-
Notifications
You must be signed in to change notification settings - Fork 324
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add OIDC audience resolve protocol mapper #606
Merged
mrparkers
merged 6 commits into
keycloak:master
from
thyming:audience-resolve-protocol-mapper
Oct 8, 2021
Merged
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit
Hold shift + click to select a range
a2e7a59
Add oidc audience resolve protocol mapper
2563400
Merge branch 'master' into audience-resolve-protocol-mapper
mrparkers 7fb0cae
Remove commented code
c75c245
Merge branch 'audience-resolve-protocol-mapper' of github.com:thyming…
3d888cf
Address feedback
af8be87
docs page
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| package keycloak | ||
|
|
||
| import ( | ||
| "fmt" | ||
| ) | ||
|
|
||
| const AudienceResolveMapperName = "audience resolve" | ||
|
|
||
| type OpenIdAudienceResolveProtocolMapper struct { | ||
| Id string | ||
| RealmId string | ||
| ClientId string | ||
| ClientScopeId string | ||
| } | ||
|
|
||
| func (mapper *OpenIdAudienceResolveProtocolMapper) convertToGenericProtocolMapper() *protocolMapper { | ||
| return &protocolMapper{ | ||
| Id: mapper.Id, | ||
| Name: AudienceResolveMapperName, | ||
| Protocol: "openid-connect", | ||
| ProtocolMapper: "oidc-audience-resolve-mapper", | ||
| Config: map[string]string{}, | ||
| } | ||
| } | ||
|
|
||
| func (protocolMapper *protocolMapper) convertToOpenIdAudienceResolveProtocolMapper(realmId, clientId, clientScopeId string) (*OpenIdAudienceResolveProtocolMapper, error) { | ||
| return &OpenIdAudienceResolveProtocolMapper{ | ||
| Id: protocolMapper.Id, | ||
| RealmId: realmId, | ||
| ClientId: clientId, | ||
| ClientScopeId: clientScopeId, | ||
| }, nil | ||
| } | ||
|
|
||
| func (keycloakClient *KeycloakClient) GetOpenIdAudienceResolveProtocolMapper(realmId, clientId, clientScopeId, mapperId string) (*OpenIdAudienceResolveProtocolMapper, error) { | ||
| var protocolMapper *protocolMapper | ||
|
|
||
| err := keycloakClient.get(individualProtocolMapperPath(realmId, clientId, clientScopeId, mapperId), &protocolMapper, nil) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return protocolMapper.convertToOpenIdAudienceResolveProtocolMapper(realmId, clientId, clientScopeId) | ||
| } | ||
|
|
||
| func (keycloakClient *KeycloakClient) DeleteOpenIdAudienceResolveProtocolMapper(realmId, clientId, clientScopeId, mapperId string) error { | ||
| return keycloakClient.delete(individualProtocolMapperPath(realmId, clientId, clientScopeId, mapperId), nil) | ||
| } | ||
|
|
||
| func (keycloakClient *KeycloakClient) NewOpenIdAudienceResolveProtocolMapper(mapper *OpenIdAudienceResolveProtocolMapper) error { | ||
| path := protocolMapperPath(mapper.RealmId, mapper.ClientId, mapper.ClientScopeId) | ||
|
|
||
| _, location, err := keycloakClient.post(path, mapper.convertToGenericProtocolMapper()) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| mapper.Id = getIdFromLocationHeader(location) | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func (keycloakClient *KeycloakClient) UpdateOpenIdAudienceResolveProtocolMapper(mapper *OpenIdAudienceResolveProtocolMapper) error { | ||
| path := individualProtocolMapperPath(mapper.RealmId, mapper.ClientId, mapper.ClientScopeId, mapper.Id) | ||
|
|
||
| return keycloakClient.put(path, mapper.convertToGenericProtocolMapper()) | ||
| } | ||
|
|
||
| func (keycloakClient *KeycloakClient) ValidateOpenIdAudienceResolveProtocolMapper(mapper *OpenIdAudienceResolveProtocolMapper) error { | ||
| if mapper.ClientId == "" && mapper.ClientScopeId == "" { | ||
| return fmt.Errorf("validation error: one of ClientId or ClientScopeId must be set") | ||
| } | ||
|
|
||
| if mapper.ClientId != "" && mapper.ClientScopeId != "" { | ||
thyming marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| return fmt.Errorf("validation error: ClientId and ClientScopeId cannot both be set") | ||
| } | ||
|
|
||
| protocolMappers, err := keycloakClient.listGenericProtocolMappers(mapper.RealmId, mapper.ClientId, mapper.ClientScopeId) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| for _, protocolMapper := range protocolMappers { | ||
| if protocolMapper.Name == AudienceResolveMapperName && protocolMapper.Id != mapper.Id { | ||
| return fmt.Errorf("validation error: a protocol mapper with name %s already exists for this client", AudienceResolveMapperName) | ||
| } | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
111 changes: 111 additions & 0 deletions
111
provider/resource_keycloak_openid_audience_resolve_protocol_mapper.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| package provider | ||
|
|
||
| import ( | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" | ||
| "github.com/mrparkers/terraform-provider-keycloak/keycloak" | ||
| ) | ||
|
|
||
| func resourceKeycloakOpenIdAudienceResolveProtocolMapper() *schema.Resource { | ||
