.4.0 // indirect
|
||||
github.com/docker/go-units v0.5.0 // indirect
|
||||
github.com/dustin/go-humanize v1.0.1 // indirect
|
||||
github.com/dvsekhvalnov/jose2go v1.5.1-0.20231206184617-48ba0b76bc88 // indirect
|
||||
github.com/fatih/color v1.16.0 // indirect
|
||||
github.com/docker/go-units v0.4.0 // indirect
|
||||
github.com/dvsekhvalnov/jose2go v1.5.0 // indirect
|
||||
github.com/fatih/color v1.14.1 // indirect
|
||||
github.com/fatih/structs v1.1.0 // indirect
|
||||
github.com/glebarez/go-sqlite v1.21.2 // indirect
|
||||
github.com/glebarez/sqlite v1.9.0 // indirect
|
||||
github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
|
||||
github.com/go-jose/go-jose/v3 v3.0.1 // indirect
|
||||
github.com/go-ldap/ldap/v3 v3.4.6 // indirect
|
||||
github.com/godbus/dbus/v5 v5.1.0 // indirect
|
||||
github.com/godbus/dbus/v5 v5.0.6 // indirect
|
||||
github.com/gogo/protobuf v1.3.2 // indirect
|
||||
github.com/golang-migrate/migrate/v4 v4.16.2 // indirect
|
||||
github.com/golang/protobuf v1.5.3 // indirect
|
||||
github.com/google/go-cmp v0.6.0 // indirect
|
||||
github.com/golang-migrate/migrate/v4 v4.15.1 // indirect
|
||||
github.com/golang/protobuf v1.5.2 // indirect
|
||||
github.com/golang/snappy v0.0.4 // indirect
|
||||
github.com/google/go-cmp v0.5.9 // indirect
|
||||
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
|
||||
github.com/google/uuid v1.4.0 // indirect
|
||||
github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.0 // indirect
|
||||
github.com/hashicorp/cli v1.1.6 // indirect
|
||||
github.com/hashicorp/dbassert v0.0.0-20231012105025-1bc1bd88e22b // indirect
|
||||
github.com/google/uuid v1.3.0 // indirect
|
||||
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.2 // indirect
|
||||
github.com/hashicorp/dbassert v0.0.0-20210708202608-ecf920cf1ed8 // indirect
|
||||
github.com/hashicorp/errwrap v1.1.0 // indirect
|
||||
github.com/hashicorp/eventlogger v0.2.6-0.20231025104552-802587e608f0 // indirect
|
||||
github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0 // indirect
|
||||
github.com/hashicorp/go-bexpr v0.1.13 // indirect
|
||||
github.com/hashicorp/eventlogger v0.1.2-0.20230227112545-f26a3bdf6871 // indirect
|
||||
github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230227112545-f26a3bdf6871 // indirect
|
||||
github.com/hashicorp/go-bexpr v0.1.10 // indirect
|
||||
github.com/hashicorp/go-checkpoint v0.5.0 // indirect
|
||||
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
||||
github.com/hashicorp/go-dbw v0.1.1 // indirect
|
||||
github.com/hashicorp/go-hclog v1.5.0 // indirect
|
||||
github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20231124110655-4315424d22d0 // indirect
|
||||
github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.5 // indirect
|
||||
github.com/hashicorp/go-dbw v0.0.0-20220910135738-ed4505749995 // indirect
|
||||
github.com/hashicorp/go-hclog v1.3.1 // indirect
|
||||
github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
|
||||
github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20221122211539-47c893099f13 // indirect
|
||||
github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.3 // indirect
|
||||
github.com/hashicorp/go-multierror v1.1.1 // indirect
|
||||
github.com/hashicorp/go-plugin v1.6.0 // indirect
|
||||
github.com/hashicorp/go-rate v0.0.0-20231204194614-cc8d401f70ab // indirect
|
||||
github.com/hashicorp/go-retryablehttp v0.7.4 // indirect
|
||||
github.com/hashicorp/go-plugin v1.4.9 // indirect
|
||||
github.com/hashicorp/go-retryablehttp v0.7.2 // indirect
|
||||
github.com/hashicorp/go-rootcerts v1.0.2 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.2 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.9 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/mlock v0.1.3 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.1 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.5 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/mlock v0.1.1 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3 // indirect
|
||||
github.com/hashicorp/go-sockaddr v1.0.5 // indirect
|
||||
github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2 // indirect
|
||||
github.com/hashicorp/go-sockaddr v1.0.2 // indirect
|
||||
github.com/hashicorp/go-uuid v1.0.3 // indirect
|
||||
github.com/hashicorp/go-version v1.6.0 // indirect
|
||||
github.com/hashicorp/hc-install v0.6.2 // indirect
|
||||
github.com/hashicorp/golang-lru v0.5.4 // indirect
|
||||
github.com/hashicorp/hc-install v0.5.0 // indirect
|
||||
github.com/hashicorp/hcl v1.0.0 // indirect
|
||||
github.com/hashicorp/hcl/v2 v2.19.1 // indirect
|
||||
github.com/hashicorp/hcl/v2 v2.16.2 // indirect
|
||||
github.com/hashicorp/logutils v1.0.0 // indirect
|
||||
github.com/hashicorp/nodeenrollment v0.2.9 // indirect
|
||||
github.com/hashicorp/terraform-exec v0.20.0 // indirect
|
||||
github.com/hashicorp/terraform-json v0.21.0 // indirect
|
||||
github.com/hashicorp/terraform-plugin-go v0.20.0 // indirect
|
||||
github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
|
||||
github.com/hashicorp/terraform-registry-address v0.2.3 // indirect
|
||||
github.com/hashicorp/terraform-svchost v0.1.1 // indirect
|
||||
github.com/hashicorp/vault/api v1.10.0 // indirect
|
||||
github.com/hashicorp/nodeenrollment v0.1.18 // indirect
|
||||
github.com/hashicorp/terraform-exec v0.18.1 // indirect
|
||||
github.com/hashicorp/terraform-json v0.16.0 // indirect
|
||||
github.com/hashicorp/terraform-plugin-go v0.14.3 // indirect
|
||||
github.com/hashicorp/terraform-plugin-log v0.7.0 // indirect
|
||||
github.com/hashicorp/terraform-registry-address v0.1.0 // indirect
|
||||
github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 // indirect
|
||||
github.com/hashicorp/vault/api v1.3.1 // indirect
|
||||
github.com/hashicorp/vault/sdk v0.3.0 // indirect
|
||||
github.com/hashicorp/yamux v0.1.1 // indirect
|
||||
github.com/huandu/xstrings v1.4.0 // indirect
|
||||
github.com/imdario/mergo v0.3.15 // indirect
|
||||
github.com/imdario/mergo v0.3.13 // indirect
|
||||
github.com/jackc/chunkreader/v2 v2.0.1 // indirect
|
||||
github.com/jackc/pgconn v1.14.1 // indirect
|
||||
github.com/jackc/pgconn v1.12.1 // indirect
|
||||
github.com/jackc/pgio v1.0.0 // indirect
|
||||
github.com/jackc/pgpassfile v1.0.0 // indirect
|
||||
github.com/jackc/pgproto3/v2 v2.3.2 // indirect
|
||||
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
|
||||
github.com/jackc/pgtype v1.14.0 // indirect
|
||||
github.com/jackc/pgx/v4 v4.18.1 // indirect
|
||||
github.com/jackc/pgx/v5 v5.4.3 // indirect
|
||||
github.com/jackc/pgproto3/v2 v2.3.0 // indirect
|
||||
github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b // indirect
|
||||
github.com/jackc/pgtype v1.11.0 // indirect
|
||||
github.com/jackc/pgx/v4 v4.16.1 // indirect
|
||||
github.com/jefferai/go-libsecret v0.0.0-20210525195240-b53481abef97 // indirect
|
||||
github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f // indirect
|
||||
github.com/jefferai/keyring v1.1.7-0.20220316160357-58a74bb55891 // indirect
|
||||
github.com/jinzhu/gorm v1.9.16 // indirect
|
||||
github.com/jinzhu/gorm v1.9.12 // indirect
|
||||
github.com/jinzhu/inflection v1.0.0 // indirect
|
||||
github.com/jinzhu/now v1.1.5 // indirect
|
||||
github.com/kr/text v0.2.0 // indirect
|
||||
github.com/lib/pq v1.10.9 // indirect
|
||||
github.com/lib/pq v1.10.2 // indirect
|
||||
github.com/mattn/go-colorable v0.1.13 // indirect
|
||||
github.com/mattn/go-isatty v0.0.20 // indirect
|
||||
github.com/mattn/go-runewidth v0.0.9 // indirect
|
||||
github.com/mattn/go-isatty v0.0.17 // indirect
|
||||
github.com/mattn/go-sqlite3 v2.0.3+incompatible // indirect
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
|
||||
github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a // indirect
|
||||
github.com/mitchellh/cli v1.1.5 // indirect
|
||||
github.com/mitchellh/copystructure v1.2.0 // indirect
|
||||
@@ -147,65 +132,56 @@ require (
|
||||
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
||||
github.com/mitchellh/pointerstructure v1.2.1 // indirect
|
||||
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
||||
github.com/moby/term v0.5.0 // indirect
|
||||
github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
|
||||
github.com/mr-tron/base58 v1.2.0 // indirect
|
||||
github.com/mtibben/percent v0.2.1 // indirect
|
||||
github.com/oklog/run v1.1.0 // indirect
|
||||
github.com/opencontainers/go-digest v1.0.0 // indirect
|
||||
github.com/opencontainers/image-spec v1.0.2 // indirect
|
||||
github.com/opencontainers/runc v1.1.12 // indirect
|
||||
github.com/ory/dockertest/v3 v3.10.0 // indirect
|
||||
github.com/pires/go-proxyproto v0.7.0 // indirect
|
||||
github.com/opencontainers/runc v1.1.2 // indirect
|
||||
github.com/ory/dockertest/v3 v3.9.1 // indirect
|
||||
github.com/pierrec/lz4 v2.5.2+incompatible // indirect
|
||||
github.com/pires/go-proxyproto v0.6.1 // indirect
|
||||
github.com/pkg/errors v0.9.1 // indirect
|
||||
github.com/pmezard/go-difflib v1.0.0 // indirect
|
||||
github.com/posener/complete v1.2.3 // indirect
|
||||
github.com/prometheus/client_golang v1.17.0 // indirect
|
||||
github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 // indirect
|
||||
github.com/prometheus/common v0.44.0 // indirect
|
||||
github.com/prometheus/procfs v0.11.1 // indirect
|
||||
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
||||
github.com/rogpeppe/go-internal v1.12.0 // indirect
|
||||
github.com/prometheus/client_golang v1.12.1 // indirect
|
||||
github.com/prometheus/client_model v0.2.0 // indirect
|
||||
github.com/prometheus/common v0.32.1 // indirect
|
||||
github.com/prometheus/procfs v0.7.3 // indirect
|
||||
github.com/rogpeppe/go-internal v1.9.0 // indirect
|
||||
github.com/russross/blackfriday v1.6.0 // indirect
|
||||
github.com/ryanuber/go-glob v1.0.0 // indirect
|
||||
github.com/sethvargo/go-diceware v0.3.0 // indirect
|
||||
github.com/shopspring/decimal v1.3.1 // indirect
|
||||
github.com/sirupsen/logrus v1.9.2 // indirect
|
||||
github.com/sirupsen/logrus v1.8.1 // indirect
|
||||
github.com/spf13/cast v1.5.0 // indirect
|
||||
github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
|
||||
github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
|
||||
github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
|
||||
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
|
||||
github.com/vmihailenco/msgpack/v4 v4.3.12 // indirect
|
||||
github.com/vmihailenco/tagparser v0.1.1 // indirect
|
||||
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
|
||||
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
|
||||
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
|
||||
github.com/xo/dburl v0.16.0 // indirect
|
||||
github.com/yuin/goldmark v1.6.0 // indirect
|
||||
github.com/yuin/goldmark-meta v1.1.0 // indirect
|
||||
github.com/zalando/go-keyring v0.2.3 // indirect
|
||||
github.com/zclconf/go-cty v1.14.1 // indirect
|
||||
go.uber.org/atomic v1.11.0 // indirect
|
||||
golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
|
||||
golang.org/x/mod v0.14.0 // indirect
|
||||
golang.org/x/net v0.18.0 // indirect
|
||||
golang.org/x/oauth2 v0.13.0 // indirect
|
||||
golang.org/x/sync v0.4.0 // indirect
|
||||
golang.org/x/sys v0.16.0 // indirect
|
||||
golang.org/x/term v0.16.0 // indirect
|
||||
golang.org/x/text v0.14.0 // indirect
|
||||
github.com/xo/dburl v0.11.0 // indirect
|
||||
github.com/zalando/go-keyring v0.2.1 // indirect
|
||||
github.com/zclconf/go-cty v1.13.1 // indirect
|
||||
go.uber.org/atomic v1.9.0 // indirect
|
||||
golang.org/x/exp v0.0.0-20230224173230-c95f2b4c22f2 // indirect
|
||||
golang.org/x/mod v0.8.0 // indirect
|
||||
golang.org/x/net v0.8.0 // indirect
|
||||
golang.org/x/oauth2 v0.4.0 // indirect
|
||||
golang.org/x/sys v0.6.0 // indirect
|
||||
golang.org/x/term v0.6.0 // indirect
|
||||
golang.org/x/text v0.8.0 // indirect
|
||||
golang.org/x/time v0.3.0 // indirect
|
||||
golang.org/x/tools v0.14.0 // indirect
|
||||
google.golang.org/appengine v1.6.8 // indirect
|
||||
google.golang.org/genproto v0.0.0-20231030173426-d783a09b4405 // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20231030173426-d783a09b4405 // indirect
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405 // indirect
|
||||
google.golang.org/grpc v1.60.0 // indirect
|
||||
google.golang.org/protobuf v1.31.0 // indirect
|
||||
google.golang.org/appengine v1.6.7 // indirect
|
||||
google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488 // indirect
|
||||
google.golang.org/grpc v1.53.0 // indirect
|
||||
google.golang.org/protobuf v1.29.1 // indirect
|
||||
gopkg.in/square/go-jose.v2 v2.6.0 // indirect
|
||||
gopkg.in/yaml.v2 v2.4.0 // indirect
|
||||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||
gorm.io/driver/postgres v1.5.4 // indirect
|
||||
gorm.io/driver/sqlite v1.5.4 // indirect
|
||||
gorm.io/gorm v1.25.5 // indirect
|
||||
modernc.org/libc v1.22.5 // indirect
|
||||
modernc.org/mathutil v1.5.0 // indirect
|
||||
modernc.org/memory v1.5.0 // indirect
|
||||
modernc.org/sqlite v1.23.1 // indirect
|
||||
gorm.io/driver/postgres v1.3.8 // indirect
|
||||
gorm.io/driver/sqlite v1.3.6 // indirect
|
||||
gorm.io/gorm v1.23.8 // indirect
|
||||
)
|
||||
@@ -44,16 +44,4 @@ const (
|
||||
// internalForceUpdateKey is used to force updates so we can always check
|
||||
// the value of secrets
|
||||
internalForceUpdateKey = "internal_force_update"
|
||||
// workerFilter is used for common "worker_filter" resource attribute
|
||||
WorkerFilterKey = "worker_filter"
|
||||
// LoginNameKey is used for common "login_name" resource attribute
|
||||
LoginNameKey = "login_name"
|
||||
// PrimaryAccountIdKey is used for common "primary_account_id" resource attribute
|
||||
PrimaryAccountIdKey = "primary_account_id"
|
||||
// ScopeKey is used for common "scope" resource attribute
|
||||
ScopeKey = "scope"
|
||||
// ParentScopeKey is used for common "parent_scope_id" resource attribute
|
||||
ParentScopeIdKey = "parent_scope_id"
|
||||
// GroupMemberIdsKey is used for common "member_ids" resource attribute
|
||||
GroupMemberIdsKey = "member_ids"
|
||||
)
|
||||
@@ -1,139 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
|
||||
"github.com/hashicorp/boundary/api"
|
||||
"github.com/hashicorp/boundary/api/accounts"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
|
||||
)
|
||||
|
||||
func dataSourceAccount() *schema.Resource {
|
||||
return &schema.Resource{
|
||||
Description: "The boundary_account data source allows you to find a Boundary account.",
|
||||
ReadContext: dataSourceAccountRead,
|
||||
|
||||
Schema: map[string]*schema.Schema{
|
||||
NameKey: {
|
||||
Description: "The name of the account to retrieve.",
|
||||
Type: schema.TypeString,
|
||||
Required: true,
|
||||
ValidateFunc: validation.StringIsNotEmpty,
|
||||
},
|
||||
AuthMethodIdKey: {
|
||||
Description: "The auth method ID that will be queried for the account.",
|
||||
Type: schema.TypeString,
|
||||
Required: true,
|
||||
ValidateFunc: validation.StringIsNotEmpty,
|
||||
},
|
||||
IDKey: {
|
||||
Description: "The ID of the retrieved account.",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
DescriptionKey: {
|
||||
Description: "The description of the retrieved account.",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
TypeKey: {
|
||||
Description: "The type of the account",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
ScopeKey: {
|
||||
Type: schema.TypeList,
|
||||
Computed: true,
|
||||
Elem: &schema.Resource{
|
||||
Schema: map[string]*schema.Schema{
|
||||
IDKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
NameKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
TypeKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
DescriptionKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
ParentScopeIdKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func dataSourceAccountRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
|
||||
md := meta.(*metaData)
|
||||
|
||||
name := d.Get(NameKey).(string)
|
||||
authMethodId := d.Get(AuthMethodIdKey).(string)
|
||||
|
||||
acl := accounts.NewClient(md.client)
|
||||
accountsList, err := acl.List(ctx, authMethodId,
|
||||
accounts.WithFilter(FilterWithItemNameMatches(name)),
|
||||
)
|
||||
if err != nil {
|
||||
return diag.Errorf("error calling list account: %v", err)
|
||||
}
|
||||
accounts := accountsList.GetItems()
|
||||
if accounts == nil {
|
||||
return diag.Errorf("no accounts found")
|
||||
}
|
||||
if len(accounts) == 0 {
|
||||
return diag.Errorf("no matching account found")
|
||||
}
|
||||
if len(accounts) > 1 {
|
||||
return diag.Errorf("error found more than 1 account")
|
||||
}
|
||||
|
||||
arr, err := acl.Read(ctx, accounts[0].Id)
|
||||
if err != nil {
|
||||
if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
|
||||
d.SetId("")
|
||||
return nil
|
||||
}
|
||||
return diag.Errorf("error calling read account: %v", err)
|
||||
}
|
||||
if arr == nil {
|
||||
return diag.Errorf("account nil after read")
|
||||
}
|
||||
|
||||
if err := setFromAccountRead(d, *arr.Item); err != nil {
|
||||
return diag.FromErr(err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func setFromAccountRead(d *schema.ResourceData, account accounts.Account) error {
|
||||
if err := d.Set(NameKey, account.Name); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(DescriptionKey, account.Description); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(TypeKey, account.Type); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
d.Set(ScopeKey, flattenScopeInfo(account.Scope))
|
||||
d.SetId(account.Id)
|
||||
return nil
|
||||
}
|
||||
@@ -1,121 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/boundary/testing/controller"
|
||||
"github.com/hashicorp/cap/oidc"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
)
|
||||
|
||||
var accountPasswordRead = `
|
||||
data "boundary_account" "acc_password" {
|
||||
depends_on = [ boundary_account_password.foo ]
|
||||
name = "test"
|
||||
auth_method_id = boundary_auth_method.foo.id
|
||||
}`
|
||||
|
||||
var accountLdapRead = fmt.Sprintf(`
|
||||
data "boundary_account" "acc_ldap" {
|
||||
depends_on = [ boundary_account_ldap.foo ]
|
||||
name = "%s"
|
||||
auth_method_id = boundary_auth_method_ldap.foo.id
|
||||
}`, testAccountLdapName)
|
||||
|
||||
var accountOidcRead = `
|
||||
data "boundary_account" "acc_oidc" {
|
||||
depends_on = [ boundary_account_oidc.foo ]
|
||||
name = "test"
|
||||
auth_method_id = boundary_auth_method_oidc.foo.id
|
||||
}`
|
||||
|
||||
func TestAccAccountReadPassword(t *testing.T) {
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
Config: testConfig(url, fooOrg, fooAccountPassword, accountPasswordRead),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_account.acc_password", IDKey),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_account.acc_password", AuthMethodIdKey),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_account.acc_password", NameKey),
|
||||
resource.TestCheckResourceAttr("data.boundary_account.acc_password", DescriptionKey, fooAccountPasswordDesc),
|
||||
resource.TestCheckResourceAttr("data.boundary_account.acc_password", TypeKey, "password"),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_account.acc_password", "scope.0.id"),
|
||||
resource.TestCheckResourceAttr("data.boundary_account.acc_password", "scope.0.name", "org1"),
|
||||
resource.TestCheckResourceAttr("data.boundary_account.acc_password", "scope.0.type", "org"),
|
||||
),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func TestAccAccountReadLdap(t *testing.T) {
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
Config: testConfig(url, fooOrg, testAccountLdap, accountLdapRead),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_account.acc_ldap", IDKey),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_account.acc_ldap", AuthMethodIdKey),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_account.acc_ldap", NameKey),
|
||||
resource.TestCheckResourceAttr("data.boundary_account.acc_ldap", DescriptionKey, testAccountLdapDesc),
|
||||
resource.TestCheckResourceAttr("data.boundary_account.acc_ldap", TypeKey, "ldap"),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_account.acc_ldap", "scope.0.id"),
|
||||
resource.TestCheckResourceAttr("data.boundary_account.acc_ldap", "scope.0.name", "org1"),
|
||||
resource.TestCheckResourceAttr("data.boundary_account.acc_ldap", "scope.0.type", "org"),
|
||||
),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func TestAccAccountReadOidc(t *testing.T) {
|
||||
tp := oidc.StartTestProvider(t)
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
var provider *schema.Provider
|
||||
tpCert := strings.TrimSpace(tp.CACert())
|
||||
createConfig := fmt.Sprintf(fooAccountOidc, tp.Addr(), tpCert, fooAccountOidcDesc, tp.ExpectedSubject(), tp.Addr())
|
||||
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
Config: testConfig(url, fooOrg, createConfig, accountOidcRead),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
testAccCheckAccountResourceExists(provider, "boundary_account_oidc.foo"),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_account.acc_oidc", IDKey),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_account.acc_oidc", AuthMethodIdKey),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_account.acc_oidc", NameKey),
|
||||
resource.TestCheckResourceAttr("data.boundary_account.acc_oidc", DescriptionKey, fooAccountOidcDesc),
|
||||
resource.TestCheckResourceAttr("data.boundary_account.acc_oidc", TypeKey, "oidc"),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_account.acc_oidc", "scope.0.id"),
|
||||
resource.TestCheckResourceAttr("data.boundary_account.acc_oidc", "scope.0.name", "org1"),
|
||||
resource.TestCheckResourceAttr("data.boundary_account.acc_oidc", "scope.0.type", "org"),
|
||||
),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
@@ -1,142 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
|
||||
"github.com/hashicorp/boundary/api"
|
||||
"github.com/hashicorp/boundary/api/authmethods"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
|
||||
)
|
||||
|
||||
func dataSourceAuthMethod() *schema.Resource {
|
||||
return &schema.Resource{
|
||||
Description: "The boundary_auth_method data source allows you to find a Boundary auth method.",
