[CLI-3479] Union of Pools Identity Provider (#3065)

cqin-confluent · web-flow · commit 65af2c4b137a · 2025-03-31T12:50:00.000-07:00
diff --git a/cmd/lint/main.go b/cmd/lint/main.go
@@ -252,6 +252,7 @@ var vocabWords = []string{
 	"jit",
 	"jsonschema",
 	"jwks",
+	"JWT",
 	"kafka",
 	"kek",
 	"keychain",
diff --git a/internal/iam/command_provider.go b/internal/iam/command_provider.go
@@ -14,11 +14,12 @@ type identityProviderCommand struct {
 }
 
 type identityProviderOut struct {
-	Id          string `human:"ID" serialized:"id"`
-	Name        string `human:"Name" serialized:"name"`
-	Description string `human:"Description" serialized:"description"`
-	IssuerUri   string `human:"Issuer URI" serialized:"issuer_uri"`
-	JwksUri     string `human:"JWKS URI" serialized:"jwks_uri"`
+	Id            string `human:"ID" serialized:"id"`
+	Name          string `human:"Name" serialized:"name"`
+	Description   string `human:"Description" serialized:"description"`
+	IdentityClaim string `human:"Identity Claim,omitempty" serialized:"identity_claim,omitempty"`
+	IssuerUri     string `human:"Issuer URI" serialized:"issuer_uri"`
+	JwksUri       string `human:"JWKS URI" serialized:"jwks_uri"`
 }
 
 func newProviderCommand(prerunner pcmd.PreRunner) *cobra.Command {
@@ -42,11 +43,12 @@ func newProviderCommand(prerunner pcmd.PreRunner) *cobra.Command {
 func printIdentityProvider(cmd *cobra.Command, provider identityproviderv2.IamV2IdentityProvider) error {
 	table := output.NewTable(cmd)
 	table.Add(&identityProviderOut{
-		Id:          provider.GetId(),
-		Name:        provider.GetDisplayName(),
-		Description: provider.GetDescription(),
-		IssuerUri:   provider.GetIssuer(),
-		JwksUri:     provider.GetJwksUri(),
+		Id:            provider.GetId(),
+		Name:          provider.GetDisplayName(),
+		Description:   provider.GetDescription(),
+		IdentityClaim: provider.GetIdentityClaim(),
+		IssuerUri:     provider.GetIssuer(),
+		JwksUri:       provider.GetJwksUri(),
 	})
 	return table.Print()
 }
diff --git a/internal/iam/command_provider_create.go b/internal/iam/command_provider_create.go
@@ -26,6 +26,7 @@ func (c *identityProviderCommand) newCreateCommand() *cobra.Command {
 	cmd.Flags().String("issuer-uri", "", "URI of the identity provider issuer.")
 	cmd.Flags().String("jwks-uri", "", "JWKS (JSON Web Key Set) URI of the identity provider.")
 	cmd.Flags().String("description", "", "Description of the identity provider.")
+	cmd.Flags().String("identity-claim", "", "The JSON Web Token (JWT) claim to extract the authenticating identity to Confluent resources from Registered Claim Names.")
 	pcmd.AddContextFlag(cmd, c.CLICommand)
 	pcmd.AddOutputFlag(cmd)
 
@@ -51,11 +52,17 @@ func (c *identityProviderCommand) create(cmd *cobra.Command, args []string) erro
 		return err
 	}
 
