Adds user attributes, client auth resources, service account roles (#104

)

example/main.tf

@@ -444,3 +444,80 @@ resource keycloak_hardcoded_attribute_identity_provider_mapper saml {
   attribute_value         = "value"
   user_session            = false
 }
+
+data "keycloak_openid_client" "broker" {
+  realm_id  = "${keycloak_realm.test.id}"
+  client_id = "broker"
+}
+
+data "keycloak_openid_client_authorization_policy" "default" {
+  realm_id           = "${keycloak_realm.test.id}"
+  resource_server_id = "${keycloak_openid_client.test_client_auth.resource_server_id}"
+  name               = "default"
+}
+
+resource "keycloak_openid_client" "test_client_auth" {
+  client_id   = "test-client-auth"
+  name        = "test-client-auth"
+  realm_id    = "${keycloak_realm.test.id}"
+  description = "a test openid client"
+
+  access_type                  = "CONFIDENTIAL"
+  direct_access_grants_enabled = true
+  implicit_flow_enabled        = true
+  service_accounts_enabled     = true
+
+  valid_redirect_uris = [
+    "http://localhost:5555/callback",
+  ]
+
+  authorization {
+    policy_enforcement_mode = "ENFORCING"
+  }
+
+  client_secret = "secret"
+}
+
+resource "keycloak_openid_client_authorization_permission" "resource" {
+  resource_server_id = "${keycloak_openid_client.test_client_auth.resource_server_id}"
+  realm_id           = "${keycloak_realm.test.id}"
+  name               = "test"
+  policies           = ["${data.keycloak_openid_client_authorization_policy.default.id}"]
+  resources          = ["${keycloak_openid_client_authorization_resource.resource.id}"]
+}
+
+resource "keycloak_openid_client_authorization_resource" "resource" {
+  resource_server_id = "${keycloak_openid_client.test_client_auth.resource_server_id}"
+  name               = "test-openid-client1"
+  realm_id           = "${keycloak_realm.test.id}"
+
+  uris = [
+    "/endpoint/*"
+  ]
+
+  attributes = {
+    "asdads" = "asdasd"
+  }
+}
+
+resource "keycloak_openid_client_authorization_scope" "resource" {
+  resource_server_id = "${keycloak_openid_client.test_client_auth.resource_server_id}"
+  name               = "test-openid-client1"
+  realm_id           = "${keycloak_realm.test.id}"
+}
+
+resource "keycloak_user" "resource" {
+  realm_id = "${keycloak_realm.test.id}"
+  username = "test"
+
+  attributes = {
+    "key" = "value"
+  }
+}
+
+resource "keycloak_openid_client_service_account_role" "read_token" {
+  realm_id                = "${keycloak_realm.test.id}"
+  client_id               = "${data.keycloak_openid_client.broker.id}"
+  service_account_user_id = "${keycloak_openid_client.test_client_auth.service_account_user_id}"
+  role                    = "read-token"
+}

keycloak/custom_user_federation.go

@@ -85,7 +85,7 @@ func (keycloakClient *KeycloakClient) ValidateCustomUserFederation(custom *Custo
 }
 
 func (keycloakClient *KeycloakClient) NewCustomUserFederation(customUserFederation *CustomUserFederation) error {
-	location, err := keycloakClient.post(fmt.Sprintf("/realms/%s/components", customUserFederation.RealmId), convertFromCustomUserFederationToComponent(customUserFederation))
+	_, location, err := keycloakClient.post(fmt.Sprintf("/realms/%s/components", customUserFederation.RealmId), convertFromCustomUserFederationToComponent(customUserFederation))
 	if err != nil {
 		return err
 	}
@@ -98,7 +98,7 @@ func (keycloakClient *KeycloakClient) NewCustomUserFederation(customUserFederati
 func (keycloakClient *KeycloakClient) GetCustomUserFederation(realmId, id string) (*CustomUserFederation, error) {
 	var component *component
 
