Skip to content

Commit 13e7bce

Browse files
laureat-natzkaLaureat GrepiFilirom1robson90simonregn
authored
feat: Add new resources for realm client policy profiles (#1138)
* feat: Add new resources for realm client policy profiles Signed-off-by: Laureat Grepi <[email protected]> * fmt Signed-off-by: Laureat Grepi <[email protected]> * Fix tests Signed-off-by: Laureat Grepi <[email protected]> * Fix tests 2 Signed-off-by: Laureat Grepi <[email protected]> * Fix tests 3 Signed-off-by: Laureat Grepi <[email protected]> * Fix tests profile executor update Signed-off-by: Laureat Grepi <[email protected]> * update test values Signed-off-by: Laureat Grepi <[email protected]> * Allow secret regeneration in openid client Signed-off-by: Laureat Grepi <[email protected]> * update Signed-off-by: Laureat Grepi <[email protected]> * update Signed-off-by: Laureat Grepi <[email protected]> * typeString -> typeMap Signed-off-by: Laureat Grepi <[email protected]> * Increase MaxIdleConnsPerHost in http.Transport (#1169) The default behaviour of http.Transport does not handle the use case of "many concurrent requests against a single host" very well. By default, it will only keep 2 persistent connections in the pool. Everything above that is burst capacity, and those connections are closed. The result is a lot of connection churn, which can lead to port exhaustion (especially on more constrained resources like a shared NAT). Increase the idle pool from 2 to 100, allowing for more connection reuse and in turn reducing connection churn. Signed-off-by: Romain Philibert <[email protected]> Signed-off-by: Laureat Grepi <[email protected]> * test: Add tests for saml aggregate attributes (#1171) * add tests for saml aggregate attributes * Fix implementation, as tests were failing * rework tests in resource_keycloak_saml_user_attribute_protocol_mapper_test.go Signed-off-by: Robin Meese <[email protected]> Signed-off-by: Laureat Grepi <[email protected]> * Update realm_keys.md (#1174) Signed-off-by: simonregn <[email protected]> Signed-off-by: Laureat Grepi <[email protected]> * Allow the alias of Google IdP to be set (#1177) Signed-off-by: Matthew H. Irby <[email protected]> Co-authored-by: Sebastian Schuster <[email protected]> Signed-off-by: Laureat Grepi <[email protected]> * chore(deps): bump golang.org/x/net from 0.38.0 to 0.39.0 (#1183) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.38.0 to 0.39.0. - [Commits](golang/net@v0.38.0...v0.39.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.39.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Laureat Grepi <[email protected]> * feat: add identity provider hardcoded group mapper (#886) Signed-off-by: Fabien Carrion <[email protected]> Signed-off-by: Laureat Grepi <[email protected]> * feat: Support extra_origins in web_authn_policy and web_authn_passwordless_policy (#1173) Fixes #1170 Signed-off-by: Thomas Darimont <[email protected]> Co-authored-by: Sebastian Schuster <[email protected]> Signed-off-by: Laureat Grepi <[email protected]> * Update to version 5.2 (#1185) Signed-off-by: Sebastian Schuster <[email protected]> Signed-off-by: Laureat Grepi <[email protected]> * fix conflicts Signed-off-by: Laureat Grepi <[email protected]> * chore(deps): bump dario.cat/mergo from 1.0.1 to 1.0.2 (#1196) Bumps [dario.cat/mergo](https://github.com/imdario/mergo) from 1.0.1 to 1.0.2. - [Release notes](https://github.com/imdario/mergo/releases) - [Commits](darccio/mergo@v1.0.1...v1.0.2) --- updated-dependencies: - dependency-name: dario.cat/mergo dependency-version: 1.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Laureat Grepi <[email protected]> * chore(deps): bump golang.org/x/net from 0.39.0 to 0.40.0 (#1197) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.39.0 to 0.40.0. - [Commits](golang/net@v0.39.0...v0.40.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Laureat Grepi <[email protected]> * chore(deps): bump org.jetbrains.kotlin.jvm (#1203) Bumps [org.jetbrains.kotlin.jvm](https://github.com/JetBrains/kotlin) from 2.1.20 to 2.1.21. - [Release notes](https://github.com/JetBrains/kotlin/releases) - [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md) - [Commits](JetBrains/kotlin@v2.1.20...v2.1.21) --- updated-dependencies: - dependency-name: org.jetbrains.kotlin.jvm dependency-version: 2.1.21 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sebastian Schuster <[email protected]> Signed-off-by: Laureat Grepi <[email protected]> * chore(deps): bump github.com/hashicorp/terraform-plugin-sdk/v2 (#1202) Bumps [github.com/hashicorp/terraform-plugin-sdk/v2](https://github.com/hashicorp/terraform-plugin-sdk) from 2.36.1 to 2.37.0. - [Release notes](https://github.com/hashicorp/terraform-plugin-sdk/releases) - [Changelog](https://github.com/hashicorp/terraform-plugin-sdk/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-plugin-sdk@v2.36.1...v2.37.0) --- updated-dependencies: - dependency-name: github.com/hashicorp/terraform-plugin-sdk/v2 dependency-version: 2.