|
||||
ReadContext: dataSourceAuthMethodRead,
|
||||
|
||||
Schema: map[string]*schema.Schema{
|
||||
NameKey: {
|
||||
Description: "The name of the auth method to retrieve.",
|
||||
Type: schema.TypeString,
|
||||
Required: true,
|
||||
ValidateFunc: validation.StringIsNotEmpty,
|
||||
},
|
||||
ScopeIdKey: {
|
||||
Description: "The scope ID in which the resource is created. Defaults `global` if unset.",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
Default: "global",
|
||||
ValidateFunc: validation.StringIsNotEmpty,
|
||||
},
|
||||
IDKey: {
|
||||
Description: "The ID of the retrieved auth method.",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
DescriptionKey: {
|
||||
Description: "The description of the retrieved auth method.",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
TypeKey: {
|
||||
Description: "The type of the auth method",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
ScopeKey: {
|
||||
Type: schema.TypeList,
|
||||
Computed: true,
|
||||
Elem: &schema.Resource{
|
||||
Schema: map[string]*schema.Schema{
|
||||
IDKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
NameKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
TypeKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
DescriptionKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
ParentScopeIdKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func dataSourceAuthMethodRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
|
||||
md := meta.(*metaData)
|
||||
|
||||
name := d.Get(NameKey).(string)
|
||||
scopeId := d.Get(ScopeIdKey).(string)
|
||||
|
||||
amcl := authmethods.NewClient(md.client)
|
||||
authMethodsList, err := amcl.List(ctx, scopeId,
|
||||
authmethods.WithFilter(FilterWithItemNameMatches(name)),
|
||||
)
|
||||
if err != nil {
|
||||
return diag.Errorf("error calling list auth method: %v", err)
|
||||
}
|
||||
authMethods := authMethodsList.GetItems()
|
||||
if authMethods == nil {
|
||||
return diag.Errorf("no auth methods found")
|
||||
}
|
||||
if len(authMethods) == 0 {
|
||||
return diag.Errorf("no matching auth method found")
|
||||
}
|
||||
if len(authMethods) > 1 {
|
||||
return diag.Errorf("error found more than 1 auth method")
|
||||
}
|
||||
|
||||
amrr, err := amcl.Read(ctx, authMethods[0].Id)
|
||||
if err != nil {
|
||||
if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
|
||||
d.SetId("")
|
||||
return nil
|
||||
}
|
||||
return diag.Errorf("error calling read auth method: %v", err)
|
||||
}
|
||||
if amrr == nil {
|
||||
return diag.Errorf("auth method nil after read")
|
||||
}
|
||||
|
||||
if err := setFromAuthMethodRead(d, *amrr.Item); err != nil {
|
||||
return diag.FromErr(err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func setFromAuthMethodRead(d *schema.ResourceData, authMethod authmethods.AuthMethod) error {
|
||||
if err := d.Set(NameKey, authMethod.Name); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(DescriptionKey, authMethod.Description); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(ScopeIdKey, authMethod.ScopeId); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(TypeKey, authMethod.Type); err != nil {
|
||||
return err
|
||||
}
|
||||
d.Set(ScopeKey, flattenScopeInfo(authMethod.Scope))
|
||||
d.SetId(authMethod.Id)
|
||||
return nil
|
||||
}
|
||||
@@ -1,98 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/boundary/testing/controller"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
)
|
||||
|
||||
const (
|
||||
testAuthMethodName = "test_auth_method"
|
||||
)
|
||||
|
||||
var authMethodReadGlobal = fmt.Sprintf(`
|
||||
resource "boundary_auth_method" "auth_method" {
|
||||
name = "%s"
|
||||
description = "test"
|
||||
scope_id = "global"
|
||||
type = "password"
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
}
|
||||
|
||||
data "boundary_auth_method" "auth_method" {
|
||||
depends_on = [ boundary_auth_method.auth_method ]
|
||||
name = "%s"
|
||||
}`, testAuthMethodName, testAuthMethodName)
|
||||
|
||||
var authMethodReadOrg = fmt.Sprintf(`
|
||||
resource "boundary_auth_method" "auth_method" {
|
||||
name = "%s"
|
||||
description = "test"
|
||||
scope_id = boundary_scope.org1.id
|
||||
type = "password"
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
}
|
||||
|
||||
data "boundary_auth_method" "auth_method" {
|
||||
depends_on = [ boundary_auth_method.auth_method ]
|
||||
name = "%s"
|
||||
scope_id = boundary_scope.org1.id
|
||||
}`, testAuthMethodName, testAuthMethodName)
|
||||
|
||||
func TestAccAuthMethodReadGlobal(t *testing.T) {
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
Config: testConfig(url, fooOrg, authMethodReadGlobal),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", IDKey),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", ScopeIdKey),
|
||||
resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", NameKey, testAuthMethodName),
|
||||
resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", TypeKey, "password"),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", DescriptionKey),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", "scope.0.id"),
|
||||
resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", "scope.0.name", "global"),
|
||||
resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", "scope.0.type", "global"),
|
||||
),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func TestAccAuthMethodReadOrg(t *testing.T) {
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
Config: testConfig(url, fooOrg, authMethodReadOrg),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", IDKey),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", ScopeIdKey),
|
||||
resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", NameKey, testAuthMethodName),
|
||||
resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", TypeKey, "password"),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", DescriptionKey),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", "scope.0.id"),
|
||||
resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", "scope.0.name", "org1"),
|
||||
resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", "scope.0.type", "org"),
|
||||
),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
@@ -1,144 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
|
||||
"github.com/hashicorp/boundary/api"
|
||||
"github.com/hashicorp/boundary/api/groups"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
|
||||
)
|
||||
|
||||
func dataSourceGroup() *schema.Resource {
|
||||
return &schema.Resource{
|
||||
Description: "The boundary_group data source allows you to find a Boundary group.",
|
||||
ReadContext: dataSourceGroupRead,
|
||||
|
||||
Schema: map[string]*schema.Schema{
|
||||
NameKey: {
|
||||
Description: "The name of the group to retrieve.",
|
||||
Type: schema.TypeString,
|
||||
Required: true,
|
||||
ValidateFunc: validation.StringIsNotEmpty,
|
||||
},
|
||||
ScopeIdKey: {
|
||||
Description: "The scope ID in which the resource is created. Defaults `global` if unset.",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
Default: "global",
|
||||
ValidateFunc: validation.StringIsNotEmpty,
|
||||
},
|
||||
IDKey: {
|
||||
Description: "The ID of the retrieved group.",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
DescriptionKey: {
|
||||
Description: "The description of the retrieved group.",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
ScopeKey: {
|
||||
Type: schema.TypeList,
|
||||
Computed: true,
|
||||
Elem: &schema.Resource{
|
||||
Schema: map[string]*schema.Schema{
|
||||
IDKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
NameKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
TypeKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
DescriptionKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
ParentScopeIdKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
GroupMemberIdsKey: {
|
||||
Description: "Resource IDs for group members, these are most likely boundary users.",
|
||||
Type: schema.TypeSet,
|
||||
Elem: &schema.Schema{Type: schema.TypeString},
|
||||
Computed: true,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func dataSourceGroupRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
|
||||
md := meta.(*metaData)
|
||||
|
||||
name := d.Get(NameKey).(string)
|
||||
scopeId := d.Get(ScopeIdKey).(string)
|
||||
|
||||
gcl := groups.NewClient(md.client)
|
||||
groupsList, err := gcl.List(ctx, scopeId,
|
||||
groups.WithFilter(FilterWithItemNameMatches(name)),
|
||||
)
|
||||
if err != nil {
|
||||
return diag.Errorf("error calling list group: %v", err)
|
||||
}
|
||||
groups := groupsList.GetItems()
|
||||
if groups == nil {
|
||||
return diag.Errorf("no groups found")
|
||||
}
|
||||
if len(groups) == 0 {
|
||||
return diag.Errorf("no matching group found")
|
||||
}
|
||||
if len(groups) > 1 {
|
||||
return diag.Errorf("error found more than 1 group")
|
||||
}
|
||||
|
||||
grr, err := gcl.Read(ctx, groups[0].Id)
|
||||
if err != nil {
|
||||
if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
|
||||
d.SetId("")
|
||||
return nil
|
||||
}
|
||||
return diag.Errorf("error calling read group: %v", err)
|
||||
}
|
||||
if grr == nil {
|
||||
return diag.Errorf("group nil after read")
|
||||
}
|
||||
|
||||
if err := setFromGroupRead(d, *grr.Item); err != nil {
|
||||
return diag.FromErr(err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func setFromGroupRead(d *schema.ResourceData, group groups.Group) error {
|
||||
if err := d.Set(NameKey, group.Name); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(DescriptionKey, group.Description); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(ScopeIdKey, group.ScopeId); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(GroupMemberIdsKey, group.MemberIds); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
d.Set(ScopeKey, flattenScopeInfo(group.Scope))
|
||||
d.SetId(group.Id)
|
||||
return nil
|
||||
}
|
||||
@@ -1,113 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/boundary/testing/controller"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
)
|
||||
|
||||
const (
|
||||
testGroupName = "test_group"
|
||||
)
|
||||
|
||||
var groupReadGlobal = fmt.Sprintf(`
|
||||
|
||||
resource "boundary_user" "user" {
|
||||
description = "user"
|
||||
scope_id = "global"
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
}
|
||||
|
||||
resource "boundary_group" "group" {
|
||||
name = "%s"
|
||||
description = "test"
|
||||
scope_id = "global"
|
||||
member_ids = [boundary_user.user.id]
|
||||
depends_on = [boundary_user.user]
|
||||
}
|
||||
|
||||
data "boundary_group" "group" {
|
||||
depends_on = [ boundary_group.group ]
|
||||
name = "%s"
|
||||
}`, testGroupName, testGroupName)
|
||||
|
||||
var groupReadOrg = fmt.Sprintf(`
|
||||
resource "boundary_user" "user" {
|
||||
description = "user"
|
||||
scope_id = boundary_scope.org1.id
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
}
|
||||
|
||||
resource "boundary_group" "group" {
|
||||
name = "%s"
|
||||
description = "test"
|
||||
scope_id = boundary_scope.org1.id
|
||||
member_ids = [boundary_user.user.id]
|
||||
depends_on = [boundary_user.user]
|
||||
}
|
||||
|
||||
data "boundary_group" "group" {
|
||||
depends_on = [ boundary_group.group ]
|
||||
name = "%s"
|
||||
scope_id = boundary_scope.org1.id
|
||||
}`, testGroupName, testGroupName)
|
||||
|
||||
func TestAccGroupReadGlobal(t *testing.T) {
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
Config: testConfig(url, fooOrg, groupReadGlobal),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
testAccCheckGroupResourceExists(provider, "boundary_group.group"),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_group.group", IDKey),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_group.group", ScopeIdKey),
|
||||
resource.TestCheckResourceAttr("data.boundary_group.group", NameKey, testGroupName),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_group.group", DescriptionKey),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_group.group", fmt.Sprintf("%s.#", GroupMemberIdsKey)),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_group.group", "scope.0.id"),
|
||||
resource.TestCheckResourceAttr("data.boundary_group.group", "scope.0.name", "global"),
|
||||
resource.TestCheckResourceAttr("data.boundary_group.group", "scope.0.type", "global"),
|
||||
),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func TestAccGroupReadOrg(t *testing.T) {
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
Config: testConfig(url, fooOrg, groupReadOrg),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
testAccCheckGroupResourceExists(provider, "boundary_group.group"),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_group.group", IDKey),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_group.group", ScopeIdKey),
|
||||
resource.TestCheckResourceAttr("data.boundary_group.group", NameKey, testGroupName),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_group.group", DescriptionKey),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_group.group", fmt.Sprintf("%s.#", GroupMemberIdsKey)),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_group.group", "scope.0.id"),
|
||||
resource.TestCheckResourceAttr("data.boundary_group.group", "scope.0.name", "org1"),
|
||||
resource.TestCheckResourceAttr("data.boundary_group.group", "scope.0.type", "org"),
|
||||
),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
@@ -1,115 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
|
||||
"github.com/hashicorp/boundary/api"
|
||||
"github.com/hashicorp/boundary/api/scopes"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
)
|
||||
|
||||
func dataSourceScope() *schema.Resource {
|
||||
return &schema.Resource{
|
||||
Description: "The scope data source allows you to discover an existing Boundary scope by name.",
|
||||
ReadContext: dataSourceScopeRead,
|
||||
|
||||
Schema: map[string]*schema.Schema{
|
||||
IDKey: {
|
||||
Description: "The ID of the retrieved scope.",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
NameKey: {
|
||||
Description: "The name of the scope to retrieve.",
|
||||
Type: schema.TypeString,
|
||||
Required: true,
|
||||
},
|
||||
DescriptionKey: {
|
||||
Description: "The description of the retrieved scope.",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
ScopeIdKey: {
|
||||
Description: "The parent scope ID that will be queried for the scope.",
|
||||
Type: schema.TypeString,
|
||||
Required: true,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func dataSourceScopeRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
|
||||
md := meta.(*metaData)
|
||||
opts := []scopes.Option{}
|
||||
|
||||
var name string
|
||||
if v, ok := d.GetOk(NameKey); ok {
|
||||
name = v.(string)
|
||||
} else {
|
||||
return diag.Errorf("no name provided")
|
||||
}
|
||||
|
||||
var scopeId string
|
||||
if scopeIdVal, ok := d.GetOk(ScopeIdKey); ok {
|
||||
scopeId = scopeIdVal.(string)
|
||||
} else {
|
||||
return diag.Errorf("no parent scope ID provided")
|
||||
}
|
||||
|
||||
scp := scopes.NewClient(md.client)
|
||||
|
||||
scpls, err := scp.List(ctx, scopeId, opts...)
|
||||
if err != nil {
|
||||
return diag.Errorf("error calling list scope: %v", err)
|
||||
}
|
||||
if scpls == nil {
|
||||
return diag.Errorf("no scopes found")
|
||||
}
|
||||
|
||||
var scopeIdRead string
|
||||
for _, scopeItem := range scpls.GetItems() {
|
||||
if scopeItem.Name == name {
|
||||
scopeIdRead = scopeItem.Id
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if scopeIdRead == "" {
|
||||
return diag.Errorf("scope name %v not found in scope list", err)
|
||||
}
|
||||
|
||||
srr, err := scp.Read(ctx, scopeIdRead)
|
||||
if err != nil {
|
||||
if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
|
||||
d.SetId("")
|
||||
return nil
|
||||
}
|
||||
return diag.Errorf("error calling read scope: %v", err)
|
||||
}
|
||||
if srr == nil {
|
||||
return diag.Errorf("scope nil after read")
|
||||
}
|
||||
|
||||
if err := setFromScopeReadResponseMap(d, srr.GetResponse().Map); err != nil {
|
||||
return diag.FromErr(err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func setFromScopeReadResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
|
||||
if err := d.Set(NameKey, raw["name"]); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(DescriptionKey, raw["description"]); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
d.SetId(raw["id"].(string))
|
||||
return nil
|
||||
}
|
||||
@@ -1,96 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/boundary/testing/controller"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
)
|
||||
|
||||
const (
|
||||
orgName = "test org scope"
|
||||
projectName = "test project scope"
|
||||
notProjectName = "test project scope with wrong name"
|
||||
scopeDesc = "created to test the scope datasource"
|
||||
)
|
||||
|
||||
var scopeCreateAndRead = fmt.Sprintf(`
|
||||
resource "boundary_scope" "global" {
|
||||
global_scope = true
|
||||
name = "global"
|
||||
description = "Global Scope"
|
||||
scope_id = "global"
|
||||
}
|
||||
|
||||
resource "boundary_scope" "org" {
|
||||
scope_id = boundary_scope.global.id
|
||||
name = "%s"
|
||||
description = "%s"
|
||||
}
|
||||
|
||||
resource "boundary_scope" "project" {
|
||||
depends_on = [boundary_role.org_admin]
|
||||
scope_id = boundary_scope.org.id
|
||||
name = "%s"
|
||||
description = "%s"
|
||||
}
|
||||
|
||||
resource "boundary_role" "org_admin" {
|
||||
scope_id = "global"
|
||||
grant_scope_id = boundary_scope.org.id
|
||||
grant_strings = ["ids=*;type=*;actions=*"]
|
||||
principal_ids = ["u_auth"]
|
||||
}
|
||||
|
||||
data "boundary_scope" "org" {
|
||||
depends_on = [boundary_scope.org]
|
||||
scope_id = "global"
|
||||
name = "%s"
|
||||
}
|
||||
|
||||
data "boundary_scope" "project" {
|
||||
depends_on = [boundary_scope.project]
|
||||
scope_id = data.boundary_scope.org.id
|
||||
name = "%s"
|
||||
}`, orgName, scopeDesc, projectName, scopeDesc, orgName, projectName)
|
||||
|
||||
func TestAccScopeRead(t *testing.T) {
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
CheckDestroy: testAccCheckScopeResourceDestroy(t, provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
// create and read
|
||||
Config: testConfig(url, scopeCreateAndRead),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
testAccCheckScopeResourceExists(provider, "boundary_scope.org"),
|
||||
resource.TestCheckResourceAttr("boundary_scope.org", "description", scopeDesc),
|
||||
resource.TestCheckResourceAttr("boundary_scope.org", "name", orgName),
|
||||
testAccCheckScopeResourceExists(provider, "boundary_scope.project"),
|
||||
resource.TestCheckResourceAttr("boundary_scope.project", "description", scopeDesc),
|
||||
resource.TestCheckResourceAttr("boundary_scope.project", "name", projectName),
|
||||
// Check attributes on the org datasource
|
||||
resource.TestCheckResourceAttrSet("data.boundary_scope.org", "scope_id"),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_scope.org", "id"),
|
||||
resource.TestCheckResourceAttr("data.boundary_scope.org", "name", orgName),
|
||||
resource.TestCheckResourceAttr("data.boundary_scope.org", "description", scopeDesc),
|
||||
// Check attributes on the project datasource
|
||||
resource.TestCheckResourceAttrSet("data.boundary_scope.project", "scope_id"),
|
||||
resource.TestCheckResourceAttrSet("data.boundary_scope.project", "id"),
|
||||
resource.TestCheckResourceAttr("data.boundary_scope.project", "name", projectName),
|
||||
resource.TestCheckResourceAttr("data.boundary_scope.project", "description", scopeDesc),
|
||||
),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
@@ -1,161 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"context"
|
||||
|
||||
"github.com/hashicorp/boundary/api/users"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
|
||||
)
|
||||
|
||||
func dataSourceUser() *schema.Resource {
|
||||
return &schema.Resource{
|
||||
Description: "The user data source allows you to find a Boundary user.",
|
||||
ReadContext: dataSourceUserRead,
|
||||
|
||||
Schema: map[string]*schema.Schema{
|
||||
IDKey: {
|
||||
Description: "The ID of the user.",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
NameKey: {
|
||||
Description: "The username to search for.",
|
||||
Type: schema.TypeString,
|
||||
Required: true,
|
||||
ValidateFunc: validation.StringIsNotEmpty,
|
||||
},
|
||||
DescriptionKey: {
|
||||
Description: "The user description.",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
ScopeIdKey: {
|
||||
Description: "The scope ID in which the resource is created. Defaults `global` if unset.",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
Default: "global",
|
||||
ValidateFunc: validation.StringIsNotEmpty,
|
||||
},
|
||||
userAccountIDsKey: {
|
||||
Description: "Account ID's to associate with this user resource.",
|
||||
Type: schema.TypeSet,
|
||||
Computed: true,
|
||||
Elem: &schema.Schema{Type: schema.TypeString},
|
||||
},
|
||||
ScopeKey: {
|
||||
Type: schema.TypeList,
|
||||
Computed: true,
|
||||
Elem: &schema.Resource{
|
||||
Schema: map[string]*schema.Schema{
|
||||
IDKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
NameKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
TypeKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
DescriptionKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
ParentScopeIdKey: {
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
authorizedActions: {
|
||||
Description: "A list of actions that the worker is entitled to perform.",
|
||||
Type: schema.TypeList,
|
||||
Elem: &schema.Schema{
|
||||
Type: schema.TypeString,
|
||||
},
|
||||
Computed: true,
|
||||
},
|
||||
LoginNameKey: {
|
||||
Description: "Login name for user.",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
PrimaryAccountIdKey: {
|
||||
Description: "Primary account ID.",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func dataSourceUserRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
|
||||
md := meta.(*metaData)
|
||||
usrs := users.NewClient(md.client)
|
||||
|
||||
opts := []users.Option{}
|
||||
|
||||
// Get user ID using name
|
||||
name := d.Get(NameKey).(string)
|
||||
scopeID := d.Get(ScopeIdKey).(string)
|
||||
|
||||
opts = append(opts, users.WithFilter(FilterWithItemNameMatches(name)))
|
||||
|
||||
usersList, err := usrs.List(ctx, scopeID, opts...)
