Skip to content

Commit 709ab85

Browse files
omkark-googleomkark-google
committed
Add support for extra attributes oauth2 client
fields to create workforce pool operation. This address the gap between newly added support in Gcloud command of iam create workforce pool provider and iam update workforce pool provider. Fixes hashicorp/terraform-provider-google#20862 ``` iam: added `extra_attributes_oauth2_client` field to `google_iam_workforce_pool_provider` SAML resource ```
1 parent e2df63b commit 709ab85

File tree

2 files changed

+212
-10
lines changed

2 files changed

+212
-10
lines changed

‎mmv1/products/iamworkforcepool/WorkforcePoolProvider.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -388,7 +388,7 @@ properties:
388388
The configuration for OAuth 2.0 client used to get the additional user
389389
attributes. This should be used when users can't get the desired claims
390390
in authentication credentials. Currently this configuration is only
391-
supported with OIDC protocol.
391+
supported with SAML and OIDC protocol.
392392
properties:
393393
- name: 'issuerUri'
394394
type: String

‎mmv1/third_party/terraform/services/iamworkforcepool/resource_iam_workforce_pool_provider_test.go.tmpl

+211-9
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ func TestAccIAMWorkforcePoolWorkforcePoolProvider_saml(t *testing.T) {
120120
})
121121
}
122122

123-
func TestAccIAMWorkforcePoolWorkforcePoolProvider_extraAttributesOauth2Client(t *testing.T) {
123+
func TestAccIAMWorkforcePoolWorkforcePoolOidcProvider_extraAttributesOauth2Client(t *testing.T) {
124124
t.Parallel()
125125

126126
random_suffix := acctest.RandString(t, 10)
@@ -135,7 +135,7 @@ func TestAccIAMWorkforcePoolWorkforcePoolProvider_extraAttributesOauth2Client(t
135135
CheckDestroy: testAccCheckIAMWorkforcePoolWorkforcePoolDestroyProducer(t),
136136
Steps: []resource.TestStep{
137137
{
138-
Config: testAccIAMWorkforcePoolWorkforcePoolProvider_extraAttributesOauth2Client_full(context),
138+
Config: testAccIAMWorkforcePoolWorkforcePoolOidcProvider_extraAttributesOauth2Client_full(context),
139139
},
140140
{
141141
ResourceName: "google_iam_workforce_pool_provider.my_provider",
@@ -144,7 +144,7 @@ func TestAccIAMWorkforcePoolWorkforcePoolProvider_extraAttributesOauth2Client(t
144144
ImportStateVerifyIgnore: []string{"oidc.0.client_secret.0.value.0.plain_text", "extra_attributes_oauth2_client.0.client_secret.0.value.0.plain_text"},
145145
},
146146
{
147-
Config: testAccIAMWorkforcePoolWorkforcePoolProvider_extraAttributesOauth2Client_update(context),
147+
Config: testAccIAMWorkforcePoolWorkforcePoolOidcProvider_extraAttributesOauth2Client_update(context),
148148
},
149149
{
150150
ResourceName: "google_iam_workforce_pool_provider.my_provider",
@@ -153,7 +153,7 @@ func TestAccIAMWorkforcePoolWorkforcePoolProvider_extraAttributesOauth2Client(t
153153
ImportStateVerifyIgnore: []string{"oidc.0.client_secret.0.value.0.plain_text", "extra_attributes_oauth2_client.0.client_secret.0.value.0.plain_text"},
154154
},
155155
{
156-
Config: testAccIAMWorkforcePoolWorkforcePoolProvider_extraAttributesOauth2Client_update_clearConfig(context),
156+
Config: testAccIAMWorkforcePoolWorkforcePoolOidcProvider_extraAttributesOauth2Client_update_clearConfig(context),
157157
},
158158
{
159159
ResourceName: "google_iam_workforce_pool_provider.my_provider",
@@ -162,7 +162,7 @@ func TestAccIAMWorkforcePoolWorkforcePoolProvider_extraAttributesOauth2Client(t
162162
ImportStateVerifyIgnore: []string{"oidc.0.client_secret.0.value.0.plain_text"},
163163
},
164164
{
165-
Config: testAccIAMWorkforcePoolWorkforcePoolProvider_extraAttributesOauth2Client_basic(context),
165+
Config: testAccIAMWorkforcePoolWorkforcePoolOidcProvider_extraAttributesOauth2Client_basic(context),
166166
},
167167
{
168168
ResourceName: "google_iam_workforce_pool_provider.my_provider",
@@ -180,6 +180,67 @@ func TestAccIAMWorkforcePoolWorkforcePoolProvider_extraAttributesOauth2Client(t
180180
})
181181
}
182182

