@@ -140,6 +140,8 @@ import (
140140// RetryAPIDelay - retry api delay
141141const RetryAPIDelay = 5 * time .Second
142142
143+ const IAMURL = iamidentity .DefaultServiceURL
144+
143145// BluemixRegion ...
144146var BluemixRegion string
145147
@@ -198,9 +200,15 @@ type Config struct {
198200 // IAM Token
199201 IAMToken string
200202
201- // TrustedProfileToken Token
203+ // TrustedProfileID
202204 IAMTrustedProfileID string
203205
206+ // TrustedProfileName
207+ IAMTrustedProfileName string
208+
209+ // Account
210+ Account string
211+
204212 // IAM Refresh Token
205213 IAMRefreshToken string
206214
@@ -1449,62 +1457,22 @@ func (c *Config) ClientSession() (interface{}, error) {
14491457 return session , nil
14501458 }
14511459
1452- if sess .BluemixSession .Config .BluemixAPIKey != "" && c .IAMTrustedProfileID == "" {
1453- err = authenticateAPIKey (sess .BluemixSession )
1454- if err != nil {
1455- for count := c .RetryCount ; count >= 0 ; count -- {
1456- if err == nil || ! isRetryable (err ) {
1457- break
1458- }
1459- time .Sleep (c .RetryDelay )
1460- log .Printf ("Retrying IAM Authentication %d" , count )
1461- err = authenticateAPIKey (sess .BluemixSession )
1462- }
1463- if err != nil {
1464- session .bmxUserFetchErr = fmt .Errorf ("[ERROR] Error occured while fetching auth key for account user details: %q" , err )
1465- session .functionConfigErr = fmt .Errorf ("[ERROR] Error occured while fetching auth key for function: %q" , err )
1460+ err = fetchAuthorizationData (sess .BluemixSession )
1461+ if err != nil {
1462+ for count := c .RetryCount ; count >= 0 ; count -- {
1463+ if err == nil || ! isRetryable (err ) {
1464+ break
14661465 }
1466+ time .Sleep (c .RetryDelay )
1467+ log .Printf ("Retrying IAM Authentication %d" , count )
1468+ err = fetchAuthorizationData (sess .BluemixSession )
14671469 }
1468-
1469- session .functionConfigErr = fmt .Errorf ("[ERROR] Error occured while fetching auth key for function: %q" , err )
1470- }
1471-
1472- if sess .BluemixSession .Config .BluemixAPIKey != "" && c .IAMTrustedProfileID != "" {
1473- err = authenticateAssume (sess .BluemixSession )
14741470 if err != nil {
1475- for count := c .RetryCount ; count >= 0 ; count -- {
1476- if err == nil || ! isRetryable (err ) {
1477- break
1478- }
1479- time .Sleep (c .RetryDelay )
1480- log .Printf ("Retrying IAM Authentication %d" , count )
1481- err = authenticateAssume (sess .BluemixSession )
1482- }
1483- if err != nil {
1484- session .bmxUserFetchErr = fmt .Errorf ("[ERROR] Error occured while fetching auth key for account user details: %q" , err )
1485- session .functionConfigErr = fmt .Errorf ("[ERROR] Error occured while fetching auth key for function: %q" , err )
1486- }
1471+ session .bmxUserFetchErr = fmt .Errorf ("[ERROR] Error occured while fetching auth key for account user details: %q" , err )
1472+ session .functionConfigErr = fmt .Errorf ("[ERROR] Error occured while fetching auth key for function: %q" , err )
14871473 }
1488-
1489- session .functionConfigErr = fmt .Errorf ("[ERROR] Error occured while fetching auth key for function: %q" , err )
14901474 }
14911475
1492- if c .IAMTrustedProfileID == "" && sess .BluemixSession .Config .BluemixAPIKey == "" && sess .BluemixSession .Config .IAMAccessToken != "" && sess .BluemixSession .Config .IAMRefreshToken != "" {
1493- err := RefreshToken (sess .BluemixSession )
1494- if err != nil {
1495- for count := c .RetryCount ; count >= 0 ; count -- {
1496- if err == nil || ! isRetryable (err ) {
1497- break
1498- }
1499- time .Sleep (c .RetryDelay )
1500- log .Printf ("Retrying refresh token %d" , count )
1501- err = RefreshToken (sess .BluemixSession )
1502- }
1503- if err != nil {
1504- return nil , fmt .Errorf ("[ERROR] Error occured while refreshing the token: %q" , err )
1505- }
1506- }
1507- }
15081476 userConfig , err := fetchUserDetails (sess .BluemixSession , c .RetryCount , c .RetryDelay )