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Laureat Grepi <[email protected]> * chore(deps): bump gradle/actions in /.github/workflows (#1204) Bumps [gradle/actions](https://github.com/gradle/actions) from 4.3.1 to 4.4.0. - [Release notes](https://github.com/gradle/actions/releases) - [Commits](gradle/actions@06832c7...8379f6a) --- updated-dependencies: - dependency-name: gradle/actions dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Laureat Grepi <[email protected]> * Add support for ephemeral/write-only arguments for keycloak_oidc_identity_provider & keycloak_openid_client (#1190) * feat: Support ephemeral/write-only arguments for client_secret in keycloak_openid_client Resource Signed-off-by: Hector Valcarcel <[email protected]> * feat: Support ephemeral/write-only arguments for client_secret in keycloak_oidc_identity_provider Resource Signed-off-by: Hector Valcarcel <[email protected]> * feat: Support ephemeral/write-only arguments for client_secret in keycloak_openid_client Resource Signed-off-by: Hector Valcarcel <[email protected]> * feat: Support ephemeral/write-only arguments for client_secret in keycloak_oidc_identity_provider Resource Signed-off-by: Hector Valcarcel <[email protected]> * feat: Remove validation for write-only attribute preference in keycloak resources Signed-off-by: Hector Valcarcel <[email protected]> --------- Signed-off-by: Hector Valcarcel <[email protected]> Signed-off-by: Laureat Grepi <[email protected]> * Update to KC26.2.5 (#1214) * Update to KC26.2.5 Signed-off-by: Sebastian Schuster <[email protected]> * Fixed test failures Signed-off-by: Sebastian Schuster <[email protected]> * Added debug outpt Signed-off-by: Sebastian Schuster <[email protected]> * Fixed test failures Signed-off-by: Sebastian Schuster <[email protected]> * Removed comments Signed-off-by: Sebastian Schuster <[email protected]> * Fix typo Signed-off-by: Sebastian Schuster <[email protected]> * Just me being stupid Signed-off-by: Sebastian Schuster <[email protected]> * Re-enabled tests for custom-example for compatible Keycloak versions Signed-off-by: Sebastian Schuster <[email protected]> --------- Signed-off-by: Sebastian Schuster <[email protected]> Signed-off-by: Laureat Grepi <[email protected]> * Docs: Updated Markdown to format correctly (#1201) * Updated Markdown to format correctly Signed-off-by: bubbletroubles <[email protected]> * Update openid_client_service_account_user.md Signed-off-by: bubbletroubles <[email protected]> --------- Signed-off-by: bubbletroubles <[email protected]> Signed-off-by: Laureat Grepi <[email protected]> * chore(deps): bump golang.org/x/net from 0.40.0 to 0.41.0 (#1216) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.40.0 to 0.41.0. - [Commits](golang/net@v0.40.0...v0.41.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.41.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Laureat Grepi <[email protected]> * fix import Signed-off-by: Laureat Grepi <[email protected]> * remove client secret regeneration Signed-off-by: Laureat Grepi <[email protected]> * remove client secret regeneration Signed-off-by: Laureat Grepi <[email protected]> * fix Signed-off-by: Laureat Grepi <[email protected]> --------- Signed-off-by: Laureat Grepi <[email protected]> Signed-off-by: Romain Philibert <[email protected]> Signed-off-by: Robin Meese <[email protected]> Signed-off-by: simonregn <[email protected]> Signed-off-by: Matthew H. Irby <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: Fabien Carrion <[email protected]> Signed-off-by: Thomas Darimont <[email protected]> Signed-off-by: Sebastian Schuster <[email protected]> Signed-off-by: Hector Valcarcel <[email protected]> Signed-off-by: Sebastian Schuster <[email protected]> Signed-off-by: bubbletroubles <[email protected]> Signed-off-by: laureat-natzka <[email protected]> Co-authored-by: Laureat Grepi <[email protected]> Co-authored-by: Romain <[email protected]> Co-authored-by: Robin Meese <[email protected]> Co-authored-by: simonregn <[email protected]> Co-authored-by: Matthew H. Irby <[email protected]> Co-authored-by: Sebastian Schuster <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Fabien Carrion <[email protected]> Co-authored-by: Thomas Darimont <[email protected]> Co-authored-by: Sebastian Schuster <[email protected]> Co-authored-by: Hector Manuel <[email protected]> Co-authored-by: bubbletroubles <[email protected]>
1 parent 186f7cf commit 13e7bce

