@@ -1449,7 +1449,7 @@ func (c *Config) ClientSession() (interface{}, error) {
14491449 return session , nil
14501450 }
14511451
1452- if sess .BluemixSession .Config .BluemixAPIKey != "" {
1452+ if sess .BluemixSession .Config .BluemixAPIKey != "" && c . IAMTrustedProfileID == "" {
14531453 err = authenticateAPIKey (sess .BluemixSession )
14541454 if err != nil {
14551455 for count := c .RetryCount ; count >= 0 ; count -- {
@@ -1469,7 +1469,27 @@ func (c *Config) ClientSession() (interface{}, error) {
14691469 session .functionConfigErr = fmt .Errorf ("[ERROR] Error occured while fetching auth key for function: %q" , err )
14701470 }
14711471
1472- if c .IAMTrustedProfileID == "" && sess .BluemixSession .Config .IAMAccessToken != "" && sess .BluemixSession .Config .BluemixAPIKey == "" {
1472+ if sess .BluemixSession .Config .BluemixAPIKey != "" && c .IAMTrustedProfileID != "" {
1473+ err = authenticateAssume (sess .BluemixSession )
1474+ if err != nil {
1475+ for count := c .RetryCount ; count >= 0 ; count -- {
1476+ if err == nil || ! isRetryable (err ) {
1477+ break
1478+ }
1479+ time .Sleep (c .RetryDelay )
1480+ log .Printf ("Retrying IAM Authentication %d" , count )
1481+ err = authenticateAssume (sess .BluemixSession )
1482+ }
1483+ if err != nil {
1484+ session .bmxUserFetchErr = fmt .Errorf ("[ERROR] Error occured while fetching auth key for account user details: %q" , err )
1485+ session .functionConfigErr = fmt .Errorf ("[ERROR] Error occured while fetching auth key for function: %q" , err )
1486+ }
1487+ }
1488+
1489+ session .functionConfigErr = fmt .Errorf ("[ERROR] Error occured while fetching auth key for function: %q" , err )
1490+ }
1491+
1492+ if c .IAMTrustedProfileID == "" && sess .BluemixSession .Config .BluemixAPIKey == "" && sess .BluemixSession .Config .IAMAccessToken != "" && sess .BluemixSession .Config .IAMRefreshToken != "" {
14731493 err := RefreshToken (sess .BluemixSession )
14741494 if err != nil {
14751495 for count := c .RetryCount ; count >= 0 ; count -- {
@@ -1627,7 +1647,15 @@ func (c *Config) ClientSession() (interface{}, error) {
16271647
16281648 var authenticator core.Authenticator
16291649
1630- if c .BluemixAPIKey != "" || sess .BluemixSession .Config .IAMRefreshToken != "" {
1650+ if (c .BluemixAPIKey != "" ) && c .IAMTrustedProfileID != "" {
1651+ authenticator , err = core .NewIamAssumeAuthenticatorBuilder ().
1652+ SetApiKey (c .BluemixAPIKey ).
1653+ SetIAMProfileID (c .IAMTrustedProfileID ).
1654+ Build ()
1655+ if err != nil {
1656+ log .Fatalf ("Error in authenticating using NewIamAssumeAuthenticatorBuilder. Error: %s" , err )
1657+ }
1658+ } else if c .BluemixAPIKey != "" || sess .BluemixSession .Config .IAMRefreshToken != "" {
16311659 if c .BluemixAPIKey != "" {
16321660 authenticator = & core.IamAuthenticator {
16331661 ApiKey : c .BluemixAPIKey ,
@@ -3770,12 +3798,12 @@ func newSession(c *Config) (*Session, error) {
37703798 softlayerSession .AppendUserAgent (fmt .Sprintf ("terraform-provider-ibm/%s" , version .Version ))
37713799 ibmSession .SoftLayerSession = softlayerSession
37723800
3773- if c .IAMTrustedProfileID == "" && (c .IAMToken != "" && c .IAMRefreshToken == "" ) || (c .IAMToken == "" && c .IAMRefreshToken != "" ) {
3801+ /* if c.IAMTrustedProfileID == "" && (c.IAMToken != "" && c.IAMRefreshToken == "") || (c.IAMToken == "" && c.IAMRefreshToken != "") {
37743802 return nil, fmt.Errorf("iam_token and iam_refresh_token must be provided")
37753803 }
37763804 if c.IAMTrustedProfileID != "" && c.IAMToken == "" {
37773805 return nil, fmt.Errorf("iam_token and iam_profile_id must be provided")
3778- }
3806+ }*/
37793807
37803808 if c .IAMToken != "" {
37813809 log .Println ("Configuring IBM Cloud Session with token" )
@@ -3818,6 +3846,7 @@ func newSession(c *Config) (*Session, error) {
38183846 PrivateEndpointType : c .PrivateEndpointType ,
38193847 EndpointsFile : c .EndpointsFile ,
38203848 UserAgent : fmt .Sprintf ("terraform-provider-ibm/%s" , version .Version ),
3849+ IAMTrustedProfileID : c .IAMTrustedProfileID ,
38213850 }
38223851 sess , err := bxsession .New (bmxConfig )
38233852 if err != nil {
@@ -3843,6 +3872,20 @@ func authenticateAPIKey(sess *bxsession.Session) error {
38433872 return tokenRefresher .AuthenticateAPIKey (config .BluemixAPIKey )
38443873}
38453874
3875+ func authenticateAssume (sess * bxsession.Session ) error {
3876+ config := sess .Config
3877+ tokenRefresher , err := authentication .NewIAMAuthRepository (config , & rest.Client {
3878+ DefaultHeader : gohttp.Header {
3879+ "User-Agent" : []string {http .UserAgent ()},
3880+ "X-Original-User-Agent" : []string {config .UserAgent },
3881+ },
3882+ })
3883+ if err != nil {
3884+ return err
3885+ }
3886+ return tokenRefresher .AuthenticateAssume (config .BluemixAPIKey , config .IAMTrustedProfileID )
3887+ }
3888+
38463889func fetchUserDetails (sess * bxsession.Session , retries int , retryDelay time.Duration ) (* UserConfig , error ) {
38473890 config := sess .Config
38483891 user := UserConfig {}
@@ -3860,11 +3903,17 @@ func fetchUserDetails(sess *bxsession.Session, retries int, retryDelay time.Dura
38603903 // TODO validate with key
38613904 if err != nil && ! strings .Contains (err .Error (), "key is of invalid type" ) {
38623905 if retries > 0 {
3863- if config .BluemixAPIKey != "" {
3906+ if config .BluemixAPIKey != "" && config . IAMTrustedProfileID == "" {
38643907 time .Sleep (retryDelay )
38653908 log .Printf ("Retrying authentication for user details %d" , retries )
38663909 _ = authenticateAPIKey (sess )
38673910 return fetchUserDetails (sess , retries - 1 , retryDelay )
3911+ } else if config .BluemixAPIKey != "" && config .IAMTrustedProfileID != "" {
3912+ time .Sleep (retryDelay )
3913+ log .Printf ("Retrying authentication for user details %d" , retries )
3914+ _ = authenticateAssume (sess )
3915+ return fetchUserDetails (sess , retries - 1 , retryDelay )
3916+
38683917 }
38693918 }
38703919 return & user , err
0 commit comments