183+
184+
func TestAccIAMWorkforcePoolWorkforcePoolSamlProvider_extraAttributesOauth2Client(t *testing.T) {
185+
t.Parallel()
186+
187+
random_suffix := acctest.RandString(t, 10)
188+
context := map[string]interface{}{
189+
"org_id": envvar.GetTestOrgFromEnv(t),
190+
"random_suffix": random_suffix,
191+
}
192+
193+
acctest.VcrTest(t, resource.TestCase{
194+
PreCheck: func() { acctest.AccTestPreCheck(t) },
195+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
196+
CheckDestroy: testAccCheckIAMWorkforcePoolWorkforcePoolDestroyProducer(t),
197+
Steps: []resource.TestStep{
198+
{
199+
Config: testAccIAMWorkforcePoolWorkforcePoolSamlProvider_extraAttributesOauth2Client_full(context),
200+
},
201+
{
202+
ResourceName: "google_iam_workforce_pool_provider.my_provider",
203+
ImportState: true,
204+
ImportStateVerify: true,
205+
ImportStateVerifyIgnore: []string{"extra_attributes_oauth2_client.0.client_secret.0.value.0.plain_text"},
206+
},
207+
{
208+
Config: testAccIAMWorkforcePoolWorkforcePoolSamlProvider_extraAttributesOauth2Client_update(context),
209+
},
210+
{
211+
ResourceName: "google_iam_workforce_pool_provider.my_provider",
212+
ImportState: true,
213+
ImportStateVerify: true,
214+
ImportStateVerifyIgnore: []string{"extra_attributes_oauth2_client.0.client_secret.0.value.0.plain_text"},
215+
},
216+
{
217+
Config: testAccIAMWorkforcePoolWorkforcePoolSamlProvider_extraAttributesOauth2Client_update_clearConfig(context),
218+
},
219+
{
220+
ResourceName: "google_iam_workforce_pool_provider.my_provider",
221+
ImportState: true,
222+
ImportStateVerify: true,
223+
ImportStateVerifyIgnore: []string{"oidc.0.client_secret.0.value.0.plain_text"},
224+
},
225+
{
226+
Config: testAccIAMWorkforcePoolWorkforcePoolSamlProvider_extraAttributesOauth2Client_basic(context),
227+
},
228+
{
229+
ResourceName: "google_iam_workforce_pool_provider.my_provider",
230+
ImportState: true,
231+
ImportStateVerify: true,
232+
ImportStateVerifyIgnore: []string{"extra_attributes_oauth2_client.0.client_secret.0.value.0.plain_text"},
233+
},
234+
{
235+
Config: testAccIAMWorkforcePoolWorkforcePoolProvider_destroy(context),
236+
Check: resource.ComposeTestCheckFunc(
237+
testAccCheckIAMWorkforcePoolWorkforcePoolProviderAccess(t, random_suffix),
238+
),
239+
},
240+
},
241+
})
242+
}
243+
183244
func testAccCheckIAMWorkforcePoolWorkforcePoolProviderAccess(t *testing.T, random_suffix string) resource.TestCheckFunc {
184245
return func(s *terraform.State) error {
185246
pool_resource_name := "google_iam_workforce_pool.my_pool"
@@ -426,7 +487,7 @@ resource "google_iam_workforce_pool_provider" "my_provider" {
426487
}
427488

428489

429-
func testAccIAMWorkforcePoolWorkforcePoolProvider_extraAttributesOauth2Client_full(context map[string]interface{}) string {
490+
func testAccIAMWorkforcePoolWorkforcePoolOidcProvider_extraAttributesOauth2Client_full(context map[string]interface{}) string {
430491
return acctest.Nprintf(`
431492
resource "google_iam_workforce_pool" "my_pool" {
432493
workforce_pool_id = "my-pool-%{random_suffix}"
@@ -476,7 +537,7 @@ resource "google_iam_workforce_pool_provider" "my_provider" {
476537
`, context)
477538
}
478539

