Skip to content

Commit 0f2af8c

Browse files
elshirakelshirak
authored
Add support for fetchRoles in keycloak_openid_client_role_policy resource (#1241)
* Add fetchRoles option to keycloak_openid_client_role_policy resource Signed-off-by: Shirak Elbakyan <[email protected]> * Add fetch_roles to test Signed-off-by: Shirak Elbakyan <[email protected]> * Cosmetic changes Signed-off-by: Shirak Elbakyan <[email protected]> * Cosmetics Signed-off-by: Shirak Elbakyan <[email protected]> * Add fetchRoles option to keycloak_openid_client_role_policy resource Signed-off-by: Shirak Elbakyan <[email protected]> * Cosmetic changes Signed-off-by: Shirak Elbakyan <[email protected]> * Cosmetics Signed-off-by: Shirak Elbakyan <[email protected]> * Fix TestAccKeycloakOpenidClientAuthorizationRolePolicy_multiple Signed-off-by: Shirak Elbakyan <[email protected]> * Fix err interface conversion: interface {} is bool, not string Signed-off-by: Shirak Elbakyan <[email protected]> * Update Signed-off-by: Shirak Elbakyan <[email protected]> * Update Signed-off-by: Shirak Elbakyan <[email protected]> * upd Signed-off-by: Shirak Elbakyan <[email protected]> * Update Signed-off-by: Shirak Elbakyan <[email protected]> * Update Signed-off-by: Shirak Elbakyan <[email protected]> * Try Signed-off-by: Shirak Elbakyan <[email protected]> * upd Signed-off-by: Shirak Elbakyan <[email protected]> * Fix tests Signed-off-by: Shirak Elbakyan <[email protected]> --------- Signed-off-by: Shirak Elbakyan <[email protected]>
1 parent 323d0f3 commit 0f2af8c

File tree

3 files changed

+98
-9
lines changed

3 files changed

+98
-9
lines changed

‎keycloak/openid_client_authorization_role_policy.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ type OpenidClientAuthorizationRolePolicy struct {
1616
Type string `json:"type"`
1717
Roles []OpenidClientAuthorizationRole `json:"roles,omitempty"`
1818
Description string `json:"description"`
19+
FetchRoles bool `json:"fetchRoles,omitempty"`
1920
}
2021

2122
type OpenidClientAuthorizationRole struct {

‎provider/resource_keycloak_openid_client_authorization_role_policy.go‎

Lines changed: 37 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ package provider
22

33
import (
44
"context"
5+
6+
"github.com/hashicorp/go-version"
57
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
68
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
79
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -47,6 +49,10 @@ func resourceKeycloakOpenidClientAuthorizationRolePolicy() *schema.Resource {
4749
Type: schema.TypeString,
4850
Optional: true,
4951
},
52+
"fetch_roles": {
53+
Type: schema.TypeBool,
54+
Optional: true,
55+
},
5056
"role": {
5157
Type: schema.TypeSet,
5258
Required: true,
@@ -68,7 +74,7 @@ func resourceKeycloakOpenidClientAuthorizationRolePolicy() *schema.Resource {
6874
}
6975
}
7076

71-
func getOpenidClientAuthorizationRolePolicyResourceFromData(data *schema.ResourceData) *keycloak.OpenidClientAuthorizationRolePolicy {
77+
func getOpenidClientAuthorizationRolePolicyResourceFromData(data *schema.ResourceData, keycloakVersion *version.Version) *keycloak.OpenidClientAuthorizationRolePolicy {
7278
var rolesList []keycloak.OpenidClientAuthorizationRole
7379
if v, ok := data.Get("role").(*schema.Set); ok {
7480
for _, role := range v.List() {
@@ -93,10 +99,16 @@ func getOpenidClientAuthorizationRolePolicyResourceFromData(data *schema.Resourc
9399
Description: data.Get("description").(string),
94100
}
95101

102+
if keycloakVersion.GreaterThanOrEqual(keycloak.Version_25.AsVersion()) {
103+
if v, ok := data.GetOk("fetch_roles"); ok {
104+
resource.FetchRoles = v.(bool)
105+
}
106+
}
107+
96108
return &resource
97109
}
98110

