WIP: Add client scope mapping of roles between clients

example/roles.tf

@@ -96,6 +96,13 @@ resource "keycloak_openid_hardcoded_role_protocol_mapper" "pet_app_pet_api_read_
  role_id = "${keycloak_role.pet_api_read_pet.id}"
 }
 
+// Map a role from the "pet_api" api client to the "pet_app" consumer client
+resource "keycloak_generic_client_role_mapper" "pet_app_pet_api_read_role_mapping" {
+ realm_id = "${keycloak_realm.roles_example.id}"
+ client_id = "${keycloak_openid_client.pet_app.id}"
+ role_id = "${keycloak_role.pet_api_read_pet.id}"
+}
+
 // Users and groups
 
 resource "keycloak_group" "pet_api_base" {

keycloak/generic_client.go

@@ -28,6 +28,19 @@ func (keycloakClient *KeycloakClient) listGenericClients(realmId string) ([]*Gen
  return clients, nil
 }
 
+func (keycloakClient *KeycloakClient) GetGenericClient(realmId, id string) (*GenericClient, error) {
+ var client GenericClient
+
+ err := keycloakClient.get(fmt.Sprintf("/realms/%s/clients/%s", realmId, id), &client, nil)
+ if err != nil {
+ return nil, err
+ }
+
+ client.RealmId = realmId
+
+ return &client, nil
+}
+
 func (keycloakClient *KeycloakClient) GetGenericClientByClientId(realmId, clientId string) (*GenericClient, error) {
  var clients []GenericClient
 

keycloak/role_scope_mapping.go

@@ -0,0 +1,43 @@
+package keycloak
+
+import (
+ "fmt"
+)
+
+func roleScopeMappingUrl(realmId, clientId string, role *Role) string {
+ return fmt.Sprintf("/realms/%s/clients/%s/scope-mappings/clients/%s", realmId, clientId, role.ClientId)
+}
+
+func (keycloakClient *KeycloakClient) CreateRoleScopeMapping(realmId string, clientId string, role *Role) error {
+ roleUrl := roleScopeMappingUrl(realmId, clientId, role)
+
+ _, _, err := keycloakClient.post(roleUrl, []Role{*role})
+ if err != nil {
+ return err
+ }
+
+ return nil
+}
+
+func (keycloakClient *KeycloakClient) GetRoleScopeMapping(realmId string, clientId string, role *Role) (*Role, error) {
+ roleUrl := roleScopeMappingUrl(realmId, clientId, role)
+ var roles []Role
+
+ err := keycloakClient.get(roleUrl, &roles, nil)
+ if err != nil {
+ return nil, err
+ }
+
+ for _, mappedRole := range roles {
+ if mappedRole.Id == role.Id {
+ return role, nil
+ }
+ }
+
+ return nil, nil
+}
+
+func (keycloakClient *KeycloakClient) DeleteRoleScopeMapping(realmId string, clientId string, role *Role) error {
+ roleUrl := roleScopeMappingUrl(realmId, clientId, role)
+ return keycloakClient.delete(roleUrl, nil)
+}

provider/provider.go

@@ -47,6 +47,7 @@ func KeycloakProvider() *schema.Provider {
  "keycloak_openid_client_optional_scopes": resourceKeycloakOpenidClientOptionalScopes(),
  "keycloak_saml_client": resourceKeycloakSamlClient(),
  "keycloak_generic_client_protocol_mapper": resourceKeycloakGenericClientProtocolMapper(),
+ "keycloak_generic_client_role_mapper": resourceKeycloakGenericClientRoleMapper(),
  "keycloak_saml_user_attribute_protocol_mapper": resourceKeycloakSamlUserAttributeProtocolMapper(),
  "keycloak_saml_user_property_protocol_mapper": resourceKeycloakSamlUserPropertyProtocolMapper(),
  "keycloak_hardcoded_attribute_identity_provider_mapper": resourceKeycloakHardcodedAttributeIdentityProviderMapper(),