-	err := keycloakClient.get(fmt.Sprintf("/realms/%s/components/%s", realmId, id), &component)
+	err := keycloakClient.get(fmt.Sprintf("/realms/%s/components/%s", realmId, id), &component, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -111,5 +111,5 @@ func (keycloakClient *KeycloakClient) UpdateCustomUserFederation(customUserFeder
 }
 
 func (keycloakClient *KeycloakClient) DeleteCustomUserFederation(realmId, id string) error {
-	return keycloakClient.delete(fmt.Sprintf("/realms/%s/components/%s", realmId, id))
+	return keycloakClient.delete(fmt.Sprintf("/realms/%s/components/%s", realmId, id), nil)
 }

keycloak/generic_client.go

@@ -16,7 +16,7 @@ type GenericClient struct {
 func (keycloakClient *KeycloakClient) listGenericClients(realmId string) ([]*GenericClient, error) {
 	var clients []*GenericClient
 
-	err := keycloakClient.get(fmt.Sprintf("/realms/%s/clients", realmId), &clients)
+	err := keycloakClient.get(fmt.Sprintf("/realms/%s/clients", realmId), &clients, nil)
 	if err != nil {
 		return nil, err
 	}

keycloak/group.go

@@ -2,7 +2,6 @@ package keycloak
 
 import (
 	"fmt"
-	"net/url"
 	"strings"
 )
 
@@ -79,7 +78,7 @@ func (keycloakClient *KeycloakClient) NewGroup(group *Group) error {
 		createGroupUrl = fmt.Sprintf("/realms/%s/groups/%s/children", group.RealmId, group.ParentId)
 	}
 
-	location, err := keycloakClient.post(createGroupUrl, group)
+	_, location, err := keycloakClient.post(createGroupUrl, group)
 	if err != nil {
 		return err
 	}
@@ -92,7 +91,7 @@ func (keycloakClient *KeycloakClient) NewGroup(group *Group) error {
 func (keycloakClient *KeycloakClient) GetGroup(realmId, id string) (*Group, error) {
 	var group Group
 
-	err := keycloakClient.get(fmt.Sprintf("/realms/%s/groups/%s", realmId, id), &group)
+	err := keycloakClient.get(fmt.Sprintf("/realms/%s/groups/%s", realmId, id), &group, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -114,13 +113,17 @@ func (keycloakClient *KeycloakClient) UpdateGroup(group *Group) error {
 }
 
 func (keycloakClient *KeycloakClient) DeleteGroup(realmId, id string) error {
-	return keycloakClient.delete(fmt.Sprintf("/realms/%s/groups/%s", realmId, id))
+	return keycloakClient.delete(fmt.Sprintf("/realms/%s/groups/%s", realmId, id), nil)
 }
 
 func (keycloakClient *KeycloakClient) ListGroupsWithName(realmId, name string) ([]*Group, error) {
 	var groups []*Group
 
-	err := keycloakClient.get(fmt.Sprintf("/realms/%s/groups?search=%s", realmId, url.QueryEscape(name)), &groups)
+	params := map[string]string{
+		"search": name,
+	}
+
+	err := keycloakClient.get(fmt.Sprintf("/realms/%s/groups", realmId), &groups, params)
 	if err != nil {
 		return nil, err
 	}
@@ -131,7 +134,7 @@ func (keycloakClient *KeycloakClient) ListGroupsWithName(realmId, name string) (
 func (keycloakClient *KeycloakClient) GetGroupMembers(realmId, groupId string) ([]*User, error) {
 	var users []*User
 
-	err := keycloakClient.get(fmt.Sprintf("/realms/%s/groups/%s/members", realmId, groupId), &users)
+	err := keycloakClient.get(fmt.Sprintf("/realms/%s/groups/%s/members", realmId, groupId), &users, nil)
 	if err != nil {
 		return nil, err
 	}

keycloak/identity_provider.go

@@ -53,7 +53,7 @@ type IdentityProvider struct {
 
 func (keycloakClient *KeycloakClient) NewIdentityProvider(identityProvider *IdentityProvider) error {
 	log.Printf("[WARN] Realm: %s", identityProvider.Realm)
-	_, err := keycloakClient.post(fmt.Sprintf("/realms/%s/identity-provider/instances", identityProvider.Realm), identityProvider)
+	_, _, err := keycloakClient.post(fmt.Sprintf("/realms/%s/identity-provider/instances", identityProvider.Realm), identityProvider)
 	if err != nil {
 		return err
 	}
@@ -65,7 +65,7 @@ func (keycloakClient *KeycloakClient) GetIdentityProvider(realm, alias string) (
 	var identityProvider IdentityProvider
 	identityProvider.Realm = realm
 
