Add support for 11.0.0 and drop support for 8.0.0

.circleci/config.yml

@@ -6,9 +6,9 @@ workflows:
           matrix:
             parameters:
               keycloak-version:
+                - '11.0.0'
                 - '10.0.2'
                 - '9.0.3'
-                - '8.0.2'
   release:
     jobs:
       - test:

README.md

@@ -15,9 +15,9 @@ This provider will officially support the latest three major versions of Keycloa
 
 The following versions are used when running acceptance tests in CI:
 
-- 10.0.2 (latest)
+- 11.0.0 (latest)
+- 10.0.2
 - 9.0.3
-- 8.0.2
 
 ## Releases
 

keycloak/keycloak_client.go

@@ -6,13 +6,15 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
+	"github.com/hashicorp/go-version"
 	"io"
 	"io/ioutil"
 	"log"
 	"net/http"
 	"net/http/cookiejar"
 	"net/http/httputil"
 	"net/url"
+	"regexp"
 	"strings"
 	"time"
 
@@ -26,6 +28,7 @@ type KeycloakClient struct {
 	httpClient        *http.Client
 	initialLogin      bool
 	userAgent         string
+	serverVersion     *version.Version
 }
 
 type ClientCredentials struct {
@@ -44,7 +47,7 @@ const (
 	tokenUrl = "%s/realms/%s/protocol/openid-connect/token"
 )
 
-func NewKeycloakClient(url, basePath, clientId, clientSecret, realm, username, password string, initialLogin bool, clientTimeout int, caCert string, tlsInsecureSkipVerify bool, userAgent string) (*KeycloakClient, error) {
+func NewKeycloakClient(url, basePath, clientId, clientSecret, realm, username, password string, initialLogin bool, clientTimeout int, caCert string, tlsInsecureSkipVerify bool, keycloakVersion string, userAgent string) (*KeycloakClient, error) {
 	cookieJar, err := cookiejar.New(&cookiejar.Options{
 		PublicSuffixList: publicsuffix.List,
 	})
@@ -100,6 +103,28 @@ func NewKeycloakClient(url, basePath, clientId, clientSecret, realm, username, p
 		if err != nil {
 			return nil, err
 		}
+
+		if keycloakVersion == "" {
+			serverInfo, err := keycloakClient.GetServerInfo()
+			if err != nil {
+				return nil, fmt.Errorf("/serverInfo endpoint retuned an error, server Keycloak version could not be determined: %s", err)
+			}
+
+			regex := regexp.MustCompile(`^(\d+\.\d+\.\d+)`)
+			semver := regex.FindStringSubmatch(serverInfo.SystemInfo.ServerVersion)[0]
+
+			keycloakServerInfoVersion, err := version.NewVersion(semver)
+			if err != nil {
+				return nil, fmt.Errorf("/serverInfo endpoint retuned an unreadable version, server Keycloak version could not be determined: %s", err)
+			}
+			keycloakClient.serverVersion = keycloakServerInfoVersion
+		} else {
+			v, err := version.NewVersion(keycloakVersion)
+			if err != nil {
+				return nil, err
+			}
+			keycloakClient.serverVersion = v
+		}
 	}
 
 	return &keycloakClient, nil
@@ -401,3 +426,7 @@ func (keycloakClient *KeycloakClient) delete(path string, requestBody interface{
 
 	return err
 }
+
+func (keycloakClient *KeycloakClient) ServerVersion() *version.Version {
+	return keycloakClient.serverVersion
+}

keycloak/keycloak_client_test.go

@@ -51,7 +51,7 @@ func TestAccKeycloakApiClientRefresh(t *testing.T) {
 		t.Fatal("KEYCLOAK_CLIENT_TIMEOUT must be an integer")
 	}
 
-	keycloakClient, err := NewKeycloakClient(os.Getenv("KEYCLOAK_URL"), "/auth", os.Getenv("KEYCLOAK_CLIENT_ID"), os.Getenv("KEYCLOAK_CLIENT_SECRET"), os.Getenv("KEYCLOAK_REALM"), os.Getenv("KEYCLOAK_USER"), os.Getenv("KEYCLOAK_PASSWORD"), true, clientTimeout, "", false, "")
+	keycloakClient, err := NewKeycloakClient(os.Getenv("KEYCLOAK_URL"), "/auth", os.Getenv("KEYCLOAK_CLIENT_ID"), os.Getenv("KEYCLOAK_CLIENT_SECRET"), os.Getenv("KEYCLOAK_REALM"), os.Getenv("KEYCLOAK_USER"), os.Getenv("KEYCLOAK_PASSWORD"), true, clientTimeout, "", false, "", "")
 	if err != nil {
 		t.Fatalf("%s", err)
 	}

keycloak/ldap_group_mapper.go

@@ -27,9 +27,11 @@ type LdapGroupMapper struct {
 	MappedGroupAttributes       []string
 