| return &schema.Resource{ | ||
| Create: resourceKeycloakOpenIdAudienceResolveProtocolMapperCreate, | ||
| Read: resourceKeycloakOpenIdAudienceResolveProtocolMapperRead, | ||
| //Update: resourceKeycloakOpenIdAudienceResolveProtocolMapperUpdate, | ||
| Delete: resourceKeycloakOpenIdAudienceResolveProtocolMapperDelete, | ||
| Importer: &schema.ResourceImporter{ | ||
| // import a mapper tied to a client: | ||
| // {{realmId}}/client/{{clientId}}/{{protocolMapperId}} | ||
| // or a client scope: | ||
| // {{realmId}}/client-scope/{{clientScopeId}}/{{protocolMapperId}} | ||
| State: genericProtocolMapperImport, | ||
| }, | ||
| Schema: map[string]*schema.Schema{ | ||
| "realm_id": { | ||
| Type: schema.TypeString, | ||
| Required: true, | ||
| ForceNew: true, | ||
| Description: "The realm id where the associated client or client scope exists.", | ||
| }, | ||
| "client_id": { | ||
| Type: schema.TypeString, | ||
| Optional: true, | ||
| ForceNew: true, | ||
| Description: "The mapper's associated client. Cannot be used at the same time as client_scope_id.", | ||
| ConflictsWith: []string{"client_scope_id"}, | ||
| }, | ||
| "client_scope_id": { | ||
| Type: schema.TypeString, | ||
| Optional: true, | ||
| ForceNew: true, | ||
| Description: "The mapper's associated client scope. Cannot be used at the same time as client_id.", | ||
| ConflictsWith: []string{"client_id"}, | ||
| }, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| func mapFromDataToOpenIdAudienceResolveProtocolMapper(data *schema.ResourceData) *keycloak.OpenIdAudienceResolveProtocolMapper { | ||
| return &keycloak.OpenIdAudienceResolveProtocolMapper{ | ||
| Id: data.Id(), | ||
| RealmId: data.Get("realm_id").(string), | ||
| ClientId: data.Get("client_id").(string), | ||
| ClientScopeId: data.Get("client_scope_id").(string), | ||
| } | ||
| } | ||
|
|
||
| func mapFromOpenIdAudienceResolveMapperToData(mapper *keycloak.OpenIdAudienceResolveProtocolMapper, data *schema.ResourceData) { | ||
| data.SetId(mapper.Id) | ||
| data.Set("realm_id", mapper.RealmId) | ||
|
|
||
| if mapper.ClientId != "" { | ||
| data.Set("client_id", mapper.ClientId) | ||
| } else { | ||
| data.Set("client_scope_id", mapper.ClientScopeId) | ||
| } | ||
| } | ||
|
|
||
| func resourceKeycloakOpenIdAudienceResolveProtocolMapperCreate(data *schema.ResourceData, meta interface{}) error { | ||
| keycloakClient := meta.(*keycloak.KeycloakClient) | ||
|
|
||
| openIdAudienceResolveMapper := mapFromDataToOpenIdAudienceResolveProtocolMapper(data) | ||
|
|
||
| err := keycloakClient.ValidateOpenIdAudienceResolveProtocolMapper(openIdAudienceResolveMapper) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| err = keycloakClient.NewOpenIdAudienceResolveProtocolMapper(openIdAudienceResolveMapper) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| mapFromOpenIdAudienceResolveMapperToData(openIdAudienceResolveMapper, data) | ||
|
|
||
| return resourceKeycloakOpenIdAudienceResolveProtocolMapperRead(data, meta) | ||
| } | ||
|
|
||
| func resourceKeycloakOpenIdAudienceResolveProtocolMapperRead(data *schema.ResourceData, meta interface{}) error { | ||
| keycloakClient := meta.(*keycloak.KeycloakClient) | ||
|
|
||
| realmId := data.Get("realm_id").(string) | ||
| clientId := data.Get("client_id").(string) | ||
| clientScopeId := data.Get("client_scope_id").(string) | ||
|
|
||
| openIdAudienceResolveMapper, err := keycloakClient.GetOpenIdAudienceResolveProtocolMapper(realmId, clientId, clientScopeId, data.Id()) | ||
| if err != nil { | ||
| return handleNotFoundError(err, data) | ||
| } | ||
|
|
||
| mapFromOpenIdAudienceResolveMapperToData(openIdAudienceResolveMapper, data) | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func resourceKeycloakOpenIdAudienceResolveProtocolMapperDelete(data *schema.ResourceData, meta interface{}) error { | ||
| keycloakClient := meta.(*keycloak.KeycloakClient) | ||
|
|
||
| realmId := data.Get("realm_id").(string) | ||
| clientId := data.Get("client_id").(string) | ||
| clientScopeId := data.Get("client_scope_id").(string) | ||
|
|
||
| return keycloakClient.DeleteOpenIdAudienceResolveProtocolMapper(realmId, clientId, clientScopeId, data.Id()) | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it should be up to the user to specify the name for this mapper, so it should be part of the schema instead of hardcoded to "audience resolve".
I realize that this isn't super importan, because 1) it isn't editable on the Keycloak side (which I just learned today 😄) and 2) there's no reason to attach two different audience resolve protocol mappers to the same client / client scope.
However, since Keycloak allows you to create two instances of this protocol mapper attached to the same client with different names, this provider should allow it too.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Okey doke, updated to have that behavior.