-	err := keycloakClient.get(fmt.Sprintf("/realms/%s/identity-provider/instances/%s", realm, alias), &identityProvider)
+	err := keycloakClient.get(fmt.Sprintf("/realms/%s/identity-provider/instances/%s", realm, alias), &identityProvider, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -78,5 +78,5 @@ func (keycloakClient *KeycloakClient) UpdateIdentityProvider(identityProvider *I
 }
 
 func (keycloakClient *KeycloakClient) DeleteIdentityProvider(realm, alias string) error {
-	return keycloakClient.delete(fmt.Sprintf("/realms/%s/identity-provider/instances/%s", realm, alias))
+	return keycloakClient.delete(fmt.Sprintf("/realms/%s/identity-provider/instances/%s", realm, alias), nil)
 }

keycloak/identity_provider_mapper.go

@@ -29,7 +29,7 @@ type IdentityProviderMapper struct {
 
 func (keycloakClient *KeycloakClient) NewIdentityProviderMapper(identityProviderMapper *IdentityProviderMapper) error {
 	log.Printf("[WARN] Realm: %s", identityProviderMapper.Realm)
-	location, err := keycloakClient.post(fmt.Sprintf("/realms/%s/identity-provider/instances/%s/mappers", identityProviderMapper.Realm, identityProviderMapper.IdentityProviderAlias), identityProviderMapper)
+	_, location, err := keycloakClient.post(fmt.Sprintf("/realms/%s/identity-provider/instances/%s/mappers", identityProviderMapper.Realm, identityProviderMapper.IdentityProviderAlias), identityProviderMapper)
 	if err != nil {
 		return err
 	}
@@ -44,7 +44,7 @@ func (keycloakClient *KeycloakClient) GetIdentityProviderMapper(realm, alias, id
 	identityProviderMapper.Realm = realm
 	identityProviderMapper.IdentityProviderAlias = alias
 
-	err := keycloakClient.get(fmt.Sprintf("/realms/%s/identity-provider/instances/%s/mappers/%s", realm, alias, id), &identityProviderMapper)
+	err := keycloakClient.get(fmt.Sprintf("/realms/%s/identity-provider/instances/%s/mappers/%s", realm, alias, id), &identityProviderMapper, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -57,5 +57,5 @@ func (keycloakClient *KeycloakClient) UpdateIdentityProviderMapper(identityProvi
 }
 
 func (keycloakClient *KeycloakClient) DeleteIdentityProviderMapper(realm, alias, id string) error {
-	return keycloakClient.delete(fmt.Sprintf("/realms/%s/identity-provider/instances/%s/mappers/%s", realm, alias, id))
+	return keycloakClient.delete(fmt.Sprintf("/realms/%s/identity-provider/instances/%s/mappers/%s", realm, alias, id), nil)
 }

keycloak/keycloak_client.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
+	"io"
 	"io/ioutil"
 	"log"
 	"net/http"
@@ -166,7 +167,7 @@ func (keycloakClient *KeycloakClient) addRequestHeaders(request *http.Request) {
 	request.Header.Set("Authorization", fmt.Sprintf("%s %s", tokenType, accessToken))
 	request.Header.Set("Accept", "application/json")
 
-	if request.Method == http.MethodPost || request.Method == http.MethodPut {
+	if request.Method == http.MethodPost || request.Method == http.MethodPut || request.Method == http.MethodDelete {
 		request.Header.Set("Content-type", "application/json")
 	}
 }
@@ -247,14 +248,22 @@ func (keycloakClient *KeycloakClient) sendRequest(request *http.Request) ([]byte
 	return body, response.Header.Get("Location"), nil
 }
 