provider/resource_keycloak_generic_client_role_mapper.go

@@ -0,0 +1,92 @@
+package provider
+
+import (
+ "fmt"
+
+ "github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+ "github.com/mrparkers/terraform-provider-keycloak/keycloak"
+)
+
+func resourceKeycloakGenericClientRoleMapper() *schema.Resource {
+ return &schema.Resource{
+ Create: resourceKeycloakGenericClientRoleMapperCreate,
+ Read: resourceKeycloakGenericClientRoleMapperRead,
+ Delete: resourceKeycloakGenericClientRoleMapperDelete,
+
+ Schema: map[string]*schema.Schema{
+ "realm_id": {
+ Type: schema.TypeString,
+ Required: true,
+ ForceNew: true,
+ },
+ "client_id": {
+ Type: schema.TypeString,
+ Required: true,
+ ForceNew: true,
+ },
+ "role_id": {
+ Type: schema.TypeString,
+ Required: true,
+ ForceNew: true,
+ },
+ },
+ }
+}
+
+func resourceKeycloakGenericClientRoleMapperCreate(data *schema.ResourceData, meta interface{}) error {
+ keycloakClient := meta.(*keycloak.KeycloakClient)
+
+ realmId := data.Get("realm_id").(string)
+ clientId := data.Get("client_id").(string)
+ roleId := data.Get("role_id").(string)
+
+ role, err := keycloakClient.GetRole(realmId, roleId)
+ if err != nil {
+ return err
+ }
+
+ err = keycloakClient.CreateRoleScopeMapping(realmId, clientId, role)
+ if err != nil {
+ return err
+ }
+
+ data.SetId(fmt.Sprintf("%s/client/%s/scope-mappings/%s/%s", realmId, clientId, role.ClientId, role.Id))
+
+ return resourceKeycloakGenericClientRoleMapperRead(data, meta)
+}
+
+func resourceKeycloakGenericClientRoleMapperRead(data *schema.ResourceData, meta interface{}) error {
+ keycloakClient := meta.(*keycloak.KeycloakClient)
+
+ realmId := data.Get("realm_id").(string)
+ clientId := data.Get("client_id").(string)
+ roleId := data.Get("role_id").(string)
+
+ role, err := keycloakClient.GetRole(realmId, roleId)
+ if err != nil {
+ return err
+ }
+
+ mappedRole, err := keycloakClient.GetRoleScopeMapping(realmId, clientId, role)
+
+ if mappedRole == nil {
+ data.SetId("")
+ }
+
+ return nil
+}
+
+func resourceKeycloakGenericClientRoleMapperDelete(data *schema.ResourceData, meta interface{}) error {
+ keycloakClient := meta.(*keycloak.KeycloakClient)
+
+ realmId := data.Get("realm_id").(string)
+ clientId := data.Get("client_id").(string)
+ roleId := data.Get("role_id").(string)
+
+ role, err := keycloakClient.GetRole(realmId, roleId)
+ if err != nil {
+ return err
+ }
+
+ return keycloakClient.DeleteRoleScopeMapping(realmId, clientId, role)
+}

