Skip to content

Commit 36d6926

Browse files
vishakhamodi-googlevishakhamodi-google
authored
add scim tenant resource (#15299)
1 parent 06530f2 commit 36d6926

File tree

3 files changed

+298
-0
lines changed

3 files changed

+298
-0
lines changed

‎mmv1/products/iamworkforcepool/WorkforcePoolProviderScimTenant.yaml‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
# Copyright 2025 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: 'WorkforcePoolProviderScimTenant'
16+
description: |
17+
Represents a SCIM tenant configuration for a Workforce Pool Provider.
18+
The SCIM tenant configuration allows for the synchronization of user/group identities from external identity provider into Google Cloud using the System for Cross-domain Identity Management (SCIM) protocol.
19+
references:
20+
guides:
21+
'QUICKSTART_TITLE': 'https://cloud.google.com/iam/docs/workforce-sign-in-microsoft-entra-id-scalable-groups?group_type=extended#extended-attributes'
22+
api: 'https://cloud.google.com/sdk/gcloud/reference/iam/workforce-pools/providers/scim-tenants'
23+
base_url: 'locations/{{location}}/workforcePools/{{workforce_pool_id}}/providers/{{provider_id}}/scimTenants'
24+
self_link: 'locations/{{location}}/workforcePools/{{workforce_pool_id}}/providers/{{provider_id}}/scimTenants/{{scim_tenant_id}}'
25+
create_url: 'locations/{{location}}/workforcePools/{{workforce_pool_id}}/providers/{{provider_id}}/scimTenants?workforcePoolProviderScimTenantId={{scim_tenant_id}}'
26+
27+
import_format:
28+
- 'locations/{{location}}/workforcePools/{{workforce_pool_id}}/providers/{{provider_id}}/scimTenants/{{scim_tenant_id}}'
29+
update_verb: 'PATCH'
30+
update_mask: true
31+
timeouts:
32+
insert_minutes: 20
33+
delete_minutes: 20
34+
custom_code:
35+
decoder: 'templates/terraform/decoders/treat_deleted_state_as_gone.go.tmpl'
36+
post_create: 'templates/terraform/post_create/sleep.go.tmpl'
37+
post_update: 'templates/terraform/post_create/sleep.go.tmpl'
38+
examples:
39+
- name: 'iam_workforce_pool_provider_scim_tenant_basic'
40+
primary_resource_id: "example"
41+
vars:
42+
workforce_pool_id: 'example-pool'
43+
provider_id: 'example-prvdr'
44+
scim_tenant_id: 'example-scim-tenant'
45+
test_env_vars:
46+
org_id: 'ORG_ID'
47+
properties:
48+
- name: 'name'
49+
type: String
50+
description: |
51+
Identifier. The resource name of the scim tenant.
52+
Format: `locations/{location}/workforcePools/{workforce_pool}/providers/{workforce_pool_provider}/scimTenants/{scim_tenant_id}
53+
output: true
54+
- name: 'displayName'
55+
type: String
56+
description:
57+
A user-specified display name for the scim tenant. Cannot exceed 32
58+
characters.
59+
- name: 'description'
60+
type: String
61+
description:
62+
A user-specified description of the provider. Cannot exceed 256
63+
characters.
64+
- name: 'state'
65+
type: Enum
66+
output: true
67+
description: |
68+
The current state of the scim tenant.
69+
* STATE_UNSPECIFIED: State unspecified.
70+
* ACTIVE: The scim tenant is active and may be used to validate authentication credentials.
71+
* DELETED: The scim tenant is soft-deleted. Soft-deleted scim tenants are permanently
72+
deleted after approximately 30 days.
73+
enum_values:
74+
- 'STATE_UNSPECIFIED'
75+
- 'ACTIVE'
76+
- 'DELETED'
77+
- name: 'baseURI'
78+
type: String
79+
description: |
80+
Represents the base URI as defined in [RFC 7644, Section
81+
1.3](https://datatracker.ietf.org/doc/html/rfc7644#section-1.3). Clients
82+
must use this as the root address for managing resources under the tenant.
83+
Format:
84+
https://iamscim.googleapis.com/{version}/{tenant_id}/
85+
output: true
86+
parameters:
87+
- name: 'location'
88+
type: String
89+
description: |
90+
The location for the resource.
91+
url_param_only: true
92+
required: true
93+
immutable: true
94+
- name: 'workforcePoolId'
95+
type: String
96+
description: |
97+
The ID of the workforce pool.
98+
url_param_only: true
99+
required: true
100+
immutable: true
101+
- name: 'ProviderId'
102+
type: String
103+
description: |
104+
The ID of the provider.
105+
url_param_only: true
106+
required: true
107+
immutable: true
108+
- name: 'scimTenantId'
109+
type: String
110+
description: |
111+
The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].
112+
url_param_only: true
113+
required: true
114+
immutable: true