479-
func testAccIAMWorkforcePoolWorkforcePoolProvider_extraAttributesOauth2Client_update(context map[string]interface{}) string {
540+
func testAccIAMWorkforcePoolWorkforcePoolOidcProvider_extraAttributesOauth2Client_update(context map[string]interface{}) string {
480541
return acctest.Nprintf(`
481542
resource "google_iam_workforce_pool" "my_pool" {
482543
workforce_pool_id = "my-pool-%{random_suffix}"
@@ -526,7 +587,7 @@ resource "google_iam_workforce_pool_provider" "my_provider" {
526587
`, context)
527588
}
528589

529-
func testAccIAMWorkforcePoolWorkforcePoolProvider_extraAttributesOauth2Client_update_clearConfig(context map[string]interface{}) string {
590+
func testAccIAMWorkforcePoolWorkforcePoolOidcProvider_extraAttributesOauth2Client_update_clearConfig(context map[string]interface{}) string {
530591
return acctest.Nprintf(`
531592
resource "google_iam_workforce_pool" "my_pool" {
532593
workforce_pool_id = "my-pool-%{random_suffix}"
@@ -563,7 +624,7 @@ resource "google_iam_workforce_pool_provider" "my_provider" {
563624
`, context)
564625
}
565626

566-
func testAccIAMWorkforcePoolWorkforcePoolProvider_extraAttributesOauth2Client_basic(context map[string]interface{}) string {
627+
func testAccIAMWorkforcePoolWorkforcePoolOidcProvider_extraAttributesOauth2Client_basic(context map[string]interface{}) string {
567628
return acctest.Nprintf(`
568629
resource "google_iam_workforce_pool" "my_pool" {
569630
workforce_pool_id = "my-pool-%{random_suffix}"
@@ -610,6 +671,147 @@ resource "google_iam_workforce_pool_provider" "my_provider" {
610671
`, context)
611672
}
612673