99-
func setOpenidClientAuthorizationRolePolicyResourceData(data *schema.ResourceData, policy *keycloak.OpenidClientAuthorizationRolePolicy) {
111+
func setOpenidClientAuthorizationRolePolicyResourceData(data *schema.ResourceData, policy *keycloak.OpenidClientAuthorizationRolePolicy, keycloakVersion *version.Version) {
100112
data.SetId(policy.Id)
101113

102114
data.Set("resource_server_id", policy.ResourceServerId)
@@ -107,6 +119,10 @@ func setOpenidClientAuthorizationRolePolicyResourceData(data *schema.ResourceDat
107119
data.Set("type", policy.Type)
108120
data.Set("description", policy.Description)
109121

122+
if keycloakVersion.GreaterThanOrEqual(keycloak.Version_25.AsVersion()) {
123+
data.Set("fetch_roles", policy.FetchRoles)
124+
}
125+
110126
var roles []interface{}
111127
for _, r := range policy.Roles {
112128
role := map[string]interface{}{
@@ -122,21 +138,29 @@ func setOpenidClientAuthorizationRolePolicyResourceData(data *schema.ResourceDat
122138

123139
func resourceKeycloakOpenidClientAuthorizationRolePolicyCreate(ctx context.Context, data *schema.ResourceData, meta interface{}) diag.Diagnostics {
124140
keycloakClient := meta.(*keycloak.KeycloakClient)
141+
keycloakVersion, err := keycloakClient.Version(ctx)
142+
if err != nil {
143+
return diag.FromErr(err)
144+
}
125145

126-
resource := getOpenidClientAuthorizationRolePolicyResourceFromData(data)
146+
resource := getOpenidClientAuthorizationRolePolicyResourceFromData(data, keycloakVersion)
127147

128-
err := keycloakClient.NewOpenidClientAuthorizationRolePolicy(ctx, resource)
148+
err = keycloakClient.NewOpenidClientAuthorizationRolePolicy(ctx, resource)
129149
if err != nil {
130150
return diag.FromErr(err)
131151
}
132152

133-
setOpenidClientAuthorizationRolePolicyResourceData(data, resource)
153+
setOpenidClientAuthorizationRolePolicyResourceData(data, resource, keycloakVersion)
134154

135155
return resourceKeycloakOpenidClientAuthorizationRolePolicyRead(ctx, data, meta)
136156
}
137157

138158
func resourceKeycloakOpenidClientAuthorizationRolePolicyRead(ctx context.Context, data *schema.ResourceData, meta interface{}) diag.Diagnostics {
139159
keycloakClient := meta.(*keycloak.KeycloakClient)
160+
keycloakVersion, err := keycloakClient.Version(ctx)
161+
if err != nil {
162+
return diag.FromErr(err)
163+
}
140164

141165
realmId := data.Get("realm_id").(string)
142166
resourceServerId := data.Get("resource_server_id").(string)
@@ -147,22 +171,26 @@ func resourceKeycloakOpenidClientAuthorizationRolePolicyRead(ctx context.Context
147171
return handleNotFoundError(ctx, err, data)
148172
}
149173

150-
setOpenidClientAuthorizationRolePolicyResourceData(data, resource)
174+
setOpenidClientAuthorizationRolePolicyResourceData(data, resource, keycloakVersion)
151175

152176
return nil
153177
}
154178

155179
func resourceKeycloakOpenidClientAuthorizationRolePolicyUpdate(ctx context.Context, data *schema.ResourceData, meta interface{}) diag.Diagnostics {
156180
keycloakClient := meta.(*keycloak.KeycloakClient)
181+
keycloakVersion, err := keycloakClient.Version(ctx)
182+
if err != nil {
183+
return diag.FromErr(err)
184+
}
157185

158-
resource := getOpenidClientAuthorizationRolePolicyResourceFromData(data)
186+
resource := getOpenidClientAuthorizationRolePolicyResourceFromData(data, keycloakVersion)
159187

160-
err := keycloakClient.UpdateOpenidClientAuthorizationRolePolicy(ctx, resource)
188+
err = keycloakClient.UpdateOpenidClientAuthorizationRolePolicy(ctx, resource)
161189
if err != nil {
162190
return diag.FromErr(err)
163191
}
164192

