Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for project user_on_demand_period attribute #76

Merged
merged 4 commits into from
Sep 15, 2022
Merged

Add support for project user_on_demand_period attribute #76

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a41afd8
Add support for project user_on_demand_period attribute
stevenelleman-okta Sep 13, 2022
e712987
Add docs
stevenelleman-okta Sep 13, 2022
405466b
Fix test
stevenelleman-okta Sep 14, 2022
b7981af
Add attribute to project data source and corresponding docs
stevenelleman-okta Sep 14, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/data-sources/project.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,5 +33,6 @@ Returns a previously created ASA Project. For details, [Projects](https://help.o
- `ssh_certificate_type` (String) The SSH certificate type used by access requests. Options include: [`CERT_TYPE_ED25519_01`, `CERT_TYPE_ECDSA_521_01`, `CERT_TYPE_ECDSA_384_01`, `CERT_TYPE_ECDSA_256_01`, `CERT_TYPE_RSA_01`]. 'CERT_TYPE_RSA_01' is a deprecated key algorithm type. This option should only be used to connect to legacy systems that cannot use newer SSH versions. If you do need to use 'CERT_TYPE_RSA_01', it is recommended to connect via a gateway with traffic forwarding. Otherwise, please use a more current key algorithm. If left unspecified, 'CERT_TYPE_ED25519_01' is used by default.
- `ssh_session_recording` (Boolean) If `true`, enables ssh recording on server access requests.
- `team` (String) The human-readable name of the ASA Team that owns the resource. Values are lower-case.
- `user_on_demand_period` (Number) If defined, set time period in seconds that an on-demand user account exists on the server following an access request.


1 change: 1 addition & 0 deletions docs/resources/project.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ An ASA construct that contains servers and is used to grant end users access to
- `require_preauth_for_creds` (Boolean) If `true`, require preauthorization before an ASA User can retrieve credentials to sign in.
- `ssh_certificate_type` (String) The SSH certificate type used by access requests. Options include: [`CERT_TYPE_ED25519_01`, `CERT_TYPE_ECDSA_521_01`, `CERT_TYPE_ECDSA_384_01`, `CERT_TYPE_ECDSA_256_01`, `CERT_TYPE_RSA_01`]. 'CERT_TYPE_RSA_01' is a deprecated key algorithm type. This option should only be used to connect to legacy systems that cannot use newer SSH versions. If you do need to use 'CERT_TYPE_RSA_01', it is recommended to connect via a gateway with traffic forwarding. Otherwise, please use a more current key algorithm. If left unspecified, 'CERT_TYPE_ED25519_01' is used by default.
- `ssh_session_recording` (Boolean) If `true`, enables ssh recording on server access requests.
- `user_on_demand_period` (Number) If defined, set time period in seconds that an on-demand user account exists on the server following an access request.

### Read-Only

Expand Down
4 changes: 4 additions & 0 deletions oktapam/client/project.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ type Project struct {
SSHSessionRecording *bool `json:"ssh_session_recording,omitempty"`
GatewaySelector *string `json:"gateway_selector,omitempty"`
SSHCertificateType *string `json:"ssh_certificate_type,omitempty"`
UserOnDemandPeriod *int `json:"user_on_demand_period,omitempty"`
}

func (p Project) ToResourceMap() map[string]interface{} {
Expand Down Expand Up @@ -73,6 +74,9 @@ func (p Project) ToResourceMap() map[string]interface{} {
if p.SSHCertificateType != nil {
m[attributes.SSHCertificateType] = *p.SSHCertificateType
}
if p.UserOnDemandPeriod != nil {
m[attributes.UserOnDemandPeriod] = *p.UserOnDemandPeriod
}