9 files changed

+851
-0
lines changed
Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
page_title: "keycloak_realm_client_policy_profile Resource"
3+
---
4+
5+
# keycloak_realm_client_policy_profile Resource
6+
7+
Allows for managing Realm Client Policy Profiles.
8+
9+
## Example Usage
10+
11+
```hcl
12+
resource "keycloak_realm" "realm" {
13+
realm = "my-realm"
14+
}
15+
16+
resource "keycloak_realm_client_policy_profile" "profile" {
17+
name = "my-profile"
18+
realm_id = keycloak_realm.realm.id
19+
20+
executor {
21+
name = "intent-client-bind-checker"
22+
23+
configuration = {
24+
auto-configure = true
25+
}
26+
}
27+
28+
executor {
29+
name = "secure-session"
30+
}
31+
}
32+
33+
```
34+
35+
### Attribute Arguments
36+
37+
- `name` - (Required) The name of the attribute.
38+
- `realm_id` - (Required) The realm id.
39+
- `executor` - (Optional) An ordered list of [executors](#executor-arguments)
40+
41+
#### Executor Arguments
42+
43+
- `name` - (Required) The name of the executor. NOTE! The executor needs to exist
44+
- `configuration` - (Optional) - A map of configuration values
45+
46+
## Import
47+
48+
This resource currently does not support importing.
Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
---
2+
page_title: "keycloak_realm_client_policy_profile_policy Resource"
3+
---
4+
5+
# keycloak_realm_client_policy_profile_policy Resource
6+
7+
Allows for managing Realm Client Policy Profile Policies.
8+
9+
## Example Usage
10+
11+
```hcl
12+
resource "keycloak_realm" "realm" {
13+
realm = "my-realm"
14+
}
15+
16+
resource "keycloak_realm_client_policy_profile" "profile" {
17+
name = "my-profile"
18+
realm_id = keycloak_realm.realm.id
19+
description = "Some desc"
20+
21+
executor {
22+
name = "intent-client-bind-checker"
23+
24+
configuration = {
25+
auto-configure = "true"
26+
}
27+
}
28+
29+
executor {
30+
name = "secret-rotation"
31+
configuration = {
32+
expiration-period = 2505600,
33+
rotated-expiration-period = 172800,
34+
remaining-rotation-period = 864000
35+
}
36+
}
37+
}
38+
39+
resource "keycloak_realm_client_policy_profile_policy" "policy" {
40+
name = "my-profile"
41+
realm_id = keycloak_realm.realm.id
42+
description = "Some desc"
43+
profiles = [
44+
keycloak_realm_client_policy_profile.profile.name
45+
]
46+
47+
condition {
48+
name = "client-type"
49+
configuration = {
50+
"protocol" = "openid-connect"
51+
}
52+
}
53+
54+
condition {
55+
name = "client-attributes"
56+
configuration = {
57+
is-negative-logic = false
58+
attributes = jsonencode([{ "key" : "test-key", "value" : "test-value" }])
59+
}
60+
}
61+
}
62+
63+
```
64+
65+
### Attribute Arguments
66+
67+
- `name` - (Required) The name of the attribute.
68+
- `realm_id` - (Required) The realm id.
69+
- `condition` - (Optional) An ordered list of [condition](#condition-arguments)
70+
71+
#### Condition Arguments
72+
73+
- `name` - (Required) The name of the executor. NOTE! The executor needs to exist
74+
- `configuration` - (Optional) - A map of configuration values
75+
76+
## Import
77+
78+
This resource currently does not support importing.

