Skip to content

Commit ab2fd15

Browse files
posquit0posquit0
committed
feat(saml-app): support more saml configs
1 parent 0c92ea0 commit ab2fd15

File tree

4 files changed

+124
-2
lines changed

4 files changed

+124
-2
lines changed

‎modules/saml-app/README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ This module creates following resources.
1919

2020
| Name | Version |
2121
|------|---------|
22-
| <a name="provider_okta"></a> [okta](#provider\_okta) | 6.3.0 |
22+
| <a name="provider_okta"></a> [okta](#provider\_okta) | 6.5.3 |
2323

2424
## Modules
2525

@@ -51,6 +51,7 @@ No modules.
5151
| <a name="input_notes"></a> [notes](#input\_notes) | (Optional) A configurations for application notes. `notes` block as defined below.<br/> (Optional) `admin` - Application notes for admins.<br/> (Optional) `user` - Application notes for end users. | <pre>object({<br/> admin = optional(string, "")<br/> user = optional(string, "")<br/> })</pre> | `{}` | no |
5252
| <a name="input_preconfigured_app"></a> [preconfigured\_app](#input\_preconfigured\_app) | (Optional) The name of a preconfigured app from the Okta App Integration Network. For example `aws_sso`, `google`, `github_enterprise`, etc. When this is specified, most SAML configuration is inherited from the preconfigured app. | `string` | `null` | no |
5353
| <a name="input_saml_attributes"></a> [saml\_attributes](#input\_saml\_attributes) | (Optional) A list of SAML attribute statements for the application. Each item of `saml_attributes` block as defined below.<br/> (Required) `name` - The name of the attribute.<br/> (Optional) `namespace` - The namespace for the attribute. Valid values are `urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified`, `urn:oasis:names:tc:SAML:2.0:attrname-format:uri`, `urn:oasis:names:tc:SAML:2.0:attrname-format:basic`. Defaults to `urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified`.<br/> (Optional) `type` - The type of the attribute. Valid values are `EXPRESSION`, `GROUP`.<br/> (Optional) `values` - The values for the attribute.<br/> (Optional) `filter` - A filter configuration for group attributes. Only requirded if `type` is `GROUP`. `filter` block as defined below.<br/> (Required) `type` - The filter type for group attributes. Valid values are `REGEX`, `STARTS_WITH`, `EQUALS`, `CONTAINS`.<br/> (Required) `value` - The filter value for group attributes. | <pre>list(object({<br/> type = optional(string, "EXPRESSION")<br/> namespace = optional(string, "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified")<br/> name = string<br/> values = optional(list(string))<br/> filter = optional(object({<br/> type = string<br/> value = string<br/> }))<br/> }))</pre> | `[]` | no |
54+
| <a name="input_saml_config"></a> [saml\_config](#input\_saml\_config) | (Optional) A configurations for SAML settings for the application. `saml_config` block as defined below.<br/> (Optional) `sso_url` - The location to send the SAML assertion using a POST operation. This URL is required and serves as the default Assertion Consumer Services (ACS) URL value for the Service Provider (SP). This URL is always used for Identity Provider (IdP) initiated sign-on requests.<br/> (Optional) `recipient_url` - The location where the app can present the SAML assertion. This is usually the Single Sign-On (SSO) URL. Defaults to the value of `sso_url` if not provided.<br/> (Optional) `destination_url` - The location to send the SAML Response, as defined in the SAML assertion. This is usually the Single Sign-On (SSO) URL. Defaults to the value of `sso_url` if not provided.<br/> (Optional) `audience` - The intended audience of the SAML assertion. This is usually the Entity ID of your app.<br/><br/> (Optional) `subject_name_id` - A configuration for the subject name ID. `subject_name_id` block as defined below.<br/> (Optional) `format` - The format of the subject name ID.<br/> (Optional) `template` - Template for app user's username when a user is assigned to the app. Defaults to `${user.userName}`.<br/><br/> (Optional) `assertion_signed` - Whether to sign the SAML assertion. Defaults to `true`.<br/> (Optional) `response_signed` - Whether to sign the SAML auth response. Defaults to<br/> (Optional) `digest_algorithm` - The algorithm used to digitally sign the SAML assertion and response. Valid values are `SHA1`, `SHA256`, `SHA384`, `SHA512`. Defaults to `SHA256`.