‎mmv1/templates/terraform/examples/iam_workforce_pool_provider_scim_tenant_basic.tf.tmpl‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
resource "google_iam_workforce_pool" "pool" {
2+
workforce_pool_id = "{{index $.Vars "workforce_pool_id"}}"
3+
parent = "organizations/{{index $.TestEnvVars "org_id"}}"
4+
location = "global"
5+
}
6+
7+
resource "google_iam_workforce_pool_provider" "provider" {
8+
location = "global"
9+
workforce_pool_id = google_iam_workforce_pool.pool.workforce_pool_id
10+
provider_id = "{{index $.Vars "provider_id"}}"
11+
attribute_mapping = {
12+
"google.subject" = "assertion.sub"
13+
}
14+
oidc {
15+
issuer_uri = "https://accounts.thirdparty.com"
16+
client_id = "client-id"
17+
client_secret {
18+
value {
19+
plain_text = "client-secret"
20+
}
21+
}
22+
web_sso_config {
23+
response_type = "CODE"
24+
assertion_claims_behavior = "MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS"
25+
additional_scopes = ["groups", "roles"]
26+
}
27+
}
28+
display_name = "Display name"
29+
description = "A sample OIDC workforce pool provider."
30+
disabled = false
31+
attribute_condition = "true"
32+
}
33+
34+
resource "google_iam_workforce_pool_provider_scim_tenant" "{{$.PrimaryResourceId}}" {
35+
location = "global"
36+
workforce_pool_id = google_iam_workforce_pool.pool.workforce_pool_id
37+
provider_id = google_iam_workforce_pool_provider.provider.provider_id
38+
scim_tenant_id = "example-scim-tenant"
39+
display_name = "Example SCIM Tenant"
40+
description = "A basic SCIM tenant for IAM Workforce Pool Provider"
41+
# state is output only, not settable
42+
}
43+
44+