674+
675+
func testAccIAMWorkforcePoolWorkforcePoolSamlProvider_extraAttributesOauth2Client_full(context map[string]interface{}) string {
676+
return acctest.Nprintf(`
677+
resource "google_iam_workforce_pool" "my_pool" {
678+
workforce_pool_id = "my-pool-%{random_suffix}"
679+
parent = "organizations/%{org_id}"
680+
location = "global"
681+
}
682+
683+
resource "google_iam_workforce_pool_provider" "my_provider" {
684+
workforce_pool_id = google_iam_workforce_pool.my_pool.workforce_pool_id
685+
location = google_iam_workforce_pool.my_pool.location
686+
provider_id = "my-provider-%{random_suffix}"
687+
attribute_mapping = {
688+
"google.subject" = "assertion.sub"
689+
}
690+
saml {
691+
idp_metadata_xml = "<?xml version=\"1.0\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"https://sts.windows.net/3c75f51a-5393-4b53-8efe-fa85c311e533/\"><md:IDPSSODescriptor protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"> <md:KeyDescriptor use=\"signing\"><ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\"><ds:X509Data><ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAX7/5qPhMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCmRldi00NTg0MjExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjIwMjE2MDAxOTEyWhcNMzIwMjE2MDAyMDEyWjCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDApkZXYtNDU4NDIxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxrBl7GKz52cRpxF9xCsirnRuMxnhFBaUrsHqAQrLqWmdlpNYZTVg+T9iQ+aq/iE68L+BRZcZniKIvW58wqqS0ltXVvIkXuDSvnvnkkI5yMIVErR20K8jSOKQm1FmK+fgAJ4koshFiu9oLiqu0Ejc0DuL3/XRsb4RuxjktKTb1khgBBtb+7idEk0sFR0RPefAweXImJkDHDm7SxjDwGJUubbqpdTxasPr0W+AHI1VUzsUsTiHAoyb0XDkYqHfDzhj/ZdIEl4zHQ3bEZvlD984ztAnmX2SuFLLKfXeAAGHei8MMixJvwxYkkPeYZ/5h8WgBZPP4heS2CPjwYExt29L8QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARjJFz++a9Z5IQGFzsZMrX2EDR5ML4xxUiQkbhld1S1PljOLcYFARDmUC2YYHOueU4ee8Jid9nPGEUebV/4Jok+b+oQh+dWMgiWjSLI7h5q4OYZ3VJtdlVwgMFt2iz+/4yBKMUZ50g3Qgg36vE34us+eKitg759JgCNsibxn0qtJgSPm0sgP2L6yTaLnoEUbXBRxCwynTSkp9ZijZqEzbhN0e2dWv7Rx/nfpohpDP6vEiFImKFHpDSv3M/5de1ytQzPFrZBYt9WlzlYwE1aD9FHCxdd+rWgYMVVoRaRmndpV/Rq3QUuDuFJtaoX11bC7ExkOpg9KstZzA63i3VcfYv</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"https://test.com/sso\"/></md:IDPSSODescriptor></md:EntityDescriptor>"
692+
}
693+
extra_attributes_oauth2_client {
694+
issuer_uri = "https://login.microsoftonline.com/3c75f51a-5393-4b53-8efe-fa85c311e533/v2.0/"
695+
client_id = "client-id"
696+
client_secret {
697+
value {
698+
plain_text = "client-secret"
699+
}
700+
}
701+
attributes_type = "AZURE_AD_GROUPS_MAIL"
702+
query_parameters {
703+
filter = "mail:gcp"
704+
}
705+
}
706+
display_name = "Display name"
707+
description = "A sample OIDC workforce pool provider."
708+
disabled = false
709+
attribute_condition = "true"
710+
}
711+
`, context)
712+
}
713+
714+
func testAccIAMWorkforcePoolWorkforcePoolSamlProvider_extraAttributesOauth2Client_update(context map[string]interface{}) string {
715+
return acctest.Nprintf(`
716+
resource "google_iam_workforce_pool" "my_pool" {
717+
workforce_pool_id = "my-pool-%{random_suffix}"
718+
parent = "organizations/%{org_id}"
719+
location = "global"
720+
}
721+
722+
resource "google_iam_workforce_pool_provider" "my_provider" {
723+
workforce_pool_id = google_iam_workforce_pool.my_pool.workforce_pool_id
724+
location = google_iam_workforce_pool.my_pool.location
725+
provider_id = "my-provider-%{random_suffix}"
726+
attribute_mapping = {
727+
"google.subject" = "false"
728+
}
729+
saml {
730+