<br/> (Optional) `signature_algorithm` - The signing algorithm that's used to digitally sign the SAML assertion and response. Valid values are `RSA_SHA1`, `RSA_SHA256`, `RSA_SHA384`, `RSA_SHA512`, `DSA_SHA1`, `DSA_SHA256`, `DSA_SHA384`, `DSA_SHA512`, `ECDSA_SHA1`, `ECDSA_SHA256`, `ECDSA_SHA384`, `ECDSA_SHA512`. Defaults to `RSA_SHA256`.<br/><br/> (Optional) `authn_context_class_ref` - The authentication context class for the assertion’s authentication statement.<br/> (Optional) `honor_force_authn` - Whether to honor the ForceAuthn attribute in the SAML request. Defaults to `false`. | <pre>object({<br/> sso_url = optional(string)<br/> recipient_url = optional(string)<br/> destination_url = optional(string)<br/> audience = optional(string)<br/><br/> subject_name_id = optional(object({<br/> format = optional(string)<br/> template = optional(string, "$${user.userName}")<br/> }))<br/><br/> assertion_signed = optional(bool, true)<br/> response_signed = optional(bool, true)<br/> digest_algorithm = optional(string, "SHA256")<br/> signature_algorithm = optional(string, "RSA_SHA256")<br/><br/> authn_context_class_ref = optional(string)<br/> honor_force_authn = optional(bool, false)<br/> })</pre> | `{}` | no |
5455
| <a name="input_self_service"></a> [self\_service](#input\_self\_service) | (Optional) Self-service configurations for the application. `self_service` block as defined below.<br/> (Optional) `enabled` - Whether to enable self-service. Defaults to `false`. | <pre>object({<br/> enabled = optional(bool, false)<br/> })</pre> | `{}` | no |
5556
| <a name="input_sign_on"></a> [sign\_on](#input\_sign\_on) | (Optional) A configurations for application sign-on. `sign_on` block as defined below.<br/> (Optional) `authentication_policy` - The ID of the authentication policy to associate to the applicatioauthentication policy to associate to the application. If this is removed from the application the default sign-on-policy will be associated with this application.<br/> (Optional) `user_name_template` - A configuration for the user name template. `user_name_template` block as defined below.<br/> (Optional) `type` - The type of user name template. Valid values are `BUILT_IN`, `CUSTOM` or `NONE`. Defaults to `BUILT_IN`.<br/> (Optional) `template` - The template for the user name. Defaults to `${source.login}`.<br/> (Optional) `suffix` - The suffix to append to the user name. Only applicable if `type` is `BUILT_IN`. Defaults to an empty string.<br/> (Optional) `push_status` - The push status for the user name template. Valid values are `PUSH`, `DONT_PUSH` or `NOT_CONFIGURED`. Defaults to `PUSH`. | <pre>object({<br/> authentication_policy = optional(string)<br/> user_name_template = optional(object({<br/> type = optional(string, "BUILT_IN")<br/> template = optional(string, "$${source.login}")<br/> suffix = optional(string, "")<br/> push_status = optional(string, "PUSH")<br/> }), {})<br/> })</pre> | `{}` | no |
5657
| <a name="input_single_logout"></a> [single\_logout](#input\_single\_logout) | (Optional) Single logout configuration for the application. `single_logout` block as defined below.<br/> (Optional) `issuer` - The issuer of the Service Provider that generates the Single Logout request.<br/> (Optional) `url` - The URL where the logout response is sent.<br/> (Optional) `certificate` - The X509 encoded certificate that the Service Provider uses to sign Single Logout requests. Note: should be provided without `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`. | <pre>object({<br/> issuer = optional(string)<br/> url = optional(string)<br/> certificate = optional(string)<br/> })</pre> | `{}` | no |
@@ -74,6 +75,7 @@ No modules.
7475
| <a name="output_notes"></a> [notes](#output\_notes) | The configurations for application notes. |
7576
| <a name="output_preconfigured_app"></a> [preconfigured\_app](#output\_preconfigured\_app) | The name of a preconfigured app from the Okta App Integration Network. |
7677
| <a name="output_saml_attributes"></a> [saml\_attributes](#output\_saml\_attributes) | A list of SAML attribute statements for the application. |
78+
| <a name="output_saml_config"></a> [saml\_config](#output\_saml\_config) | The SAML configurations for the application. |
7779
| <a name="output_saml_metadata"></a> [saml\_metadata](#output\_saml\_metadata) | The SAML metadata configurations. |
7880
| <a name="output_saml_version"></a> [saml\_version](#output\_saml\_version) | The SAML version used by the application. |
7981
| <a name="output_sign_on"></a> [sign\_on](#output\_sign\_on) | The configurations for application sign-on. |