 	DropNonExistingGroupsDuringSync bool
+
+	LdapGroupsPath string
 }
 
-func convertFromLdapGroupMapperToComponent(ldapGroupMapper *LdapGroupMapper) *component {
+func (keycloakClient *KeycloakClient) convertFromLdapGroupMapperToComponent(ldapGroupMapper *LdapGroupMapper) *component {
 	componentConfig := map[string][]string{
 		"groups.dn": {
 			ldapGroupMapper.LdapGroupsDn,
@@ -69,6 +71,10 @@ func convertFromLdapGroupMapperToComponent(ldapGroupMapper *LdapGroupMapper) *co
 		},
 	}
 
+	if KeycloakVersionIsGreaterThanOrEqualTo(keycloakClient, "11.0.0") {
+		componentConfig["groups.path"] = []string{ldapGroupMapper.LdapGroupsPath}
+	}
+
 	if ldapGroupMapper.GroupsLdapFilter != "" {
 		componentConfig["groups.ldap.filter"] = []string{ldapGroupMapper.GroupsLdapFilter}
 	}
@@ -126,6 +132,7 @@ func convertFromComponentToLdapGroupMapper(component *component, realmId string)
 		UserRolesRetrieveStrategy:       component.getConfig("user.roles.retrieve.strategy"),
 		MemberofLdapAttribute:           component.getConfig("memberof.ldap.attribute"),
 		DropNonExistingGroupsDuringSync: dropNonExistingGroupsDuringSync,
+		LdapGroupsPath:                  component.getConfig("groups.path"),
 	}
 
 	if groupsLdapFilter := component.getConfig("groups.ldap.filter"); groupsLdapFilter != "" {
@@ -153,7 +160,7 @@ func (keycloakClient *KeycloakClient) ValidateLdapGroupMapper(ldapGroupMapper *L
 }
 
 func (keycloakClient *KeycloakClient) NewLdapGroupMapper(ldapGroupMapper *LdapGroupMapper) error {
-	_, location, err := keycloakClient.post(fmt.Sprintf("/realms/%s/components", ldapGroupMapper.RealmId), convertFromLdapGroupMapperToComponent(ldapGroupMapper))
+	_, location, err := keycloakClient.post(fmt.Sprintf("/realms/%s/components", ldapGroupMapper.RealmId), keycloakClient.convertFromLdapGroupMapperToComponent(ldapGroupMapper))
 	if err != nil {
 		return err
 	}
@@ -175,7 +182,7 @@ func (keycloakClient *KeycloakClient) GetLdapGroupMapper(realmId, id string) (*L
 }
 
 func (keycloakClient *KeycloakClient) UpdateLdapGroupMapper(ldapGroupMapper *LdapGroupMapper) error {
-	return keycloakClient.put(fmt.Sprintf("/realms/%s/components/%s", ldapGroupMapper.RealmId, ldapGroupMapper.Id), convertFromLdapGroupMapperToComponent(ldapGroupMapper))
+	return keycloakClient.put(fmt.Sprintf("/realms/%s/components/%s", ldapGroupMapper.RealmId, ldapGroupMapper.Id), keycloakClient.convertFromLdapGroupMapperToComponent(ldapGroupMapper))
 }
 
 func (keycloakClient *KeycloakClient) DeleteLdapGroupMapper(realmId, id string) error {

keycloak/util.go

@@ -2,6 +2,7 @@ package keycloak
 
 import (
 	"bytes"
+	"github.com/hashicorp/go-version"
 	"strconv"
 	"strings"
 	"time"
@@ -74,3 +75,12 @@ func parseBoolAndTreatEmptyStringAsFalse(b string) (bool, error) {
 