|
||||
if err != nil {
|
||||
return diag.Errorf("error calling list user: %v", err)
|
||||
}
|
||||
users := usersList.GetItems()
|
||||
|
||||
// check length, 0 means no user, > 1 means too many
|
||||
if len(users) == 0 {
|
||||
return diag.Errorf("no matching user found: %v", err)
|
||||
}
|
||||
|
||||
if len(users) > 1 {
|
||||
return diag.Errorf("error found more than 1 user: %v", err)
|
||||
}
|
||||
|
||||
if err := setFromUserItem(d, *users[0]); err != nil {
|
||||
return diag.FromErr(err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func setFromUserItem(d *schema.ResourceData, user users.User) error {
|
||||
if err := d.Set(NameKey, user.Name); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(DescriptionKey, user.Description); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(ScopeIdKey, user.ScopeId); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(userAccountIDsKey, user.AccountIds); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(authorizedActions, user.AuthorizedActions); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(LoginNameKey, user.LoginName); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(PrimaryAccountIdKey, user.PrimaryAccountId); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
d.Set(ScopeKey, flattenScopeInfo(user.Scope))
|
||||
|
||||
d.SetId(user.Id)
|
||||
return nil
|
||||
}
|
||||
@@ -1,95 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
"github.com/YakDriver/regexache"
|
||||
"github.com/hashicorp/boundary/testing/controller"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
)
|
||||
|
||||
var (
|
||||
orgUserDataSource = fmt.Sprintf(`
|
||||
resource "boundary_user" "org1" {
|
||||
name = "test"
|
||||
description = "%s"
|
||||
scope_id = boundary_scope.org1.id
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
}
|
||||
data "boundary_user" "org1" {
|
||||
name = "test"
|
||||
scope_id = boundary_scope.org1.id
|
||||
depends_on = [boundary_user.org1]
|
||||
}`, fooDescription)
|
||||
|
||||
globalUserDataSource = `
|
||||
data "boundary_user" "admin" {
|
||||
name = "admin"
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
}`
|
||||
)
|
||||
|
||||
// NOTE: this test also tests out the direct token auth mechanism.
|
||||
|
||||
func TestAccUserDataSource_basicOrgUser(t *testing.T) {
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
token := tc.Token().Token
|
||||
|
||||
resourceName := "boundary_user.org1"
|
||||
dataSourceName := "data.boundary_user.org1"
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
CheckDestroy: testAccCheckUserResourceDestroy(t, provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
// test create
|
||||
Config: testConfigWithToken(url, token, fooOrg, orgUserDataSource),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
testAccCheckUserResourceExists(provider, resourceName),
|
||||
resource.TestCheckResourceAttr(dataSourceName, DescriptionKey, fooDescription),
|
||||
resource.TestCheckResourceAttr(dataSourceName, NameKey, "test"),
|
||||
),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func TestAccUserDataSource_globalAdminUser(t *testing.T) {
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
token := tc.Token().Token
|
||||
|
||||
dataSourceName := "data.boundary_user.admin"
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
Config: testConfigWithToken(url, token, fooOrg, globalUserDataSource),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr(dataSourceName, NameKey, "admin"),
|
||||
resource.TestCheckResourceAttr(dataSourceName, DescriptionKey, "Initial admin user within the \"global\" scope"),
|
||||
resource.TestCheckResourceAttr(dataSourceName, LoginNameKey, "testuser"),
|
||||
resource.TestMatchResourceAttr(dataSourceName, IDKey, regexache.MustCompile(`^u_.+`)),
|
||||
resource.TestMatchResourceAttr(dataSourceName, PrimaryAccountIdKey, regexache.MustCompile(`^acctpw_.+`)),
|
||||
resource.TestCheckResourceAttr(dataSourceName, "authorized_actions.#", "7"),
|
||||
resource.TestCheckResourceAttr(dataSourceName, "scope.0.name", "global"),
|
||||
resource.TestCheckResourceAttr(dataSourceName, "scope.0.id", "global"),
|
||||
resource.TestCheckResourceAttr(dataSourceName, "scope.0.type", "global"),
|
||||
resource.TestCheckResourceAttr(dataSourceName, "scope.0.description", "Global Scope"),
|
||||
),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import "fmt"
|
||||
|
||||
func FilterWithItemNameMatches(name string) string {
|
||||
return fmt.Sprintf("\"/item/name\" matches \"%s\"", name)
|
||||
}
|
||||
+12
-110
@@ -21,12 +21,6 @@ import (
|
||||
kms_plugin_assets "github.com/hashicorp/terraform-provider-boundary/plugins/kms"
|
||||
)
|
||||
|
||||
const (
|
||||
PASSWORD_AUTH_METHOD_PREFIX = "ampw"
|
||||
LDAP_AUTH_METHOD_PREFIX = "amldap"
|
||||
DEFAULT_PROVIDER_SCOPE = "global"
|
||||
)
|
||||
|
||||
func init() {
|
||||
// descriptions are written in markdown for docs
|
||||
schema.DescriptionKind = schema.StringMarkdown
|
||||
@@ -53,29 +47,17 @@ func New() *schema.Provider {
|
||||
"auth_method_id": {
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
Description: "The auth method ID e.g. ampw_1234567890. If not set, the default auth method for the given scope ID will be used.",
|
||||
Description: "The auth method ID e.g. ampw_1234567890",
|
||||
},
|
||||
"password_auth_method_login_name": {
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
Description: "The auth method login name for password-style auth methods",
|
||||
Deprecated: "Use auth_method_login_name instead",
|
||||
},
|
||||
"password_auth_method_password": {
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
Description: "The auth method password for password-style auth methods",
|
||||
Deprecated: "Use auth_method_password instead",
|
||||
},
|
||||
"auth_method_login_name": {
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
Description: "The auth method login name for password-style or ldap-style auth methods",
|
||||
},
|
||||
"auth_method_password": {
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
Description: "The auth method password for password-style or ldap-style auth methods",
|
||||
},
|
||||
"tls_insecure": {
|
||||
Type: schema.TypeBool,
|
||||
@@ -87,21 +69,14 @@ func New() *schema.Provider {
|
||||
Optional: true,
|
||||
Description: `Specifies a directory that the Boundary provider can use to write and execute its built-in plugins.`,
|
||||
},
|
||||
"scope_id": {
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
Description: `The scope ID for the default auth method.`,
|
||||
},
|
||||
},
|
||||
ResourcesMap: map[string]*schema.Resource{
|
||||
"boundary_account": resourceAccount(),
|
||||
"boundary_account_password": resourceAccountPassword(),
|
||||
"boundary_account_oidc": resourceAccountOidc(),
|
||||
"boundary_account_ldap": resourceAccountLdap(),
|
||||
"boundary_auth_method": resourceAuthMethod(),
|
||||
"boundary_auth_method_password": resourceAuthMethodPassword(),
|
||||
"boundary_auth_method_oidc": resourceAuthMethodOidc(),
|
||||
"boundary_auth_method_ldap": resourceAuthMethodLdap(),
|
||||
"boundary_credential_library_vault": resourceCredentialLibraryVault(),
|
||||
"boundary_credential_library_vault_ssh_certificate": resourceCredentialLibraryVaultSshCertificate(),
|
||||
"boundary_credential_store_vault": resourceCredentialStoreVault(),
|
||||
@@ -110,7 +85,6 @@ func New() *schema.Provider {
|
||||
"boundary_credential_ssh_private_key": resourceCredentialSshPrivateKey(),
|
||||
"boundary_credential_json": resourceCredentialJson(),
|
||||
"boundary_managed_group": resourceManagedGroup(),
|
||||
"boundary_managed_group_ldap": resourceManagedGroupLdap(),
|
||||
"boundary_group": resourceGroup(),
|
||||
"boundary_host": resourceHost(),
|
||||
"boundary_host_static": resourceHostStatic(),
|
||||
@@ -122,18 +96,10 @@ func New() *schema.Provider {
|
||||
"boundary_host_set_plugin": resourceHostSetPlugin(),
|
||||
"boundary_role": resourceRole(),
|
||||
"boundary_scope": resourceScope(),
|
||||
"boundary_storage_bucket": resourceStorageBucket(),
|
||||
"boundary_target": resourceTarget(),
|
||||
"boundary_user": resourceUser(),
|
||||
"boundary_worker": resourceWorker(),
|
||||
},
|
||||
DataSourcesMap: map[string]*schema.Resource{
|
||||
"boundary_account": dataSourceAccount(),
|
||||
"boundary_auth_method": dataSourceAuthMethod(),
|
||||
"boundary_group": dataSourceGroup(),
|
||||
"boundary_scope": dataSourceScope(),
|
||||
"boundary_user": dataSourceUser(),
|
||||
},
|
||||
}
|
||||
|
||||
p.ConfigureContextFunc = providerConfigure(p)
|
||||
@@ -148,34 +114,13 @@ type metaData struct {
|
||||
|
||||
func providerAuthenticate(ctx context.Context, d *schema.ResourceData, md *metaData) error {
|
||||
var credentials map[string]interface{}
|
||||
amClient := authmethods.NewClient(md.client)
|
||||
|
||||
var providerScope string
|
||||
scopeId, scopeIdOk := d.GetOk("scope_id")
|
||||
switch {
|
||||
case scopeIdOk:
|
||||
providerScope = scopeId.(string)
|
||||
default:
|
||||
providerScope = DEFAULT_PROVIDER_SCOPE
|
||||
}
|
||||
|
||||
authMethodId, authMethodIdOk := d.GetOk("auth_method_id")
|
||||
recoveryKmsHcl, recoveryKmsHclOk := d.GetOk("recovery_kms_hcl")
|
||||
if token, ok := d.GetOk("token"); ok {
|
||||
md.client.SetToken(token.(string))
|
||||
}
|
||||
|
||||
// If auth_method_id is not set, get the default auth method ID for the given scope ID.
|
||||
// Skip fetching default auth method when recovery_kms_hcl is set or the client token isn't null.
|
||||
authMethodId, authMethodIdOk := d.GetOk("auth_method_id")
|
||||
if !authMethodIdOk && !recoveryKmsHclOk && md.client.Token() == "" {
|
||||
defaultAuthMethodId, err := getDefaultAuthMethodId(ctx, amClient, providerScope, "")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
authMethodIdOk = true
|
||||
authMethodId = defaultAuthMethodId
|
||||
}
|
||||
|
||||
switch {
|
||||
case recoveryKmsHclOk:
|
||||
recoveryHclStr, _, err := ReadPathOrContents(recoveryKmsHcl.(string))
|
||||
@@ -214,34 +159,28 @@ func providerAuthenticate(ctx context.Context, d *schema.ResourceData, md *metaD
|
||||
|
||||
case authMethodIdOk:
|
||||
switch {
|
||||
case strings.HasPrefix(authMethodId.(string), PASSWORD_AUTH_METHOD_PREFIX) || strings.HasPrefix(authMethodId.(string), LDAP_AUTH_METHOD_PREFIX):
|
||||
// Password-style & LDAP-style
|
||||
authMethodLoginName, ok := d.GetOk("auth_method_login_name")
|
||||
case strings.HasPrefix(authMethodId.(string), "ampw"):
|
||||
// Password-style
|
||||
authMethodLoginName, ok := d.GetOk("password_auth_method_login_name")
|
||||
if !ok {
|
||||
authMethodLoginName, ok = d.GetOk("password_auth_method_login_name")
|
||||
if !ok {
|
||||
return errors.New("auth method login name not set, please set auth_method_login_name on the provider")
|
||||
}
|
||||
return errors.New("password-style auth method login name not set, please set password_auth_method_login_name on the provider")
|
||||
}
|
||||
authMethodPassword, ok := d.GetOk("auth_method_password")
|
||||
authMethodPassword, ok := d.GetOk("password_auth_method_password")
|
||||
if !ok {
|
||||
authMethodPassword, ok = d.GetOk("password_auth_method_password")
|
||||
if !ok {
|
||||
return errors.New("auth method password not set, please set auth_method_password on the provider")
|
||||
}
|
||||
return errors.New("password-style auth method password not set, please set password_auth_method_password on the provider")
|
||||
}
|
||||
credentials = map[string]interface{}{
|
||||
"login_name": authMethodLoginName,
|
||||
"password": authMethodPassword,
|
||||
}
|
||||
case strings.HasPrefix(authMethodId.(string), "amoidc"):
|
||||
// OIDC-style
|
||||
return errors.New("OIDC auth method is currently not supported by Boundary Terraform Provider. only password auth method is supported at this time")
|
||||
|
||||
default:
|
||||
return errors.New("no suitable typed auth method information found")
|
||||
}
|
||||
|
||||
at, err := amClient.Authenticate(ctx, authMethodId.(string), "login", credentials)
|
||||
am := authmethods.NewClient(md.client)
|
||||
|
||||
at, err := am.Authenticate(ctx, authMethodId.(string), "login", credentials)
|
||||
if err != nil {
|
||||
if apiErr := api.AsServerError(err); apiErr != nil {
|
||||
statusCode := apiErr.Response().StatusCode()
|
||||
@@ -298,40 +237,3 @@ func providerConfigure(p *schema.Provider) schema.ConfigureContextFunc {
|
||||
return md, nil
|
||||
}
|
||||
}
|
||||
|
||||
// getDefaultAuthMethodId iterates over boundary client.List() to find the default auth method ID for the given scopeId.
|
||||
// If there is only one auth method, it'll return it even if it's not the primary auth method
|
||||
// If scope ID is empty or no primary auth method is found, it returns an error.
|
||||
func getDefaultAuthMethodId(ctx context.Context, client *authmethods.Client, scopeId, amType string) (string, error) {
|
||||
if scopeId == "" {
|
||||
return "", fmt.Errorf("must pass a non empty scope ID string to get default auth method ID")
|
||||
}
|
||||
authMethodListResult, err := client.List(ctx, scopeId)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
authMethodItems := authMethodListResult.GetItems()
|
||||
|
||||
// If there is only one auth method that matches the auth method prefix, return it even if it's not the primary auth method
|
||||
if len(authMethodItems) == 1 {
|
||||
authMethod := authMethodItems[0]
|
||||
if !strings.HasPrefix(authMethod.Id, amType) {
|
||||
return "", fmt.Errorf("error looking up default auth method for scope ID: '%s'. got '%s' but the provider requires an auth method prefix of '%s'", scopeId, authMethod.Id, amType)
|
||||
}
|
||||
|
||||
return authMethod.Id, nil
|
||||
}
|
||||
|
||||
// find the primary auth method that matches auth method prefix
|
||||
for _, m := range authMethodItems {
|
||||
if m.IsPrimary {
|
||||
if !strings.HasPrefix(m.Id, amType) {
|
||||
return "", fmt.Errorf("error looking up primary auth method for scope ID: '%s'. got '%s' but the provider requires an auth method prefix of '%s'", scopeId, m.Id, amType)
|
||||
}
|
||||
|
||||
return m.Id, nil
|
||||
}
|
||||
}
|
||||
return "", fmt.Errorf("default auth method not found for scope ID: '%s'. Please set a primary auth method on this scope or pass one explicitly using the `auth_method_id` field", scopeId)
|
||||
}
|
||||
@@ -8,20 +8,14 @@ import (
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"fmt"
|
||||
"regexp"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/boundary/testing/controller"
|
||||
"github.com/hashicorp/cap/ldap"
|
||||
"github.com/hashicorp/cap/oidc"
|
||||
wrapping "github.com/hashicorp/go-kms-wrapping/v2"
|
||||
"github.com/hashicorp/go-kms-wrapping/v2/aead"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
|
||||
"github.com/jimlambrt/gldap"
|
||||
"github.com/jimlambrt/gldap/testdirectory"
|
||||
)
|
||||
|
||||
var (
|
||||
@@ -104,46 +98,13 @@ provider "boundary" {
|
||||
return strings.Join(c, "\n")
|
||||
}
|
||||
|
||||
func testConfigWithDefaultAuthMethod(url string, res ...string) string {
|
||||
provider := fmt.Sprintf(`
|
||||
provider "boundary" {
|
||||
addr = "%s"
|
||||
password_auth_method_login_name = "%s"
|
||||
password_auth_method_password = "%s"
|
||||
}`, url, tcLoginName, tcPassword)
|
||||
|
||||
c := []string{provider}
|
||||
c = append(c, res...)
|
||||
return strings.Join(c, "\n")
|
||||
}
|
||||
|
||||
func testConfigWithOIDCAuthMethod(url string, res ...string) string {
|
||||
provider := fmt.Sprintf(`
|
||||
provider "boundary" {
|
||||
addr = "%s"
|
||||
auth_method_id = "amoidc_0000000000"
|
||||
}`, url)
|
||||
|
||||
c := []string{provider}
|
||||
c = append(c, res...)