15091477 if err != nil {
15101478 session .bmxUserFetchErr = fmt .Errorf ("[ERROR] Error occured while fetching account user details: %q" , err )
@@ -1601,7 +1569,8 @@ func (c *Config) ClientSession() (interface{}, error) {
16011569 }
16021570 session .kpAPI = kpAPIclient
16031571
1604- iamURL := iamidentity .DefaultServiceURL
1572+ iamURL := EnvFallBack ([]string {"IBMCLOUD_IAM_API_ENDPOINT" }, IAMURL )
1573+
16051574 if c .Visibility == "private" || c .Visibility == "public-and-private" {
16061575 if c .Region == "us-south" || c .Region == "us-east" {
16071576 iamURL = ContructEndpoint (fmt .Sprintf ("private.%s.iam" , c .Region ), cloudEndpoint )
@@ -1647,13 +1616,25 @@ func (c *Config) ClientSession() (interface{}, error) {
16471616
16481617 var authenticator core.Authenticator
16491618
1650- if (c .BluemixAPIKey != "" ) && c .IAMTrustedProfileID != "" {
1651- authenticator , err = core .NewIamAssumeAuthenticatorBuilder ().
1652- SetApiKey (c .BluemixAPIKey ).
1653- SetIAMProfileID (c .IAMTrustedProfileID ).
1654- Build ()
1655- if err != nil {
1656- log .Fatalf ("Error in authenticating using NewIamAssumeAuthenticatorBuilder. Error: %s" , err )
1619+ if (c .BluemixAPIKey != "" ) && (c .IAMTrustedProfileID != "" || c .IAMTrustedProfileName != "" ) {
1620+ if c .IAMTrustedProfileID != "" {
1621+ authenticator , err = core .NewIamAssumeAuthenticatorBuilder ().
1622+ SetApiKey (c .BluemixAPIKey ).
1623+ SetIAMProfileID (c .IAMTrustedProfileID ).
1624+ Build ()
1625+ if err != nil {
1626+ log .Fatalf ("Error in authenticating using NewIamAssumeAuthenticatorBuilder. Error: %s" , err )
1627+ }
1628+ } else {
1629+ authenticator , err = core .NewIamAssumeAuthenticatorBuilder ().
1630+ SetApiKey (c .BluemixAPIKey ).
1631+ SetIAMProfileName (c .IAMTrustedProfileName ).
1632+ SetIAMAccountID (c .Account ).
1633+ Build ()
1634+ if err != nil {
1635+ log .Fatalf ("Error in authenticating using NewIamAssumeAuthenticatorBuilder with trusted profile name. Error: %s" , err )
1636+ }
1637+
16571638 }
16581639 } else if c .BluemixAPIKey != "" || sess .BluemixSession .Config .IAMRefreshToken != "" {
16591640 if c .BluemixAPIKey != "" {
@@ -3799,67 +3780,83 @@ func newSession(c *Config) (*Session, error) {
37993780 softlayerSession .AppendUserAgent (fmt .Sprintf ("terraform-provider-ibm/%s" , version .Version ))
38003781 ibmSession .SoftLayerSession = softlayerSession
38013782
3802- /*if c.IAMTrustedProfileID == "" && (c.IAMToken != "" && c.IAMRefreshToken == "") || (c.IAMToken == "" && c.IAMRefreshToken != "") {
3803- return nil, fmt.Errorf("iam_token and iam_refresh_token must be provided")
3804- }
3805- if c.IAMTrustedProfileID != "" && c.IAMToken == "" {
3806- return nil, fmt.Errorf("iam_token and iam_profile_id must be provided")
3807- }*/
3808-
3809- if c .IAMToken != "" {
3810- log .Println ("Configuring IBM Cloud Session with token" )
3811- var sess * bxsession.Session
3812- bmxConfig := & bluemix.Config {
3813- IAMAccessToken : c .IAMToken ,
3814- IAMRefreshToken : c .IAMRefreshToken ,
3815- // Comment out debug mode for v0.12
3816- Debug : os .Getenv ("TF_LOG" ) != "" ,
3817- HTTPTimeout : c .BluemixTimeout ,
3818- Region : c .Region ,
3819- ResourceGroup : c .ResourceGroup ,
3820- RetryDelay : & c .RetryDelay ,
3821- MaxRetries : & c .RetryCount ,
3822- Visibility : c .Visibility ,
3823- PrivateEndpointType : c .PrivateEndpointType ,
3824- EndpointsFile : c .EndpointsFile ,
3825- UserAgent : fmt .Sprintf ("terraform-provider-ibm/%s" , version .Version ),
3783+ var authenticator core.Authenticator
3784+ var err error
3785+ iamURL := EnvFallBack ([]string {"IBMCLOUD_IAM_API_ENDPOINT" }, IAMURL )
3786+ if (c .BluemixAPIKey != "" ) && (c .IAMTrustedProfileID != "" || c .IAMTrustedProfileName != "" ) {
3787+ if c .IAMTrustedProfileID != "" {
3788+ authenticator , err = core .NewIamAssumeAuthenticatorBuilder ().
