Adding keycloak ldap msad-lds user account control mapper

docs/resources/keycloak_ldap_msad_lds_user_account_control_mapper.md

@@ -0,0 +1,60 @@
+# keycloak_ldap_msad_lds_user_account_control_mapper
+
+Allows for creating and managing MSAD-LDS user account control mappers for Keycloak
+users federated via LDAP.
+
+The MSAD-LDS (Microsoft Active Directory Lightweight Directory Service) user account control mapper is specific
+to LDAP user federation providers that are pulling from AD-LDS, and it can propagate
+AD-LDS user state to Keycloak in order to enforce settings like expired passwords
+or disabled accounts.
+
+### Example Usage
+
+```hcl
+resource "keycloak_realm" "realm" {
+    realm   = "test"
+    enabled = true
+}
+
+resource "keycloak_ldap_user_federation" "ldap_user_federation" {
+	name                    = "ad"
+	realm_id                = "${keycloak_realm.realm.id}"
+
+	username_ldap_attribute = "cn"
+	rdn_ldap_attribute      = "cn"
+	uuid_ldap_attribute     = "objectGUID"
+	user_object_classes     = [
+		"person",
+		"organizationalPerson",
+		"user"
+	]
+	connection_url          = "ldap://my-ad-server"
+	users_dn                = "dc=example,dc=org"
+	bind_dn                 = "cn=admin,dc=example,dc=org"
+	bind_credential         = "admin"
+}
+
+resource "keycloak_ldap_msad_lds_user_account_control_mapper" "msad_lds_user_account_control_mapper" {
+	realm_id                 = "${keycloak_realm.realm.id}"
+	ldap_user_federation_id  = "${keycloak_ldap_user_federation.ldap_user_federation.id}"
+	name                     = "msad-lds-user-account-control-mapper"
+}
+```
+
+### Argument Reference
+
+The following arguments are supported:
+
+- `realm_id` - (Required) The realm that this LDAP mapper will exist in.
+- `ldap_user_federation_id` - (Required) The ID of the LDAP user federation provider to attach this mapper to.
+- `name` - (Required) Display name of this mapper when displayed in the console.
+
+### Import
+
+LDAP mappers can be imported using the format `{{realm_id}}/{{ldap_user_federation_id}}/{{ldap_mapper_id}}`.
+The ID of the LDAP user federation provider and the mapper can be found within
+the Keycloak GUI, and they are typically GUIDs:
+
+```bash
+$ terraform import keycloak_ldap_msad_lds_user_account_control_mapper.msad_lds_user_account_control_mapper my-realm/af2a6ca3-e4d7-49c3-b08b-1b3c70b4b860/3d923ece-1a91-4bf7-adaf-3b82f2a12b67
+```

example/main.tf

@@ -278,6 +278,12 @@ resource "keycloak_ldap_msad_user_account_control_mapper" "msad_uac_mapper" {
   ldap_user_federation_id = "${keycloak_ldap_user_federation.openldap.id}"
 }
 
+resource "keycloak_ldap_msad_lds_user_account_control_mapper" "msad_lds_uac_mapper" {
+  name                    = "msad-lds-uac-mapper"
+  realm_id                = "${keycloak_ldap_user_federation.openldap.realm_id}"
+  ldap_user_federation_id = "${keycloak_ldap_user_federation.openldap.id}"
+}
+
 resource "keycloak_ldap_full_name_mapper" "full_name_mapper" {
   name                    = "full-name-mapper"
   realm_id                = "${keycloak_ldap_user_federation.openldap.realm_id}"