idp_metadata_xml = "<?xml version=\"1.0\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"https://sts.windows.net/3c75f51a-5393-4b53-8efe-fa85c311e533/\"><md:IDPSSODescriptor protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"> <md:KeyDescriptor use=\"signing\"><ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\"><ds:X509Data><ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAX7/5qPhMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCmRldi00NTg0MjExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjIwMjE2MDAxOTEyWhcNMzIwMjE2MDAyMDEyWjCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDApkZXYtNDU4NDIxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxrBl7GKz52cRpxF9xCsirnRuMxnhFBaUrsHqAQrLqWmdlpNYZTVg+T9iQ+aq/iE68L+BRZcZniKIvW58wqqS0ltXVvIkXuDSvnvnkkI5yMIVErR20K8jSOKQm1FmK+fgAJ4koshFiu9oLiqu0Ejc0DuL3/XRsb4RuxjktKTb1khgBBtb+7idEk0sFR0RPefAweXImJkDHDm7SxjDwGJUubbqpdTxasPr0W+AHI1VUzsUsTiHAoyb0XDkYqHfDzhj/ZdIEl4zHQ3bEZvlD984ztAnmX2SuFLLKfXeAAGHei8MMixJvwxYkkPeYZ/5h8WgBZPP4heS2CPjwYExt29L8QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARjJFz++a9Z5IQGFzsZMrX2EDR5ML4xxUiQkbhld1S1PljOLcYFARDmUC2YYHOueU4ee8Jid9nPGEUebV/4Jok+b+oQh+dWMgiWjSLI7h5q4OYZ3VJtdlVwgMFt2iz+/4yBKMUZ50g3Qgg36vE34us+eKitg759JgCNsibxn0qtJgSPm0sgP2L6yTaLnoEUbXBRxCwynTSkp9ZijZqEzbhN0e2dWv7Rx/nfpohpDP6vEiFImKFHpDSv3M/5de1ytQzPFrZBYt9WlzlYwE1aD9FHCxdd+rWgYMVVoRaRmndpV/Rq3QUuDuFJtaoX11bC7ExkOpg9KstZzA63i3VcfYv</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"https://test.com/sso\"/></md:IDPSSODescriptor></md:EntityDescriptor>"
731+
}
732+
extra_attributes_oauth2_client {
733+
issuer_uri = "https://login.microsoftonline.com/3c75f51a-5393-4b53-8efe-fa85c311e533/v2.0/"
734+
client_id = "new-client-id"
735+
client_secret {
736+
value {
737+
plain_text = "new-client-secret"
738+
}
739+
}
740+
attributes_type = "AZURE_AD_GROUPS_MAIL"
741+
query_parameters {
742+
filter = "displayName:gcp"
743+
}
744+
}
745+
display_name = "New Display name"
746+
description = "A sample OIDC workforce pool provider with updated description."
747+
disabled = true
748+
attribute_condition = "false"
749+
}
750+
`, context)
751+
}
752+
753+
func testAccIAMWorkforcePoolWorkforcePoolSamlProvider_extraAttributesOauth2Client_update_clearConfig(context map[string]interface{}) string {
754+
return acctest.Nprintf(`
755+
resource "google_iam_workforce_pool" "my_pool" {
756+
workforce_pool_id = "my-pool-%{random_suffix}"
757+
parent = "organizations/%{org_id}"
758+
location = "global"
759+
}
760+
761+
resource "google_iam_workforce_pool_provider" "my_provider" {
762+
workforce_pool_id = google_iam_workforce_pool.my_pool.workforce_pool_id
763+
location = google_iam_workforce_pool.my_pool.location
764+
provider_id = "my-provider-%{random_suffix}"
765+
attribute_mapping = {
766+
"google.subject" = "false"
767+
}
768+
saml {
769+
idp_metadata_xml = "<?xml version=\"1.0\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"https://test.com\"><md:IDPSSODescriptor protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"> <md:KeyDescriptor use=\"signing\"><ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\"><ds:X509Data><ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAX7/5qPhMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCmRldi00NTg0MjExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjIwMjE2MDAxOTEyWhcNMzIwMjE2MDAyMDEyWjCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDApkZXYtNDU4NDIxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxrBl7GKz52cRpxF9xCsirnRuMxnhFBaUrsHqAQrLqWmdlpNYZTVg+T9iQ+aq/iE68L+BRZcZniKIvW58wqqS0ltXVvIkXuDSvnvnkkI5yMIVErR20K8jSOKQm1FmK+fgAJ4koshFiu9oLiqu0Ejc0DuL3/XRsb4RuxjktKTb1khgBBtb+7idEk0sFR0RPefAweXImJkDHDm7SxjDwGJUubbqpdTxasPr0W+AHI1VUzsUsTiHAoyb0XDkYqHfDzhj/ZdIEl4zHQ3bEZvlD984ztAnmX2SuFLLKfXeAAGHei8MMixJvwxYkkPeYZ/5h8WgBZPP4heS2CPjwYExt29L8QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARjJFz++a9Z5IQGFzsZMrX2EDR5ML4xxUiQkbhld1S1PljOLcYFARDmUC2YYHOueU4ee8Jid9nPGEUebV/4Jok+b+oQh+dWMgiWjSLI7h5q4OYZ3VJtdlVwgMFt2iz+/4yBKMUZ50g3Qgg36vE34us+eKitg759JgCNsibxn0qtJgSPm0sgP2L6yTaLnoEUbXBRxCwynTSkp9ZijZqEzbhN0e2dWv7Rx/nfpohpDP6vEiFImKFHpDSv3M/5de1ytQzPFrZBYt9WlzlYwE1aD9FHCxdd+rWgYMVVoRaRmndpV/Rq3QUuDuFJtaoX11bC7ExkOpg9KstZzA63i3VcfYv</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"https://test.com/sso\"/></md:IDPSSODescriptor></md:EntityDescriptor>"