+	identityClaim, err := cmd.Flags().GetString("identity-claim")
+	if err != nil {
+		return err
+	}
+
 	createIdentityProvider := identityproviderv2.IamV2IdentityProvider{
-		DisplayName: identityproviderv2.PtrString(args[0]),
-		Description: identityproviderv2.PtrString(description),
-		Issuer:      identityproviderv2.PtrString(issuerUri),
-		JwksUri:     identityproviderv2.PtrString(jwksUri),
+		DisplayName:   identityproviderv2.PtrString(args[0]),
+		Description:   identityproviderv2.PtrString(description),
+		IdentityClaim: identityproviderv2.PtrString(identityClaim),
+		Issuer:        identityproviderv2.PtrString(issuerUri),
+		JwksUri:       identityproviderv2.PtrString(jwksUri),
 	}
 	provider, err := c.V2Client.CreateIdentityProvider(createIdentityProvider)
 	if err != nil {
diff --git a/internal/iam/command_provider_list.go b/internal/iam/command_provider_list.go
@@ -30,11 +30,12 @@ func (c *identityProviderCommand) list(cmd *cobra.Command, _ []string) error {
 	list := output.NewList(cmd)
 	for _, provider := range identityProviders {
 		list.Add(&identityProviderOut{
-			Id:          provider.GetId(),
-			Name:        provider.GetDisplayName(),
-			Description: provider.GetDescription(),
-			IssuerUri:   provider.GetIssuer(),
-			JwksUri:     provider.GetJwksUri(),
+			Id:            provider.GetId(),
+			Name:          provider.GetDisplayName(),
+			Description:   provider.GetDescription(),
+			IdentityClaim: provider.GetIdentityClaim(),
+			IssuerUri:     provider.GetIssuer(),
+			JwksUri:       provider.GetJwksUri(),
 		})
 	}
 	return list.Print()
diff --git a/internal/iam/command_provider_update.go b/internal/iam/command_provider_update.go
@@ -26,10 +26,11 @@ func (c *identityProviderCommand) newUpdateCommand() *cobra.Command {
 
 	cmd.Flags().String("name", "", "Name of the identity provider.")
 	cmd.Flags().String("description", "", "Description of the identity provider.")
+	cmd.Flags().String("identity-claim", "", "The JSON Web Token (JWT) claim to extract the authenticating identity to Confluent resources from Registered Claim Names.")
 	pcmd.AddContextFlag(cmd, c.CLICommand)
 	pcmd.AddOutputFlag(cmd)
 
-	cmd.MarkFlagsOneRequired("name", "description")
+	cmd.MarkFlagsOneRequired("name", "description", "identity-claim")
 
 	return cmd
 }
@@ -45,10 +46,18 @@ func (c *identityProviderCommand) update(cmd *cobra.Command, args []string) erro
 		return err
 	}
 