keycloak/ldap_msad_lds_user_account_control_mapper.go

@@ -0,0 +1,61 @@
+package keycloak
+
+import (
+	"fmt"
+)
+
+type LdapMsadLdsUserAccountControlMapper struct {
+	Id                   string
+	Name                 string
+	RealmId              string
+	LdapUserFederationId string
+}
+
+func convertFromLdapMsadLdsUserAccountControlMapperToComponent(ldapMsadLdsUserAccountControlMapper *LdapMsadLdsUserAccountControlMapper) *component {
+	return &component{
+		Id:           ldapMsadLdsUserAccountControlMapper.Id,
+		Name:         ldapMsadLdsUserAccountControlMapper.Name,
+		ProviderId:   "msad-lds-user-account-control-mapper",
+		ProviderType: "org.keycloak.storage.ldap.mappers.LDAPStorageMapper",
+		ParentId:     ldapMsadLdsUserAccountControlMapper.LdapUserFederationId,
+	}
+}
+
+func convertFromComponentToLdapMsadLdsUserAccountControlMapper(component *component, realmId string) (*LdapMsadLdsUserAccountControlMapper, error) {
+	return &LdapMsadLdsUserAccountControlMapper{
+		Id:                   component.Id,
+		Name:                 component.Name,
+		RealmId:              realmId,
+		LdapUserFederationId: component.ParentId,
+	}, nil
+}
+
+func (keycloakClient *KeycloakClient) NewLdapMsadLdsUserAccountControlMapper(ldapMsadLdsUserAccountControlMapper *LdapMsadLdsUserAccountControlMapper) error {
+	_, location, err := keycloakClient.post(fmt.Sprintf("/realms/%s/components", ldapMsadLdsUserAccountControlMapper.RealmId), convertFromLdapMsadLdsUserAccountControlMapperToComponent(ldapMsadLdsUserAccountControlMapper))
+	if err != nil {
+		return err
+	}
+
+	ldapMsadLdsUserAccountControlMapper.Id = getIdFromLocationHeader(location)
+
+	return nil
+}
+
+func (keycloakClient *KeycloakClient) GetLdapMsadLdsUserAccountControlMapper(realmId, id string) (*LdapMsadLdsUserAccountControlMapper, error) {
+	var component *component
+
+	err := keycloakClient.get(fmt.Sprintf("/realms/%s/components/%s", realmId, id), &component, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return convertFromComponentToLdapMsadLdsUserAccountControlMapper(component, realmId)
+}
+
+func (keycloakClient *KeycloakClient) UpdateLdapMsadLdsUserAccountControlMapper(ldapMsadLdsUserAccountControlMapper *LdapMsadLdsUserAccountControlMapper) error {
+	return keycloakClient.put(fmt.Sprintf("/realms/%s/components/%s", ldapMsadLdsUserAccountControlMapper.RealmId, ldapMsadLdsUserAccountControlMapper.Id), convertFromLdapMsadLdsUserAccountControlMapperToComponent(ldapMsadLdsUserAccountControlMapper))
+}
+
+func (keycloakClient *KeycloakClient) DeleteLdapMsadLdsUserAccountControlMapper(realmId, id string) error {
+	return keycloakClient.delete(fmt.Sprintf("/realms/%s/components/%s", realmId, id), nil)
+}

provider/provider.go

@@ -32,6 +32,7 @@ func KeycloakProvider() *schema.Provider {
 			"keycloak_ldap_group_mapper":                               resourceKeycloakLdapGroupMapper(),
 			"keycloak_ldap_hardcoded_role_mapper":                      resourceKeycloakLdapHardcodedRoleMapper(),
 			"keycloak_ldap_msad_user_account_control_mapper":           resourceKeycloakLdapMsadUserAccountControlMapper(),
+			"keycloak_ldap_msad_lds_user_account_control_mapper":       resourceKeycloakLdapMsadLdsUserAccountControlMapper(),
 			"keycloak_ldap_full_name_mapper":                           resourceKeycloakLdapFullNameMapper(),
 			"keycloak_custom_user_federation":                          resourceKeycloakCustomUserFederation(),
 			"keycloak_openid_user_attribute_protocol_mapper":           resourceKeycloakOpenIdUserAttributeProtocolMapper(),