‎modules/saml-app/main.tf‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,60 @@ resource "okta_app_saml" "this" {
5858
status = var.enabled ? "ACTIVE" : "INACTIVE"
5959

6060

61+
## SAML Config
62+
sso_url = (!local.is_preconfigured
63+
? var.saml_config.sso_url
64+
: null
65+
)
66+
recipient = (!local.is_preconfigured
67+
? var.saml_config.recipient_url
68+
: null
69+
)
70+
destination = (!local.is_preconfigured
71+
? var.saml_config.destination_url
72+
: null
73+
)
74+
audience = (!local.is_preconfigured
75+
? var.saml_config.audience
76+
: null
77+
)
78+
79+
subject_name_id_format = (!local.is_preconfigured
80+
? var.saml_config.subject_name_id.format
81+
: null
82+
)
83+
subject_name_id_template = (!local.is_preconfigured
84+
? var.saml_config.subject_name_id.template
85+
: null
86+
)
87+
88+
assertion_signed = (!local.is_preconfigured
89+
? var.saml_config.assertion_signed
90+
: null
91+
)
92+
response_signed = (!local.is_preconfigured
93+
? var.saml_config.response_signed
94+
: null
95+
)
96+
digest_algorithm = (!local.is_preconfigured
97+
? var.saml_config.digest_algorithm
98+
: null
99+
)
100+
signature_algorithm = (!local.is_preconfigured
101+
? var.saml_config.signature_algorithm
102+
: null
103+
)
104+
105+
authn_context_class_ref = (!local.is_preconfigured
106+
? var.saml_config.authn_context_class_ref
107+
: null
108+
)
109+
honor_force_authn = (!local.is_preconfigured
110+
? var.saml_config.honor_force_authn
111+
: null
112+
)
113+
114+
61115
## SAML Attribute Statements
62116
dynamic "attribute_statements" {
63117
for_each = var.saml_attributes

‎modules/saml-app/outputs.tf‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,29 @@ output "saml_metadata" {
5757
}
5858
}
5959

60+
output "saml_config" {
61+
description = "The SAML configurations for the application."
62+
value = {
63+
sso_url = okta_app_saml.this.sso_url
64+
recipient_url = okta_app_saml.this.recipient
65+
destination_url = okta_app_saml.this.destination
66+
audience = okta_app_saml.this.audience
67+
68+
subject_name_id = {
69+
format = okta_app_saml.this.subject_name_id_format
70+
template = okta_app_saml.this.subject_name_id_template
71+
}
72+
73+
assertion_signed = okta_app_saml.this.assertion_signed
74+
response_signed = okta_app_saml.this.response_signed
75+
digest_algorithm = okta_app_saml.this.digest_algorithm
76+
signature_algorithm = okta_app_saml.this.signature_algorithm
77+
78+
authn_context_class_ref = okta_app_saml.this.authn_context_class_ref
79+
honor_force_authn = okta_app_saml.this.honor_force_authn
80+
}
81+
}
82+
6083
output "saml_attributes" {
6184
description = "A list of SAML attribute statements for the application."
6285
value = [
@@ -142,6 +165,6 @@ output "group_assignments" {
142165
# value = {
143166
# for k, v in okta_app_saml.this :
144167
# k => v
145-
# if !contains(["id", "label", "url", "status", "authentication_policy", "accessibility_error_redirect_url", "timeouts", "request_integration", "accessibility_login_redirect_url", "accessibility_self_service", "hide_ios", "hide_web", "enduser_note", "admin_note", "auto_submit_toolbar", "logo", "logo_url", "name", "sign_on_mode", "features", "single_logout_issuer", "single_logout_url", "single_logout_certificate", "user_name_template_type", "user_name_template_suffix", "user_name_template_push_status", "user_name_template", "app_links_json", "metadata_url", "certificate", "preconfigured_app", "entity_key", "embed_url", "app_settings_json", "saml_version", "metadata", "http_post_binding", "http_redirect_binding"], k)
168+
# if !contains(["id", "label", "url", "status", "authentication_policy", "accessibility_error_redirect_url", "timeouts", "request_integration", "accessibility_login_redirect_url", "accessibility_self_service", "hide_ios", "hide_web", "enduser_note", "admin_note", "auto_submit_toolbar", "logo", "logo_url", "name", "sign_on_mode", "features", "single_logout_issuer", "single_logout_url", "single_logout_certificate", "user_name_template_type", "user_name_template_suffix", "user_name_template_push_status", "user_name_template", "app_links_json", "metadata_url", "certificate", "preconfigured_app", "entity_key", "embed_url", "app_settings_json", "saml_version", "metadata", "http_post_binding", "http_redirect_binding", "digest_algorithm", "signature_algorithm", "sso_url", "recipient", "destination", "audience", "subject_name_id_format", "subject_name_id_template", "assertion_signed", "response_signed", "authn_context_class_ref", "honor_force_authn"], k)
146169
# }
147170
# }