+	identityClaim, err := cmd.Flags().GetString("identity-claim")
+	if err != nil {
+		return err
+	}
+
 	update := identityproviderv2.IamV2IdentityProvider{Id: identityproviderv2.PtrString(args[0])}
 	if name != "" {
 		update.DisplayName = identityproviderv2.PtrString(name)
 	}
+	if identityClaim != "" {
+		update.IdentityClaim = identityproviderv2.PtrString(identityClaim)
+	}
 	if description != "" {
 		update.Description = identityproviderv2.PtrString(description)
 	}
diff --git a/test/fixtures/output/iam/identity-provider/create-with-identity-claim.golden b/test/fixtures/output/iam/identity-provider/create-with-identity-claim.golden
@@ -0,0 +1,8 @@
++----------------+-------------------------------------------------+
+| ID             | op-67890                                        |
+| Name           | okta-with-identity-claim                        |
+| Description    | new description.                                |
+| Identity Claim | claims.sub                                      |
+| Issuer URI     | https://company.new-provider.com                |
+| JWKS URI       | https://company.new-provider.com/oauth2/v1/keys |
++----------------+-------------------------------------------------+
diff --git a/test/fixtures/output/iam/identity-provider/describe-autocomplete.golden b/test/fixtures/output/iam/identity-provider/describe-autocomplete.golden
@@ -1,4 +1,5 @@
 op-12345	identity-provider: providing identities.
 op-abc	another-provider: providing identities.
+op-67890	okta-with-identity-claim: new description.
 :4
 Completion ended with directive: ShellCompDirectiveNoFileComp
diff --git a/test/fixtures/output/iam/identity-provider/describe-with-identity-claim.golden b/test/fixtures/output/iam/identity-provider/describe-with-identity-claim.golden
@@ -0,0 +1,8 @@
++----------------+-------------------------------------------------+
+| ID             | op-67890                                        |
+| Name           | okta-with-identity-claim                        |
+| Description    | new description.                                |
+| Identity Claim | claims.sub                                      |
+| Issuer URI     | https://company.new-provider.com                |
+| JWKS URI       | https://company.new-provider.com/oauth2/v1/keys |
++----------------+-------------------------------------------------+
diff --git a/test/fixtures/output/iam/identity-provider/list.golden b/test/fixtures/output/iam/identity-provider/list.golden
@@ -1,4 +1,5 @@
-     ID    |       Name        |      Description      |          Issuer URI          |                  JWKS URI                    
------------+-------------------+-----------------------+------------------------------+----------------------------------------------
-  op-12345 | identity-provider | providing identities. | https://company.provider.com | https://company.provider.com/oauth2/v1/keys  
-  op-abc   | another-provider  | providing identities. | https://company.provider.com | https://company.provider.com/oauth2/v1/keys  
+     ID    |           Name           |      Description      | Identity Claim |            Issuer URI            |                    JWKS URI                      
+-----------+--------------------------+-----------------------+----------------+----------------------------------+--------------------------------------------------
+  op-12345 | identity-provider        | providing identities. |                | https://company.provider.com     | https://company.provider.com/oauth2/v1/keys      
+  op-67890 | okta-with-identity-claim | new description.      | claims.sub     | https://company.new-provider.com | https://company.new-provider.com/oauth2/v1/keys  
+  op-abc   | another-provider         | providing identities. |                | https://company.provider.com     | https://company.provider.com/oauth2/v1/keys      
diff --git a/test/fixtures/output/iam/identity-provider/update-with-identity-claim.golden b/test/fixtures/output/iam/identity-provider/update-with-identity-claim.golden
@@ -0,0 +1,9 @@
++----------------+-------------------------------------------------+
+| ID             | op-67890                                        |
+| Name           | okta-with-identity-claim                        |
+| Description    | providing identities with                       |
+|                | identity claim.                                 |
+| Identity Claim | claims.sub.updated                              |
+| Issuer URI     | https://company.new-provider.com                |
+| JWKS URI       | https://company.new-provider.com/oauth2/v1/keys |
++----------------+-------------------------------------------------+
diff --git a/test/fixtures/output/iam/provider/create-help.golden b/test/fixtures/output/iam/provider/create-help.golden
@@ -9,11 +9,12 @@ Create an identity provider named "demo-identity-provider".
   $ confluent iam provider create demo-identity-provider --description "new description" --jwks-uri https://company.provider.com/oauth2/v1/keys --issuer-uri https://company.provider.com
 
 Flags:
-      --issuer-uri string    REQUIRED: URI of the identity provider issuer.
-      --jwks-uri string      REQUIRED: JWKS (JSON Web Key Set) URI of the identity provider.
-      --description string   Description of the identity provider.
-      --context string       CLI context name.
-  -o, --output string        Specify the output format as "human", "json", or "yaml". (default "human")
+      --issuer-uri string       REQUIRED: URI of the identity provider issuer.
+      --jwks-uri string         REQUIRED: JWKS (JSON Web Key Set) URI of the identity provider.
+      --description string      Description of the identity provider.
+      --identity-claim string   The JSON Web Token (JWT) claim to extract the authenticating identity to Confluent resources from Registered Claim Names.
+      --context string          CLI context name.
+  -o, --output string           Specify the output format as "human", "json", or "yaml". (default "human")
 
 Global Flags:
   -h, --help            Show help for this command.
diff --git a/test/fixtures/output/iam/provider/update-help.golden b/test/fixtures/output/iam/provider/update-help.golden
@@ -9,10 +9,11 @@ Update the description of identity provider "op-123456".
   $ confluent iam provider update op-123456 --description "updated description"
 
 Flags:
-      --name string          Name of the identity provider.
-      --description string   Description of the identity provider.
-      --context string       CLI context name.
-  -o, --output string        Specify the output format as "human", "json", or "yaml". (default "human")
+      --name string             Name of the identity provider.
+      --description string      Description of the identity provider.
+      --identity-claim string   The JSON Web Token (JWT) claim to extract the authenticating identity to Confluent resources from Registered Claim Names.
+      --context string          CLI context name.
+  -o, --output string           Specify the output format as "human", "json", or "yaml". (default "human")
 