example/main.tf

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1191,3 +1191,41 @@ resource "keycloak_realm_user_profile" "userprofile" {
11911191
name = "group2"
11921192
}
11931193
}
1194+
1195+
resource "keycloak_realm_client_policy_profile" "profile" {
1196+
name = "my-profile"
1197+
realm_id = keycloak_realm.test.id
1198+
executor {
1199+
name = "intent-client-bind-checker"
1200+
configuration = {
1201+
auto-configure = true
1202+
}
1203+
}
1204+
executor {
1205+
name = "secure-session"
1206+
}
1207+
}
1208+
1209+
resource "keycloak_realm_client_policy_profile_policy" "policy" {
1210+
name = "my-profile-policy"
1211+
realm_id = keycloak_realm.test.id
1212+
description = "Some desc"
1213+
profiles = [
1214+
keycloak_realm_client_policy_profile.profile.name
1215+
]
1216+
1217+
condition {
1218+
name = "client-type"
1219+
configuration = {
1220+
"protocol" = "openid-connect"
1221+
}
1222+
}
1223+
1224+
condition {
1225+
name = "client-attributes"
1226+
configuration = {
1227+
"is-negative-logic" = false
1228+
"attributes" = jsonencode([{ "key" : "something", "value" : "other3" }])
1229+
}
1230+
}
1231+
}
Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
package keycloak
2+
3+
import (
4+
"context"
5+
"fmt"
6+
)
7+
8+
type RealmClientPolicyProfileExecutor struct {
9+
Name string `json:"executor"`
10+
Configuration map[string]interface{} `json:"configuration"`
11+
}
12+
13+
type RealmClientPolicyProfile struct {
14+
Name string `json:"name"`
15+
RealmId string `json:"-"`
16+
Description string `json:"description"`
17+
Executors []RealmClientPolicyProfileExecutor `json:"executors"`
18+
}
19+
20+
type RealmClientPolicyProfiles struct {
21+
Profiles []RealmClientPolicyProfile `json:"profiles"`
22+
GlobalProfiles []RealmClientPolicyProfile `json:"globalProfiles"`
23+
}
24+
25+
func (keycloakClient *KeycloakClient) UpdateRealmClientPolicyProfiles(ctx context.Context, realmId string, profiles *RealmClientPolicyProfiles) error {
26+
return keycloakClient.put(ctx, fmt.Sprintf("/realms/%s/client-policies/profiles", realmId), profiles)
27+
}
28+
29+
func (keycloakClient *KeycloakClient) GetAllRealmClientPolicyProfiles(ctx context.Context, realmId string) (*RealmClientPolicyProfiles, error) {
30+
var realmClientPolicyProfiles *RealmClientPolicyProfiles
31+
params := map[string]string{"include-global-profiles": "true"}
32+
33+
err := keycloakClient.get(ctx, fmt.Sprintf("/realms/%s/client-policies/profiles", realmId), &realmClientPolicyProfiles, params)
34+
if err != nil {
35+
return nil, err
36+
}
37+
38+
return realmClientPolicyProfiles, nil
39+
}
40+
41+
func (keycloakClient *KeycloakClient) GetRealmClientPolicyProfileByName(ctx context.Context, realmId string, name string) (*RealmClientPolicyProfile, error) {
42+
realmClientPolicyProfiles, err := keycloakClient.GetAllRealmClientPolicyProfiles(ctx, realmId)
43+
if err != nil {
44+
return nil, err
45+
}
46+
47+
for _, profile := range realmClientPolicyProfiles.Profiles {
48+
if profile.Name == name {
49+
return &profile, nil