provider/resource_keycloak_ldap_msad_lds_user_account_control_mapper.go

@@ -0,0 +1,111 @@
+package provider
+
+import (
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/mrparkers/terraform-provider-keycloak/keycloak"
+)
+
+func resourceKeycloakLdapMsadLdsUserAccountControlMapper() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceKeycloakLdapMsadLdsUserAccountControlMapperCreate,
+		Read:   resourceKeycloakLdapMsadLdsUserAccountControlMapperRead,
+		Update: resourceKeycloakLdapMsadLdsUserAccountControlMapperUpdate,
+		Delete: resourceKeycloakLdapMsadLdsUserAccountControlMapperDelete,
+		// This resource can be imported using {{realm}}/{{provider_id}}/{{mapper_id}}. The Provider and Mapper IDs are displayed in the GUI
+		Importer: &schema.ResourceImporter{
+			State: resourceKeycloakLdapGenericMapperImport,
+		},
+		Schema: map[string]*schema.Schema{
+			"name": {
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: "Display name of the mapper when displayed in the console.",
+			},
+			"realm_id": {
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: "The realm in which the ldap user federation provider exists.",
+			},
+			"ldap_user_federation_id": {
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: "The ldap user federation provider to attach this mapper to.",
+			},
+		},
+	}
+}
+
+func getLdapMsadLdsUserAccountControlMapperFromData(data *schema.ResourceData) *keycloak.LdapMsadLdsUserAccountControlMapper {
+	return &keycloak.LdapMsadLdsUserAccountControlMapper{
+		Id:                   data.Id(),
+		Name:                 data.Get("name").(string),
+		RealmId:              data.Get("realm_id").(string),
+		LdapUserFederationId: data.Get("ldap_user_federation_id").(string),
+	}
+}
+
+func setLdapMsadLdsUserAccountControlMapperData(data *schema.ResourceData, ldapMsadLdsUserAccountControlMapper *keycloak.LdapMsadLdsUserAccountControlMapper) {
+	data.SetId(ldapMsadLdsUserAccountControlMapper.Id)
+
+	data.Set("id", ldapMsadLdsUserAccountControlMapper.Id)
+	data.Set("name", ldapMsadLdsUserAccountControlMapper.Name)
+	data.Set("realm_id", ldapMsadLdsUserAccountControlMapper.RealmId)
+	data.Set("ldap_user_federation_id", ldapMsadLdsUserAccountControlMapper.LdapUserFederationId)
+}
+
+func resourceKeycloakLdapMsadLdsUserAccountControlMapperCreate(data *schema.ResourceData, meta interface{}) error {
+	keycloakClient := meta.(*keycloak.KeycloakClient)
+
+	ldapMsadLdsUserAccountControlMapper := getLdapMsadLdsUserAccountControlMapperFromData(data)
+
+	err := keycloakClient.NewLdapMsadLdsUserAccountControlMapper(ldapMsadLdsUserAccountControlMapper)
+	if err != nil {
+		return err
+	}
+
+	setLdapMsadLdsUserAccountControlMapperData(data, ldapMsadLdsUserAccountControlMapper)
+
+	return resourceKeycloakLdapMsadLdsUserAccountControlMapperRead(data, meta)
+}
+
+func resourceKeycloakLdapMsadLdsUserAccountControlMapperRead(data *schema.ResourceData, meta interface{}) error {
+	keycloakClient := meta.(*keycloak.KeycloakClient)
+
+	realmId := data.Get("realm_id").(string)
+	id := data.Id()
+
+	ldapMsadLdsUserAccountControlMapper, err := keycloakClient.GetLdapMsadLdsUserAccountControlMapper(realmId, id)
+	if err != nil {
+		return handleNotFoundError(err, data)
+	}
+
+	setLdapMsadLdsUserAccountControlMapperData(data, ldapMsadLdsUserAccountControlMapper)
+
+	return nil
+}
+
+func resourceKeycloakLdapMsadLdsUserAccountControlMapperUpdate(data *schema.ResourceData, meta interface{}) error {
+	keycloakClient := meta.(*keycloak.KeycloakClient)
+
+	ldapMsadLdsUserAccountControlMapper := getLdapMsadLdsUserAccountControlMapperFromData(data)
+
+	err := keycloakClient.UpdateLdapMsadLdsUserAccountControlMapper(ldapMsadLdsUserAccountControlMapper)
+	if err != nil {
+		return err
+	}
+
+	setLdapMsadLdsUserAccountControlMapperData(data, ldapMsadLdsUserAccountControlMapper)
+
+	return nil
+}
+
+func resourceKeycloakLdapMsadLdsUserAccountControlMapperDelete(data *schema.ResourceData, meta interface{}) error {
+	keycloakClient := meta.(*keycloak.KeycloakClient)
+
+	realmId := data.Get("realm_id").(string)
+	id := data.Id()
+
+	return keycloakClient.DeleteLdapMsadLdsUserAccountControlMapper(realmId, id)
+}