 Global Flags:
   -h, --help            Show help for this command.
diff --git a/test/iam_test.go b/test/iam_test.go
@@ -270,14 +270,17 @@ func (s *CLITestSuite) TestIamUserInvitationList() {
 func (s *CLITestSuite) TestIamProvider() {
 	tests := []CLITest{
 		{args: "iam provider create okta --description 'new description' --jwks-uri https://company.provider.com/oauth2/v1/keys --issuer-uri https://company.provider.com", fixture: "iam/identity-provider/create.golden"},
+		{args: "iam provider create okta-with-identity-claim --description 'new description' --jwks-uri https://company.provider.com/oauth2/v1/keys --issuer-uri https://company.provider.com --identity-claim claims.sub", fixture: "iam/identity-provider/create-with-identity-claim.golden"},
 		{args: "iam provider delete op-12345 --force", fixture: "iam/identity-provider/delete.golden"},
 		{args: "iam provider delete op-12345 op-54321", fixture: "iam/identity-provider/delete-multiple-fail.golden", exitCode: 1},
 		{args: "iam provider delete op-12345 op-67890", input: "n\n", fixture: "iam/identity-provider/delete-multiple-refuse.golden"},
 		{args: "iam provider delete op-12345 op-67890", input: "y\n", fixture: "iam/identity-provider/delete-multiple-success.golden"},
 		{args: "iam provider delete op-12345", input: "y\n", fixture: "iam/identity-provider/delete-prompt.golden"},
 		{args: "iam provider delete op-1 --force", fixture: "iam/identity-provider/delete-dne.golden", exitCode: 1},
 		{args: "iam provider describe op-12345", fixture: "iam/identity-provider/describe.golden"},
+		{args: "iam provider describe op-67890", fixture: "iam/identity-provider/describe-with-identity-claim.golden"},
 		{args: "iam provider update op-12345 --name updated-name --description 'updated description'", fixture: "iam/identity-provider/update.golden"},
+		{args: "iam provider update op-67890 --identity-claim claims.sub.updated", fixture: "iam/identity-provider/update-with-identity-claim.golden"},
 		{args: "iam provider list", fixture: "iam/identity-provider/list.golden"},
 	}
 
