Skip to content

Conversation

@thomas-VIGINUM
Copy link

@thomas-VIGINUM thomas-VIGINUM commented Aug 29, 2025

Current problem

The keycloak_openid_client resource documentation states some arguments defaults, especially on the flow definition. However, those attributes are computed instead of defaulted.

Changes

Move some arguments from Computed to Default.

@sschu
Copy link
Contributor

sschu commented Sep 2, 2025

@thomas-VIGINUM It looks like you didnt hit the correct defaults e.g. standard flow is enabled by default.

@thomas-VIGINUM
Copy link
Author

Hey @sschu,

Concerning to the Terraform documentation page, all variables mentioned default to false, even the standard flow. And I think it is nice to keep as the documentation states : by default all flows are disabled, and you have to explicitly enable on your code the different flows.

- `standard_flow_enabled` - (Optional) When `true`, the OAuth2 Authorization Code Grant will be enabled for this client. Defaults to `false`.
- `implicit_flow_enabled` - (Optional) When `true`, the OAuth2 Implicit Grant will be enabled for this client. Defaults to `false`.
- `direct_access_grants_enabled` - (Optional) When `true`, the OAuth2 Resource Owner Password Grant will be enabled for this client. Defaults to `false`.
- `service_accounts_enabled` - (Optional) When `true`, the OAuth2 Client Credentials grant will be enabled for this client. Defaults to `false`.

- `consent_required` - (Optional) When `true`, users have to consent to client access. Defaults to `false`.

@sschu
Copy link
Contributor

sschu commented Sep 8, 2025

What the documentation says is wrong because the provider is currently just using the Keycloak defaults - which has standard flow enabled. That's why the tests are failing.

@thomas-VIGINUM thomas-VIGINUM force-pushed the feat/computed-to-optional branch from 2a26a1b to 6f0aeb2 Compare September 23, 2025 12:46
@thomasdarimont
Copy link
Contributor

I created an issue for this #1325 think we should indeed fix this.

@thomasdarimont
Copy link
Contributor

@thomas-VIGINUM thanks for your PR! Would you mind rebasing it to latest main and add your DCO (git commit -s ...)?

@thomasdarimont
Copy link
Contributor

With the change from this PR the OIDC client example configuration works correctly:

resource "keycloak_openid_client" "openid_client" {
  realm_id            = keycloak_realm.test.id
  client_id           = "test-client"

  name                = "test client"
  enabled             = true

  access_type         = "CONFIDENTIAL"
  valid_redirect_uris = [
    "http://localhost:8080/openid-callback"
  ]

  login_theme = "keycloak"

  extra_config = {
    "key1" = "value1"
    "key2" = "value2"
  }
}

@thomasdarimont thomasdarimont changed the title feat: transform computed to default arguments to match documentation fix: Align flow config of OIDC clients with Keycloak defaults Sep 25, 2025
@thomasdarimont
Copy link
Contributor

... just tried to run the tests locally, as @sschu already wrote this change breaks many tests. I think we have to think a bit more about how we can solve this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants