Skip to content

Commit bd6ab22

Browse files
ShiChangkuoShiChangkuo
authored
feat: add support to identity provider resources (#671)
1 parent 37bf9d2 commit bd6ab22

23 files changed

Lines changed: 2000 additions & 0 deletions

‎docs/resources/identity_provider.md‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
---
2+
subcategory: "Identity and Access Management (IAM)"
3+
---
4+
5+
# flexibleengine_identity_provider
6+
7+
Manages the identity providers within FlexibleEngine IAM service.
8+
9+
-> **NOTE:** You can create up to 10 identity providers.
10+
11+
## Example Usage
12+
13+
### Create a SAML protocol provider
14+
15+
```hcl
16+
resource "flexibleengine_identity_provider" "provider_1" {
17+
name = "saml_idp_demo"
18+
protocol = "saml"
19+
}
20+
```
21+
22+
### Create a OpenID Connect protocol provider
23+
24+
```hcl
25+
resource "flexibleengine_identity_provider" "provider_2" {
26+
name = "oidc_idp_demo"
27+
protocol = "oidc"
28+
29+
openid_connect_config {
30+
access_type = "program_console"
31+
provider_url = "https://accounts.example.com"
32+
client_id = "your_client_id"
33+
authorization_endpoint = "https://accounts.example.com/o/oauth2/v2/auth"
34+
scopes = ["openid"]
35+
signing_key = jsonencode(
36+
{
37+
keys = [
38+
{
39+
alg = "RS256"
40+
e = "AQAB"
41+
kid = "..."
42+
kty = "RSA"
43+
n = "..."
44+
use = "sig"
45+
},
46+
]
47+
}
48+
)
49+
}
50+
}
51+
```
52+
53+
## Argument Reference
54+
55+
The following arguments are supported:
56+
57+
* `name` - (Required, String, ForceNew) Specifies the name of the identity provider to be registered.
58+
The maximum length is 64 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed.
59+
The name is unique, it is recommended to include domain name information.
60+
Changing this creates a new resource.
61+
62+
* `protocol` - (Required, String, ForceNew) Specifies the protocol of the identity provider.
63+
Valid values are *saml* and *oidc*.
64+
Changing this creates a new resource.
65+
66+
* `enabled` - (Optional, Bool) Specifies the status for the identity provider. Defaults to true.
67+
68+
* `description` - (Optional, String) Specifies the description of the identity provider.
69+
70+
* `metadata` - (Optional, String) Specifies the metadata of the IDP(Identity Provider) server.
71+
To obtain the metadata file of your enterprise IDP, contact the enterprise administrator.
72+
This field is used to import a metadata file to IAM to implement federated identity authentication.
73+
This field is required only if the protocol is set to *saml*.
74+
The maximum length is 30,000 characters and it stores in the state with SHA1 algorithm.
75+
76+
-> **NOTE:**
77+
The metadata file specifies API addresses and certificate information in compliance with the SAML 2.0 standard.
78+
It is usually stored in a file. In the TF script, you can import the metafile through the **file** function,
79+
for example:
80+
<br/>`metadata = file("/usr/local/data/files/metadata.txt")`
81+
82+
* `openid_connect_config` - (Optional, List) Specifies the description of the identity provider.
83+
This field is required only if the protocol is set to *oidc*.
84+
85+
The `openid_connect_config` block supports:
86+
87+
* `access_type` - (Required, String) Specifies the access type of the identity provider.
88+
Available options are:
89+
+ `program`: programmatic access only.
90+
+ `program_console`: programmatic access and management console access.
91+
92+
* `provider_url` - (Required, String) Specifies the URL of the identity provider.
93+
This field corresponds to the iss field in the ID token.
94+
95+
* `client_id` - (Required, String) Specifies the ID of a client registered with the OpenID Connect identity provider.
96+
97+
* `signing_key` - (Required, String) Public key used to sign the ID token of the OpenID Connect identity provider.
98+
This field is required only if the protocol is set to *oidc*.
99+
100+
* `authorization_endpoint` - (Optional, String) Specifies the authorization endpoint of the OpenID Connect identity
101+
provider. This field is required only if the access type is set to `program_console`.
102+
103+
* `scopes` - (Optional, List) Specifies the scopes of authorization requests. It is an array of one or more scopes.
104+
Valid values are *openid*, *email*, *profile* and other values defined by you.
105+
This field is required only if the access type is set to `program_console`.
106+
107+
* `response_type` - (Optional, String) Response type. Valid values is *id_token*, default value is *id_token*.
108+
This field is required only if the access type is set to `program_console`.
109+
110+
* `response_mode` - (Optional, String) Response mode.
111+
Valid values is *form_post* and *fragment*, default value is *form_post*.
112+
This field is required only if the access type is set to `program_console`.
113+
114+
## Attributes Reference
115+
116+
In addition to all arguments above, the following attributes are exported:
117+
118+
* `id` - The resource ID which equals to the name.
119+
120+
* `login_link` - The login link of the identity provider.
121+
122+
* `sso_type` - The single sign-on type of the identity provider.
123+
124+
* `conversion_rules` - The identity conversion rules of the identity provider.
125+
The [object](#conversion_rules) structure is documented below
126+
127+
<a name="conversion_rules"></a>
128+
The `conversion_rules` block supports:
129+
130+
* `local` - The federated user information on the cloud platform.
131+
132+
* `remote` - The description of the identity provider.
133+
134+
The `local` block supports:
135+
136+
* `username` - The name of a federated user on the cloud platform.
137+
138+
* `group` - The user group to which the federated user belongs on the cloud platform.
139+
140+
The `remote` block supports:
141+
142+
* `attribute` - The attribute in the IDP assertion.
143+
144+
* `condition` - The condition of conversion rule.
145+
146+
* `value` - The rule is matched only if the specified strings appear in the attribute type.
147+
148+
## Import
149+
150+
Identity provider can be imported using the `name`, e.g.
151+
152+
```
153+
$ terraform import flexibleengine_identity_provider.provider_1 example_com_provider_saml
154+
```

