Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add root_url support to OpenID client #248

Merged
merged 1 commit into from
Apr 17, 2020
Merged

Add root_url support to OpenID client #248

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions keycloak/openid_client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ type OpenidClient struct {
WebOrigins []string `json:"webOrigins"`
AdminUrl string `json:"adminUrl"`
BaseUrl string `json:"baseUrl"`
RootUrl *string `json:"rootUrl,omitempty"`
FullScopeAllowed bool `json:"fullScopeAllowed"`
Attributes OpenidClientAttributes `json:"attributes"`
AuthorizationSettings *OpenidClientAuthorizationSettings `json:"authorizationSettings,omitempty"`
Expand Down
4 changes: 4 additions & 0 deletions provider/data_source_keycloak_openid_client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,10 @@ func dataSourceKeycloakOpenidClient() *schema.Resource {
Type: schema.TypeBool,
Computed: true,
},
"root_url": {
Type: schema.TypeString,
Computed: true,
},
"resource_server_id": {
Type: schema.TypeString,
Computed: true,
Expand Down
36 changes: 32 additions & 4 deletions provider/resource_keycloak_openid_client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,10 @@ func resourceKeycloakOpenidClient() *schema.Resource {
Type: schema.TypeString,
Optional: true,
},
"root_url": {
Type: schema.TypeString,
Optional: true,
},
"service_accounts_enabled": {
Type: schema.TypeBool,
Optional: true,
Expand Down Expand Up @@ -180,18 +184,37 @@ func getOpenidClientFromData(data *schema.ResourceData) (*keycloak.OpenidClient,
validRedirectUris := make([]string, 0)
webOrigins := make([]string, 0)

if v, ok := data.GetOk("valid_redirect_uris"); ok {
for _, validRedirectUri := range v.(*schema.Set).List() {
rootUrlData, rootUrlOk := data.GetOkExists("root_url")
validRedirectUrisData, validRedirectUrisOk := data.GetOk("valid_redirect_uris")
webOriginsData, webOriginsOk := data.GetOk("web_origins")

rootUrlString := rootUrlData.(string)

if validRedirectUrisOk {
for _, validRedirectUri := range validRedirectUrisData.(*schema.Set).List() {
validRedirectUris = append(validRedirectUris, validRedirectUri.(string))
}
}

if v, ok := data.GetOk("web_origins"); ok {
for _, webOrigin := range v.(*schema.Set).List() {
if webOriginsOk {
for _, webOrigin := range webOriginsData.(*schema.Set).List() {
webOrigins = append(webOrigins, webOrigin.(string))
}
}

// Keycloak uses the root URL for web origins if not specified otherwise
if rootUrlOk && rootUrlString != "" {
if !validRedirectUrisOk {
return nil, errors.New("valid_redirect_uris is required when root_url is given1")
}
if !webOriginsOk {
return nil, errors.New("web_origins is required when root_url is given")
}
if _, adminOk := data.GetOk("admin_url"); !adminOk {
return nil, errors.New("admin_url is required when root_url is given")
}
}

openidClient := &keycloak.OpenidClient{
Id: data.Id(),
ClientId: data.Get("client_id").(string),
Expand All @@ -217,6 +240,10 @@ func getOpenidClientFromData(data *schema.ResourceData) (*keycloak.OpenidClient,
ConsentRequired: data.Get("consent_required").(bool),
}

if rootUrlOk {
openidClient.RootUrl = &rootUrlString
}

if !openidClient.ImplicitFlowEnabled && !openidClient.StandardFlowEnabled {
if _, ok := data.GetOk("valid_redirect_uris"); ok {
return nil, errors.New("valid_redirect_uris cannot be set when standard or implicit flow is not enabled")
Expand Down Expand Up @@ -285,6 +312,7 @@ func setOpenidClientData(keycloakClient *keycloak.KeycloakClient, data *schema.R
data.Set("web_origins", client.WebOrigins)
data.Set("admin_url", client.AdminUrl)
data.Set("base_url", client.BaseUrl)
data.Set("root_url", &client.RootUrl)
data.Set("authorization_services_enabled", client.AuthorizationServicesEnabled)
data.Set("full_scope_allowed", client.FullScopeAllowed)
data.Set("consent_required", client.ConsentRequired)
Expand Down
59 changes: 58 additions & 1 deletion provider/resource_keycloak_openid_client_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,24 @@ func TestAccKeycloakOpenidClient_baseUrl(t *testing.T) {
})
}

func TestAccKeycloakOpenidClient_rootUrl(t *testing.T) {
realmName := "terraform-" + acctest.RandString(10)
clientId := "terraform-" + acctest.RandString(10)
rootUrl := "https://www.example.com"

resource.Test(t, resource.TestCase{
Providers: testAccProviders,
PreCheck: func() { testAccPreCheck(t) },
CheckDestroy: testAccCheckKeycloakOpenidClientDestroy(),
Steps: []resource.TestStep{
{
Config: testKeycloakOpenidClient_rootUrl(realmName, clientId, rootUrl),
Check: testAccCheckKeycloakOpenidClientRootUrl("keycloak_openid_client.client", rootUrl),
},
},
})
}

