Michael Li
2d920805d4
* chore: Update make testacc to use boundary dev Use boundary dev instead of test controller in order to get an enterprise cluster * test: Update tests to use boundary dev cluster - Set up environment variables via loadTestConfig - Update testConfigWithRecovery to use recovery key from config - Update testCOnfigWithoutAMPWCredentials to use boundary dev's auth method * test: Update tests to use their own orgs This is to address some test failures due to conflicts when creating resources within the same org. * test: Enable tests that require boundary-enterprise * chore: Update workflow to use boundary enterprise
98 lines
3.1 KiB
Go
98 lines
3.1 KiB
Go
// Copyright IBM Corp. 2020, 2026
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package provider
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/hashicorp/cap/oidc"
|
|
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
|
|
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
|
|
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
const (
|
|
fooAccountOidcDesc = "test account oidc"
|
|
fooAccountOidcDescUpdate = "test account oidc update"
|
|
)
|
|
|
|
var fooAccountOidc = `
|
|
resource "boundary_auth_method_oidc" "foo" {
|
|
name = "test"
|
|
description = "test account oidc auth method"
|
|
scope_id = boundary_scope.org1.id
|
|
depends_on = [boundary_role.org1_admin]
|
|
|
|
issuer = "%s"
|
|
client_id = "foo_id"
|
|
client_secret = "foo_secret"
|
|
max_age = 0
|
|
api_url_prefix = "http://localhost:9200"
|
|
idp_ca_certs = [
|
|
<<EOT
|
|
%s
|
|
EOT
|
|
]
|
|
allowed_audiences = ["foo_aud"]
|
|
signing_algorithms = ["ES256"]
|
|
account_claim_maps = ["oid=sub"]
|
|
claims_scopes = ["profile"]
|
|
}
|
|
|
|
resource "boundary_account_oidc" "foo" {
|
|
name = "test"
|
|
description = "%s"
|
|
subject = "%s"
|
|
issuer = "%s"
|
|
auth_method_id = boundary_auth_method_oidc.foo.id
|
|
}`
|
|
|
|
func TestAccOidcAccount(t *testing.T) {
|
|
tp := oidc.StartTestProvider(t)
|
|
cfg, err := loadTestConfig()
|
|
require.NoError(t, err)
|
|
suffix := id.UniqueId()
|
|
url := cfg.BoundaryAddr
|
|
|
|
var provider *schema.Provider
|
|
|
|
tpCert := strings.TrimSpace(tp.CACert())
|
|
createConfig := fmt.Sprintf(fooAccountOidc, tp.Addr(), tpCert, fooAccountOidcDesc, tp.ExpectedSubject(), tp.Addr())
|
|
updateConfig := fmt.Sprintf(fooAccountOidc, tp.Addr(), tpCert, fooAccountOidcDescUpdate, tp.ExpectedSubject(), tp.Addr())
|
|
|
|
resource.Test(t, resource.TestCase{
|
|
ProviderFactories: providerFactories(&provider),
|
|
CheckDestroy: testAccCheckAccountResourceDestroy(t, provider, oidcAccountType),
|
|
Steps: []resource.TestStep{
|
|
{
|
|
// create
|
|
Config: testConfig(url, fooOrg(suffix), createConfig),
|
|
Check: resource.ComposeTestCheckFunc(
|
|
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "description", fooAccountOidcDesc),
|
|
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "name", "test"),
|
|
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "issuer", tp.Addr()),
|
|
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "subject", tp.ExpectedSubject()),
|
|
testAccCheckAccountResourceExists(provider, "boundary_account_oidc.foo"),
|
|
),
|
|
},
|
|
importStep("boundary_account_oidc.foo", "oidc"),
|
|
{
|
|
// update
|
|
Config: testConfig(url, fooOrg(suffix), updateConfig),
|
|
Check: resource.ComposeTestCheckFunc(
|
|
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "description", fooAccountOidcDescUpdate),
|
|
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "name", "test"),
|
|
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "issuer", tp.Addr()),
|
|
resource.TestCheckResourceAttr("boundary_account_oidc.foo", "subject", tp.ExpectedSubject()),
|
|
testAccCheckAccountResourceExists(provider, "boundary_account_oidc.foo"),
|
|
),
|
|
},
|
|
importStep("boundary_account_oidc.foo", "oidc"),
|
|
},
|
|
})
|
|
}
|