Add keycloak generic client role mapper importer

docs/resources/keycloak_generic_client_role_mapper.md

@@ -7,7 +7,7 @@ the token or assertion. When `full_scope_allowed` is set to `false` for a
 client, role scope mapping allows you to limit the roles that get declared
 inside an access token for a client.
 
-### Example Usage (Realm role)
+### Example Usage (Realm Role to Client)
 
 ```hcl
 resource "keycloak_realm" "realm" {
@@ -38,8 +38,7 @@ resource "keycloak_generic_client_role_mapper" "client_role_mapper" {
 }
 ```
 
-### Example Usage (Client role)
-
+### Example Usage (Client Role to Client)
 
 ```hcl
 resource "keycloak_realm" "realm" {
@@ -88,11 +87,75 @@ resource "keycloak_generic_client_role_mapper" "client_b_role_mapper" {
 }
 ```
 
+### Example Usage (Realm Role to Client Scope)
+
+```hcl
+resource "keycloak_realm" "realm" {
+ realm = "my-realm"
+ enabled = true
+}
+
+resource "keycloak_openid_client_scope" "client_scope" {
+ realm_id = keycloak_realm.realm.id
+ name = "my-client-scope"
+}
+
+resource "keycloak_role" "realm_role" {
+ realm_id = keycloak_realm.realm.id
+ name = "my-realm-role"
+ description = "My Realm Role"
+}
+
+resource "keycloak_generic_client_role_mapper" "client_role_mapper" {
+ realm_id = keycloak_realm.realm.id
+ client_scope_id = keycloak_openid_client_scope.client_scope.id
+ role_id = keycloak_role.realm_role.id
+}
+```
+
+### Example Usage (Client Role to Client Scope)
+
+```hcl
+resource "keycloak_realm" "realm" {
+ realm = "my-realm"
+ enabled = true
+}
+
+resource "keycloak_openid_client" "client" {
+ realm_id = keycloak_realm.realm.id
+ client_id = "client"
+ name = "client"
+
+ enabled = true
+
+ access_type = "BEARER-ONLY"
+}
+
+resource "keycloak_role" "client_role" {
+ realm_id = keycloak_realm.realm.id
+ client_id = keycloak_openid_client.client.id
+ name = "my-client-role"
+ description = "My Client Role"
+}
+
+resource "keycloak_openid_client_scope" "client_scope" {
+ realm_id = keycloak_realm.realm.id
+ name = "my-client-scope"
+}
+
+resource "keycloak_generic_client_role_mapper" "client_b_role_mapper" {
+ realm_id = keycloak_realm.realm.id
+ client_scope_id = keycloak_client_scope.client_scope.id
+ role_id = keycloak_role.client_role.id
+}
+```
+
 ### Argument Reference
 
 The following arugments are supported:
 
 - `realm_id` - (Required) The realm this role mapper exists within
-- `client_id` - (Required) The ID of the client this role mapper is created for
+- `client_id` - (Optional) The ID of the client this role mapper is added to
+- `client_scope_id` - (Optional) The ID of the client scope this role mapper is added to
 - `role_id` - (Required) The ID of the role to be added to this role mapper
 

provider/resource_keycloak_generic_client_role_mapper.go

@@ -2,6 +2,7 @@ package provider
 
 import (
  "fmt"
+ "strings"
 
  "github.com/hashicorp/terraform-plugin-sdk/helper/schema"
  "github.com/mrparkers/terraform-provider-keycloak/keycloak"
@@ -12,7 +13,9 @@ func resourceKeycloakGenericClientRoleMapper() *schema.Resource {
  Create: resourceKeycloakGenericClientRoleMapperCreate,
  Read: resourceKeycloakGenericClientRoleMapperRead,
  Delete: resourceKeycloakGenericClientRoleMapperDelete,
-
+ Importer: &schema.ResourceImporter{
+ State: resourceKeycloakGenericClientRoleMapperImport,
+ },
  Schema: map[string]*schema.Schema{
  "realm_id": {
  Type: schema.TypeString,
@@ -108,3 +111,27 @@ func resourceKeycloakGenericClientRoleMapperDelete(data *schema.ResourceData, me
 