provider/resource_keycloak_generic_client_role_mapper_test.go

@@ -0,0 +1,142 @@
+package provider
+
+import (
+ "fmt"
+ "github.com/hashicorp/terraform-plugin-sdk/helper/acctest"
+ "github.com/hashicorp/terraform-plugin-sdk/helper/resource"
+ "github.com/hashicorp/terraform-plugin-sdk/terraform"
+ "github.com/mrparkers/terraform-provider-keycloak/keycloak"
+ "testing"
+)
+
+func TestGenericRoleMapper_basic(t *testing.T) {
+ realmName := "terraform-" + acctest.RandString(10)
+ parentClientName := "client1-" + acctest.RandString(10)
+ parentRoleName := "role-" + acctest.RandString(10)
+ childClientName := "client2-" + acctest.RandString(10)
+
+ resource.Test(t, resource.TestCase{
+ Providers: testAccProviders,
+ PreCheck: func() { testAccPreCheck(t) },
+ Steps: []resource.TestStep{
+ {
+ Config: testKeycloakGenericRoleMapping_basic(realmName, parentClientName, parentRoleName, childClientName),
+ Check: testAccCheckKeycloakScopeMappingExists("keycloak_generic_client_role_mapper.child-client-with-parent-client-role"),
+ },
+ },
+ })
+}
+
+func TestGenericRoleMapper_createAfterManualDestroy(t *testing.T) {
+ var role = &keycloak.Role{}
+ var childClient = &keycloak.GenericClient{}
+
+ realmName := "terraform-" + acctest.RandString(10)
+ parentClientName := "client1-" + acctest.RandString(10)
+ parentRoleName := "role-" + acctest.RandString(10)
+ childClientName := "client2-" + acctest.RandString(10)
+
+ resource.Test(t, resource.TestCase{
+ Providers: testAccProviders,
+ PreCheck: func() { testAccPreCheck(t) },
+ Steps: []resource.TestStep{
+ {
+ Config: testKeycloakGenericRoleMapping_basic(realmName, parentClientName, parentRoleName, childClientName),
+ Check: resource.ComposeTestCheckFunc(
+ testAccCheckKeycloakScopeMappingExists("keycloak_generic_client_role_mapper.child-client-with-parent-client-role"),
+ testAccCheckKeycloakRoleFetch("keycloak_role.parent-role", role),
+ testAccCheckKeycloakGenericClientFetch("keycloak_openid_client.child-client", childClient),
+ ),
+ },
+ {
+ PreConfig: func() {
+ keycloakClient := testAccProvider.Meta().(*keycloak.KeycloakClient)
+
+ err := keycloakClient.DeleteRoleScopeMapping(childClient.RealmId, childClient.Id, role)
+ if err != nil {
+ t.Fatal(err)
+ }
+ },
+ Config: testKeycloakGenericRoleMapping_basic(realmName, parentClientName, parentRoleName, childClientName),
+ Check: testAccCheckKeycloakScopeMappingExists("keycloak_generic_client_role_mapper.child-client-with-parent-client-role"),
+ },
+ },
+ })
+}
+
+func testKeycloakGenericRoleMapping_basic(realmName, parentClientName, parentRoleName, childClientName string) string {
+ return fmt.Sprintf(`
+resource "keycloak_realm" "realm" {
+ realm = "%s"
+}
+
+resource "keycloak_openid_client" "parent-client" {
+ realm_id = "${keycloak_realm.realm.id}"
+ client_id = "%s"
+ access_type = "PUBLIC"
+}
+
+resource "keycloak_role" "parent-role" {
+ realm_id = "${keycloak_realm.realm.id}"
+ client_id = "${keycloak_openid_client.parent-client.id}"
+ name = "%s"
+}
+
+resource "keycloak_openid_client" "child-client" {
+ realm_id = "${keycloak_realm.realm.id}"
+ client_id = "%s"
+ access_type = "PUBLIC"
+}
+
+resource "keycloak_generic_client_role_mapper" "child-client-with-parent-client-role" {
+ realm_id = "${keycloak_realm.realm.id}"
+ client_id = "${keycloak_openid_client.child-client.id}"
+ role_id = "${keycloak_role.parent-role.id}"
+}
+ `, realmName, parentClientName, parentRoleName, childClientName)
+}
+
+func testAccCheckKeycloakScopeMappingExists(resourceName string) resource.TestCheckFunc {
+ return func(s *terraform.State) error {
+ _, ok := s.RootModule().Resources[resourceName]
+ if !ok {
+ return fmt.Errorf("resource not found: %s", resourceName)
+ }
+
+ return nil
+ }
+}
+
+func testAccCheckKeycloakGenericClientFetch(resourceName string, client *keycloak.GenericClient) resource.TestCheckFunc {
+ return func(s *terraform.State) error {
+ fetchedClient, err := getGenericClientFromState(s, resourceName)
+ if err != nil {
+ return err
+ }
+
+ client.Id = fetchedClient.Id
+ client.ClientId = fetchedClient.ClientId
+ client.RealmId = fetchedClient.RealmId
+
+ return nil
+ }
+}
+
+func getGenericClientFromState(s *terraform.State, resourceName string) (*keycloak.GenericClient, error) {
+ keycloakClient := testAccProvider.Meta().(*keycloak.KeycloakClient)
+
+ rs, ok := s.RootModule().Resources[resourceName]
+ if !ok {
+ return nil, fmt.Errorf("resource not found: %s", resourceName)
+ }
+
+ id := rs.Primary.ID
+ realm := rs.Primary.Attributes["realm_id"]
+
+ client, err := keycloakClient.GetGenericClient(realm, id)
+ if err != nil {
+ return nil, fmt.Errorf("error getting generic client %s: %s", id, err)
+ }
+
+ return client, nil
+}

provider/resource_keycloak_role_test.go

@@ -308,6 +308,7 @@ func testAccCheckKeycloakRoleFetch(resourceName string, role *keycloak.Role) res
  role.Id = fetchedRole.Id
  role.Name = fetchedRole.Name
  role.RealmId = fetchedRole.RealmId
+ role.ClientId = fetchedRole.ClientId
 
  return nil
  }