‎modules/saml-app/variables.tf‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,49 @@ variable "app_settings" {
3434
nullable = true
3535
}
3636

37+
variable "saml_config" {
38+
description = <<EOF
39+
(Optional) A configurations for SAML settings for the application. `saml_config` block as defined below.
40+
(Optional) `sso_url` - The location to send the SAML assertion using a POST operation. This URL is required and serves as the default Assertion Consumer Services (ACS) URL value for the Service Provider (SP). This URL is always used for Identity Provider (IdP) initiated sign-on requests.
41+
(Optional) `recipient_url` - The location where the app can present the SAML assertion. This is usually the Single Sign-On (SSO) URL. Defaults to the value of `sso_url` if not provided.
42+
(Optional) `destination_url` - The location to send the SAML Response, as defined in the SAML assertion. This is usually the Single Sign-On (SSO) URL. Defaults to the value of `sso_url` if not provided.
43+
(Optional) `audience` - The intended audience of the SAML assertion. This is usually the Entity ID of your app.
44+
45+
(Optional) `subject_name_id` - A configuration for the subject name ID. `subject_name_id` block as defined below.
46+
(Optional) `format` - The format of the subject name ID.
47+
(Optional) `template` - Template for app user's username when a user is assigned to the app. Defaults to `$${user.userName}`.
48+
49+
(Optional) `assertion_signed` - Whether to sign the SAML assertion. Defaults to `true`.
50+
(Optional) `response_signed` - Whether to sign the SAML auth response. Defaults to
51+
(Optional) `digest_algorithm` - The algorithm used to digitally sign the SAML assertion and response. Valid values are `SHA1`, `SHA256`, `SHA384`, `SHA512`. Defaults to `SHA256`.
52+
(Optional) `signature_algorithm` - The signing algorithm that's used to digitally sign the SAML assertion and response. Valid values are `RSA_SHA1`, `RSA_SHA256`, `RSA_SHA384`, `RSA_SHA512`, `DSA_SHA1`, `DSA_SHA256`, `DSA_SHA384`, `DSA_SHA512`, `ECDSA_SHA1`, `ECDSA_SHA256`, `ECDSA_SHA384`, `ECDSA_SHA512`. Defaults to `RSA_SHA256`.
53+
54+
(Optional) `authn_context_class_ref` - The authentication context class for the assertion’s authentication statement.
55+
(Optional) `honor_force_authn` - Whether to honor the ForceAuthn attribute in the SAML request. Defaults to `false`.
56+
EOF
57+
type = object({
58+
sso_url = optional(string)
59+
recipient_url = optional(string)
60+
destination_url = optional(string)
61+
audience = optional(string)
62+
63+
subject_name_id = optional(object({
64+
format = optional(string)
65+
template = optional(string, "$${user.userName}")
66+
}))
67+
68+
assertion_signed = optional(bool, true)
69+
response_signed = optional(bool, true)
70+
digest_algorithm = optional(string, "SHA256")
71+
signature_algorithm = optional(string, "RSA_SHA256")
72+
73+
authn_context_class_ref = optional(string)
74+
honor_force_authn = optional(bool, false)
75+
})
76+
default = {}
77+
nullable = false
78+
}
79+
3780
variable "saml_attributes" {
3881
description = <<EOF
3982
(Optional) A list of SAML attribute statements for the application. Each item of `saml_attributes` block as defined below.

0 commit comments

Comments
 (0)