770+
}
771+
display_name = "New Display name"
772+
description = "A sample OIDC workforce pool provider with updated description."
773+
disabled = true
774+
attribute_condition = "false"
775+
}
776+
`, context)
777+
}
778+
779+
func testAccIAMWorkforcePoolWorkforcePoolSamlProvider_extraAttributesOauth2Client_basic(context map[string]interface{}) string {
780+
return acctest.Nprintf(`
781+
resource "google_iam_workforce_pool" "my_pool" {
782+
workforce_pool_id = "my-pool-%{random_suffix}"
783+
parent = "organizations/%{org_id}"
784+
location = "global"
785+
}
786+
787+
resource "google_iam_workforce_pool_provider" "my_provider" {
788+
workforce_pool_id = google_iam_workforce_pool.my_pool.workforce_pool_id
789+
location = google_iam_workforce_pool.my_pool.location
790+
provider_id = "my-provider-%{random_suffix}"
791+
attribute_mapping = {
792+
"google.subject" = "false"
793+
}
794+
saml {
795+
idp_metadata_xml = "<?xml version=\"1.0\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"https://sts.windows.net/3c75f51a-5393-4b53-8efe-fa85c311e533/\"><md:IDPSSODescriptor protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\"> <md:KeyDescriptor use=\"signing\"><ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\"><ds:X509Data><ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAX7/5qPhMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCmRldi00NTg0MjExHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjIwMjE2MDAxOTEyWhcNMzIwMjE2MDAyMDEyWjCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDApkZXYtNDU4NDIxMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxrBl7GKz52cRpxF9xCsirnRuMxnhFBaUrsHqAQrLqWmdlpNYZTVg+T9iQ+aq/iE68L+BRZcZniKIvW58wqqS0ltXVvIkXuDSvnvnkkI5yMIVErR20K8jSOKQm1FmK+fgAJ4koshFiu9oLiqu0Ejc0DuL3/XRsb4RuxjktKTb1khgBBtb+7idEk0sFR0RPefAweXImJkDHDm7SxjDwGJUubbqpdTxasPr0W+AHI1VUzsUsTiHAoyb0XDkYqHfDzhj/ZdIEl4zHQ3bEZvlD984ztAnmX2SuFLLKfXeAAGHei8MMixJvwxYkkPeYZ/5h8WgBZPP4heS2CPjwYExt29L8QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARjJFz++a9Z5IQGFzsZMrX2EDR5ML4xxUiQkbhld1S1PljOLcYFARDmUC2YYHOueU4ee8Jid9nPGEUebV/4Jok+b+oQh+dWMgiWjSLI7h5q4OYZ3VJtdlVwgMFt2iz+/4yBKMUZ50g3Qgg36vE34us+eKitg759JgCNsibxn0qtJgSPm0sgP2L6yTaLnoEUbXBRxCwynTSkp9ZijZqEzbhN0e2dWv7Rx/nfpohpDP6vEiFImKFHpDSv3M/5de1ytQzPFrZBYt9WlzlYwE1aD9FHCxdd+rWgYMVVoRaRmndpV/Rq3QUuDuFJtaoX11bC7ExkOpg9KstZzA63i3VcfYv</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"https://test.com/sso\"/></md:IDPSSODescriptor></md:EntityDescriptor>"
796+
}
797+
extra_attributes_oauth2_client {
798+
issuer_uri = "https://login.microsoftonline.com/3c75f51a-5393-4b53-8efe-fa85c311e533/v2.0/"
799+
client_id = "client-id"
800+
client_secret {
801+
value {
802+
plain_text = "client-secret"
803+
}
804+
}
805+
attributes_type = "AZURE_AD_GROUPS_MAIL"
806+
}
807+
display_name = "New Display name"
808+
description = "A sample OIDC workforce pool provider with updated description."
809+
disabled = true
810+
attribute_condition = "false"
811+
}
812+
`, context)
813+
}
814+
613815
func testAccIAMWorkforcePoolWorkforcePoolProvider_destroy(context map[string]interface{}) string {
614816
return acctest.Nprintf(`
615817
resource "google_iam_workforce_pool" "my_pool" {

0 commit comments

Comments
 (0)