|
||||
return strings.Join(c, "\n")
|
||||
}
|
||||
|
||||
func testConfigWithoutAMPWCredentials(url string, res ...string) string {
|
||||
provider := fmt.Sprintf(`
|
||||
provider "boundary" {
|
||||
addr = "%s"
|
||||
}`, url)
|
||||
|
||||
c := []string{provider}
|
||||
c = append(c, res...)
|
||||
return strings.Join(c, "\n")
|
||||
}
|
||||
|
||||
func testConfigWithRecovery(url string, res ...string) string {
|
||||
provider := fmt.Sprintf(`
|
||||
provider "boundary" {
|
||||
addr = "%s"
|
||||
auth_method_id = "%s"
|
||||
password_auth_method_login_name = "%s"
|
||||
password_auth_method_password = "%s"
|
||||
recovery_kms_hcl = <<DOC
|
||||
kms "aead" {
|
||||
purpose = ["recovery", "config"]
|
||||
@@ -152,20 +113,7 @@ provider "boundary" {
|
||||
key_id = "global_recovery"
|
||||
}
|
||||
DOC
|
||||
}`, url)
|
||||
|
||||
c := []string{provider}
|
||||
c = append(c, res...)
|
||||
return strings.Join(c, "\n")
|
||||
}
|
||||
|
||||
func testConfigWithLDAPAuthMethod(url string, loginName string, password string, res ...string) string {
|
||||
provider := fmt.Sprintf(`
|
||||
provider "boundary" {
|
||||
addr = "%s"
|
||||
auth_method_login_name = "%s"
|
||||
auth_method_password = "%s"
|
||||
}`, url, loginName, password)
|
||||
}`, url, tcPAUM, tcLoginName, tcPassword)
|
||||
|
||||
c := []string{provider}
|
||||
c = append(c, res...)
|
||||
@@ -191,188 +139,3 @@ func TestProvider(t *testing.T) {
|
||||
t.Fatalf("err: %s", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestConfigWithLdapAuthMethod(t *testing.T) {
|
||||
td := createDefaultLdap(t)
|
||||
defer td.Stop()
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
ldapLoginName := "alice"
|
||||
ldapPassword := "password"
|
||||
|
||||
createLdapAMConfig := fmt.Sprintf(testPrimaryAuthMethodLdap, td.Host(), td.Port(), testdirectory.DefaultUserDN, testdirectory.DefaultGroupDN)
|
||||
createLdapAccountConfig := fmt.Sprintf(testProviderLdapAccountConfig, ldapLoginName)
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
CheckDestroy: testAccCheckAuthMethodResourceDestroy(t, provider, ldapAuthMethodType),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
// create ldap auth method
|
||||
Config: testConfig(url, fooOrg, createLdapAMConfig, createLdapAccountConfig),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "true"),
|
||||
),
|
||||
},
|
||||
{
|
||||
// authenticate with LDAP auth method and ensure auth token exists
|
||||
Config: testConfigWithLDAPAuthMethod(url, ldapLoginName, ldapPassword, fooOrg, createLdapAMConfig, createLdapAccountConfig),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
testProviderTokenExists(provider),
|
||||
),
|
||||
},
|
||||
{
|
||||
// check if authentication with password auth method works after
|
||||
Config: testConfig(url, fooOrg),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
testProviderTokenExists(provider),
|
||||
),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func TestConfigWithDefaultAuthMethod(t *testing.T) {
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
IsUnitTest: true,
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
CheckDestroy: testAccCheckScopeResourceDestroy(t, provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
Config: testConfigWithDefaultAuthMethod(url, fooOrg, firstProjectFoo, secondProject),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
|
||||
testProviderTokenExists(provider),
|
||||
),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func TestConfigWithoutAMPWCredentials(t *testing.T) {
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
IsUnitTest: true,
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
Config: testConfigWithoutAMPWCredentials(url, fooOrg, firstProjectFoo, secondProject),
|
||||
ExpectError: regexp.MustCompile("auth method login name not set, please set auth_method_login_name on the provider"),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func TestConfigWithOIDCAuthMethod(t *testing.T) {
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
IsUnitTest: true,
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
Config: testConfigWithOIDCAuthMethod(url, fooOrg, firstProjectFoo, secondProject),
|
||||
ExpectError: regexp.MustCompile("OIDC auth method is currently not supported by Boundary Terraform Provider. only password auth method is supported at this time"),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
// Create OIDC auth method and set it as the primary auth method.
|
||||
// Attempt to authenticate with recovery to test checks for default auth method
|
||||
func TestRecoveryWithOIDCDefaultAuthMethod(t *testing.T) {
|
||||
tp := oidc.StartTestProvider(t)
|
||||
wrapper := testWrapper(context.Background(), t, tcRecoveryKey)
|
||||
tc := controller.NewTestController(t, append(tcConfig, controller.WithRecoveryKms(wrapper))...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
tpCert := strings.TrimSpace(tp.CACert())
|
||||
createConfig := fmt.Sprintf(fooAuthMethodOidc, fooAuthMethodOidcDesc, tp.Addr(), tpCert)
|
||||
updateConfig := fmt.Sprintf(fooAuthMethodOidcUpdate, fooAuthMethodOidcDescUpdate, fooAuthMethodOidcCaCerts)
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
CheckDestroy: testAccCheckAuthMethodResourceDestroy(t, provider, oidcAuthMethodType),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
// create auth method
|
||||
Config: testConfig(url, fooOrg, createConfig),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "description", fooAuthMethodOidcDesc),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcIssuerKey, tp.Addr()),
|
||||
),
|
||||
},
|
||||
importStep("boundary_auth_method_oidc.foo", "client_secret", "is_primary_for_scope"),
|
||||
{
|
||||
// set auth method as primary auth method
|
||||
Config: testConfig(url, fooOrg, updateConfig),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
|
||||
testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", true),
|
||||
),
|
||||
},
|
||||
{
|
||||
// authenticate provider with recovery kms with unsupported OIDC primary auth method
|
||||
Config: testConfigWithRecovery(url, fooOrg, updateConfig),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
|
||||
testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", true),
|
||||
),
|
||||
},
|
||||
importStep("boundary_auth_method_oidc.foo", "client_secret", "is_primary_for_scope", authmethodOidcMaxAgeKey),
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func testProviderTokenExists(testProvider *schema.Provider) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
md := testProvider.Meta().(*metaData)
|
||||
if md.client.Token() == "" {
|
||||
return fmt.Errorf("token not set")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
func createDefaultLdap(t *testing.T) *testdirectory.Directory {
|
||||
td := testdirectory.Start(t,
|
||||
testdirectory.WithDefaults(t, &testdirectory.Defaults{AllowAnonymousBind: true}),
|
||||
testdirectory.WithNoTLS(t),
|
||||
)
|
||||
|
||||
groups := []*gldap.Entry{
|
||||
testdirectory.NewGroup(t, "admin", []string{"alice"}),
|
||||
}
|
||||
|
||||
users := testdirectory.NewUsers(t, []string{"alice"}, testdirectory.WithMembersOf(t, "admin"))
|
||||
|
||||
for _, u := range users {
|
||||
u.Attributes = append(u.Attributes,
|
||||
gldap.NewEntryAttribute(ldap.DefaultADUserPasswordAttribute, []string{"password"}),
|
||||
gldap.NewEntryAttribute(ldap.DefaultOpenLDAPUserPasswordAttribute, []string{"password"}),
|
||||
gldap.NewEntryAttribute("fullName", []string{"test-full-name"}),
|
||||
)
|
||||
}
|
||||
|
||||
td.SetUsers(users...)
|
||||
td.SetGroups(groups...)
|
||||
|
||||
return td
|
||||
}
|
||||
@@ -1,248 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
|
||||
"github.com/hashicorp/boundary/api"
|
||||
"github.com/hashicorp/boundary/api/accounts"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
)
|
||||
|
||||
const (
|
||||
accountTypeLdap = "ldap"
|
||||
)
|
||||
|
||||
func resourceAccountLdap() *schema.Resource {
|
||||
return &schema.Resource{
|
||||
Description: "The account resource allows you to configure a Boundary account.",
|
||||
|
||||
CreateContext: resourceAccountLdapCreate,
|
||||
ReadContext: resourceAccountLdapRead,
|
||||
UpdateContext: resourceAccountLdapUpdate,
|
||||
DeleteContext: resourceAccountDelete,
|
||||
Importer: &schema.ResourceImporter{
|
||||
StateContext: schema.ImportStatePassthroughContext,
|
||||
},
|
||||
|
||||
Schema: map[string]*schema.Schema{
|
||||
IDKey: {
|
||||
Description: "The ID of the account.",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
NameKey: {
|
||||
Description: "The account name. Defaults to the resource name.",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
DescriptionKey: {
|
||||
Description: "The account description.",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
AuthMethodIdKey: {
|
||||
Description: "The resource ID for the auth method.",
|
||||
Type: schema.TypeString,
|
||||
Required: true,
|
||||
ForceNew: true,
|
||||
},
|
||||
TypeKey: {
|
||||
Description: "The resource type.",
|
||||
Type: schema.TypeString,
|
||||
Deprecated: "The value for this field will be infered since 'ldap' is the only possible value.",
|
||||
Default: accountTypeLdap,
|
||||
Optional: true,
|
||||
ForceNew: true,
|
||||
},
|
||||
accountLoginNameKey: {
|
||||
Description: "The login name for this account.",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
ForceNew: true,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func setFromAccountLdapResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
|
||||
if err := d.Set(NameKey, raw["name"]); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(DescriptionKey, raw["description"]); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(AuthMethodIdKey, raw["auth_method_id"]); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(TypeKey, raw["type"]); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
switch raw["type"].(string) {
|
||||
case accountTypeLdap:
|
||||
if attrsVal, ok := raw["attributes"]; ok {
|
||||
attrs := attrsVal.(map[string]interface{})
|
||||
if err := d.Set(accountLoginNameKey, attrs["login_name"]); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
d.SetId(raw["id"].(string))
|
||||
return nil
|
||||
}
|
||||
|
||||
func resourceAccountLdapCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
|
||||
md := meta.(*metaData)
|
||||
|
||||
var authMethodId string
|
||||
if authMethodIdVal, ok := d.GetOk(AuthMethodIdKey); ok {
|
||||
authMethodId = authMethodIdVal.(string)
|
||||
} else {
|
||||
return diag.Errorf("no auth method ID provided")
|
||||
}
|
||||
|
||||
var loginName *string
|
||||
if keyVal, ok := d.GetOk(accountLoginNameKey); ok {
|
||||
key := keyVal.(string)
|
||||
loginName = &key
|
||||
}
|
||||
|
||||
opts := []accounts.Option{}
|
||||
|
||||
var typeStr string
|
||||
if typeVal, ok := d.GetOk(TypeKey); ok {
|
||||
typeStr = typeVal.(string)
|
||||
} else {
|
||||
return diag.Errorf("no type provided")
|
||||
}
|
||||
switch typeStr {
|
||||
case accountTypeLdap:
|
||||
if loginName != nil {
|
||||
opts = append(opts, accounts.WithLdapAccountLoginName(*loginName))
|
||||
}
|
||||
default:
|
||||
return diag.Errorf("invalid type provided")
|
||||
}
|
||||
|
||||
nameVal, ok := d.GetOk(NameKey)
|
||||
if ok {
|
||||
nameStr := nameVal.(string)
|
||||
opts = append(opts, accounts.WithName(nameStr))
|
||||
}
|
||||
|
||||
descVal, ok := d.GetOk(DescriptionKey)
|
||||
if ok {
|
||||
descStr := descVal.(string)
|
||||
opts = append(opts, accounts.WithDescription(descStr))
|
||||
}
|
||||
|
||||
aClient := accounts.NewClient(md.client)
|
||||
|
||||
acr, err := aClient.Create(ctx, authMethodId, opts...)
|
||||
if err != nil {
|
||||
return diag.Errorf("error creating account: %v", err)
|
||||
}
|
||||
if acr == nil {
|
||||
return diag.Errorf("nil account after create")
|
||||
}
|
||||
|
||||
if err := setFromAccountLdapResponseMap(d, acr.GetResponse().Map); err != nil {
|
||||
return diag.FromErr(err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func resourceAccountLdapRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
|
||||
md := meta.(*metaData)
|
||||
aClient := accounts.NewClient(md.client)
|
||||
|
||||
arr, err := aClient.Read(ctx, d.Id())
|
||||
if err != nil {
|
||||
if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
|
||||
d.SetId("")
|
||||
return nil
|
||||
}
|
||||
return diag.Errorf("error reading account: %v", err)
|
||||
}
|
||||
if arr == nil {
|
||||
return diag.Errorf("account nil after read")
|
||||
}
|
||||
|
||||
if err := setFromAccountLdapResponseMap(d, arr.GetResponse().Map); err != nil {
|
||||
return diag.FromErr(err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func resourceAccountLdapUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
|
||||
md := meta.(*metaData)
|
||||
aClient := accounts.NewClient(md.client)
|
||||
|
||||
opts := []accounts.Option{}
|
||||
|
||||
var name *string
|
||||
if d.HasChange(NameKey) {
|
||||
opts = append(opts, accounts.DefaultName())
|
||||
nameVal, ok := d.GetOk(NameKey)
|
||||
if ok {
|
||||
nameStr := nameVal.(string)
|
||||
name = &nameStr
|
||||
opts = append(opts, accounts.WithName(nameStr))
|
||||
}
|
||||
}
|
||||
|
||||
var desc *string
|
||||
if d.HasChange(DescriptionKey) {
|
||||
opts = append(opts, accounts.DefaultDescription())
|
||||
descVal, ok := d.GetOk(DescriptionKey)
|
||||
if ok {
|
||||
descStr := descVal.(string)
|
||||
desc = &descStr
|
||||
opts = append(opts, accounts.WithDescription(descStr))
|
||||
}
|
||||
}
|
||||
|
||||
var loginName *string
|
||||
if d.HasChange(accountLoginNameKey) {
|
||||
switch d.Get(TypeKey).(string) {
|
||||
case accountTypeLdap:
|
||||
opts = append(opts, accounts.DefaultLdapAccountLoginName())
|
||||
keyVal, ok := d.GetOk(accountLoginNameKey)
|
||||
if ok {
|
||||
keyStr := keyVal.(string)
|
||||
loginName = &keyStr
|
||||
opts = append(opts, accounts.WithLdapAccountLoginName(keyStr))
|
||||
}
|
||||
default:
|
||||
return diag.Errorf(`"login_name" cannot be used with this type of account`)
|
||||
}
|
||||
}
|
||||
|
||||
if len(opts) > 0 {
|
||||
opts = append(opts, accounts.WithAutomaticVersioning(true))
|
||||
_, err := aClient.Update(ctx, d.Id(), 0, opts...)