diff --git a/test/test-server/iam_handlers.go b/test/test-server/iam_handlers.go
@@ -362,14 +362,27 @@ func handleIamIdentityProvider(t *testing.T) http.HandlerFunc {
 				Issuer:      identityproviderv2.PtrString("https://company.provider.com"),
 				JwksUri:     identityproviderv2.PtrString("https://company.provider.com/oauth2/v1/keys"),
 			}
+			if id == "op-67890" {
+				res.IdentityClaim = req.IdentityClaim
+				res.DisplayName = identityproviderv2.PtrString("okta-with-identity-claim")
+				res.Description = identityproviderv2.PtrString("providing identities with identity claim.")
+				res.Issuer = identityproviderv2.PtrString("https://company.new-provider.com")
+				res.JwksUri = identityproviderv2.PtrString("https://company.new-provider.com/oauth2/v1/keys")
+			}
 			err = json.NewEncoder(w).Encode(res)
 			require.NoError(t, err)
 		case http.MethodDelete:
 			w.WriteHeader(http.StatusNoContent)
 		case http.MethodGet:
-			identityProvider := buildIamProvider(id, "identity-provider", "providing identities.", "https://company.provider.com", "https://company.provider.com/oauth2/v1/keys")
-			err := json.NewEncoder(w).Encode(identityProvider)
-			require.NoError(t, err)
+			if id == identityProviderId {
+				identityProvider := buildIamProvider(id, "identity-provider", "providing identities.", "https://company.provider.com", "https://company.provider.com/oauth2/v1/keys", "")
+				err := json.NewEncoder(w).Encode(identityProvider)
+				require.NoError(t, err)
+			} else if id == "op-67890" {
+				identityProviderIdentityClaim := buildIamProvider(id, "okta-with-identity-claim", "new description.", "https://company.new-provider.com", "https://company.new-provider.com/oauth2/v1/keys", "claims.sub")
+				err := json.NewEncoder(w).Encode(identityProviderIdentityClaim)
+				require.NoError(t, err)
+			}
 		}
 	}
 }
@@ -379,21 +392,30 @@ func handleIamIdentityProviders(t *testing.T) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		switch r.Method {
 		case http.MethodGet:
-			identityProvider := buildIamProvider(identityProviderId, "identity-provider", "providing identities.", "https://company.provider.com", "https://company.provider.com/oauth2/v1/keys")
-			anotherIdentityProvider := buildIamProvider("op-abc", "another-provider", "providing identities.", "https://company.provider.com", "https://company.provider.com/oauth2/v1/keys")
-			err := json.NewEncoder(w).Encode(identityproviderv2.IamV2IdentityProviderList{Data: []identityproviderv2.IamV2IdentityProvider{identityProvider, anotherIdentityProvider}})
+			identityProvider := buildIamProvider(identityProviderId, "identity-provider", "providing identities.", "https://company.provider.com", "https://company.provider.com/oauth2/v1/keys", "")
+			anotherIdentityProvider := buildIamProvider("op-abc", "another-provider", "providing identities.", "https://company.provider.com", "https://company.provider.com/oauth2/v1/keys", "")
+			identityProviderIdentityClaim := buildIamProvider("op-67890", "okta-with-identity-claim", "new description.", "https://company.new-provider.com", "https://company.new-provider.com/oauth2/v1/keys", "claims.sub")
+			err := json.NewEncoder(w).Encode(identityproviderv2.IamV2IdentityProviderList{Data: []identityproviderv2.IamV2IdentityProvider{identityProvider, anotherIdentityProvider, identityProviderIdentityClaim}})
 			require.NoError(t, err)
 		case http.MethodPost:
 			var req identityproviderv2.IamV2IdentityProvider
 			err := json.NewDecoder(r.Body).Decode(&req)
 			require.NoError(t, err)
 			identityProvider := &identityproviderv2.IamV2IdentityProvider{
-				Id:          identityproviderv2.PtrString("op-55555"),
 				DisplayName: req.DisplayName,
 				Description: req.Description,
 				Issuer:      req.Issuer,
 				JwksUri:     req.JwksUri,
 			}
+			if *req.DisplayName == "okta" {
+				identityProvider.Id = identityproviderv2.PtrString("op-55555")
+			} else if *req.DisplayName == "okta-with-identity-claim" {
+				identityProvider.Id = identityproviderv2.PtrString("op-67890")
+				identityProvider.IdentityClaim = req.IdentityClaim
+				identityProvider.Description = identityproviderv2.PtrString("new description.")
+				identityProvider.Issuer = identityproviderv2.PtrString("https://company.new-provider.com")
+				identityProvider.JwksUri = identityproviderv2.PtrString("https://company.new-provider.com/oauth2/v1/keys")
+			}
 			err = json.NewEncoder(w).Encode(identityProvider)
 			require.NoError(t, err)
 		}
@@ -859,13 +881,14 @@ func buildIamCertificatePool(id, name, description, externalIdentifier, filter s
 	}
 }
 
-func buildIamProvider(id, name, description, issuer, jwksUri string) identityproviderv2.IamV2IdentityProvider {
+func buildIamProvider(id, name, description, issuer, jwksUri, identityClaim string) identityproviderv2.IamV2IdentityProvider {
 	return identityproviderv2.IamV2IdentityProvider{
-		Id:          iamv2.PtrString(id),
-		DisplayName: iamv2.PtrString(name),
-		Description: iamv2.PtrString(description),
-		Issuer:      iamv2.PtrString(issuer),
-		JwksUri:     iamv2.PtrString(jwksUri),
+		Id:            iamv2.PtrString(id),
+		DisplayName:   iamv2.PtrString(name),
+		Description:   iamv2.PtrString(description),
+		IdentityClaim: iamv2.PtrString(identityClaim),
+		Issuer:        iamv2.PtrString(issuer),
+		JwksUri:       iamv2.PtrString(jwksUri),
 	}
 }
 