func TestAccKeycloakOpenidClient_updateInPlace(t *testing.T) {
realm := "terraform-" + acctest.RandString(10)
clientId := "terraform-" + acctest.RandString(10)
Expand All @@ -169,6 +187,7 @@ func TestAccKeycloakOpenidClient_updateInPlace(t *testing.T) {
implicitFlowEnabled = !standardFlowEnabled
}

rootUrlBefore := acctest.RandString(20)
openidClientBefore := &keycloak.OpenidClient{
RealmId: realm,
ClientId: clientId,
Expand All @@ -184,10 +203,12 @@ func TestAccKeycloakOpenidClient_updateInPlace(t *testing.T) {
WebOrigins: []string{acctest.RandString(10), acctest.RandString(10), acctest.RandString(10)},
AdminUrl: acctest.RandString(20),
BaseUrl: acctest.RandString(20),
RootUrl: &rootUrlBefore,
}

standardFlowEnabled, implicitFlowEnabled = implicitFlowEnabled, standardFlowEnabled

rootUrlAfter := acctest.RandString(20)
openidClientAfter := &keycloak.OpenidClient{
RealmId: realm,
ClientId: clientId,
Expand All @@ -203,6 +224,7 @@ func TestAccKeycloakOpenidClient_updateInPlace(t *testing.T) {
WebOrigins: []string{acctest.RandString(10), acctest.RandString(10), acctest.RandString(10), acctest.RandString(10), acctest.RandString(10)},
AdminUrl: acctest.RandString(20),
BaseUrl: acctest.RandString(20),
RootUrl: &rootUrlAfter,
}

resource.Test(t, resource.TestCase{
Expand Down Expand Up @@ -539,6 +561,21 @@ func testAccCheckKeycloakOpenidClientBaseUrl(resourceName string, baseUrl string
}
}

func testAccCheckKeycloakOpenidClientRootUrl(resourceName string, rootUrl string) resource.TestCheckFunc {
return func(s *terraform.State) error {
client, err := getOpenidClientFromState(s, resourceName)
if err != nil {
return err
}

if *client.RootUrl != rootUrl {
return fmt.Errorf("expected openid client to have rootUrl set to %s, but got %s", rootUrl, *client.RootUrl)
}

return nil
}
}

func testAccCheckKeycloakOpenidClientBelongsToRealm(resourceName, realm string) resource.TestCheckFunc {
return func(s *terraform.State) error {
client, err := getOpenidClientFromState(s, resourceName)
Expand Down Expand Up @@ -777,6 +814,25 @@ resource "keycloak_openid_client" "client" {
`, realm, clientId, baseUrl)
}

func testKeycloakOpenidClient_rootUrl(realm, clientId, rootUrl string) string {
return fmt.Sprintf(`
resource "keycloak_realm" "realm" {
realm = "%s"
}

resource "keycloak_openid_client" "client" {
client_id = "%s"
realm_id = "${keycloak_realm.realm.id}"
root_url = "%s"
valid_redirect_uris = ["http://example.com"]
web_origins = ["http://example.com"]
admin_url = "http://example.com"
access_type = "CONFIDENTIAL"
standard_flow_enabled = true
}
`, realm, clientId, rootUrl)
}

func testKeycloakOpenidClient_pkceChallengeMethod(realm, clientId, pkceChallengeMethod string) string {

return fmt.Sprintf(`
Expand Down Expand Up @@ -901,8 +957,9 @@ resource "keycloak_openid_client" "client" {
web_origins = %s
admin_url = "%s"
base_url = "%s"
root_url = "%s"
}
`, openidClient.RealmId, openidClient.ClientId, openidClient.Name, openidClient.Enabled, openidClient.Description, openidClient.ClientSecret, openidClient.StandardFlowEnabled, openidClient.ImplicitFlowEnabled, openidClient.DirectAccessGrantsEnabled, openidClient.ServiceAccountsEnabled, arrayOfStringsForTerraformResource(openidClient.ValidRedirectUris), arrayOfStringsForTerraformResource(openidClient.WebOrigins), openidClient.AdminUrl, openidClient.BaseUrl)
`, openidClient.RealmId, openidClient.ClientId, openidClient.Name, openidClient.Enabled, openidClient.Description, openidClient.ClientSecret, openidClient.StandardFlowEnabled, openidClient.ImplicitFlowEnabled, openidClient.DirectAccessGrantsEnabled, openidClient.ServiceAccountsEnabled, arrayOfStringsForTerraformResource(openidClient.ValidRedirectUris), arrayOfStringsForTerraformResource(openidClient.WebOrigins), openidClient.AdminUrl, openidClient.BaseUrl, *openidClient.RootUrl)
}

func testKeycloakOpenidClient_secret(realm, clientId, clientSecret string) string {
Expand Down