 	return strconv.ParseBool(b)
 }
+
+func KeycloakVersionIsGreaterThanOrEqualTo(keycloakClient *KeycloakClient, keycloakVersion string) bool {
+	v, err := version.NewVersion(keycloakVersion)
+	if err != nil {
+		// This should never happen
+		panic(err)
+	}
+	return keycloakClient.ServerVersion().GreaterThanOrEqual(v)
+}

provider/provider.go

@@ -142,6 +142,10 @@ func KeycloakProvider() *schema.Provider {
 				Description: "Allows ignoring insecure certificates when set to true. Defaults to false. Disabling security check is dangerous and should be avoided.",
 				Default:     false,
 			},
+			"keycloak_version": {
+				Optional: true,
+				Type:     schema.TypeString,
+			},
 			"base_path": {
 				Optional: true,
 				Type:     schema.TypeString,
@@ -177,7 +181,8 @@ func configureKeycloakProvider(data *schema.ResourceData, userAgent string) (int
 	initialLogin := data.Get("initial_login").(bool)
 	clientTimeout := data.Get("client_timeout").(int)
 	tlsInsecureSkipVerify := data.Get("tls_insecure_skip_verify").(bool)
+	keycloakVersion := data.Get("keycloak_version").(string)
 	rootCaCertificate := data.Get("root_ca_certificate").(string)
 
-	return keycloak.NewKeycloakClient(url, basePath, clientId, clientSecret, realm, username, password, initialLogin, clientTimeout, rootCaCertificate, tlsInsecureSkipVerify, userAgent)
+	return keycloak.NewKeycloakClient(url, basePath, clientId, clientSecret, realm, username, password, initialLogin, clientTimeout, rootCaCertificate, tlsInsecureSkipVerify, keycloakVersion, userAgent)
 }

provider/provider_test.go

@@ -26,7 +26,7 @@ func init() {
 		"keycloak": testAccProvider,
 	}
 
-	keycloakClient, _ = keycloak.NewKeycloakClient(os.Getenv("KEYCLOAK_URL"), "/auth", os.Getenv("KEYCLOAK_CLIENT_ID"), os.Getenv("KEYCLOAK_CLIENT_SECRET"), os.Getenv("KEYCLOAK_REALM"), "", "", true, 5, "", false, httpclient.TerraformUserAgent(testAccProvider.TerraformVersion))
+	keycloakClient, _ = keycloak.NewKeycloakClient(os.Getenv("KEYCLOAK_URL"), "/auth", os.Getenv("KEYCLOAK_CLIENT_ID"), os.Getenv("KEYCLOAK_CLIENT_SECRET"), os.Getenv("KEYCLOAK_REALM"), "", "", true, 5, "", false, "", httpclient.TerraformUserAgent(testAccProvider.TerraformVersion))
 }
 
 func TestProvider(t *testing.T) {

provider/resource_keycloak_ldap_group_mapper.go

@@ -111,6 +111,11 @@ func resourceKeycloakLdapGroupMapper() *schema.Resource {
 				Optional: true,
 				Default:  false,
 			},
+			"ldap_groups_path": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Default:  "/",
+			},
 		},
 	}
 }
@@ -148,10 +153,11 @@ func getLdapGroupMapperFromData(data *schema.ResourceData) *keycloak.LdapGroupMa
 		MemberofLdapAttribute:           data.Get("memberof_ldap_attribute").(string),
 		MappedGroupAttributes:           mappedGroupAttributes,
 		DropNonExistingGroupsDuringSync: data.Get("drop_non_existing_groups_during_sync").(bool),
+		LdapGroupsPath:                  data.Get("ldap_groups_path").(string),
 	}
 }
 
-func setLdapGroupMapperData(data *schema.ResourceData, ldapGroupMapper *keycloak.LdapGroupMapper) {
+func setLdapGroupMapperData(keycloakClient *keycloak.KeycloakClient, data *schema.ResourceData, ldapGroupMapper *keycloak.LdapGroupMapper) {
 	data.SetId(ldapGroupMapper.Id)
 