‎docs/resources/identity_provider_conversion.md‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
subcategory: "Identity and Access Management (IAM)"
3+
---
4+
5+
# flexibleengine_identity_provider_conversion
6+
7+
Manage the conversion rules of identity provider within FlexibleEngine IAM service.
8+
9+
## Example Usage
10+
11+
```hcl
12+
variable provider_id {}
13+
14+
resource "flexibleengine_identity_provider_conversion" "conversion" {
15+
provider_id = var.provider_id
16+
17+
conversion_rules {
18+
local {
19+
username = "Tom"
20+
}
21+
remote {
22+
attribute = "Tom"
23+
}
24+
}
25+
26+
conversion_rules {
27+
local {
28+
username = "FederationUser"
29+
}
30+
remote {
31+
attribute = "username"
32+
condition = "any_one_of"
33+
value = ["Tom", "Jerry"]
34+
}
35+
}
36+
}
37+
```
38+
39+
## Argument Reference
40+
41+
The following arguments are supported:
42+
43+
* `provider_id` - (Required, String) The ID or name of the identity provider used to manage the conversion rules.
44+
45+
* `conversion_rules` - (Required, List) Specifies the identity conversion rules of the identity provider.
46+
You can use identity conversion rules to map the identities of existing users to FlexibleEngine and manage their access
47+
to cloud resources.
48+
The [object](#conversion_rules) structure is documented below.
49+
50+
<a name="conversion_rules"></a>
51+
The `conversion_rules` block supports:
52+
53+
* `local` - (Required, List) Specifies the federated user information on the cloud platform.
54+
55+
* `remote` - (Required, List) Specifies Federated user information in the IDP system.
56+
57+
-> **NOTE:**
58+
If the protocol of identity provider is SAML, this field is an expression consisting of assertion
59+
attributes and operators.<br/>
60+
If the protocol of identity provider is OIDC, the value of this field is determined by the ID token.
61+
62+
The `local` block supports:
63+
64+
* `username` - (Required, String) Specifies the name of a federated user on the cloud platform.
65+
66+
* `group` - (Optional, String) Specifies the user group to which the federated user belongs on the cloud platform.
67+
68+
The `remote` block supports:
69+
70+
* `attribute` - (Required, String) Specifies the attribute in the IDP assertion.
71+
72+
* `condition` - (Optional, String) Specifies the condition of conversion rule.
73+
Available options are:
74+
+ `any_one_of`: The rule is matched only if the specified strings appear in the attribute type.
75+
+ `not_any_of`: The rule is matched only if the specified strings do not appear in the attribute type.
76+
77+
* `value` - (Optional, List) Specifies the rule is matched only if the specified strings appear in the attribute type.
78+
79+
## Attributes Reference
80+
81+
In addition to all arguments above, the following attributes are exported:
82+
83+
* `id` - The ID of conversion rules.
84+
85+
## Import
86+
87+
Identity provider conversion rules are imported using the `provider_id`, e.g.
88+
89+
```
90+
$ terraform import flexibleengine_identity_provider_conversion.conversion example_com_provider_oidc
91+
```

‎flexibleengine/provider.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -290,6 +290,8 @@ func Provider() *schema.Provider {
290290
"flexibleengine_identity_role_v3": resourceIdentityRoleV3(),
291291
"flexibleengine_identity_role_assignment_v3": resourceIdentityRoleAssignmentV3(),
292292
"flexibleengine_identity_user_v3": resourceIdentityUserV3(),
293+
"flexibleengine_identity_provider": resourceIdentityProvider(),
294+
"flexibleengine_identity_provider_conversion": resourceIAMProviderConversion(),
293295
"flexibleengine_lts_group": resourceLTSGroupV2(),
294296
"flexibleengine_lts_topic": resourceLTSTopicV2(),
295297
"flexibleengine_s3_bucket": resourceS3Bucket(),

0 commit comments

Comments
 (0)