-func (keycloakClient *KeycloakClient) get(path string, resource interface{}) error {
+func (keycloakClient *KeycloakClient) get(path string, resource interface{}, params map[string]string) error {
 	resourceUrl := keycloakClient.baseUrl + apiUrl + path
 
 	request, err := http.NewRequest(http.MethodGet, resourceUrl, nil)
 	if err != nil {
 		return err
 	}
 
+	if params != nil {
+		query := url.Values{}
+		for k, v := range params {
+			query.Add(k, v)
+		}
+		request.URL.RawQuery = query.Encode()
+	}
+
 	body, _, err := keycloakClient.sendRequest(request)
 	if err != nil {
 		return err
@@ -263,22 +272,22 @@ func (keycloakClient *KeycloakClient) get(path string, resource interface{}) err
 	return json.Unmarshal(body, resource)
 }
 
-func (keycloakClient *KeycloakClient) post(path string, requestBody interface{}) (string, error) {
+func (keycloakClient *KeycloakClient) post(path string, requestBody interface{}) ([]byte, string, error) {
 	resourceUrl := keycloakClient.baseUrl + apiUrl + path
 
 	payload, err := json.Marshal(requestBody)
 	if err != nil {
-		return "", err
+		return nil, "", err
 	}
 
 	request, err := http.NewRequest(http.MethodPost, resourceUrl, bytes.NewReader(payload))
 	if err != nil {
-		return "", err
+		return nil, "", err
 	}
 
-	_, location, err := keycloakClient.sendRequest(request)
+	body, location, err := keycloakClient.sendRequest(request)
 
-	return location, err
+	return body, location, err
 }
 
 func (keycloakClient *KeycloakClient) put(path string, requestBody interface{}) error {
@@ -299,10 +308,20 @@ func (keycloakClient *KeycloakClient) put(path string, requestBody interface{})
 	return err
 }
 
-func (keycloakClient *KeycloakClient) delete(path string) error {
+func (keycloakClient *KeycloakClient) delete(path string, requestBody interface{}) error {
 	resourceUrl := keycloakClient.baseUrl + apiUrl + path
 
-	request, err := http.NewRequest(http.MethodDelete, resourceUrl, nil)
+	var body io.Reader
+
+	if requestBody != nil {
+		payload, err := json.Marshal(requestBody)
+		if err != nil {
+			return err
+		}
+		body = bytes.NewReader(payload)
+	}
+
+	request, err := http.NewRequest(http.MethodDelete, resourceUrl, body)
 	if err != nil {
 		return err
 	}

keycloak/ldap_full_name_mapper.go

@@ -82,7 +82,7 @@ func (keycloakClient *KeycloakClient) ValidateLdapFullNameMapper(mapper *LdapFul
 }
 
 func (keycloakClient *KeycloakClient) NewLdapFullNameMapper(ldapFullNameMapper *LdapFullNameMapper) error {
-	location, err := keycloakClient.post(fmt.Sprintf("/realms/%s/components", ldapFullNameMapper.RealmId), convertFromLdapFullNameMapperToComponent(ldapFullNameMapper))
+	_, location, err := keycloakClient.post(fmt.Sprintf("/realms/%s/components", ldapFullNameMapper.RealmId), convertFromLdapFullNameMapperToComponent(ldapFullNameMapper))
 	if err != nil {
 		return err
 	}
@@ -95,7 +95,7 @@ func (keycloakClient *KeycloakClient) NewLdapFullNameMapper(ldapFullNameMapper *
 func (keycloakClient *KeycloakClient) GetLdapFullNameMapper(realmId, id string) (*LdapFullNameMapper, error) {
 	var component *component
 