 	data.Set("name", ldapGroupMapper.Name)
@@ -172,6 +178,11 @@ func setLdapGroupMapperData(data *schema.ResourceData, ldapGroupMapper *keycloak
 	data.Set("memberof_ldap_attribute", ldapGroupMapper.MemberofLdapAttribute)
 	data.Set("mapped_group_attributes", ldapGroupMapper.MappedGroupAttributes)
 	data.Set("drop_non_existing_groups_during_sync", ldapGroupMapper.DropNonExistingGroupsDuringSync)
+	if keycloak.KeycloakVersionIsGreaterThanOrEqualTo(keycloakClient, "11.0.0") {
+		data.Set("ldap_groups_path", ldapGroupMapper.LdapGroupsPath)
+	} else {
+		data.Set("ldap_groups_path", "/")
+	}
 }
 
 func resourceKeycloakLdapGroupMapperCreate(data *schema.ResourceData, meta interface{}) error {
@@ -189,7 +200,7 @@ func resourceKeycloakLdapGroupMapperCreate(data *schema.ResourceData, meta inter
 		return err
 	}
 
-	setLdapGroupMapperData(data, ldapGroupMapper)
+	setLdapGroupMapperData(keycloakClient, data, ldapGroupMapper)
 
 	return resourceKeycloakLdapGroupMapperRead(data, meta)
 }
@@ -205,7 +216,7 @@ func resourceKeycloakLdapGroupMapperRead(data *schema.ResourceData, meta interfa
 		return handleNotFoundError(err, data)
 	}
 
-	setLdapGroupMapperData(data, ldapGroupMapper)
+	setLdapGroupMapperData(keycloakClient, data, ldapGroupMapper)
 
 	return nil
 }
@@ -225,7 +236,7 @@ func resourceKeycloakLdapGroupMapperUpdate(data *schema.ResourceData, meta inter
 		return err
 	}
 
-	setLdapGroupMapperData(data, ldapGroupMapper)
+	setLdapGroupMapperData(keycloakClient, data, ldapGroupMapper)
 
 	return nil
 }

provider/resource_keycloak_openid_client_optional_scopes_test.go

@@ -13,10 +13,7 @@ import (
 
 // All openid clients in Keycloak will automatically have these scopes listed as "optional client scopes".
 func getPreAssignedOptionalClientScopes(t *testing.T) []string {
-	keycloakVersionIsGreaterThanOrEqualTo6, err := keycloakVersionIsGreaterThanOrEqualTo(keycloakClient, getKeycloakVersion600())
-	if err != nil {
-		t.Fatal(err)
-	}
+	keycloakVersionIsGreaterThanOrEqualTo6 := keycloak.KeycloakVersionIsGreaterThanOrEqualTo(keycloakClient, "6.0.0")
 	if keycloakVersionIsGreaterThanOrEqualTo6 {
 		return []string{"address", "phone", "offline_access", "microprofile-jwt"}
 	} else {
@@ -409,7 +406,7 @@ func testAccCheckKeycloakOpenidClientOptionalScopeIsNotAttached(resourceName, cl
 }
 
 func testKeycloakOpenidClientOptionalScopes_basic(realm, client, clientScope string) string {
-	keycloakVersionIsHigherOrEqualTo6, _ := keycloakVersionIsGreaterThanOrEqualTo(keycloakClient, getKeycloakVersion600())
+	keycloakVersionIsHigherOrEqualTo6 := keycloak.KeycloakVersionIsGreaterThanOrEqualTo(keycloakClient, "6.0.0")
 	if keycloakVersionIsHigherOrEqualTo6 {
 		return fmt.Sprintf(`
 resource "keycloak_realm" "realm" {
@@ -525,7 +522,7 @@ resource "keycloak_openid_client_optional_scopes" "optional_scopes" {
 }
 
 func testKeycloakOpenidClientOptionalScopes_validationNoClient(realm, client, clientScope string) string {
-	keycloakVersionIsHigherOrEqualTo6, _ := keycloakVersionIsGreaterThanOrEqualTo(keycloakClient, getKeycloakVersion600())
+	keycloakVersionIsHigherOrEqualTo6 := keycloak.KeycloakVersionIsGreaterThanOrEqualTo(keycloakClient, "6.0.0")
 	if keycloakVersionIsHigherOrEqualTo6 {
 		return fmt.Sprintf(`
 resource "keycloak_realm" "realm" {
@@ -580,7 +577,7 @@ resource "keycloak_openid_client_optional_scopes" "optional_scopes" {
 
 func testKeycloakOpenidClientOptionalScopes_validationBearerOnlyClient(realm, client, clientScope string) string {
 