|
||||
if err != nil {
|
||||
return diag.Errorf("error updating account: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(NameKey) {
|
||||
d.Set(NameKey, name)
|
||||
}
|
||||
if d.HasChange(DescriptionKey) {
|
||||
d.Set(DescriptionKey, desc)
|
||||
}
|
||||
if d.HasChange(accountLoginNameKey) {
|
||||
d.Set(accountLoginNameKey, loginName)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
@@ -1,150 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/boundary/testing/controller"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
)
|
||||
|
||||
const (
|
||||
testAccountLdapDesc = "test account"
|
||||
testAccountLdapDescUpdate = "test account update"
|
||||
testAccountLdapName = "test account name"
|
||||
testAccountLdapNameUpdate = "test account name updated"
|
||||
)
|
||||
|
||||
var (
|
||||
testAccountLdap = fmt.Sprintf(`
|
||||
resource "boundary_auth_method_ldap" "foo" {
|
||||
name = "test"
|
||||
description = "test account"
|
||||
type = "ldap"
|
||||
scope_id = boundary_scope.org1.id
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
|
||||
urls = ["ldaps://ldap1", "ldaps://ldap2"]
|
||||
}
|
||||
|
||||
resource "boundary_account_ldap" "foo" {
|
||||
name = "%s"
|
||||
description = "%s"
|
||||
type = "ldap"
|
||||
login_name = "foo"
|
||||
auth_method_id = boundary_auth_method_ldap.foo.id
|
||||
}`, testAccountLdapName, testAccountLdapDesc)
|
||||
|
||||
testAccountLdapUpdate = fmt.Sprintf(`
|
||||
resource "boundary_auth_method_ldap" "foo" {
|
||||
name = "test"
|
||||
description = "test account"
|
||||
type = "ldap"
|
||||
scope_id = boundary_scope.org1.id
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
urls = ["ldaps://ldap1", "ldaps://ldap2"]
|
||||
}
|
||||
|
||||
resource "boundary_account_ldap" "foo" {
|
||||
name = "%s"
|
||||
description = "%s"
|
||||
type = "ldap"
|
||||
login_name = "foo"
|
||||
auth_method_id = boundary_auth_method_ldap.foo.id
|
||||
}`, testAccountLdapNameUpdate, testAccountLdapDescUpdate)
|
||||
|
||||
testAccountLdapWithoutTypeField = fmt.Sprintf(`
|
||||
resource "boundary_auth_method_ldap" "foo" {
|
||||
name = "test"
|
||||
description = "test account"
|
||||
type = "ldap"
|
||||
scope_id = boundary_scope.org1.id
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
urls = ["ldaps://ldap1", "ldaps://ldap2"]
|
||||
}
|
||||
|
||||
resource "boundary_account_ldap" "foo" {
|
||||
name = "%s"
|
||||
description = "%s"
|
||||
login_name = "foo"
|
||||
auth_method_id = boundary_auth_method_ldap.foo.id
|
||||
}`, testAccountLdapNameUpdate, testAccountLdapDescUpdate)
|
||||
|
||||
testProviderLdapAccountConfig = `
|
||||
resource "boundary_account_ldap" "test-ldap" {
|
||||
name = "alice"
|
||||
description = "test"
|
||||
type = "ldap"
|
||||
login_name = "%s"
|
||||
auth_method_id = boundary_auth_method_ldap.test-ldap.id
|
||||
}
|
||||
|
||||
resource "boundary_user" "alice" {
|
||||
name = "alice"
|
||||
description = "test user resource"
|
||||
account_ids = [boundary_account_ldap.test-ldap.id]
|
||||
scope_id = boundary_scope.global.id
|
||||
}
|
||||
|
||||
resource "boundary_role" "ldap_principal" {
|
||||
scope_id = boundary_scope.global.id
|
||||
grant_scope_id = boundary_scope.global.id
|
||||
grant_strings = ["ids=*;type=*;actions=*"]
|
||||
principal_ids = [boundary_user.alice.id]
|
||||
}`
|
||||
)
|
||||
|
||||
func TestAccLdapAccount(t *testing.T) {
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
var provider *schema.Provider
|
||||
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
CheckDestroy: testAccCheckAccountResourceDestroy(t, provider, baseAccountType),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
// create
|
||||
Config: testConfig(url, fooOrg, testAccountLdap),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDesc),
|
||||
resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapName),
|
||||
resource.TestCheckResourceAttr("boundary_account_ldap.foo", "type", "ldap"),
|
||||
resource.TestCheckResourceAttr("boundary_account_ldap.foo", "login_name", "foo"),
|
||||
testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
|
||||
),
|
||||
},
|
||||
importStep("boundary_account_ldap.foo", "ldap"),
|
||||
{
|
||||
// update
|
||||
Config: testConfig(url, fooOrg, testAccountLdapUpdate),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDescUpdate),
|
||||
resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapNameUpdate),
|
||||
resource.TestCheckResourceAttr("boundary_account_ldap.foo", "type", "ldap"),
|
||||
resource.TestCheckResourceAttr("boundary_account_ldap.foo", "login_name", "foo"),
|
||||
testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
|
||||
),
|
||||
},
|
||||
importStep("boundary_account_ldap.foo", "ldap"),
|
||||
{
|
||||
// update without passing type field
|
||||
Config: testConfig(url, fooOrg, testAccountLdapWithoutTypeField),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDescUpdate),
|
||||
resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapNameUpdate),
|
||||
resource.TestCheckResourceAttr("boundary_account_ldap.foo", "type", "ldap"),
|
||||
resource.TestCheckResourceAttr("boundary_account_ldap.foo", "login_name", "foo"),
|
||||
testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
|
||||
),
|
||||
},
|
||||
importStep("boundary_account_ldap.foo", "ldap"),
|
||||
},
|
||||
})
|
||||
}
|
||||
@@ -1,95 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/boundary/testing/controller"
|
||||
"github.com/hashicorp/cap/oidc"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
)
|
||||
|
||||
const (
|
||||
fooAccountOidcDesc = "test account oidc"
|
||||
fooAccountOidcDescUpdate = "test account oidc update"
|
||||
)
|
||||
|
||||
var fooAccountOidc = `
|
||||
resource "boundary_auth_method_oidc" "foo" {
|
||||
name = "test"
|
||||
description = "test account oidc auth method"
|
||||
scope_id = boundary_scope.org1.id
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
|
||||
issuer = "%s"
|
||||
client_id = "foo_id"
|
||||
client_secret = "foo_secret"
|
||||
max_age = 0
|
||||
api_url_prefix = "http://localhost:9200"
|
||||
idp_ca_certs = [
|
||||
<<EOT
|
||||
%s
|
||||
EOT
|
||||
]
|
||||
allowed_audiences = ["foo_aud"]
|
||||
signing_algorithms = ["ES256"]
|
||||
account_claim_maps = ["oid=sub"]
|
||||
claims_scopes = ["profile"]
|
||||
}
|
||||
|
||||
resource "boundary_account_oidc" "foo" {
|
||||
name = "test"
|
||||
description = "%s"
|
||||
subject = "%s"
|
||||
issuer = "%s"
|
||||
auth_method_id = boundary_auth_method_oidc.foo.id
|
||||
}`
|
||||
|
||||
func TestAccOidcAccount(t *testing.T) {
|
||||
tp := oidc.StartTestProvider(t)
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
var provider *schema.Provider
|
||||
|
||||
tpCert := strings.TrimSpace(tp.CACert())
|
||||
createConfig := fmt.Sprintf(fooAccountOidc, tp.Addr(), tpCert, fooAccountOidcDesc, tp.ExpectedSubject(), tp.Addr())
|
||||
updateConfig := fmt.Sprintf(fooAccountOidc, tp.Addr(), tpCert, fooAccountOidcDescUpdate, tp.ExpectedSubject(), tp.Addr())
|
||||
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
CheckDestroy: testAccCheckAccountResourceDestroy(t, provider, oidcAccountType),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
// create
|
||||
Config: testConfig(url, fooOrg, createConfig),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "description", fooAccountOidcDesc),
|
||||
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "name", "test"),
|
||||
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "issuer", tp.Addr()),
|
||||
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "subject", tp.ExpectedSubject()),
|
||||
testAccCheckAccountResourceExists(provider, "boundary_account_oidc.foo"),
|
||||
),
|
||||
},
|
||||
importStep("boundary_account_oidc.foo", "oidc"),
|
||||
{
|
||||
// update
|
||||
Config: testConfig(url, fooOrg, updateConfig),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "description", fooAccountOidcDescUpdate),
|
||||
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "name", "test"),
|
||||
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "issuer", tp.Addr()),
|
||||
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "subject", tp.ExpectedSubject()),
|
||||
testAccCheckAccountResourceExists(provider, "boundary_account_oidc.foo"),
|
||||
),
|
||||
},
|
||||
importStep("boundary_account_oidc.foo", "oidc"),
|
||||
},
|
||||
})
|
||||
}
|
||||
@@ -56,9 +56,7 @@ func resourceAccountPassword() *schema.Resource {
|
||||
TypeKey: {
|
||||
Description: "The resource type.",
|
||||
Type: schema.TypeString,
|
||||
Deprecated: "The value for this field will be infered since 'password' is the only possible value.",
|
||||
Default: accountTypePassword,
|
||||
Optional: true,
|
||||
Required: true,
|
||||
ForceNew: true,
|
||||
},
|
||||
accountLoginNameKey: {
|
||||
|
||||
@@ -4,12 +4,17 @@
|
||||
package provider
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/boundary/api"
|
||||
"github.com/hashicorp/boundary/api/accounts"
|
||||
"github.com/hashicorp/boundary/testing/controller"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
|
||||
)
|
||||
|
||||
const (
|
||||
@@ -53,23 +58,6 @@ resource "boundary_account_password" "foo" {
|
||||
password = "foofoofoo"
|
||||
auth_method_id = boundary_auth_method.foo.id
|
||||
}`, fooAccountPasswordDescUpdate)
|
||||
|
||||
fooAccountPasswordWithoutTypeField = fmt.Sprintf(`
|
||||
resource "boundary_auth_method" "foo" {
|
||||
name = "test"
|
||||
description = "test account"
|
||||
type = "password"
|
||||
scope_id = boundary_scope.org1.id
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
}
|
||||
|
||||
resource "boundary_account_password" "foo" {
|
||||
name = "test"
|
||||
description = "%s"
|
||||
login_name = "foo"
|
||||
password = "foofoofoo"
|
||||
auth_method_id = boundary_auth_method.foo.id
|
||||
}`, fooAccountPasswordDescUpdate)
|
||||
)
|
||||
|
||||
func TestAccAccount(t *testing.T) {
|
||||
@@ -81,7 +69,7 @@ func TestAccAccount(t *testing.T) {
|
||||
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
CheckDestroy: testAccCheckAccountResourceDestroy(t, provider, passwordAccountType),
|
||||
CheckDestroy: testAccCheckAccountPasswordResourceDestroy(t, provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
// create
|
||||
@@ -92,7 +80,7 @@ func TestAccAccount(t *testing.T) {
|
||||
resource.TestCheckResourceAttr("boundary_account_password.foo", "type", "password"),
|
||||
resource.TestCheckResourceAttr("boundary_account_password.foo", "login_name", "foo"),
|
||||
resource.TestCheckResourceAttr("boundary_account_password.foo", "password", "foofoofoo"),
|
||||
testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
|
||||
testAccCheckAccountPasswordResourceExists(provider, "boundary_account_password.foo"),
|
||||
),
|
||||
},
|
||||
importStep("boundary_account_password.foo", "password"),
|
||||
@@ -105,23 +93,61 @@ func TestAccAccount(t *testing.T) {
|
||||
resource.TestCheckResourceAttr("boundary_account_password.foo", "type", "password"),
|
||||
resource.TestCheckResourceAttr("boundary_account_password.foo", "login_name", "foo"),
|
||||
resource.TestCheckResourceAttr("boundary_account_password.foo", "password", "foofoofoo"),
|
||||
testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
|
||||
),
|
||||
},
|
||||
importStep("boundary_account_password.foo", "password"),
|
||||
{
|
||||
// update without passing type field
|
||||
Config: testConfig(url, fooOrg, fooAccountPasswordWithoutTypeField),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr("boundary_account_password.foo", "description", fooAccountPasswordDescUpdate),
|
||||
resource.TestCheckResourceAttr("boundary_account_password.foo", "name", "test"),
|
||||
resource.TestCheckResourceAttr("boundary_account_password.foo", "type", "password"),
|
||||
resource.TestCheckResourceAttr("boundary_account_password.foo", "login_name", "foo"),
|
||||
resource.TestCheckResourceAttr("boundary_account_password.foo", "password", "foofoofoo"),
|
||||
testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
|
||||
testAccCheckAccountPasswordResourceExists(provider, "boundary_account_password.foo"),
|
||||
),
|
||||
},
|
||||
importStep("boundary_account_password.foo", "password"),
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func testAccCheckAccountPasswordResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
rs, ok := s.RootModule().Resources[name]
|
||||
if !ok {
|
||||
return fmt.Errorf("Not found: %s", name)
|
||||
}
|
||||
|
||||
id := rs.Primary.ID
|
||||
if id == "" {
|
||||
return fmt.Errorf("No ID is set")
|
||||
}
|
||||
|
||||
md := testProvider.Meta().(*metaData)
|
||||
|
||||
amClient := accounts.NewClient(md.client)
|
||||
|
||||
if _, err := amClient.Read(context.Background(), id); err != nil {
|
||||
return fmt.Errorf("Got an error when reading account %q: %v", id, err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
func testAccCheckAccountPasswordResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
if testProvider.Meta() == nil {
|
||||
t.Fatal("got nil provider metadata")
|
||||
}
|
||||
md := testProvider.Meta().(*metaData)
|
||||
|
||||
for _, rs := range s.RootModule().Resources {
|
||||
switch rs.Type {
|
||||
case "boundary_account_password":
|
||||
id := rs.Primary.ID
|
||||
|
||||
amClient := accounts.NewClient(md.client)
|
||||
|
||||
_, err := amClient.Read(context.Background(), id)
|
||||
if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
|
||||
return fmt.Errorf("didn't get a 404 when reading destroyed account %q: %v", id, err)
|
||||
}
|
||||
|
||||
default:
|
||||
continue
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
}
|
||||
@@ -69,7 +69,7 @@ func TestAccAccountBase(t *testing.T) {
|
||||
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
CheckDestroy: testAccCheckAccountResourceDestroy(t, provider, baseAccountType),
|
||||
CheckDestroy: testAccCheckAccountResourceDestroy(t, provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
// create
|
||||
@@ -125,15 +125,7 @@ func testAccCheckAccountResourceExists(testProvider *schema.Provider, name strin
|
||||
}
|
||||
}
|
||||
|
||||
type accountType string
|
||||
|
||||
const (
|
||||
baseAccountType accountType = "boundary_account"
|
||||
passwordAccountType accountType = "boundary_account_password"
|
||||
oidcAccountType accountType = "boundary_account_oidc"
|
||||
)
|
||||
|
||||
func testAccCheckAccountResourceDestroy(t *testing.T, testProvider *schema.Provider, typ accountType) resource.TestCheckFunc {
|
||||
func testAccCheckAccountResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
if testProvider.Meta() == nil {
|
||||
t.Fatal("got nil provider metadata")
|
||||
@@ -142,7 +134,7 @@ func testAccCheckAccountResourceDestroy(t *testing.T, testProvider *schema.Provi
|
||||
|
||||
for _, rs := range s.RootModule().Resources {
|
||||
switch rs.Type {
|
||||
case string(typ):
|
||||
case "boundary_account":
|
||||
id := rs.Primary.ID
|
||||
|
||||
amClient := accounts.NewClient(md.client)
|
||||
|
||||
@@ -1,865 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
|
||||
"github.com/hashicorp/boundary/api"
|
||||
"github.com/hashicorp/boundary/api/authmethods"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
)
|
||||
|
||||
const (
|
||||
authMethodTypeLdap = "ldap"
|
||||
|
||||
authMethodLdapStartTlsField = "start_tls"
|
||||
authMethodLdapInsecureTlsField = "insecure_tls"
|
||||
authMethodLdapDiscoverDnField = "discover_dn"
|
||||
authMethodLdapAnonGrpSearchField = "anon_group_search"
|
||||
authMethodLdapUpnDomainField = "upn_domain"
|
||||
authMethodLdapUrlsField = "urls"
|
||||
authMethodLdapUserDnField = "user_dn"
|
||||
authMethodLdapUserAttrField = "user_attr"
|
||||
authMethodLdapUserFilterField = "user_filter"
|
||||
authMethodLdapEnableGrpsField = "enable_groups"
|
||||
authMethodLdapGroupDnField = "group_dn"
|
||||
authMethodLdapGroupAttrField = "group_attr"
|
||||
authMethodLdapGroupFilterField = "group_filter"
|
||||
authMethodLdapCertificatesField = "certificates"
|
||||
authMethodLdapClientCertField = "client_certificate"
|
||||
authMethodLdapClientCertKeyField = "client_certificate_key"
|
||||
authMethodLdapBindDnField = "bind_dn"
|
||||
authMethodLdapBindPasswordField = "bind_password"
|
||||
authMethodLdapUseTokenGrpsField = "use_token_groups"
|
||||
authMethodLdapAccountAttrMapsField = "account_attribute_maps"
|
||||
authMethodLdapPrimaryAuthMethodForScopeField = "is_primary_for_scope"
|
||||
authMethodLdapStateField = "state"
|
||||
authMethodLdapMaxPageSizeField = "maximum_page_size"
|
||||
authMethodLdapDerefAliasesField = "dereference_aliases"
|
||||
|
||||
// computed-only parameters
|
||||
authMethodLdapClientCertKeyHmacKey = "client_certificate_key_hmac"
|
||||
authMethodLdapBindPasswordHmacKey = "bind_password_hmac"
|
||||
)
|
||||
|
||||
func resourceAuthMethodLdap() *schema.Resource {
|
||||
return &schema.Resource{
|
||||
Description: "The LDAP auth method resource allows you to configure a Boundary auth_method_ldap.",
|
||||
|
||||
CreateContext: resourceAuthMethodLdapCreate,
|
||||
ReadContext: resourceAuthMethodLdapRead,
|
||||
UpdateContext: resourceAuthMethodLdapUpdate,
|
||||
DeleteContext: resourceAuthMethodDelete,
|
||||
Importer: &schema.ResourceImporter{
|
||||
StateContext: schema.ImportStatePassthroughContext,
|
||||
},
|
||||
|
||||
Schema: map[string]*schema.Schema{
|
||||
IDKey: {
|
||||
Description: "The ID of the auth method.",
|
||||
Type: schema.TypeString,
|
||||
Computed: true,
|
||||
},
|
||||
NameKey: {
|
||||
Description: "The auth method name. Defaults to the resource name.",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
DescriptionKey: {
|
||||
Description: "The auth method description.",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
ScopeIdKey: {
|
||||
Description: "The scope ID.",
|
||||
Type: schema.TypeString,
|
||||
Required: true,
|
||||
ForceNew: true,
|
||||
},
|
||||
|
||||
// LDAP specific configurable parameters
|
||||
authMethodLdapStartTlsField: {
|
||||
Description: "Issue StartTLS command after connecting (optional).",
|
||||
Type: schema.TypeBool,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapInsecureTlsField: {
|
||||
Description: "Skip the LDAP server SSL certificate validation (optional) - insecure and use with caution.",
|
||||
Type: schema.TypeBool,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapDiscoverDnField: {
|
||||
Description: "Use anon bind to discover the bind DN of a user (optional).",
|
||||
Type: schema.TypeBool,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapAnonGrpSearchField: {
|
||||
Description: "Use anon bind when performing LDAP group searches (optional).",
|
||||
Type: schema.TypeBool,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapUpnDomainField: {
|
||||
Description: "The userPrincipalDomain used to construct the UPN string for the authenticating user (optional).",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapUrlsField: {
|
||||
Description: "The LDAP URLs that specify LDAP servers to connect to (required). May be specified multiple times.",
|
||||
Type: schema.TypeList,
|
||||
Elem: &schema.Schema{
|
||||
Type: schema.TypeString,
|
||||
},
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapUserDnField: {
|
||||
Description: "The base DN under which to perform user search (optional).",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapUserAttrField: {
|
||||
Description: "The attribute on user entry matching the username passed when authenticating (optional).",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapUserFilterField: {
|
||||
Description: "A go template used to construct a LDAP user search filter (optional).",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapEnableGrpsField: {
|
||||
Description: "Find the authenticated user's groups during authentication (optional).",
|
||||
Type: schema.TypeBool,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapGroupDnField: {
|
||||
Description: "The base DN under which to perform group search.",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapGroupAttrField: {
|
||||
Description: "The attribute that enumerates a user's group membership from entries returned by a group search (optional).",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapGroupFilterField: {
|
||||
Description: "A go template used to construct a LDAP group search filter (optional).",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapCertificatesField: {
|
||||
Description: "PEM-encoded X.509 CA certificate in ASN.1 DER form that can be used as a trust anchor when connecting to an LDAP server(optional). This may be specified multiple times",
|
||||
Type: schema.TypeList,
|
||||
Elem: &schema.Schema{
|
||||
Type: schema.TypeString,
|
||||
},
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapClientCertField: {
|
||||
Description: "PEM-encoded X.509 client certificate in ASN.1 DER form that can be used to authenticate against an LDAP server(optional).",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapClientCertKeyField: {
|
||||
Description: "PEM-encoded X.509 client certificate key in PKCS #8, ASN.1 DER form used with the client certificate (optional).",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapBindDnField: {
|
||||
Description: "The distinguished name of entry to bind when performing user and group searches (optional).",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapBindPasswordField: {
|
||||
Description: "The password to use along with bind-dn performing user and group searches (optional).",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapUseTokenGrpsField: {
|
||||
Description: "Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships (optional).",
|
||||
Type: schema.TypeBool,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapAccountAttrMapsField: {
|
||||
Description: "Account attribute maps fullname and email.",
|
||||
Type: schema.TypeList,
|
||||
Elem: &schema.Schema{
|
||||
Type: schema.TypeString,
|
||||
},
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapStateField: {
|
||||
Description: "Can be one of 'inactive', 'active-private', or 'active-public'. Defaults to active-public.",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
Computed: true,
|
||||
},
|
||||
authMethodLdapMaxPageSizeField: {
|
||||
Description: "MaximumPageSize specifies a maximum search result size to use when retrieving the authenticated user's groups (optional).",
|
||||
Type: schema.TypeInt,
|
||||
Optional: true,
|
||||
},
|
||||
authMethodLdapDerefAliasesField: {
|
||||
Description: "Control how aliases are dereferenced when performing the search. Can be one of: NeverDerefAliases, DerefInSearching, DerefFindingBaseObj, and DerefAlways (optional).",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
Computed: true,
|
||||
},
|
||||
|
||||
// LDAP specific immutable and computed parameters
|
||||
authMethodLdapClientCertKeyHmacKey: {
|
||||
Description: "The HMAC of the client certificate key returned by the Boundary controller, which is used for comparison after initial setting of the value.",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
Computed: true,
|
||||
},
|
||||
authMethodLdapBindPasswordHmacKey: {
|
||||
Description: "The HMAC of the bind password returned by the Boundary controller, which is used for comparison after initial setting of the value.",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
Computed: true,
|
||||
},
|
||||
|
||||
authMethodLdapPrimaryAuthMethodForScopeField: {
|
||||
Description: "When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an LDAP account.",
|
||||
Type: schema.TypeBool,
|
||||
Optional: true,
|
||||
},
|
||||
|
||||
TypeKey: {
|
||||
Description: "The type of auth method; hardcoded.",
|
||||
Type: schema.TypeString,
|
||||
Default: authMethodTypeLdap,
|
||||
Optional: true,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func setFromLdapAuthMethodResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
|
||||
if err := d.Set(NameKey, raw[NameKey]); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(ScopeIdKey, raw[ScopeIdKey]); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(TypeKey, raw[TypeKey]); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if attrsVal, ok := raw["attributes"]; ok {
|
||||
attrs := attrsVal.(map[string]interface{})
|
||||
|
||||
// these are always set
|
||||
if err := d.Set(authMethodLdapUrlsField, attrs[authMethodLdapUrlsField].([]interface{})); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := d.Set(authMethodLdapStateField, attrs[authMethodLdapStateField].(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// optional attributes
|
||||
if v, ok := attrs[authMethodLdapStartTlsField]; ok {
|
||||
if err := d.Set(authMethodLdapStartTlsField, v.(bool)); err != nil {
|
||||
return err
|
||||
}
|
||||
} else {
|
||||