165-
setOpenidClientAuthorizationRolePolicyResourceData(data, resource)
193+
setOpenidClientAuthorizationRolePolicyResourceData(data, resource, keycloakVersion)
166194

167195
return nil
168196
}

‎provider/resource_keycloak_openid_client_authorization_role_policy_test.go‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ func TestAccKeycloakOpenidClientAuthorizationRolePolicy_basic(t *testing.T) {
2626
Config: testResourceKeycloakOpenidClientAuthorizationRolePolicy_basic(roleName, clientId),
2727
Check: testResourceKeycloakOpenidClientAuthorizationRolePolicyExists("keycloak_openid_client_role_policy.test"),
2828
},
29+
{
30+
Config: testResourceKeycloakOpenidClientAuthorizationRolePolicy_fetchRoles(roleName, clientId),
31+
Check: testResourceKeycloakOpenidClientAuthorizationRolePolicyExists("keycloak_openid_client_role_policy.test"),
32+
},
2933
},
3034
})
3135
}
@@ -52,6 +56,25 @@ func TestAccKeycloakOpenidClientAuthorizationRolePolicy_multiple(t *testing.T) {
5256
})
5357
}
5458

59+
func TestAccKeycloakOpenidClientAuthorizationRolePolicy_fetchRoles(t *testing.T) {
60+
t.Parallel()
61+
62+
clientId := acctest.RandomWithPrefix("tf-acc")
63+
roleName := acctest.RandomWithPrefix("tf-acc")
64+
65+
resource.Test(t, resource.TestCase{
66+
ProviderFactories: testAccProviderFactories,
67+
PreCheck: func() { testAccPreCheck(t) },
68+
CheckDestroy: testResourceKeycloakOpenidClientAuthorizationRolePolicyDestroy(),
69+
Steps: []resource.TestStep{
70+
{
71+
Config: testResourceKeycloakOpenidClientAuthorizationRolePolicy_fetchRoles(roleName, clientId),
72+
Check: testResourceKeycloakOpenidClientAuthorizationRolePolicyExists("keycloak_openid_client_role_policy.test"),
73+
},
74+
},
75+
})
76+
}
77+
5578
func getResourceKeycloakOpenidClientAuthorizationRolePolicyFromState(s *terraform.State, resourceName string) (*keycloak.OpenidClientAuthorizationRolePolicy, error) {
5679
rs, ok := s.RootModule().Resources[resourceName]
5780
if !ok {
@@ -139,6 +162,43 @@ resource keycloak_openid_client_role_policy test {
139162
`, testAccRealm.Realm, roleName, clientId)
140163
}
141164

165+
func testResourceKeycloakOpenidClientAuthorizationRolePolicy_fetchRoles(roleName, clientId string) string {
166+
return fmt.Sprintf(`
167+
data "keycloak_realm" "realm" {
168+
realm = "%s"
169+
}
170+
171+
resource keycloak_openid_client test {
172+
client_id = "%s"
173+
realm_id = data.keycloak_realm.realm.id
174+
access_type = "CONFIDENTIAL"
175+
service_accounts_enabled = true
176+
authorization {
177+
policy_enforcement_mode = "ENFORCING"
178+
}
179+
}
180+
181+
resource "keycloak_role" "test" {
182+
realm_id = data.keycloak_realm.realm.id
183+
name = "%s"
184+
}
185+
186+
resource keycloak_openid_client_role_policy test {
187+
resource_server_id = keycloak_openid_client.test.resource_server_id
188+
realm_id = data.keycloak_realm.realm.id
189+
name = "keycloak_openid_client_role_policy"
190+
decision_strategy = "AFFIRMATIVE"
191+
logic = "POSITIVE"
192+
type = "role"
193+
fetch_roles = true
194+
role {
195+
id = keycloak_role.test.id
196+
required = false
197+
}
198+
}
199+
`, testAccRealm.Realm, roleName, clientId)
200+
}
201+
142202
func testResourceKeycloakOpenidClientAuthorizationRolePolicy_multipleRoles(roleNames []string, clientId string) string {
143203
var (
144204
roles strings.Builder

0 commit comments

Comments
 (0)