-	keycloakVersionIsHigherOrEqualTo6, _ := keycloakVersionIsGreaterThanOrEqualTo(keycloakClient, getKeycloakVersion600())
+	keycloakVersionIsHigherOrEqualTo6 := keycloak.KeycloakVersionIsGreaterThanOrEqualTo(keycloakClient, "6.0.0")
 	if keycloakVersionIsHigherOrEqualTo6 {
 		return fmt.Sprintf(`
 resource "keycloak_realm" "realm" {
@@ -689,7 +686,7 @@ resource "keycloak_openid_client_optional_scopes" "optional_scopes" {
 }
 
 func testKeycloakOpenidClientOptionalScopes_duplicateScopeAssignment(realm, client, clientScope string) string {
-	keycloakVersionIsHigherOrEqualTo6, _ := keycloakVersionIsGreaterThanOrEqualTo(keycloakClient, getKeycloakVersion600())
+	keycloakVersionIsHigherOrEqualTo6 := keycloak.KeycloakVersionIsGreaterThanOrEqualTo(keycloakClient, "6.0.0")
 	if keycloakVersionIsHigherOrEqualTo6 {
 		return fmt.Sprintf(`
 %s

provider/resource_keycloak_realm_events_test.go

@@ -165,10 +165,7 @@ func TestAccKeycloakRealmEvents_unsetEnabledEventTypes(t *testing.T) {
 							return err
 						}
 						keycloakClient := testAccProvider.Meta().(*keycloak.KeycloakClient)
-						keycloakVersionIsGreaterThanOrEqualTo7, err := keycloakVersionIsGreaterThanOrEqualTo(keycloakClient, getKeycloakVersion700())
-						if err != nil {
-							return err
-						}
+						keycloakVersionIsGreaterThanOrEqualTo7 := keycloak.KeycloakVersionIsGreaterThanOrEqualTo(keycloakClient, "7.0.0")
 
 						if keycloakVersionIsGreaterThanOrEqualTo7 { //keycloak versions < 7.0.0 have 63 events, versions >=7.0.0 have 67 events
 							if len(realmEventsConfig.EnabledEventTypes) != 67 {

provider/test_utils.go

@@ -2,11 +2,8 @@ package provider
 
 import (
 	"fmt"
-	"github.com/hashicorp/go-version"
-	"github.com/mrparkers/terraform-provider-keycloak/keycloak"
 	"math/rand"
 	"os"
-	"regexp"
 	"strings"
 	"testing"
 	"time"
@@ -78,48 +75,3 @@ func TestCheckResourceAttrNot(name, key, value string) resource.TestCheckFunc {
 		return nil
 	}
 }
-
-var keycloakServerInfoVersion *version.Version
-
-func keycloakVersionIsGreaterThanOrEqualTo(keycloakClient *keycloak.KeycloakClient, keycloakMajorVersion *version.Version) (bool, error) {
-	if keycloakServerInfoVersion == nil {
-		serverInfo, err := keycloakClient.GetServerInfo()
-		if err != nil {
-			return false, fmt.Errorf("/serverInfo endpoint retuned an error, server Keycloak version could not be determined: %s", err)
-		}
-
-		regex := regexp.MustCompile(`^(\d+\.\d+\.\d+)`)
-		semver := regex.FindStringSubmatch(serverInfo.SystemInfo.ServerVersion)[0]
-
-		keycloakServerInfoVersion, err = version.NewVersion(semver)
-		if err != nil {
-			return false, fmt.Errorf("/serverInfo endpoint retuned an unreadable version, server Keycloak version could not be determined: %s", err)
-		}
-	}
-	return keycloakServerInfoVersion.GreaterThanOrEqual(keycloakMajorVersion), nil
-}
-
-func getKeycloakVersion600() *version.Version {
-	v, _ := version.NewVersion("6.0.0")
-	return v
-}
-
-func getKeycloakVersion700() *version.Version {
-	v, _ := version.NewVersion("7.0.0")
-	return v
-}
-
-func getKeycloakVersion800() *version.Version {
-	v, _ := version.NewVersion("8.0.0")
-	return v
-}
-
-func getKeycloakVersion900() *version.Version {
-	v, _ := version.NewVersion("9.0.0")
-	return v
-}
-
-func getKeycloakVersion1000() *version.Version {
-	v, _ := version.NewVersion("10.0.0")
-	return v
-}