‎mmv1/third_party/terraform/services/iamworkforcepool/resource_iam_workforce_pool_provider_scim_tenant_test.go‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
package iamworkforcepool_test
2+
3+
import (
4+
"testing"
5+
6+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
7+
8+
"github.com/hashicorp/terraform-provider-google/google/acctest"
9+
"github.com/hashicorp/terraform-provider-google/google/envvar"
10+
)
11+
12+
func TestAccIAMWorkforcePoolWorkforcePoolProviderScimTenant_update(t *testing.T) {
13+
t.Parallel()
14+
15+
context := map[string]interface{}{
16+
"org_id": envvar.GetTestOrgFromEnv(t),
17+
"random_suffix": acctest.RandString(t, 10),
18+
}
19+
20+
acctest.VcrTest(t, resource.TestCase{
21+
PreCheck: func() { acctest.AccTestPreCheck(t) },
22+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
23+
CheckDestroy: testAccCheckIAMWorkforcePoolWorkforcePoolProviderScimTenantDestroyProducer(t),
24+
Steps: []resource.TestStep{
25+
{
26+
Config: testAccIAMWorkforcePoolWorkforcePoolProviderScimTenant_full(context),
27+
},
28+
{
29+
ResourceName: "google_iam_workforce_pool_provider_scim_tenant.scim_tenant",
30+
ImportState: true,
31+
ImportStateVerify: true,
32+
ImportStateVerifyIgnore: []string{"state"},
33+
},
34+
{
35+
Config: testAccIAMWorkforcePoolWorkforcePoolProviderScimTenant_update(context),
36+
},
37+
{
38+
ResourceName: "google_iam_workforce_pool_provider_scim_tenant.scim_tenant",
39+
ImportState: true,
40+
ImportStateVerify: true,
41+
ImportStateVerifyIgnore: []string{"state"},
42+
},
43+
},
44+
})
45+
}
46+
47+
func testAccIAMWorkforcePoolWorkforcePoolProviderScimTenant_full(context map[string]interface{}) string {
48+
return acctest.Nprintf(`
49+
resource "google_iam_workforce_pool" "pool" {
50+
workforce_pool_id = "tf-test-example-pool%{random_suffix}"
51+
parent = "organizations/%{org_id}"
52+
location = "global"
53+
}
54+
55+
resource "google_iam_workforce_pool_provider" "provider" {
56+
workforce_pool_id = google_iam_workforce_pool.pool.workforce_pool_id
57+
location = "global"
58+
provider_id = "tf-test-provider-%{random_suffix}"
59+
attribute_mapping = {
60+
"google.subject" = "assertion.sub"
61+
}
62+
oidc {
63+
issuer_uri = "https://accounts.thirdparty.com"
64+
client_id = "client-id"
65+
client_secret {
66+
value {
67+
plain_text = "client-secret"
68+
}
69+
}
70+
web_sso_config {
71+
response_type = "CODE"
72+
assertion_claims_behavior = "MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS"
73+
additional_scopes = ["groups", "roles"]
74+
}
75+
}
76+
display_name = "Display name"
77+
description = "A sample OIDC workforce pool provider."
78+
disabled = false
79+
attribute_condition = "true"
80+
}
81+
82+
resource "google_iam_workforce_pool_provider_scim_tenant" "scim_tenant" {
83+
location = "global"
84+
workforce_pool_id = google_iam_workforce_pool.pool.workforce_pool_id
85+
provider_id = google_iam_workforce_pool_provider.provider.provider_id
86+
scim_tenant_id = "example-scim-tenant"
87+
display_name = "Example SCIM Tenant"
88+
description = "A basic SCIM tenant for IAM Workforce Pool Provider"
89+
# state is output only, not settable
90+
}
91+
92+
`, context)
93+
}
94+
95+
func testAccIAMWorkforcePoolWorkforcePoolProviderScimTenant_update(context map[string]interface{}) string {
96+
return acctest.Nprintf(`
97+
resource "google_iam_workforce_pool" "pool" {
98+
workforce_pool_id = "tf-test-example-pool%{random_suffix}"
99+
parent = "organizations/%{org_id}"
100+
location = "global"
101+
}
102+
103+
resource "google_iam_workforce_pool_provider" "provider" {
104+
workforce_pool_id = google_iam_workforce_pool.pool.workforce_pool_id
105+
location = "global"
106+
provider_id = "tf-test-provider-%{random_suffix}"
107+
attribute_mapping = {
108+
"google.subject" = "assertion.sub"
109+
}
110+
oidc {
111+
issuer_uri = "https://accounts.thirdparty.com"
112+
client_id = "client-id"
113+
client_secret {
114+
value {
115+
plain_text = "client-secret"
116+
}
117+
}
118+
web_sso_config {
119+
response_type = "CODE"
120+
assertion_claims_behavior = "MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS"
121+
additional_scopes = ["groups", "roles"]
122+
}
123+
}
124+
display_name = "Display name"
125+
description = "A sample OIDC workforce pool provider."
126+
disabled = false
127+
attribute_condition = "true"
128+
}
129+
130+
resource "google_iam_workforce_pool_provider_scim_tenant" "scim_tenant" {
131+
location = "global"
132+
workforce_pool_id = google_iam_workforce_pool.pool.workforce_pool_id
133+
provider_id = google_iam_workforce_pool_provider.provider.provider_id
134+
scim_tenant_id = "example-scim-tenant"
135+
display_name = "Example SCIM Tenant - Updated"
136+
description = "A basic SCIM tenant for IAM Workforce Pool Provider - Updated"
137+
# state is output only, not settable
138+
}
139+
`, context)
140+
}

0 commit comments

Comments
 (0)