Skip to content

Commit

Permalink
Add root_url support to OpenID client
Browse files Browse the repository at this point in the history
  • Loading branch information
Johannes Wienke committed Apr 16, 2020
1 parent 2212afc commit 282f96e
Show file tree
Hide file tree
Showing 4 changed files with 95 additions and 5 deletions.
1 change: 1 addition & 0 deletions keycloak/openid_client.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ type OpenidClient struct {
WebOrigins []string `json:"webOrigins"`
AdminUrl string `json:"adminUrl"`
BaseUrl string `json:"baseUrl"`
RootUrl *string `json:"rootUrl,omitempty"`
FullScopeAllowed bool `json:"fullScopeAllowed"`
Attributes OpenidClientAttributes `json:"attributes"`
AuthorizationSettings *OpenidClientAuthorizationSettings `json:"authorizationSettings,omitempty"`
Expand Down
4 changes: 4 additions & 0 deletions provider/data_source_keycloak_openid_client.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,10 @@ func dataSourceKeycloakOpenidClient() *schema.Resource {
Type: schema.TypeBool,
Computed: true,
},
"root_url": {
Type: schema.TypeString,
Computed: true,
},
"resource_server_id": {
Type: schema.TypeString,
Computed: true,
Expand Down
36 changes: 32 additions & 4 deletions provider/resource_keycloak_openid_client.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,10 @@ func resourceKeycloakOpenidClient() *schema.Resource {
Type: schema.TypeString,
Optional: true,
},
"root_url": {
Type: schema.TypeString,
Optional: true,
},
"service_accounts_enabled": {
Type: schema.TypeBool,
Optional: true,
Expand Down Expand Up @@ -180,18 +184,37 @@ func getOpenidClientFromData(data *schema.ResourceData) (*keycloak.OpenidClient,
validRedirectUris := make([]string, 0)
webOrigins := make([]string, 0)

if v, ok := data.GetOk("valid_redirect_uris"); ok {
for _, validRedirectUri := range v.(*schema.Set).List() {
rootUrlData, rootUrlOk := data.GetOkExists("root_url")
validRedirectUrisData, validRedirectUrisOk := data.GetOk("valid_redirect_uris")
webOriginsData, webOriginsOk := data.GetOk("web_origins")

rootUrlString := rootUrlData.(string)

if validRedirectUrisOk {
for _, validRedirectUri := range validRedirectUrisData.(*schema.Set).List() {
validRedirectUris = append(validRedirectUris, validRedirectUri.(string))
}
}

if v, ok := data.GetOk("web_origins"); ok {
for _, webOrigin := range v.(*schema.Set).List() {
if webOriginsOk {
for _, webOrigin := range webOriginsData.(*schema.Set).List() {
webOrigins = append(webOrigins, webOrigin.(string))
}
}

// Keycloak uses the root URL for web origins if not specified otherwise
if rootUrlOk && rootUrlString != "" {
if !validRedirectUrisOk {
return nil, errors.New("valid_redirect_uris is required when root_url is given1")
}
if !webOriginsOk {
return nil, errors.New("web_origins is required when root_url is given")
}
if _, adminOk := data.GetOk("admin_url"); !adminOk {
return nil, errors.New("admin_url is required when root_url is given")
}
}

openidClient := &keycloak.OpenidClient{
Id: data.Id(),
ClientId: data.Get("client_id").(string),
Expand All @@ -217,6 +240,10 @@ func getOpenidClientFromData(data *schema.ResourceData) (*keycloak.OpenidClient,
ConsentRequired: data.Get("consent_required").(bool),
}

if rootUrlOk {
openidClient.RootUrl = &rootUrlString
}

if !openidClient.ImplicitFlowEnabled && !openidClient.StandardFlowEnabled {
if _, ok := data.GetOk("valid_redirect_uris"); ok {
return nil, errors.New("valid_redirect_uris cannot be set when standard or implicit flow is not enabled")
Expand Down Expand Up @@ -285,6 +312,7 @@ func setOpenidClientData(keycloakClient *keycloak.KeycloakClient, data *schema.R
data.Set("web_origins", client.WebOrigins)
data.Set("admin_url", client.AdminUrl)
data.Set("base_url", client.BaseUrl)
data.Set("root_url", &client.RootUrl)
data.Set("authorization_services_enabled", client.AuthorizationServicesEnabled)
data.Set("full_scope_allowed", client.FullScopeAllowed)
data.Set("consent_required", client.ConsentRequired)
Expand Down
59 changes: 58 additions & 1 deletion provider/resource_keycloak_openid_client_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,24 @@ func TestAccKeycloakOpenidClient_baseUrl(t *testing.T) {
})
}

func TestAccKeycloakOpenidClient_rootUrl(t *testing.T) {
realmName := "terraform-" + acctest.RandString(10)
clientId := "terraform-" + acctest.RandString(10)
rootUrl := "https://www.example.com"

