oci_identity_dynamic_group only shows dynamic groups of Default Identity Domains

[hslange]

Describe the bug
We have 2 Identity Domains ("Default" and "MyIdentityDomain")
We have Dynamic groups in both Identity Domains
When we run steampipe with the query "select name from oci_identity_dynamic_group", the result will only show dynamic groups from the "Default" Identity Domain, not from "MyIdentityDomain"

Steampipe version (steampipe -v)
v2.1.0

Plugin version (steampipe plugin list)
oci 1.1.0

To reproduce
Create a second Identity Domain called: "MyIdentityDomain"
In MyIdentityDomain, create a dynamic group: my_dg_test
run steampipe query with the follwoing query: select name from oci_identity_dynamic_group
The result will not show the newly created dynamic group "my_dg_test"

Expected behavior
when running steampipe query with the query: select name from "oci_identity_dynamic_group" it is expected that the newmly created Dynamic Group (my_dg_test) in the "MyIdentityDomain" Indentity Domain is part of the result.

Additional context
Add any other context about the problem here.

[misraved]

Hi @hslange, thank you for creating the issue. I took a look at the table implementation and here are my observations:

• The oci_identity_dynamic_group table uses OCI IAM ListDynamicGroups API, which is tenant-wide but scoped by the identity domain you connect to.
• Your Steampipe OCI plugin connection is likely configured for the Default domain only.
• OCI’s API does not automatically aggregate results from multiple identity domains.

How to Include the Other Domain
You can work around this in one of two ways:

Option 1: Create a Second Steampipe Connection
In your ~/.steampipe/config/oci.spc file:

connection "oci_myidentitydomain" {
  plugin = "oci"

  tenancy_ocid = "ocid1.tenancy.oc1..aaaaaaa..."
  config_file_profile = "MY_IDENTITY_DOMAIN_PROFILE"
  # This profile should point to the new domain in your OCI config file
}

Run:
steampipe query "select name from oci_myidentitydomain.oci_identity_dynamic_group"

Option 2: Use a Multi-Connection Query

https://hub.steampipe.io/plugins/turbot/oci#multi-tenant-connections

[misraved]

@ParthaI would you recommend adding a Parent Hydrate to oci_identity_dynamic_group table to list out the available domains and then list out the dynamic groups under each domain?

I am not in favor of this approach since it goes against the oci CLI behaviour.

[hslange]

Hi,
thank you for your feedback, but this is not solving the issue.
Whatever profile I use, the steampipe query always returns the dynamic groups in the Default identity domain.
The code used in steampipe refers to the Identity and Access Management service. The calls implemented are documented here:
Dynamic Group: https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/DynamicGroup/
List Dynamic Group: https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/DynamicGroup/ListDynamicGroups
But this only provides information for the Default domain, not for any other Identity Domain created in the tenant.

In order to get the Dynamic Groups from a specific Identity Domain, you would need to implement the calls for an Identity Domain itself, which is a different set of API's.
For documentation and examples please look here:
You would first lookup all dynamic groups:
https://docs.oracle.com/en-us/iaas/api/#/en/identity-domains/v1/DynamicResourceGroups/ListDynamicResourceGroups
and if you want the details for a specific Dynamic Group, you can get the info (List is not an option):
https://docs.oracle.com/en-us/iaas/api/#/en/identity-domains/v1/DynamicResourceGroup/GetDynamicResourceGroup

Hope this is useful input.
Kind regards

[hslange]

@misraved and/or @ParthaI the issue is closed but I added some addition information why I thik this is still valid (also for the other issue I raised (#660 ) since this also related to Identity Domains and should use a different Identity Management API.
Thanks in advance to look into this and if you agree, can these issues be re-opened and hopefully fixed in a future release?