50+
}
51+
}
52+
53+
return nil, fmt.Errorf("profile with name: %s not found", name)
54+
55+
}
Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
package keycloak
2+
3+
import (
4+
"context"
5+
"fmt"
6+
)
7+
8+
type RealmClientPolicyProfilePolicyCondition struct {
9+
Name string `json:"condition"`
10+
Configuration map[string]interface{} `json:"configuration"`
11+
}
12+
13+
type RealmClientPolicyProfilePolicy struct {
14+
Name string `json:"name"`
15+
RealmId string `json:"-"`
16+
Description string `json:"description"`
17+
Enabled bool `json:"enabled"`
18+
Conditions []RealmClientPolicyProfilePolicyCondition `json:"conditions"`
19+
Profiles []string `json:"profiles"`
20+
}
21+
22+
type RealmClientPolicyProfilePolicies struct {
23+
Policies []RealmClientPolicyProfilePolicy `json:"policies"`
24+
}
25+
26+
func (keycloakClient *KeycloakClient) UpdateRealmClientPolicyProfilePolicies(ctx context.Context, realmId string, policies *RealmClientPolicyProfilePolicies) error {
27+
return keycloakClient.put(ctx, fmt.Sprintf("/realms/%s/client-policies/policies", realmId), policies)
28+
}
29+
30+
func (keycloakClient *KeycloakClient) GetAllRealmClientPolicyProfilePolices(ctx context.Context, realmId string) (*RealmClientPolicyProfilePolicies, error) {
31+
var realmClientPolicyProfilePolicies *RealmClientPolicyProfilePolicies
32+
33+
err := keycloakClient.get(ctx, fmt.Sprintf("/realms/%s/client-policies/policies", realmId), &realmClientPolicyProfilePolicies, nil)
34+
if err != nil {
35+
return nil, err
36+
}
37+
38+
return realmClientPolicyProfilePolicies, nil
39+
}
40+
41+
func (keycloakClient *KeycloakClient) GetRealmClientPolicyProfilePolicyByName(ctx context.Context, realmId string, name string) (*RealmClientPolicyProfilePolicy, error) {
42+
realmClientPolicyProfilePolicies, err := keycloakClient.GetAllRealmClientPolicyProfilePolices(ctx, realmId)
43+
if err != nil {
44+
return nil, err
45+
}
46+
47+
for _, policy := range realmClientPolicyProfilePolicies.Policies {
48+
if policy.Name == name {
49+
return &policy, nil
50+
}
51+
}
52+
53+
return nil, fmt.Errorf("policy with name: %s not found", name)
54+
}

provider/provider.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ func KeycloakProvider(client *keycloak.KeycloakClient) *schema.Provider {
3535
"keycloak_realm_events": resourceKeycloakRealmEvents(),
3636
"keycloak_realm_default_client_scopes": resourceKeycloakRealmDefaultClientScopes(),
3737
"keycloak_realm_optional_client_scopes": resourceKeycloakRealmOptionalClientScopes(),
38+
"keycloak_realm_client_policy_profile": resourceKeycloakRealmClientPolicyProfile(),
39+
"keycloak_realm_client_policy_profile_policy": resourceKeycloakRealmClientPolicyProfilePolicy(),
3840
"keycloak_realm_keystore_aes_generated": resourceKeycloakRealmKeystoreAesGenerated(),
3941
"keycloak_realm_keystore_ecdsa_generated": resourceKeycloakRealmKeystoreEcdsaGenerated(),
4042
"keycloak_realm_keystore_hmac_generated": resourceKeycloakRealmKeystoreHmacGenerated(),

0 commit comments

Comments
 (0)