d.Set(authMethodLdapStartTlsField, false)
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapInsecureTlsField]; ok {
|
||||
if err := d.Set(authMethodLdapInsecureTlsField, v.(bool)); err != nil {
|
||||
return err
|
||||
}
|
||||
} else {
|
||||
if err := d.Set(authMethodLdapInsecureTlsField, false); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapDiscoverDnField]; ok {
|
||||
if err := d.Set(authMethodLdapDiscoverDnField, v.(bool)); err != nil {
|
||||
return err
|
||||
}
|
||||
} else {
|
||||
if err := d.Set(authMethodLdapDiscoverDnField, false); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapAnonGrpSearchField]; ok {
|
||||
if err := d.Set(authMethodLdapAnonGrpSearchField, v.(bool)); err != nil {
|
||||
return err
|
||||
}
|
||||
} else {
|
||||
if err := d.Set(authMethodLdapAnonGrpSearchField, false); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapUpnDomainField]; ok {
|
||||
if err := d.Set(authMethodLdapUpnDomainField, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapUserDnField]; ok {
|
||||
if err := d.Set(authMethodLdapUserDnField, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if v, ok := attrs[authMethodLdapUserAttrField]; ok {
|
||||
if err := d.Set(authMethodLdapUserAttrField, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if v, ok := attrs[authMethodLdapUserFilterField]; ok {
|
||||
if err := d.Set(authMethodLdapUserFilterField, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapEnableGrpsField]; ok {
|
||||
if err := d.Set(authMethodLdapEnableGrpsField, v.(bool)); err != nil {
|
||||
return err
|
||||
}
|
||||
} else {
|
||||
if err := d.Set(authMethodLdapEnableGrpsField, false); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapGroupDnField]; ok {
|
||||
if err := d.Set(authMethodLdapGroupDnField, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if v, ok := attrs[authMethodLdapGroupAttrField]; ok {
|
||||
if err := d.Set(authMethodLdapGroupAttrField, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if v, ok := attrs[authMethodLdapGroupFilterField]; ok {
|
||||
if err := d.Set(authMethodLdapGroupFilterField, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapCertificatesField]; ok {
|
||||
if err := d.Set(authMethodLdapCertificatesField, v.([]interface{})); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapClientCertField]; ok {
|
||||
if err := d.Set(authMethodLdapClientCertField, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapClientCertKeyField]; ok {
|
||||
if err := d.Set(authMethodLdapClientCertKeyField, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapClientCertKeyHmacKey]; ok {
|
||||
if err := d.Set(authMethodLdapClientCertKeyHmacKey, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapBindDnField]; ok {
|
||||
if err := d.Set(authMethodLdapBindDnField, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapBindPasswordField]; ok {
|
||||
if err := d.Set(authMethodLdapBindPasswordField, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapBindPasswordHmacKey]; ok {
|
||||
if err := d.Set(authMethodLdapBindPasswordHmacKey, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapUseTokenGrpsField]; ok {
|
||||
if err := d.Set(authMethodLdapUseTokenGrpsField, v.(bool)); err != nil {
|
||||
return err
|
||||
}
|
||||
} else {
|
||||
if err := d.Set(authMethodLdapUseTokenGrpsField, false); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapAccountAttrMapsField]; ok {
|
||||
if err := d.Set(authMethodLdapAccountAttrMapsField, v.([]interface{})); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapStateField]; ok {
|
||||
if err := d.Set(authMethodLdapStateField, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapMaxPageSizeField]; ok {
|
||||
if err := d.Set(authMethodLdapMaxPageSizeField, v.(json.Number)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := attrs[authMethodLdapDerefAliasesField]; ok {
|
||||
if err := d.Set(authMethodLdapDerefAliasesField, v.(string)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
d.SetId(raw["id"].(string))
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func resourceAuthMethodLdapCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
|
||||
md := meta.(*metaData)
|
||||
|
||||
var typeStr string
|
||||
if typeVal, ok := d.GetOk(TypeKey); ok {
|
||||
typeStr = typeVal.(string)
|
||||
} else {
|
||||
return diag.Errorf("no type provided")
|
||||
}
|
||||
|
||||
opts := []authmethods.Option{}
|
||||
|
||||
opts = append(opts, authmethods.WithAutomaticVersioning(true))
|
||||
|
||||
if rawUrls, ok := d.GetOk(authMethodLdapUrlsField); ok {
|
||||
urls := []string{}
|
||||
for _, u := range rawUrls.([]interface{}) {
|
||||
urls = append(urls, u.(string))
|
||||
}
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodUrls(urls))
|
||||
}
|
||||
|
||||
if startTls, ok := d.GetOk(authMethodLdapStartTlsField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodStartTls(startTls.(bool)))
|
||||
}
|
||||
|
||||
if insecureTls, ok := d.GetOk(authMethodLdapInsecureTlsField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodInsecureTls(insecureTls.(bool)))
|
||||
}
|
||||
|
||||
if discoverDn, ok := d.GetOk(authMethodLdapDiscoverDnField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodDiscoverDn(discoverDn.(bool)))
|
||||
}
|
||||
|
||||
if anonGrpSearch, ok := d.GetOk(authMethodLdapAnonGrpSearchField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodAnonGroupSearch(anonGrpSearch.(bool)))
|
||||
}
|
||||
|
||||
if upnDomain, ok := d.GetOk(authMethodLdapUpnDomainField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodUpnDomain(upnDomain.(string)))
|
||||
}
|
||||
|
||||
if userDn, ok := d.GetOk(authMethodLdapUserDnField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodUserDn(userDn.(string)))
|
||||
}
|
||||
|
||||
if userAttr, ok := d.GetOk(authMethodLdapUserAttrField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodUserAttr(userAttr.(string)))
|
||||
}
|
||||
|
||||
if userFilter, ok := d.GetOk(authMethodLdapUserFilterField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodUserFilter(userFilter.(string)))
|
||||
}
|
||||
|
||||
if enableGrps, ok := d.GetOk(authMethodLdapEnableGrpsField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodEnableGroups(enableGrps.(bool)))
|
||||
}
|
||||
|
||||
if groupDn, ok := d.GetOk(authMethodLdapGroupDnField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodGroupDn(groupDn.(string)))
|
||||
}
|
||||
|
||||
if groupAttr, ok := d.GetOk(authMethodLdapGroupAttrField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodGroupAttr(groupAttr.(string)))
|
||||
}
|
||||
|
||||
if groupFilter, ok := d.GetOk(authMethodLdapGroupFilterField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodGroupFilter(groupFilter.(string)))
|
||||
}
|
||||
|
||||
if rawCerts, ok := d.GetOk(authMethodLdapCertificatesField); ok {
|
||||
certs := []string{}
|
||||
for _, u := range rawCerts.([]interface{}) {
|
||||
certs = append(certs, u.(string))
|
||||
}
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodCertificates(certs))
|
||||
}
|
||||
|
||||
if clientCert, ok := d.GetOk(authMethodLdapClientCertField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodClientCertificate(clientCert.(string)))
|
||||
}
|
||||
|
||||
if clientCertKey, ok := d.GetOk(authMethodLdapClientCertKeyField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodClientCertificateKey(clientCertKey.(string)))
|
||||
}
|
||||
|
||||
if bindDn, ok := d.GetOk(authMethodLdapBindDnField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodBindDn(bindDn.(string)))
|
||||
}
|
||||
|
||||
if bindPassword, ok := d.GetOk(authMethodLdapBindPasswordField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodBindPassword(bindPassword.(string)))
|
||||
}
|
||||
|
||||
if useTokenGrps, ok := d.GetOk(authMethodLdapUseTokenGrpsField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodUseTokenGroups(useTokenGrps.(bool)))
|
||||
}
|
||||
|
||||
if maxPageSize, ok := d.GetOk(authMethodLdapMaxPageSizeField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodMaximumPageSize(uint32(maxPageSize.(int))))
|
||||
}
|
||||
|
||||
if derefAliases, ok := d.GetOk(authMethodLdapDerefAliasesField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodDereferenceAliases(derefAliases.(string)))
|
||||
}
|
||||
|
||||
if rawAccountAttrMaps, ok := d.GetOk(authMethodLdapAccountAttrMapsField); ok {
|
||||
accountAttrMaps := []string{}
|
||||
for _, u := range rawAccountAttrMaps.([]interface{}) {
|
||||
accountAttrMaps = append(accountAttrMaps, u.(string))
|
||||
}
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodAccountAttributeMaps(accountAttrMaps))
|
||||
}
|
||||
|
||||
state, ok := d.GetOk(authMethodLdapStateField)
|
||||
switch ok {
|
||||
case true:
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodState(state.(string)))
|
||||
default:
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodState("active-public"))
|
||||
}
|
||||
|
||||
if nameVal, ok := d.GetOk(NameKey); ok {
|
||||
nameStr := nameVal.(string)
|
||||
opts = append(opts, authmethods.WithName(nameStr))
|
||||
}
|
||||
|
||||
if descVal, ok := d.GetOk(DescriptionKey); ok {
|
||||
descStr := descVal.(string)
|
||||
opts = append(opts, authmethods.WithDescription(descStr))
|
||||
}
|
||||
|
||||
var scopeId string
|
||||
scopeIdVal, ok := d.GetOk(ScopeIdKey)
|
||||
switch ok {
|
||||
case true:
|
||||
scopeId = scopeIdVal.(string)
|
||||
default:
|
||||
return diag.Errorf("no scope ID provided")
|
||||
}
|
||||
|
||||
amClient := authmethods.NewClient(md.client)
|
||||
|
||||
amcr, err := amClient.Create(ctx, typeStr, scopeId, opts...)
|
||||
switch {
|
||||
case err != nil:
|
||||
return diag.Errorf("error creating auth method: %v", err)
|
||||
case amcr == nil:
|
||||
return diag.Errorf("nil auth method after create")
|
||||
}
|
||||
|
||||
if err := setFromLdapAuthMethodResponseMap(d, amcr.GetResponse().Map); err != nil {
|
||||
return diag.Errorf("%v", err)
|
||||
}
|
||||
|
||||
amid := amcr.GetResponse().Map["id"].(string)
|
||||
|
||||
// update scope when set to primary
|
||||
if p, ok := d.GetOk(authMethodLdapPrimaryAuthMethodForScopeField); ok {
|
||||
if p.(bool) {
|
||||
if err := updateScopeWithPrimaryAuthMethodId(ctx, scopeId, amid, meta); err != nil {
|
||||
return diag.Errorf("%v", err)
|
||||
}
|
||||
|
||||
amcr.GetResponse().Map[authMethodLdapPrimaryAuthMethodForScopeField] = true
|
||||
}
|
||||
}
|
||||
|
||||
if err := setFromLdapAuthMethodResponseMap(d, amcr.GetResponse().Map); err != nil {
|
||||
return diag.FromErr(err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func resourceAuthMethodLdapRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
|
||||
md := meta.(*metaData)
|
||||
amClient := authmethods.NewClient(md.client)
|
||||
|
||||
amrr, err := amClient.Read(ctx, d.Id())
|
||||
if err != nil {
|
||||
if apiErr := api.AsServerError(err); apiErr.Response().StatusCode() == http.StatusNotFound {
|
||||
d.SetId("")
|
||||
return nil
|
||||
}
|
||||
return diag.Errorf("error reading auth method: %v", err)
|
||||
}
|
||||
if amrr == nil {
|
||||
return diag.Errorf("auth method nil after read")
|
||||
}
|
||||
|
||||
serr, isPrimary := readScopeIsPrimaryAuthMethodId(ctx, amrr.GetResponse().Map["scope_id"].(string), amrr.GetResponse().Map["id"].(string), meta)
|
||||
if err != nil {
|
||||
return diag.Errorf("%v", serr)
|
||||
}
|
||||
|
||||
if isPrimary {
|
||||
amrr.GetResponse().Map[authMethodLdapPrimaryAuthMethodForScopeField] = true
|
||||
}
|
||||
|
||||
if err := setFromLdapAuthMethodResponseMap(d, amrr.GetResponse().Map); err != nil {
|
||||
return diag.FromErr(err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func resourceAuthMethodLdapUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
|
||||
md := meta.(*metaData)
|
||||
amClient := authmethods.NewClient(md.client)
|
||||
|
||||
opts := []authmethods.Option{}
|
||||
|
||||
if d.HasChange(NameKey) {
|
||||
opts = append(opts, authmethods.DefaultName())
|
||||
nameVal, ok := d.GetOk(NameKey)
|
||||
if ok {
|
||||
opts = append(opts, authmethods.WithName(nameVal.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(DescriptionKey) {
|
||||
opts = append(opts, authmethods.DefaultDescription())
|
||||
descVal, ok := d.GetOk(DescriptionKey)
|
||||
if ok {
|
||||
opts = append(opts, authmethods.WithDescription(descVal.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapUrlsField) {
|
||||
if rawUrls, ok := d.GetOk(authMethodLdapUrlsField); ok {
|
||||
urls := []string{}
|
||||
for _, u := range rawUrls.([]interface{}) {
|
||||
urls = append(urls, u.(string))
|
||||
}
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodUrls(urls))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapStartTlsField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodStartTls())
|
||||
if startTls, ok := d.GetOk(authMethodLdapStartTlsField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodStartTls(startTls.(bool)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapInsecureTlsField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodInsecureTls())
|
||||
if insecureTls, ok := d.GetOk(authMethodLdapInsecureTlsField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodInsecureTls(insecureTls.(bool)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapDiscoverDnField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodDiscoverDn())
|
||||
if discoverDn, ok := d.GetOk(authMethodLdapDiscoverDnField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodDiscoverDn(discoverDn.(bool)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapAnonGrpSearchField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodAnonGroupSearch())
|
||||
if AnonGrpSearch, ok := d.GetOk(authMethodLdapAnonGrpSearchField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodAnonGroupSearch(AnonGrpSearch.(bool)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapUpnDomainField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodUpnDomain())
|
||||
if upnDomain, ok := d.GetOk(authMethodLdapUpnDomainField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodUpnDomain(upnDomain.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapUserDnField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodUserDn())
|
||||
if userDn, ok := d.GetOk(authMethodLdapUserDnField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodUserDn(userDn.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapUserAttrField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodUserAttr())
|
||||
if userAttr, ok := d.GetOk(authMethodLdapUserAttrField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodUserAttr(userAttr.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapUserFilterField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodUserFilter())
|
||||
if userFilter, ok := d.GetOk(authMethodLdapUserFilterField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodUserFilter(userFilter.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapEnableGrpsField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodEnableGroups())
|
||||
if enableGrps, ok := d.GetOk(authMethodLdapEnableGrpsField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodEnableGroups(enableGrps.(bool)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapGroupDnField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodGroupDn())
|
||||
if groupDn, ok := d.GetOk(authMethodLdapGroupDnField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodGroupDn(groupDn.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapGroupAttrField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodGroupAttr())
|
||||
if groupAttr, ok := d.GetOk(authMethodLdapGroupAttrField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodGroupAttr(groupAttr.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapGroupFilterField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodGroupFilter())
|
||||
if groupFilter, ok := d.GetOk(authMethodLdapGroupFilterField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodGroupFilter(groupFilter.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapCertificatesField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodCertificates())
|
||||
if rawCerts, ok := d.GetOk(authMethodLdapCertificatesField); ok {
|
||||
certs := []string{}
|
||||
for _, u := range rawCerts.([]interface{}) {
|
||||
certs = append(certs, u.(string))
|
||||
}
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodCertificates(certs))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapClientCertField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodClientCertificate())
|
||||
if clientCert, ok := d.GetOk(authMethodLdapClientCertField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodClientCertificate(clientCert.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapClientCertKeyField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodClientCertificateKey())
|
||||
if clientCertKey, ok := d.GetOk(authMethodLdapClientCertKeyField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodClientCertificateKey(clientCertKey.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapBindDnField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodBindDn())
|
||||
if bindDn, ok := d.GetOk(authMethodLdapBindDnField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodBindDn(bindDn.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapBindPasswordField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodBindPassword())
|
||||
if bindPassword, ok := d.GetOk(authMethodLdapBindPasswordField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodBindPassword(bindPassword.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapUseTokenGrpsField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodUseTokenGroups())
|
||||
if useTokenGrps, ok := d.GetOk(authMethodLdapUseTokenGrpsField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodUseTokenGroups(useTokenGrps.(bool)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapAccountAttrMapsField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodAccountAttributeMaps())
|
||||
if rawAccountAttrMaps, ok := d.GetOk(authMethodLdapAccountAttrMapsField); ok {
|
||||
accountAttrMaps := []string{}
|
||||
for _, u := range rawAccountAttrMaps.([]interface{}) {
|
||||
accountAttrMaps = append(accountAttrMaps, u.(string))
|
||||
}
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodAccountAttributeMaps(accountAttrMaps))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapStateField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodState())
|
||||
if state, ok := d.GetOk(authMethodLdapStateField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodState(state.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapMaxPageSizeField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodMaximumPageSize())
|
||||
if maxPageSize, ok := d.GetOk(authMethodLdapMaxPageSizeField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodMaximumPageSize(uint32(maxPageSize.(int))))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapDerefAliasesField) {
|
||||
opts = append(opts, authmethods.DefaultLdapAuthMethodDereferenceAliases())
|
||||
if derefAliases, ok := d.GetOk(authMethodLdapDerefAliasesField); ok {
|
||||
opts = append(opts, authmethods.WithLdapAuthMethodDereferenceAliases(derefAliases.(string)))
|
||||
}
|
||||
}
|
||||
|
||||
if len(opts) > 0 {
|
||||
opts = append(opts, authmethods.WithAutomaticVersioning(true))
|
||||
amur, err := amClient.Update(ctx, d.Id(), 0, opts...)
|
||||
if err != nil {
|
||||
return diag.Errorf("error updating auth method: %v", err)
|
||||
}
|
||||
|
||||
if d.HasChange(authMethodLdapPrimaryAuthMethodForScopeField) {
|
||||
if p, ok := d.GetOk(authMethodLdapPrimaryAuthMethodForScopeField); ok {
|
||||
if p.(bool) {
|
||||
if err := updateScopeWithPrimaryAuthMethodId(
|
||||
ctx,
|
||||
amur.GetResponse().Map["scope_id"].(string),
|
||||
amur.GetResponse().Map["id"].(string),
|
||||
meta); err != nil {
|
||||
return diag.Errorf("%v", err)
|
||||
}
|
||||
|
||||
amur.GetResponse().Map[authMethodLdapPrimaryAuthMethodForScopeField] = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if err := setFromLdapAuthMethodResponseMap(d, amur.GetResponse().Map); err != nil {
|
||||
return diag.FromErr(err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -1,207 +0,0 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
package provider
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/boundary/testing/controller"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
"github.com/jimlambrt/gldap/testdirectory"
|
||||
)
|
||||
|
||||
const (
|
||||
testAuthMethodLdapDesc = "test auth method ldap"
|
||||
|
||||
testAuthMethodLdapDescUpdate = "test auth method ldap update"
|
||||
|
||||
testAuthMethodLdapCert = `-----BEGIN CERTIFICATE-----
|
||||
MIIDsjCCApoCCQCslgm7fAu/VzANBgkqhkiG9w0BAQsFADCBmjELMAkGA1UEBhMC
|
||||
VVMxCzAJBgNVBAgMAldBMRMwEQYDVQQHDApCZWxsaW5naGFtMRIwEAYDVQQKDAlI
|
||||
YXNoaUNvcnAxETAPBgNVBAsMCEJvdW5kYXJ5MRswGQYDVQQDDBJib3VuZGFyeXBy
|
||||
b2plY3QuaW8xJTAjBgkqhkiG9w0BCQEWFmptYWxuaWNrQGhhc2hpY29ycC5jb20w
|
||||
HhcNMjEwNDA2MjMzNTIxWhcNMjYwNDA1MjMzNTIxWjCBmjELMAkGA1UEBhMCVVMx
|
||||
CzAJBgNVBAgMAldBMRMwEQYDVQQHDApCZWxsaW5naGFtMRIwEAYDVQQKDAlIYXNo
|
||||
aUNvcnAxETAPBgNVBAsMCEJvdW5kYXJ5MRswGQYDVQQDDBJib3VuZGFyeXByb2pl
|
||||
Y3QuaW8xJTAjBgkqhkiG9w0BCQEWFmptYWxuaWNrQGhhc2hpY29ycC5jb20wggEi
|
||||
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDUa/ZLwYhTQ2hGzlwy/sB9xY9h
|
||||
dM4qzY8DUF3Sin/+J2j59q3/vXZA7PS+o1GhoG1nW3J51zgyNFOY/EKHdtxVBken
|
||||
YTTG+JswzrcTxsMV7/sYDgCLq6W8dPMV72gPH/3dRi3/0KUHtA6rBOf0Shf0f6Sz
|
||||
7VmgTWcNmLvXpHKOs4YkjOL/tyflTgNm5j1dOa53TtwtMyvCcpGrB7PGL8m5+E2U
|
||||
qxOzQ9kWfA6zr4Gl5rIm+Us8Ez3n1yGwjwFBteexk1Fot8zWKhoy7pZ3ZjWRpjwL
|
||||
hfGs5eJs4kERQVAGONt39ZIR6OzOFxAsvI9WrMvxAsdCK63RtF2k4r0X21yDAgMB
|
||||
AAEwDQYJKoZIhvcNAQELBQADggEBAJZcl7Zxjya23IcOV8jZDdCHtqnbcg9TcQb+
|
||||
kpX1uEKJMFJoNmNK1q//nJxG1YBn3G8t9XtO6Kc6egdGHXWnOsM37N9hbYPJ2kW1
|
||||
WWAwqWkQbV3wb0cc6MuU1S9xivOqwM046ZIcjrWR4T4tEUSUfYc3I+Yd8APdapn8
|
||||
vePgWnmi/aSsx9RxVOUrzmVhzgN7rQJZGwnYYnxl4cwy2jxpysmXzg/grfXCZs/V
|
||||
Kkc7Y5Ph6vRQ+vPCeB7QUxHxjlr8aq+rYDIaSiZ+/4+qyme0ergfvZmMSU8A3NNS
|
||||
tYIMds5s2lIqVwOoyzpBEOjWBhUThH+aZu1A5c7Cb7s1eLSRX70=
|
||||
-----END CERTIFICATE-----`
|
||||
)
|
||||
|
||||
var (
|
||||
testAuthMethodLdap = `
|
||||
resource "boundary_auth_method_ldap" "test-ldap" {
|
||||
name = "test"
|
||||
description = "%s"
|
||||
scope_id = boundary_scope.org1.id
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
|
||||
start_tls = true
|
||||
discover_dn = true
|
||||
anon_group_search = true
|
||||
upn_domain = "upn-domain-test"
|
||||
urls = ["ldaps://ldap1", "ldaps://ldap2"]
|
||||
user_dn = "user-dn"
|
||||
user_attr = "user-attr"
|
||||
user_filter = "user-filter"
|
||||
enable_groups = true
|
||||
group_dn = "group-dn"
|
||||
group_attr = "group-attr"
|
||||
group_filter = "group-filter"
|
||||
bind_dn = "bind-dn"
|
||||
bind_password = "bind-password"
|
||||
maximum_page_size = 10
|
||||
dereference_aliases = "DerefAlways"
|
||||
use_token_groups = true
|
||||
certificates = [
|
||||
<<EOT
|
||||
%s
|
||||
EOT
|
||||
]
|
||||
}`
|
||||
|
||||
testPrimaryAuthMethodLdap = `
|
||||
resource "boundary_auth_method_ldap" "test-ldap" {
|
||||
name = "test"
|
||||
description = "test auth method ldap"
|
||||
scope_id = "global"
|
||||
is_primary_for_scope = true
|
||||
urls = ["ldap://%s:%d"]
|
||||
user_dn = "%s"
|
||||
group_dn = "%s"
|
||||
discover_dn = true
|
||||
enable_groups = true
|
||||
insecure_tls = true
|
||||
}`
|
||||
|
||||
testAuthMethodLdapUpdate = `
|
||||
resource "boundary_auth_method_ldap" "test-ldap" {
|
||||
name = "test"
|
||||
description = "%s"
|
||||
scope_id = boundary_scope.org1.id
|
||||
is_primary_for_scope = true
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
|
||||
start_tls = false
|
||||
insecure_tls = true
|
||||
discover_dn = false
|
||||
anon_group_search = false
|
||||
upn_domain = "upn-domain-test-updated"
|
||||
urls = ["ldaps://ldap1-updated", "ldaps://ldap2-updated"]
|
||||
user_dn = "user-dn-updated"
|
||||
user_attr = "user-attr-updated"
|
||||
user_filter = "user-filter-updated"
|
||||
enable_groups = false
|
||||
group_dn = "group-dn-updated"
|
||||
group_attr = "group-attr-updated"
|
||||
group_filter = "group-filter-updated"
|
||||
bind_dn = "bind-dn-updated"
|
||||
bind_password = "bind-password-updated"
|
||||
use_token_groups = false
|
||||
state = "inactive"
|
||||
maximum_page_size = 100
|
||||
dereference_aliases = "NeverDerefAliases"
|
||||
certificates = [
|
||||
<<EOT
|
||||
%s
|
||||
EOT
|
||||
]
|
||||
}`
|
||||
)
|
||||
|
||||
func TestAccAuthMethodLdap(t *testing.T) {
|
||||
td := testdirectory.Start(t,
|
||||
testdirectory.WithDefaults(t, &testdirectory.Defaults{AllowAnonymousBind: true}),
|
||||
)
|
||||
tc := controller.NewTestController(t, tcConfig...)