-	err := keycloakClient.get(fmt.Sprintf("/realms/%s/components/%s", realmId, id), &component)
+	err := keycloakClient.get(fmt.Sprintf("/realms/%s/components/%s", realmId, id), &component, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -108,5 +108,5 @@ func (keycloakClient *KeycloakClient) UpdateLdapFullNameMapper(ldapFullNameMappe
 }
 
 func (keycloakClient *KeycloakClient) DeleteLdapFullNameMapper(realmId, id string) error {
-	return keycloakClient.delete(fmt.Sprintf("/realms/%s/components/%s", realmId, id))
+	return keycloakClient.delete(fmt.Sprintf("/realms/%s/components/%s", realmId, id), nil)
 }

keycloak/ldap_group_mapper.go

@@ -153,7 +153,7 @@ func (keycloakClient *KeycloakClient) ValidateLdapGroupMapper(ldapGroupMapper *L
 }
 
 func (keycloakClient *KeycloakClient) NewLdapGroupMapper(ldapGroupMapper *LdapGroupMapper) error {
-	location, err := keycloakClient.post(fmt.Sprintf("/realms/%s/components", ldapGroupMapper.RealmId), convertFromLdapGroupMapperToComponent(ldapGroupMapper))
+	_, location, err := keycloakClient.post(fmt.Sprintf("/realms/%s/components", ldapGroupMapper.RealmId), convertFromLdapGroupMapperToComponent(ldapGroupMapper))
 	if err != nil {
 		return err
 	}
@@ -166,7 +166,7 @@ func (keycloakClient *KeycloakClient) NewLdapGroupMapper(ldapGroupMapper *LdapGr
 func (keycloakClient *KeycloakClient) GetLdapGroupMapper(realmId, id string) (*LdapGroupMapper, error) {
 	var component *component
 
-	err := keycloakClient.get(fmt.Sprintf("/realms/%s/components/%s", realmId, id), &component)
+	err := keycloakClient.get(fmt.Sprintf("/realms/%s/components/%s", realmId, id), &component, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -179,5 +179,5 @@ func (keycloakClient *KeycloakClient) UpdateLdapGroupMapper(ldapGroupMapper *Lda
 }
 
 func (keycloakClient *KeycloakClient) DeleteLdapGroupMapper(realmId, id string) error {
-	return keycloakClient.delete(fmt.Sprintf("/realms/%s/components/%s", realmId, id))
+	return keycloakClient.delete(fmt.Sprintf("/realms/%s/components/%s", realmId, id), nil)
 }

keycloak/ldap_msad_user_account_control_mapper.go

@@ -46,7 +46,7 @@ func convertFromComponentToLdapMsadUserAccountControlMapper(component *component
 }
 
 func (keycloakClient *KeycloakClient) NewLdapMsadUserAccountControlMapper(ldapMsadUserAccountControlMapper *LdapMsadUserAccountControlMapper) error {
-	location, err := keycloakClient.post(fmt.Sprintf("/realms/%s/components", ldapMsadUserAccountControlMapper.RealmId), convertFromLdapMsadUserAccountControlMapperToComponent(ldapMsadUserAccountControlMapper))
+	_, location, err := keycloakClient.post(fmt.Sprintf("/realms/%s/components", ldapMsadUserAccountControlMapper.RealmId), convertFromLdapMsadUserAccountControlMapperToComponent(ldapMsadUserAccountControlMapper))
 	if err != nil {
 		return err
 	}
@@ -59,7 +59,7 @@ func (keycloakClient *KeycloakClient) NewLdapMsadUserAccountControlMapper(ldapMs
 func (keycloakClient *KeycloakClient) GetLdapMsadUserAccountControlMapper(realmId, id string) (*LdapMsadUserAccountControlMapper, error) {
 	var component *component
 
-	err := keycloakClient.get(fmt.Sprintf("/realms/%s/components/%s", realmId, id), &component)
+	err := keycloakClient.get(fmt.Sprintf("/realms/%s/components/%s", realmId, id), &component, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -72,5 +72,5 @@ func (keycloakClient *KeycloakClient) UpdateLdapMsadUserAccountControlMapper(lda
 }
 
 func (keycloakClient *KeycloakClient) DeleteLdapMsadUserAccountControlMapper(realmId, id string) error {
-	return keycloakClient.delete(fmt.Sprintf("/realms/%s/components/%s", realmId, id))
+	return keycloakClient.delete(fmt.Sprintf("/realms/%s/components/%s", realmId, id), nil)
 }