resource.Test(t, resource.TestCase{
Providers: testAccProviders,
PreCheck: func() { testAccPreCheck(t) },
CheckDestroy: testAccCheckKeycloakOpenidClientDestroy(),
Steps: []resource.TestStep{
{
Config: testKeycloakOpenidClient_rootUrl(realmName, clientId, rootUrl),
Check: testAccCheckKeycloakOpenidClientRootUrl("keycloak_openid_client.client", rootUrl),
},
},
})
}

func TestAccKeycloakOpenidClient_updateInPlace(t *testing.T) {
realm := "terraform-" + acctest.RandString(10)
clientId := "terraform-" + acctest.RandString(10)
Expand All @@ -169,6 +187,7 @@ func TestAccKeycloakOpenidClient_updateInPlace(t *testing.T) {
implicitFlowEnabled = !standardFlowEnabled
}

rootUrlBefore := acctest.RandString(20)
openidClientBefore := &keycloak.OpenidClient{
RealmId: realm,
ClientId: clientId,
Expand All @@ -184,10 +203,12 @@ func TestAccKeycloakOpenidClient_updateInPlace(t *testing.T) {
WebOrigins: []string{acctest.RandString(10), acctest.RandString(10), acctest.RandString(10)},
AdminUrl: acctest.RandString(20),
BaseUrl: acctest.RandString(20),
RootUrl: &rootUrlBefore,
}

standardFlowEnabled, implicitFlowEnabled = implicitFlowEnabled, standardFlowEnabled

rootUrlAfter := acctest.RandString(20)
openidClientAfter := &keycloak.OpenidClient{
RealmId: realm,
ClientId: clientId,
Expand All @@ -203,6 +224,7 @@ func TestAccKeycloakOpenidClient_updateInPlace(t *testing.T) {
WebOrigins: []string{acctest.RandString(10), acctest.RandString(10), acctest.RandString(10), acctest.RandString(10), acctest.RandString(10)},
AdminUrl: acctest.RandString(20),
BaseUrl: acctest.RandString(20),
RootUrl: &rootUrlAfter,
}

resource.Test(t, resource.TestCase{
Expand Down Expand Up @@ -539,6 +561,21 @@ func testAccCheckKeycloakOpenidClientBaseUrl(resourceName string, baseUrl string
}
}

func testAccCheckKeycloakOpenidClientRootUrl(resourceName string, rootUrl string) resource.TestCheckFunc {
return func(s *terraform.State) error {
client, err := getOpenidClientFromState(s, resourceName)
if err != nil {
return err
}

if *client.RootUrl != rootUrl {
return fmt.Errorf("expected openid client to have rootUrl set to %s, but got %s", rootUrl, *client.RootUrl)
}

return nil
}
}

func testAccCheckKeycloakOpenidClientBelongsToRealm(resourceName, realm string) resource.TestCheckFunc {
return func(s *terraform.State) error {
client, err := getOpenidClientFromState(s, resourceName)
Expand Down Expand Up @@ -777,6 +814,25 @@ resource "keycloak_openid_client" "client" {
`, realm, clientId, baseUrl)
}

func testKeycloakOpenidClient_rootUrl(realm, clientId, rootUrl string) string {
return fmt.Sprintf(`
resource "keycloak_realm" "realm" {
realm = "%s"
}
resource "keycloak_openid_client" "client" {
client_id = "%s"
realm_id = "${keycloak_realm.realm.id}"
root_url = "%s"
valid_redirect_uris = ["http://example.com"]
web_origins = ["http://example.com"]
admin_url = "http://example.com"
access_type = "CONFIDENTIAL"
standard_flow_enabled = true
}
`, realm, clientId, rootUrl)
}

func testKeycloakOpenidClient_pkceChallengeMethod(realm, clientId, pkceChallengeMethod string) string {

return fmt.Sprintf(`
Expand Down Expand Up @@ -901,8 +957,9 @@ resource "keycloak_openid_client" "client" {
web_origins = %s
admin_url = "%s"
base_url = "%s"
root_url = "%s"
}
`, openidClient.RealmId, openidClient.ClientId, openidClient.Name, openidClient.Enabled, openidClient.Description, openidClient.ClientSecret, openidClient.StandardFlowEnabled, openidClient.ImplicitFlowEnabled, openidClient.DirectAccessGrantsEnabled, openidClient.ServiceAccountsEnabled, arrayOfStringsForTerraformResource(openidClient.ValidRedirectUris), arrayOfStringsForTerraformResource(openidClient.WebOrigins), openidClient.AdminUrl, openidClient.BaseUrl)
`, openidClient.RealmId, openidClient.ClientId, openidClient.Name, openidClient.Enabled, openidClient.Description, openidClient.ClientSecret, openidClient.StandardFlowEnabled, openidClient.ImplicitFlowEnabled, openidClient.DirectAccessGrantsEnabled, openidClient.ServiceAccountsEnabled, arrayOfStringsForTerraformResource(openidClient.ValidRedirectUris), arrayOfStringsForTerraformResource(openidClient.WebOrigins), openidClient.AdminUrl, openidClient.BaseUrl, *openidClient.RootUrl)
}

func testKeycloakOpenidClient_secret(realm, clientId, clientSecret string) string {
Expand Down

0 comments on commit 282f96e

Please sign in to comment.