  return keycloakClient.DeleteRoleScopeMapping(realmId, clientId, clientScopeId, role)
 }
+
+func resourceKeycloakGenericClientRoleMapperImport(d *schema.ResourceData, _ interface{}) ([]*schema.ResourceData, error) {
+ parts := strings.Split(d.Id(), "/")
+
+ if len(parts) != 6 {
+ return nil, fmt.Errorf("Invalid import. Supported import formats: {{realmId}}/client/{{clientId}}/scope-mappings/{{roleClientId}}/{{roleId}}, {{realmId}}/client-scope/{{clientScopeId}}/scope-mappings/{{roleClientId}}/{{roleId}}")
+ }
+
+ parentResourceType := parts[1]
+ parentResourceId := parts[2]
+
+ d.Set("realm_id", parts[0])
+
+ if parentResourceType == "client" {
+ d.Set("client_id", parentResourceId)
+ } else if parentResourceType == "client-scope" {
+ d.Set("client_scope_id", parentResourceId)
+ } else {
+ return nil, fmt.Errorf("the associated parent resource must be either a client or a client-scope")
+ }
+
+ d.Set("role_id", parts[5])
+ return []*schema.ResourceData{d}, nil
+}

provider/resource_keycloak_generic_client_role_mapper_test.go

@@ -2,11 +2,12 @@ package provider
 
 import (
  "fmt"
+ "testing"
+
  "github.com/hashicorp/terraform-plugin-sdk/helper/acctest"
  "github.com/hashicorp/terraform-plugin-sdk/helper/resource"
  "github.com/hashicorp/terraform-plugin-sdk/terraform"
  "github.com/mrparkers/terraform-provider-keycloak/keycloak"
- "testing"
 )
 
 func TestGenericRoleMapper_basic(t *testing.T) {
@@ -27,6 +28,32 @@ func TestGenericRoleMapper_basic(t *testing.T) {
  })
 }
 
+func TestGenericRoleMapper_import(t *testing.T) {
+ realmName := "terraform-" + acctest.RandString(10)
+ parentClientName := "client1-" + acctest.RandString(10)
+ parentRoleName := "role-" + acctest.RandString(10)
+ childClientName := "client2-" + acctest.RandString(10)
+
+ resourceName := "keycloak_generic_client_role_mapper.child-client-with-parent-client-role"
+
+ resource.Test(t, resource.TestCase{
+ Providers: testAccProviders,
+ PreCheck: func() { testAccPreCheck(t) },
+ Steps: []resource.TestStep{
+ {
+ Config: testKeycloakGenericRoleMapping_basic(realmName, parentClientName, parentRoleName, childClientName),
+ Check: testAccCheckKeycloakScopeMappingExists(resourceName),
+ },
+ {
+ ResourceName: resourceName,
+ ImportState: true,
+ ImportStateVerify: true,
+ ImportStateIdFunc: getGenericRoleMapperId(resourceName),
+ },
+ },
+ })
+}
+
 func TestGenericRoleMapperClientScope_basic(t *testing.T) {
  realmName := "terraform-" + acctest.RandString(10)
  clientName := "client-" + acctest.RandString(10)
@@ -45,6 +72,32 @@ func TestGenericRoleMapperClientScope_basic(t *testing.T) {
  })
 }
 
+func TestGenericRoleMapperClientScope_import(t *testing.T) {
+ realmName := "terraform-" + acctest.RandString(10)
+ clientName := "client-" + acctest.RandString(10)
+ roleName := "role-" + acctest.RandString(10)
+ clientScopeName := "clientscope-" + acctest.RandString(10)
+
+ resourceName := "keycloak_generic_client_role_mapper.clientscope-with-client-role"
+
+ resource.Test(t, resource.TestCase{
+ Providers: testAccProviders,
+ PreCheck: func() { testAccPreCheck(t) },
+ Steps: []resource.TestStep{
+ {
+ Config: testKeycloakGenericRoleMappingClientScope_basic(realmName, clientName, roleName, clientScopeName),
+ Check: testAccCheckKeycloakScopeMappingExists(resourceName),
+ },
+ {
+ ResourceName: resourceName,
+ ImportState: true,
+ ImportStateVerify: true,
+ ImportStateIdFunc: getGenericRoleMapperId(resourceName),
+ },
+ },
+ })
+}
+
 func TestGenericRoleMapper_createAfterManualDestroy(t *testing.T) {
  var role = &keycloak.Role{}
  var childClient = &keycloak.GenericClient{}
@@ -259,3 +312,14 @@ func getOpenidClientScopeFromState(s *terraform.State, resourceName string) (*ke
 
  return client, nil
 }
+
+func getGenericRoleMapperId(resourceName string) resource.ImportStateIdFunc {
+ return func(s *terraform.State) (string, error) {
+ rs, ok := s.RootModule().Resources[resourceName]
+ if !ok {
+ return "", fmt.Errorf("resource not found: %s", resourceName)
+ }
+
+ return rs.Primary.ID, nil
+ }
+}