3789+ SetApiKey (c .BluemixAPIKey ).
3790+ SetIAMProfileID (c .IAMTrustedProfileID ).
3791+ SetURL (iamURL ).
3792+ Build ()
3793+ if err != nil {
3794+ log .Fatalf ("Error in authenticating using NewIamAssumeAuthenticatorBuilder. Error: %s" , err )
3795+ }
3796+ } else {
3797+ authenticator , err = core .NewIamAssumeAuthenticatorBuilder ().
3798+ SetApiKey (c .BluemixAPIKey ).
3799+ SetIAMProfileName (c .IAMTrustedProfileName ).
3800+ SetIAMAccountID (c .Account ).
3801+ SetURL (iamURL ).
3802+ Build ()
3803+ if err != nil {
3804+ log .Fatalf ("Error in authenticating using NewIamAssumeAuthenticatorBuilder with trusted profile name. Error: %s" , err )
3805+ }
38263806 }
3827- sess , err := bxsession .New (bmxConfig )
3828- if err != nil {
3829- return nil , err
3807+ } else if c .BluemixAPIKey != "" || c .IAMRefreshToken != "" {
3808+ if c .BluemixAPIKey != "" {
3809+ authenticator = & core.IamAuthenticator {
3810+ ApiKey : c .BluemixAPIKey ,
3811+ URL : iamURL ,
3812+ }
3813+ } else {
3814+ // Construct the IamAuthenticator with the IAM refresh token.
3815+ authenticator = & core.IamAuthenticator {
3816+ RefreshToken : c .IAMRefreshToken ,
3817+ ClientId : "bx" ,
3818+ ClientSecret : "bx" ,
3819+ URL : iamURL ,
3820+ }
38303821 }
3831- ibmSession .BluemixSession = sess
3832- }
3833-
3834- if c .BluemixAPIKey != "" {
3835- log .Println ("Configuring IBM Cloud Session with API key" )
3836- var sess * bxsession.Session
3837- bmxConfig := & bluemix.Config {
3838- BluemixAPIKey : c .BluemixAPIKey ,
3839- // Comment out debug mode for v0.12
3840- Debug : os .Getenv ("TF_LOG" ) != "" ,
3841- HTTPTimeout : c .BluemixTimeout ,
3842- Region : c .Region ,
3843- ResourceGroup : c .ResourceGroup ,
3844- RetryDelay : & c .RetryDelay ,
3845- MaxRetries : & c .RetryCount ,
3846- Visibility : c .Visibility ,
3847- PrivateEndpointType : c .PrivateEndpointType ,
3848- EndpointsFile : c .EndpointsFile ,
3849- UserAgent : fmt .Sprintf ("terraform-provider-ibm/%s" , version .Version ),
3850- IAMTrustedProfileID : c .IAMTrustedProfileID ,
3822+ } else if strings .HasPrefix (c .IAMToken , "Bearer" ) {
3823+ authenticator = & core.BearerTokenAuthenticator {
3824+ BearerToken : c .IAMToken [7 :],
38513825 }
3852- sess , err := bxsession . New ( bmxConfig )
3853- if err != nil {
3854- return nil , err
3826+ } else {
3827+ authenticator = & core. BearerTokenAuthenticator {
3828+ BearerToken : c . IAMToken ,
38553829 }
3856- ibmSession .BluemixSession = sess
38573830 }
38583831
3832+ var sess * bxsession.Session
3833+ bmxConfig := & bluemix.Config {
3834+ IAMAccessToken : c .IAMToken ,
3835+ IAMRefreshToken : c .IAMRefreshToken ,
3836+ BluemixAPIKey : c .BluemixAPIKey ,
3837+ // Comment out debug mode for v0.12
3838+ Debug : os .Getenv ("TF_LOG" ) != "" ,
3839+ HTTPTimeout : c .BluemixTimeout ,