|
||||
defer tc.Shutdown()
|
||||
url := tc.ApiAddrs()[0]
|
||||
|
||||
tdCert := strings.TrimSpace(td.Cert())
|
||||
createConfig := fmt.Sprintf(testAuthMethodLdap, testAuthMethodLdapDesc, tdCert)
|
||||
updateConfig := fmt.Sprintf(testAuthMethodLdapUpdate, testAuthMethodLdapDescUpdate, testAuthMethodLdapCert)
|
||||
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
CheckDestroy: testAccCheckAuthMethodResourceDestroy(t, provider, ldapAuthMethodType),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
// create
|
||||
Config: testConfig(url, fooOrg, createConfig),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "description", testAuthMethodLdapDesc),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "name", "test"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStateField, "active-public"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStartTlsField, "true"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "false"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapDiscoverDnField, "true"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapAnonGrpSearchField, "true"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUpnDomainField, "upn-domain-test"),
|
||||
testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapUrlsField, []string{"ldaps://ldap1", "ldaps://ldap2"}),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserDnField, "user-dn"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserAttrField, "user-attr"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserFilterField, "user-filter"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapEnableGrpsField, "true"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupDnField, "group-dn"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupAttrField, "group-attr"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupFilterField, "group-filter"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindDnField, "bind-dn"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindPasswordField, "bind-password"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUseTokenGrpsField, "true"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapMaxPageSizeField, "10"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapDerefAliasesField, "DerefAlways"),
|
||||
testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapCertificatesField, []string{tdCert}),
|
||||
),
|
||||
},
|
||||
importStep("boundary_auth_method_ldap.test-ldap", "is_primary_for_scope", "bind_password", "client_certificate_key"),
|
||||
{
|
||||
// update
|
||||
Config: testConfig(url, fooOrg, updateConfig),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStateField, "inactive"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "description", testAuthMethodLdapDescUpdate),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "name", "test"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStartTlsField, "false"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "true"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapDiscoverDnField, "false"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapAnonGrpSearchField, "false"), resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUpnDomainField, "upn-domain-test-updated"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUpnDomainField, "upn-domain-test-updated"),
|
||||
testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapUrlsField, []string{"ldaps://ldap1-updated", "ldaps://ldap2-updated"}),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserDnField, "user-dn-updated"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserAttrField, "user-attr-updated"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserFilterField, "user-filter-updated"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapEnableGrpsField, "false"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupDnField, "group-dn-updated"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupAttrField, "group-attr-updated"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupFilterField, "group-filter-updated"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindDnField, "bind-dn-updated"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindPasswordField, "bind-password-updated"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUseTokenGrpsField, "false"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapMaxPageSizeField, "100"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapDerefAliasesField, "NeverDerefAliases"),
|
||||
testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapCertificatesField, []string{testAuthMethodLdapCert}),
|
||||
testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_ldap.test-ldap"),
|
||||
testAccIsPrimaryForScope(provider, "boundary_auth_method_ldap.test-ldap", true),
|
||||
testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_ldap.test-ldap"),
|
||||
),
|
||||
},
|
||||
importStep("boundary_auth_method_ldap.test-ldap", "is_primary_for_scope", "bind_password", "client_certificate_key"),
|
||||
},
|
||||
})
|
||||
}
|
||||
@@ -29,7 +29,6 @@ const (
|
||||
authmethodOidcIsPrimaryAuthMethodForScope = "is_primary_for_scope"
|
||||
authmethodOidcAccountClaimMapsKey = "account_claim_maps"
|
||||
authmethodOidcClaimsScopesKey = "claims_scopes"
|
||||
authmethodOidcPromptsKey = "prompts"
|
||||
|
||||
// computed-only parameters
|
||||
authmethodOidcCallbackUrlKey = "callback_url"
|
||||
@@ -148,15 +147,6 @@ func resourceAuthMethodOidc() *schema.Resource {
|
||||
},
|
||||
Optional: true,
|
||||
},
|
||||
authmethodOidcPromptsKey: {
|
||||
Description: "The prompts passed to the identity provider to determine whether to prompt the end-user for reauthentication, account selection or consent. " +
|
||||
"Please note the values passed are case-sensitive. The valid values are: `none`, `login`, `consent` and `select_account`. ",
|
||||
Type: schema.TypeList,
|
||||
Elem: &schema.Schema{
|
||||
Type: schema.TypeString,
|
||||
},
|
||||
Optional: true,
|
||||
},
|
||||
|
||||
// OIDC specific immutable and computed parameters
|
||||
authmethodOidcClientSecretHmacKey: {
|
||||
@@ -249,10 +239,6 @@ func setFromOidcAuthMethodResponseMap(d *schema.ResourceData, raw map[string]int
|
||||
if p, ok := attrs[authmethodOidcClaimsScopesKey]; ok {
|
||||
d.Set(authmethodOidcClaimsScopesKey, p.([]interface{}))
|
||||
}
|
||||
|
||||
if val, ok := attrs[authmethodOidcPromptsKey]; ok {
|
||||
d.Set(authmethodOidcPromptsKey, val.([]interface{}))
|
||||
}
|
||||
}
|
||||
|
||||
d.SetId(raw["id"].(string))
|
||||
@@ -335,14 +321,6 @@ func resourceAuthMethodOidcCreate(ctx context.Context, d *schema.ResourceData, m
|
||||
opts = append(opts, authmethods.WithOidcAuthMethodClaimsScopes(cList))
|
||||
}
|
||||
|
||||
if prompts, ok := d.GetOk(authmethodOidcPromptsKey); ok {
|
||||
promptList := []string{}
|
||||
for _, p := range prompts.([]interface{}) {
|
||||
promptList = append(promptList, p.(string))
|
||||
}
|
||||
opts = append(opts, authmethods.WithOidcAuthMethodPrompts(promptList))
|
||||
}
|
||||
|
||||
nameVal, ok := d.GetOk(NameKey)
|
||||
if ok {
|
||||
nameStr := nameVal.(string)
|
||||
@@ -558,15 +536,6 @@ func resourceAuthMethodOidcUpdate(ctx context.Context, d *schema.ResourceData, m
|
||||
opts = append(opts, authmethods.WithOidcAuthMethodClaimsScopes(claimsScopes))
|
||||
}
|
||||
}
|
||||
if d.HasChange(authmethodOidcPromptsKey) {
|
||||
if prompts, ok := d.GetOk(authmethodOidcPromptsKey); ok {
|
||||
var promptsList []string
|
||||
for _, prompt := range prompts.([]interface{}) {
|
||||
promptsList = append(promptsList, prompt.(string))
|
||||
}
|
||||
opts = append(opts, authmethods.WithOidcAuthMethodPrompts(promptsList))
|
||||
}
|
||||
}
|
||||
|
||||
if len(opts) > 0 {
|
||||
opts = append(opts, authmethods.WithAutomaticVersioning(true))
|
||||
|
||||
@@ -50,7 +50,7 @@ var (
|
||||
resource "boundary_auth_method_oidc" "foo" {
|
||||
name = "test"
|
||||
description = "%s"
|
||||
scope_id = "global"
|
||||
scope_id = boundary_scope.org1.id
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
|
||||
issuer = "%s"
|
||||
@@ -67,14 +67,13 @@ EOT
|
||||
signing_algorithms = ["ES256"]
|
||||
account_claim_maps = ["oid=sub"]
|
||||
claims_scopes = ["profile"]
|
||||
prompts = ["select_account"]
|
||||
}`
|
||||
|
||||
fooAuthMethodOidcUpdate = `
|
||||
resource "boundary_auth_method_oidc" "foo" {
|
||||
name = "test"
|
||||
description = "%s"
|
||||
scope_id = "global"
|
||||
scope_id = boundary_scope.org1.id
|
||||
is_primary_for_scope = true
|
||||
depends_on = [boundary_role.org1_admin]
|
||||
|
||||
@@ -91,7 +90,6 @@ EOT
|
||||
signing_algorithms = ["ES256"]
|
||||
account_claim_maps = ["oid=sub"]
|
||||
claims_scopes = ["profile"]
|
||||
prompts = ["consent", "select_account"]
|
||||
|
||||
// we need to disable this validation, since the updated issuer isn't discoverable
|
||||
disable_discovered_config_validation = true
|
||||
@@ -127,7 +125,6 @@ func TestAccAuthMethodOidc(t *testing.T) {
|
||||
testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcSigningAlgorithmsKey, []string{"ES256"}),
|
||||
testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAccountClaimMapsKey, []string{"oid=sub"}),
|
||||
testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcClaimsScopesKey, []string{"profile"}),
|
||||
testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcPromptsKey, []string{"select_account"}),
|
||||
testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_oidc.foo"),
|
||||
testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", false),
|
||||
),
|
||||
@@ -144,7 +141,6 @@ func TestAccAuthMethodOidc(t *testing.T) {
|
||||
resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcMaxAgeKey, "-1"),
|
||||
testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcIdpCaCertsKey, []string{fooAuthMethodOidcCaCerts}),
|
||||
testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAllowedAudiencesKey, []string{"foo_aud_update"}),
|
||||
testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcPromptsKey, []string{"consent", "select_account"}),
|
||||
testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_oidc.foo"),
|
||||
testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", true),
|
||||
testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_oidc.foo"),
|
||||
|
||||
@@ -4,12 +4,17 @@
|
||||
package provider
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/boundary/api"
|
||||
"github.com/hashicorp/boundary/api/authmethods"
|
||||
"github.com/hashicorp/boundary/testing/controller"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
|
||||
)
|
||||
|
||||
const (
|
||||
@@ -72,3 +77,61 @@ func TestAccAuthMethodPassword(t *testing.T) {
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func testAccCheckAuthMethodResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
rs, ok := s.RootModule().Resources[name]
|
||||
if !ok {
|
||||
return fmt.Errorf("Not found: %s", name)
|
||||
}
|
||||
|
||||
id := rs.Primary.ID
|
||||
if id == "" {
|
||||
return fmt.Errorf("No ID is set")
|
||||
}
|
||||
|
||||
md := testProvider.Meta().(*metaData)
|
||||
|
||||
amClient := authmethods.NewClient(md.client)
|
||||
|
||||
if _, err := amClient.Read(context.Background(), id); err != nil {
|
||||
return fmt.Errorf("Got an error when reading auth method %q: %w", id, err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
type authMethodType string
|
||||
|
||||
const (
|
||||
passwordAuthMethodType authMethodType = "boundary_auth_method_password"
|
||||
oidcAuthMethodType authMethodType = "boundary_auth_method_oidc"
|
||||
)
|
||||
|
||||
func testAccCheckAuthMethodResourceDestroy(t *testing.T, testProvider *schema.Provider, typ authMethodType) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
if testProvider.Meta() == nil {
|
||||
t.Fatal("got nil provider metadata")
|
||||
}
|
||||
md := testProvider.Meta().(*metaData)
|
||||
|
||||
for _, rs := range s.RootModule().Resources {
|
||||
switch rs.Type {
|
||||
case string(typ):
|
||||
id := rs.Primary.ID
|
||||
|
||||
amClient := authmethods.NewClient(md.client)
|
||||
|
||||
_, err := amClient.Read(context.Background(), id)
|
||||
if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
|
||||
return fmt.Errorf("didn't get a 404 when reading destroyed auth method %q: %v", id, err)
|
||||
}
|
||||
|
||||
default:
|
||||
continue
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
}
|
||||
@@ -52,7 +52,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
CheckDestroy: testAccCheckAuthMethodResourceDestroy(t, provider, baseAuthMethodType),
|
||||
CheckDestroy: testAccCheckAuthMethodResourceDestroy(t, provider, passwordAuthMethodType),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
// create
|
||||
@@ -61,7 +61,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
|
||||
resource.TestCheckResourceAttr("boundary_auth_method.foo", "description", fooBaseAuthMethodDesc),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method.foo", "name", "test"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method.foo", "type", "password"),
|
||||
testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
|
||||
testAccCheckBaseAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
|
||||
),
|
||||
},
|
||||
importStep("boundary_auth_method.foo"),
|
||||
@@ -73,7 +73,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
|
||||
resource.TestCheckResourceAttr("boundary_auth_method.foo", "description", fooBaseAuthMethodDescUpdate),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method.foo", "name", "test"),
|
||||
resource.TestCheckResourceAttr("boundary_auth_method.foo", "type", "password"),
|
||||
testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
|
||||
testAccCheckBaseAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
|
||||
),
|
||||
},
|
||||
importStep("boundary_auth_method.foo"),
|
||||
@@ -81,7 +81,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
|
||||
})
|
||||
}
|
||||
|
||||
func testAccCheckAuthMethodResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
|
||||
func testAccCheckBaseAuthMethodResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
rs, ok := s.RootModule().Resources[name]
|
||||
if !ok {
|
||||
@@ -105,16 +105,7 @@ func testAccCheckAuthMethodResourceExists(testProvider *schema.Provider, name st
|
||||
}
|
||||
}
|
||||
|
||||
type authMethodType string
|
||||
|
||||
const (
|
||||
baseAuthMethodType authMethodType = "boundary_auth_method"
|
||||
passwordAuthMethodType authMethodType = "boundary_auth_method_password"
|
||||
ldapAuthMethodType authMethodType = "boundary_auth_method_ldap"
|
||||
oidcAuthMethodType authMethodType = "boundary_auth_method_oidc"
|
||||
)
|
||||
|
||||
func testAccCheckAuthMethodResourceDestroy(t *testing.T, testProvider *schema.Provider, typ authMethodType) resource.TestCheckFunc {
|
||||
func testAccCheckBaseAuthMethodResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
if testProvider.Meta() == nil {
|
||||
t.Fatal("got nil provider metadata")
|
||||
@@ -123,7 +114,7 @@ func testAccCheckAuthMethodResourceDestroy(t *testing.T, testProvider *schema.Pr
|
||||
|
||||
for _, rs := range s.RootModule().Resources {
|
||||
switch rs.Type {
|
||||
case string(typ):
|
||||
case "boundary_auth_method":
|
||||
id := rs.Primary.ID
|
||||
|
||||
amClient := authmethods.NewClient(md.client)
|
||||
|
||||
@@ -70,7 +70,7 @@ func TestAccCredentialJson(t *testing.T) {
|
||||
var provider *schema.Provider
|
||||
resource.Test(t, resource.TestCase{
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
CheckDestroy: testAccCheckCredentialResourceDestroy(t, provider, jsonCredentialType),
|
||||
CheckDestroy: testAccCheckCredentialJsonResourceDestroy(t, provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
// create
|
||||
@@ -80,8 +80,8 @@ func TestAccCredentialJson(t *testing.T) {
|
||||
resource.TestCheckResourceAttr(jsonCredResc, DescriptionKey, jsonCredDesc),
|
||||
resource.TestCheckResourceAttr(jsonCredResc, credentialJsonObjectKey, `{"password":"password","username":"admin"}`),
|
||||
|
||||
testAccCheckCredentialJsonObjectHmac(),
|
||||
testAccCheckCredentialResourceExists(provider, jsonCredResc),
|
||||
testAccCheckCredentialJsonObjectHmac(provider),
|
||||
testAccCheckCredentialJsonResourceExists(provider, jsonCredResc),
|
||||
),
|
||||
},
|
||||
importStep(jsonCredResc, credentialJsonObjectKey),
|
||||
@@ -93,8 +93,8 @@ func TestAccCredentialJson(t *testing.T) {
|
||||
resource.TestCheckResourceAttr(jsonCredResc, DescriptionKey, jsonCredDescUpdate),
|
||||
resource.TestCheckResourceAttr(jsonCredResc, credentialJsonObjectKey, `{"password":"password","username":"db-admin"}`),
|
||||
|
||||
testAccCheckCredentialJsonObjectHmac(),
|
||||
testAccCheckCredentialResourceExists(provider, jsonCredResc),
|
||||
testAccCheckCredentialJsonObjectHmac(provider),
|
||||
testAccCheckCredentialJsonResourceExists(provider, jsonCredResc),
|
||||
),
|
||||
},
|
||||
importStep(jsonCredResc, credentialJsonObjectKey),
|
||||
@@ -114,7 +114,32 @@ func TestAccCredentialJson(t *testing.T) {
|
||||
})
|
||||
}
|
||||
|
||||
func testAccCheckCredentialResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
|
||||
func testAccCheckCredentialJsonResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
if testProvider.Meta() == nil {
|
||||
t.Fatal("got nil provider metadata")
|
||||
}
|
||||
md := testProvider.Meta().(*metaData)
|
||||
|
||||
for _, rs := range s.RootModule().Resources {
|
||||
switch rs.Type {
|
||||
case "boundary_credential_json":
|
||||
id := rs.Primary.ID
|
||||
|
||||
c := credentials.NewClient(md.client)
|
||||
_, err := c.Read(context.Background(), id)
|
||||
if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
|
||||
return fmt.Errorf("didn't get a 404 when reading destroyed json credential %q: %v", id, err)
|
||||
}
|
||||
default:
|
||||
continue
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
func testAccCheckCredentialJsonResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
rs, ok := s.RootModule().Resources[name]
|
||||
if !ok {
|
||||
@@ -137,40 +162,7 @@ func testAccCheckCredentialResourceExists(testProvider *schema.Provider, name st
|
||||
}
|
||||
}
|
||||
|
||||
type credentialType string
|
||||
|
||||
const (
|
||||
jsonCredentialType credentialType = "boundary_credential_json"
|
||||
sshPrivateKeyCredentialType credentialType = "boundary_credential_ssh_private_key"
|
||||
usernamePasswordCredentialType credentialType = "boundary_credential_username_password"
|
||||
)
|
||||
|
||||
func testAccCheckCredentialResourceDestroy(t *testing.T, testProvider *schema.Provider, typ credentialType) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
if testProvider.Meta() == nil {
|
||||
t.Fatal("got nil provider metadata")
|
||||
}
|
||||
md := testProvider.Meta().(*metaData)
|
||||
|
||||
for _, rs := range s.RootModule().Resources {
|
||||
switch rs.Type {
|
||||
case string(typ):
|
||||
id := rs.Primary.ID
|
||||
|
||||
c := credentials.NewClient(md.client)
|
||||
_, err := c.Read(context.Background(), id)
|
||||
if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
|
||||
return fmt.Errorf("didn't get a 404 when reading destroyed credential %q: %v", id, err)
|
||||
}
|
||||
default:
|
||||
continue
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
func testAccCheckCredentialJsonObjectHmac() resource.TestCheckFunc {