return m
}
Expand Down
3 changes: 2 additions & 1 deletion oktapam/constants/attributes/attributes.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ const (
OrganizationalUnit = "organizational_unit"
OSAttribute = "os_attribute"
ProjectGroups = "project_groups"
ProjectID = "project_id"
ProjectID = "project_id"
ProjectName = "project_name"
ProjectNames = "project_names"
Projects = "projects"
Expand Down Expand Up @@ -106,6 +106,7 @@ const (
TTLDays = "ttl_days"
Type = "type"
UsePasswordless = "use_passwordless"
UserOnDemandPeriod = "user_on_demand_period"
Users = "users"
UserType = "user_type"
Value = "value"
Expand Down
1 change: 1 addition & 0 deletions oktapam/constants/descriptions/attributes.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,5 +84,6 @@ var (
TeamName = "The human-readable name of the ASA Team that owns the resource. Values are lower-case."
Token = "The secret used for resource enrollment."
UsePasswordless = "if `true`, Users will not need password to login."
UserOnDemandPeriod = "If defined, set time period in seconds that an on-demand user account exists on the server following an access request."
UserType = "The user type. Valid types are 'human' and 'service'."
)
5 changes: 5 additions & 0 deletions oktapam/data_source_project.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,11 @@ func dataSourceProject() *schema.Resource {
Computed: true,
Description: descriptions.SSHCertificateType,
},
attributes.UserOnDemandPeriod: {
Type: schema.TypeInt,
Computed: true,
Description: descriptions.UserOnDemandPeriod,
},
},
}
}
Expand Down
7 changes: 7 additions & 0 deletions oktapam/resource_project.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,11 @@ func resourceProject() *schema.Resource {
Optional: true,
Description: descriptions.GatewaySelector,
},
attributes.UserOnDemandPeriod: {
Type: schema.TypeInt,
Optional: true,
Description: descriptions.UserOnDemandPeriod,
},
attributes.SSHCertificateType: {
Type: schema.TypeString,
Optional: true,
Expand Down Expand Up @@ -147,6 +152,7 @@ func resourceProjectCreate(ctx context.Context, d *schema.ResourceData, m interf
SSHSessionRecording: getBoolPtr(attributes.SSHSessionRecording, d, false),
GatewaySelector: getStringPtr(attributes.GatewaySelector, d, false),
SSHCertificateType: getStringPtr(attributes.SSHCertificateType, d, false),
UserOnDemandPeriod: getIntPtr(attributes.UserOnDemandPeriod, d, false),
Copy link
Contributor

@sachinsaxena-okta sachinsaxena-okta Sep 14, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is UserOnDemandPeriod only need to be passed if create_server_users flag is set to true - slack link. I am not sure on this.

Copy link
Contributor Author

@stevenelleman-okta stevenelleman-okta Sep 15, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe they're independent. Looking throughout the code UserOnDemandPeriod and CreateServerUser are applied separately.

}

err := c.CreateProject(ctx, project)
Expand Down Expand Up @@ -230,6 +236,7 @@ func resourceProjectUpdate(ctx context.Context, d *schema.ResourceData, m interf
attributes.RequirePreauthForCreds,
attributes.SSHSessionRecording,
attributes.GatewaySelector,
attributes.UserOnDemandPeriod,
}

for _, attribute := range changeableAttributes {
Expand Down
18 changes: 14 additions & 4 deletions oktapam/resource_project_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ func TestAccProject(t *testing.T) {
RDPSessionRecording: utils.AsBoolPtrZero(false, true),
SSHSessionRecording: utils.AsBoolPtrZero(false, true),
SSHCertificateType: utils.AsStringPtr("CERT_TYPE_ED25519_01"),
UserOnDemandPeriod: utils.AsIntPtr(1),
}
updatedProject := client.Project{
Name: &projectName,
Expand All @@ -39,6 +40,7 @@ func TestAccProject(t *testing.T) {
SSHSessionRecording: utils.AsBoolPtrZero(true, true),
GatewaySelector: utils.AsStringPtr("env=test"),
SSHCertificateType: utils.AsStringPtr("CERT_TYPE_ED25519_01"),
UserOnDemandPeriod: utils.AsIntPtr(10),
}
resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Expand All @@ -61,6 +63,9 @@ func TestAccProject(t *testing.T) {
resource.TestCheckResourceAttr(
resourceName, attributes.SSHCertificateType, "CERT_TYPE_ED25519_01",
),
resource.TestCheckResourceAttr(
resourceName, attributes.UserOnDemandPeriod, "1",
),
),
},
{
Expand All @@ -79,6 +84,9 @@ func TestAccProject(t *testing.T) {
resource.TestCheckResourceAttr(
resourceName, attributes.SSHCertificateType, "CERT_TYPE_ED25519_01",
),
resource.TestCheckResourceAttr(
resourceName, attributes.UserOnDemandPeriod, "10",
),
),
},
{
Expand Down Expand Up @@ -139,10 +147,11 @@ func testAccProjectCheckDestroy(projectName string) resource.TestCheckFunc {

const testAccProjectCreateConfigFormat = `
resource "oktapam_project" "test_project" {
name = "%s"
next_unix_uid = 60120
next_unix_gid = 63020
ssh_certificate_type = "CERT_TYPE_ED25519_01"
name = "%s"
next_unix_uid = 60120
next_unix_gid = 63020
ssh_certificate_type = "CERT_TYPE_ED25519_01"
user_on_demand_period = 1
}`

func createTestAccProjectCreateConfig(projectName string) string {
Expand All @@ -160,6 +169,7 @@ resource "oktapam_project" "test_project" {
ssh_session_recording = true
gateway_selector = "env=test"
ssh_certificate_type = "CERT_TYPE_ED25519_01"
user_on_demand_period = 10
}`

func createTestAccProjectUpdateConfig(projectName string) string {
Expand Down