3840+ Region : c .Region ,
3841+ ResourceGroup : c .ResourceGroup ,
3842+ RetryDelay : & c .RetryDelay ,
3843+ MaxRetries : & c .RetryCount ,
3844+ Visibility : c .Visibility ,
3845+ PrivateEndpointType : c .PrivateEndpointType ,
3846+ EndpointsFile : c .EndpointsFile ,
3847+ UserAgent : fmt .Sprintf ("terraform-provider-ibm/%s" , version .Version ),
3848+ Authenticator : authenticator ,
3849+ }
3850+ sess , err = bxsession .New (bmxConfig )
3851+ if err != nil {
3852+ return nil , err
3853+ }
3854+ ibmSession .BluemixSession = sess
3855+
38593856 return ibmSession , nil
38603857}
38613858
3862- func authenticateAPIKey (sess * bxsession.Session ) error {
3859+ /* func authenticateAPIKey(sess *bxsession.Session) error {
38633860 config := sess.Config
38643861 tokenRefresher, err := authentication.NewIAMAuthRepository(config, &rest.Client{
38653862 DefaultHeader: gohttp.Header{
@@ -3885,6 +3882,20 @@ func authenticateAssume(sess *bxsession.Session) error {
38853882 return err
38863883 }
38873884 return tokenRefresher.AuthenticateAssume(config.BluemixAPIKey, config.IAMTrustedProfileID)
3885+ }*/
3886+
3887+ func fetchAuthorizationData (sess * bxsession.Session ) error {
3888+ config := sess .Config
3889+ tokenRefresher , err := authentication .NewIAMAuthRepository (config , & rest.Client {
3890+ DefaultHeader : gohttp.Header {
3891+ "User-Agent" : []string {http .UserAgent ()},
3892+ "X-Original-User-Agent" : []string {config .UserAgent },
3893+ },
3894+ })
3895+ if err != nil {
3896+ return err
3897+ }
3898+ return tokenRefresher .FetchAuthorizationData (config .Authenticator )
38883899}
38893900
38903901func fetchUserDetails (sess * bxsession.Session , retries int , retryDelay time.Duration ) (* UserConfig , error ) {
@@ -3904,18 +3915,9 @@ func fetchUserDetails(sess *bxsession.Session, retries int, retryDelay time.Dura
39043915 // TODO validate with key
39053916 if err != nil && ! strings .Contains (err .Error (), "key is of invalid type" ) {
39063917 if retries > 0 {
3907- if config .BluemixAPIKey != "" && config .IAMTrustedProfileID == "" {
3908- time .Sleep (retryDelay )
3909- log .Printf ("Retrying authentication for user details %d" , retries )
3910- _ = authenticateAPIKey (sess )
3911- return fetchUserDetails (sess , retries - 1 , retryDelay )
3912- } else if config .BluemixAPIKey != "" && config .IAMTrustedProfileID != "" {
3913- time .Sleep (retryDelay )
3914- log .Printf ("Retrying authentication for user details %d" , retries )
3915- _ = authenticateAssume (sess )
3916- return fetchUserDetails (sess , retries - 1 , retryDelay )
3917-
3918- }
3918+ time .Sleep (retryDelay )
3919+ log .Printf ("Retrying authentication for user details %d" , retries )
3920+ _ = fetchAuthorizationData (sess )
39193921 }
39203922 return & user , err
39213923 }
0 commit comments