|
||||
func testAccCheckCredentialJsonObjectHmac(testProvider *schema.Provider) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
rs, ok := s.RootModule().Resources[jsonCredResc]
|
||||
if !ok {
|
||||
|
||||
@@ -79,10 +79,9 @@ func resourceCredentialLibraryVault() *schema.Resource {
|
||||
Required: true,
|
||||
},
|
||||
credentialLibraryCredentialTypeKey: {
|
||||
Description: "The type of credential the library generates. Cannot be updated on an existing resource.",
|
||||
Description: "The type of credential the library generates.",
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
ForceNew: true,
|
||||
},
|
||||
credentialLibraryCredentialMappingOverridesKey: {
|
||||
Description: "The credential mapping override.",
|
||||
|
||||
@@ -14,16 +14,15 @@ import (
|
||||
)
|
||||
|
||||
const (
|
||||
credentialLibraryVaultSshCertificateType = "vault-ssh-certificate"
|
||||
credentialLibraryVaultSshCertificatePathKey = "path"
|
||||
credentialLibraryVaultSshCertificateUsernameKey = "username"
|
||||
credentialLibraryVaultSshCertificateKeyTypeKey = "key_type"
|
||||
credentialLibraryVaultSshCertificateKeyBitsKey = "key_bits"
|
||||
credentialLibraryVaultSshCertificateTtlKey = "ttl"
|
||||
credentialLibraryVaultSshCertificateKeyIdKey = "key_id"
|
||||
credentialLibraryVaultSshCertificateCriticalOptionsKey = "critical_options"
|
||||
credentialLibraryVaultSshCertificateExtensionsKey = "extensions"
|
||||
credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey = "additional_valid_principals"
|
||||
credentialLibraryVaultSshCertificateType = "vault-ssh-certificate"
|
||||
credentialLibraryVaultSshCertificatePathKey = "path"
|
||||
credentialLibraryVaultSshCertificateUsernameKey = "username"
|
||||
credentialLibraryVaultSshCertificateKeyTypeKey = "key_type"
|
||||
credentialLibraryVaultSshCertificateKeyBitsKey = "key_bits"
|
||||
credentialLibraryVaultSshCertificateTtlKey = "ttl"
|
||||
credentialLibraryVaultSshCertificateKeyIdKey = "key_id"
|
||||
credentialLibraryVaultSshCertificateCriticalOptionsKey = "critical_options"
|
||||
credentialLibraryVaultSshCertificateExtensionsKey = "extensions"
|
||||
)
|
||||
|
||||
var libraryVaultSshCertificateAttrs = []string{
|
||||
@@ -35,7 +34,6 @@ var libraryVaultSshCertificateAttrs = []string{
|
||||
credentialLibraryVaultSshCertificateKeyIdKey,
|
||||
credentialLibraryVaultSshCertificateCriticalOptionsKey,
|
||||
credentialLibraryVaultSshCertificateExtensionsKey,
|
||||
credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey,
|
||||
}
|
||||
|
||||
func resourceCredentialLibraryVaultSshCertificate() *schema.Resource {
|
||||
@@ -112,14 +110,6 @@ func resourceCredentialLibraryVaultSshCertificate() *schema.Resource {
|
||||
Type: schema.TypeMap,
|
||||
Optional: true,
|
||||
},
|
||||
credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey: {
|
||||
Description: "Principals to be signed as \"valid_principles\" in addition to username.",
|
||||
Type: schema.TypeList,
|
||||
Elem: &schema.Schema{
|
||||
Type: schema.TypeString,
|
||||
},
|
||||
Optional: true,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
@@ -195,13 +185,6 @@ func resourceCredentialLibraryCreateVaultSshCertificate(ctx context.Context, d *
|
||||
opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryExtensions(e))
|
||||
}
|
||||
}
|
||||
if v, ok := d.GetOk(credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey); ok {
|
||||
avp := []string{}
|
||||
for _, vv := range v.([]interface{}) {
|
||||
avp = append(avp, vv.(string))
|
||||
}
|
||||
opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryAdditionalValidPrincipals(avp))
|
||||
}
|
||||
|
||||
var credentialStoreId string
|
||||
cid, ok := d.GetOk(credentialStoreIdKey)
|
||||
@@ -392,17 +375,6 @@ func resourceCredentialLibraryUpdateVaultSshCertificate(ctx context.Context, d *
|
||||
}
|
||||
opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryExtensions(e))
|
||||
}
|
||||
if d.HasChange(credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey) {
|
||||
// set defaults first in case the value was omitted and we want to remove it
|
||||
opts = append(opts, credentiallibraries.DefaultVaultSSHCertificateCredentialLibraryAdditionalValidPrincipals())
|
||||
if v, ok := d.GetOk(credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey); ok {
|
||||
avp := []string{}
|
||||
for _, vv := range v.([]interface{}) {
|
||||
avp = append(avp, vv.(string))
|
||||
}
|
||||
opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryAdditionalValidPrincipals(avp))
|
||||
}
|
||||
}
|
||||
|
||||
if len(opts) > 0 {
|
||||
opts = append(opts, credentiallibraries.WithAutomaticVersioning(true))
|
||||
|
||||
@@ -4,14 +4,19 @@
|
||||
package provider
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"testing"
|
||||
|
||||
"github.com/hashicorp/boundary/api"
|
||||
"github.com/hashicorp/boundary/api/credentiallibraries"
|
||||
"github.com/hashicorp/boundary/testing/controller"
|
||||
"github.com/hashicorp/boundary/testing/vault"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
||||
"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
|
||||
)
|
||||
|
||||
const (
|
||||
@@ -34,6 +39,7 @@ resource "boundary_credential_library_vault_ssh_certificate" "example" {
|
||||
path = "%s"
|
||||
username = "%s"
|
||||
key_type = "ed25519"
|
||||
|
||||
}`, vaultSshCertCredLibName,
|
||||
vaultSshCertCredLibDesc,
|
||||
vaultSshCertCredLibPath,
|
||||
@@ -63,15 +69,14 @@ resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" {
|
||||
path = "%s"
|
||||
username = "%s"
|
||||
key_type = "ed25519"
|
||||
|
||||
extensions = {
|
||||
permit-pty = ""
|
||||
}
|
||||
|
||||
critical_options = {
|
||||
force-command = "/bin/foo"
|
||||
}
|
||||
additional_valid_principals = [
|
||||
"principal-1"
|
||||
]
|
||||
}`, vaultSshCertCredLibName,
|
||||
vaultSshCertCredLibDesc,
|
||||
vaultSshCertCredLibPath,
|
||||
@@ -85,14 +90,11 @@ resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" {
|
||||
path = "%s"
|
||||
username = "%s"
|
||||
key_type = "ed25519"
|
||||
|
||||
extensions = {
|
||||
permit-pty = ""
|
||||
permit-X11-forwarding = ""
|
||||
}
|
||||
additional_valid_principals = [
|
||||
"principal-2",
|
||||
"principal-3"
|
||||
]
|
||||
}`, vaultSshCertCredLibName,
|
||||
vaultSshCertCredLibDesc,
|
||||
vaultSshCertCredLibPath,
|
||||
@@ -106,9 +108,11 @@ resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" {
|
||||
path = "%s"
|
||||
username = "%s"
|
||||
key_type = "ed25519"
|
||||
|
||||
extensions = {
|
||||
permit-pty = ""
|
||||
}
|
||||
|
||||
critical_options = {
|
||||
force-command = "/bin/foo"
|
||||
source-address = "10.10.0.0/16"
|
||||
@@ -137,7 +141,7 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
|
||||
resource.Test(t, resource.TestCase{
|
||||
IsUnitTest: true,
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
CheckDestroy: testAccCheckCredentialLibraryVaultResourceDestroy(t, provider, sshCertVaultCredentialLibraryType),
|
||||
CheckDestroy: testAccCheckCredentialLibraryVaultSshCertificateResourceDestroy(t, provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
// create
|
||||
@@ -148,7 +152,7 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath),
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername),
|
||||
|
||||
testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredResc),
|
||||
testAccCheckCredentialLibraryVaultSshCertificateResourceExists(provider, vaultSshCertCredResc),
|
||||
),
|
||||
},
|
||||
importStep(vaultSshCertCredResc),
|
||||
@@ -163,21 +167,20 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultSshCertificateKeyTypeKey, vaultSshCertCredKeyType),
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultSshCertificateKeyBitsKey, strconv.Itoa(vaultSshCertCredKeyBits)),
|
||||
|
||||
testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredResc),
|
||||
testAccCheckCredentialLibraryVaultSshCertificateResourceExists(provider, vaultSshCertCredResc),
|
||||
),
|
||||
},
|
||||
importStep(vaultSshCertCredResc),
|
||||
{
|
||||
// create with extensions, critical options, and additional valid principals
|
||||
// create with extensions and critical options
|
||||
Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceExtensionsCriticalOpts),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, NameKey, vaultSshCertCredLibName),
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, DescriptionKey, vaultSshCertCredLibDesc),
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath),
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername),
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey+".#", "1"),
|
||||
|
||||
testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc),
|
||||
testAccCheckCredentialLibraryVaultSshCertificateResourceExists(provider, vaultSshCertCredExtCOResc),
|
||||
),
|
||||
},
|
||||
importStep(vaultSshCertCredExtCOResc),
|
||||
@@ -191,9 +194,8 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername),
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateCriticalOptionsKey+".%", "0"),
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateExtensionsKey+".%", "2"),
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey+".#", "2"),
|
||||
|
||||
testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc),
|
||||
testAccCheckCredentialLibraryVaultSshCertificateResourceExists(provider, vaultSshCertCredExtCOResc),
|
||||
),
|
||||
},
|
||||
importStep(vaultSshCertCredExtCOResc),
|
||||
@@ -207,12 +209,59 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername),
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateCriticalOptionsKey+".%", "2"),
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateExtensionsKey+".%", "1"),
|
||||
resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateAdditionalValidPrincipalsKey+".#", "0"),
|
||||
|
||||
testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc),
|
||||
testAccCheckCredentialLibraryVaultSshCertificateResourceExists(provider, vaultSshCertCredExtCOResc),
|
||||
),
|
||||
},
|
||||
importStep(vaultSshCertCredExtCOResc),
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func testAccCheckCredentialLibraryVaultSshCertificateResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
rs, ok := s.RootModule().Resources[name]
|
||||
if !ok {
|
||||
return fmt.Errorf("not found: %s", name)
|
||||
}
|
||||
|
||||
id := rs.Primary.ID
|
||||
if id == "" {
|
||||
return fmt.Errorf("no ID is set")
|
||||
}
|
||||
|
||||
md := testProvider.Meta().(*metaData)
|
||||
c := credentiallibraries.NewClient(md.client)
|
||||
if _, err := c.Read(context.Background(), id); err != nil {
|
||||
return fmt.Errorf("got an error reading %q: %w", id, err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
func testAccCheckCredentialLibraryVaultSshCertificateResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
if testProvider.Meta() == nil {
|
||||
t.Fatal("got nil provider metadata")
|
||||
}
|
||||
md := testProvider.Meta().(*metaData)
|
||||
|
||||
for _, rs := range s.RootModule().Resources {
|
||||
switch rs.Type {
|
||||
case "boundary_credential_library_vault":
|
||||
id := rs.Primary.ID
|
||||
|
||||
c := credentiallibraries.NewClient(md.client)
|
||||
_, err := c.Read(context.Background(), id)
|
||||
if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
|
||||
return fmt.Errorf("didn't get a 404 when reading destroyed vault credential library %q: %v", id, err)
|
||||
}
|
||||
|
||||
default:
|
||||
continue
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
}
|
||||
@@ -24,7 +24,6 @@ const (
|
||||
vaultCredUsernamePasswordResc = "boundary_credential_library_vault.username_password_mapping_override"
|
||||
vaultCredSshPrivateKeyResc = "boundary_credential_library_vault.ssh_private_key_mapping_override"
|
||||
vaultCredLibName = "foo"
|
||||
vaultCredLibNameOverride = "base foo"
|
||||
vaultCredLibDesc = "the foo"
|
||||
vaultCredLibPath = "/foo/bar"
|
||||
vaultCredLibMethodGet = "GET"
|
||||
@@ -84,7 +83,7 @@ resource "boundary_credential_library_vault" "username_password_mapping_override
|
||||
password_attribute = "alternative_password_label"
|
||||
username_attribute = "alternative_username_label"
|
||||
}
|
||||
}`, vaultCredLibNameOverride,
|
||||
}`, vaultCredLibName,
|
||||
vaultCredLibDesc,
|
||||
vaultCredLibPath,
|
||||
vaultCredLibMethodGet)
|
||||
@@ -101,7 +100,7 @@ var vaultUsernamePasswordMappingOverrideCredLibResourceUpdate = fmt.Sprintf(`
|
||||
password_attribute = "updated_password_label"
|
||||
username_attribute = "updated_username_label"
|
||||
}
|
||||
}`, vaultCredLibNameOverride,
|
||||
}`, vaultCredLibName,
|
||||
vaultCredLibDesc,
|
||||
vaultCredLibPath,
|
||||
vaultCredLibMethodGet)
|
||||
@@ -114,7 +113,7 @@ var vaultUsernamePasswordMappingOverrideCredLibResourceRemove = fmt.Sprintf(`
|
||||
path = "%s"
|
||||
http_method = "%s"
|
||||
credential_type = "username_password"
|
||||
}`, vaultCredLibNameOverride,
|
||||
}`, vaultCredLibName,
|
||||
vaultCredLibDesc,
|
||||
vaultCredLibPath,
|
||||
vaultCredLibMethodGet)
|
||||
@@ -156,7 +155,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
|
||||
resource.Test(t, resource.TestCase{
|
||||
IsUnitTest: true,
|
||||
ProviderFactories: providerFactories(&provider),
|
||||
CheckDestroy: testAccCheckCredentialLibraryVaultResourceDestroy(t, provider, baseVaultCredentialLibraryType),
|
||||
CheckDestroy: testAccCheckCredentialLibraryVaultResourceDestroy(t, provider),
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
// create
|
||||
@@ -168,7 +167,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
|
||||
resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
|
||||
resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpRequestBodyKey, ""),
|
||||
|
||||
testAccCheckCredentialLibraryResourceExists(provider, vaultCredResc),
|
||||
testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredResc),
|
||||
),
|
||||
},
|
||||
importStep(vaultCredResc),
|
||||
@@ -183,7 +182,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
|
||||
resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodPost),
|
||||
resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpRequestBodyKey, vaultCredLibRequestBody),
|
||||
|
||||
testAccCheckCredentialLibraryResourceExists(provider, vaultCredResc),
|
||||
testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredResc),
|
||||
),
|
||||
},
|
||||
importStep(vaultCredResc),
|
||||
@@ -199,7 +198,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
|
||||
resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryVaultHttpRequestBodyKey, ""),
|
||||
resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryCredentialTypeKey, "ssh_private_key"),
|
||||
|
||||
testAccCheckCredentialLibraryResourceExists(provider, vaultCredTypedResc),
|
||||
testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredTypedResc),
|
||||
),
|
||||
},
|
||||
importStep(vaultCredResc),
|
||||
@@ -207,7 +206,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
|
||||
{
|
||||
Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResource),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibName),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
|
||||
@@ -216,7 +215,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.password_attribute", "alternative_password_label"),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.username_attribute", "alternative_username_label"),
|
||||
|
||||
testAccCheckCredentialLibraryResourceExists(provider, vaultCredUsernamePasswordResc),
|
||||
testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredUsernamePasswordResc),
|
||||
),
|
||||
},
|
||||
importStep(vaultCredResc),
|
||||
@@ -224,7 +223,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
|
||||
{
|
||||
Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResourceUpdate),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibName),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
|
||||
@@ -233,7 +232,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.password_attribute", "updated_password_label"),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.username_attribute", "updated_username_label"),
|
||||
|
||||
testAccCheckCredentialLibraryResourceExists(provider, vaultCredUsernamePasswordResc),
|
||||
testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredUsernamePasswordResc),
|
||||
),
|
||||
},
|
||||
importStep(vaultCredResc),
|
||||
@@ -241,7 +240,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
|
||||
{
|
||||
Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResourceRemove),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibName),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
|
||||
@@ -249,7 +248,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialTypeKey, "username_password"),
|
||||
resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialMappingOverridesKey+".%", "0"),
|
||||
|
||||
testAccCheckCredentialLibraryResourceExists(provider, vaultCredUsernamePasswordResc),
|
||||
testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredUsernamePasswordResc),
|
||||
),
|
||||
},
|
||||
importStep(vaultCredResc),
|
||||
@@ -267,7 +266,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
|
||||
resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, "credential_mapping_overrides.private_key_passphrase_attribute", "alternative_passphrase_label"),
|
||||
resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, "credential_mapping_overrides.username_attribute", "alternative_username_label"),
|
||||
|
||||
testAccCheckCredentialLibraryResourceExists(provider, vaultCredSshPrivateKeyResc),
|
||||
testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredSshPrivateKeyResc),
|
||||
),
|
||||
},
|
||||
importStep(vaultCredResc),
|
||||
@@ -275,7 +274,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
|
||||
})
|
||||
}
|
||||
|
||||
func testAccCheckCredentialLibraryResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
|
||||
func testAccCheckCredentialLibraryVaultResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
rs, ok := s.RootModule().Resources[name]
|
||||
if !ok {
|
||||
@@ -297,14 +296,7 @@ func testAccCheckCredentialLibraryResourceExists(testProvider *schema.Provider,
|
||||
}
|
||||
}
|
||||
|
||||
type vaultCredentialLibraryType string
|
||||
|
||||
const (
|
||||
baseVaultCredentialLibraryType vaultCredentialLibraryType = "boundary_credential_library_vault"
|
||||
sshCertVaultCredentialLibraryType vaultCredentialLibraryType = "boundary_credential_library_vault_ssh_certificate"
|
||||
)
|
||||
|
||||
func testAccCheckCredentialLibraryVaultResourceDestroy(t *testing.T, testProvider *schema.Provider, typ vaultCredentialLibraryType) resource.TestCheckFunc {
|
||||
func testAccCheckCredentialLibraryVaultResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
if testProvider.Meta() == nil {
|
||||
t.Fatal("got nil provider metadata")
|
||||
@@ -313,7 +305,7 @@ func testAccCheckCredentialLibraryVaultResourceDestroy(t *testing.T, testProvide
|
||||
|
||||
for _, rs := range s.RootModule().Resources {
|
||||
switch rs.Type {
|
||||
case string(typ):
|
||||
case "boundary_credential_library_vault":
|
||||
id := rs.Primary.ID
|
||||
|
||||
c := credentiallibraries.NewClient(md.client)
|
||||
|
||||
Loaded 100 of 135 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user