Merge main

Author: adrianburusdbt

.changes/unreleased/Behind the scenes-20260401-092850.yaml

@@ -0,0 +1,12 @@
+# [v1.10.0](https://github.com/dbt-labs/terraform-provider-dbtcloud/compare/v1.9.1...v1.10.0)
+### Changes
+* Write-only resources
+* Added auth provider resource
+* Added scim_config and scim_config_token resources
+* Added openai_integration resource
+* Added resource for azure-ad-application-resource
+### Fixes
+* Don't validate adapter_type if not provided
+### Behind the scenes
+* Cleanup dead code
+* Security patch

.changes/unreleased/Changes-20260403-094140.yaml

@@ -1,4 +1,7 @@
 .terraform
+*.tfstate
+*.tfstate.backup
+*.tfvars
 vendor/
 terraform-provider*
 .idea

.changes/unreleased/Fixes-20260331-083757.yaml

@@ -6,6 +6,19 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+# [v1.10.0](https://github.com/dbt-labs/terraform-provider-dbtcloud/compare/v1.9.1...v1.10.0)
+### Changes
+* Write-only resources
+* Added auth provider resource
+* Added scim_config and scim_config_token resources
+* Added openai_integration resource
+* Added resource for azure-ad-application-resource
+### Fixes
+* Don't validate adapter_type if not provided
+### Behind the scenes
+* Cleanup dead code
+* Security patch
+
 # [v1.9.1](https://github.com/dbt-labs/terraform-provider-dbtcloud/compare/v1.9.0...v1.9.1)
 ### Changes
 * Added execution project to bq sl resource

.changes/v1.10.0.md

@@ -0,0 +1,193 @@
+---
+page_title: "dbtcloud_auth_provider Resource - dbtcloud"
+subcategory: ""
+description: |-
+  Manages an SSO auth provider for a dbt Cloud account. Supports SAML/Okta, Azure Active Directory (single-tenant, multi-tenant), and Google Workspace.
+  Only one auth provider may exist per account. Requires the SSO feature enabled on the account (enterprise plans only).
+  See the documentation https://docs.getdbt.com/docs/cloud/manage-access/sso-overview for more information.
+---
+
+# dbtcloud_auth_provider (Resource)
+
+
+Manages an SSO auth provider for a dbt Cloud account. Supports SAML/Okta, Azure Active Directory (single-tenant, multi-tenant), and Google Workspace.
+
+Only one auth provider may exist per account. Requires the SSO feature enabled on the account (enterprise plans only).
+
+See the [documentation](https://docs.getdbt.com/docs/cloud/manage-access/sso-overview) for more information.
+
+## Example Usage
+
+```terraform
+// SAML — write-only cert (recommended, not stored in state)
+//
+// Requires Terraform >= 1.11 for write-only attribute support.
+// Bump cert_wo_version to rotate the cert without recreating the resource.
+
+variable "saml_cert" {
+  type      = string
+  ephemeral = true
+}
+
+resource "dbtcloud_auth_provider" "saml" {
+  type      = "saml"
+  entity_id = "https://your-idp.example.com/metadata"
+  sso_url   = "https://your-idp.example.com/sso/saml"
+
+  cert_wo         = var.saml_cert
+  cert_wo_version = 1
+}
+
+output "login_url" {
+  description = "SSO login URL to share with users."
+  value       = dbtcloud_auth_provider.saml.login_url
+}
+
+
+// SAML — all optional fields
+
+resource "dbtcloud_auth_provider" "saml_full" {
+  type      = "saml"
+  entity_id = "https://your-idp.example.com/metadata"
+  sso_url   = "https://your-idp.example.com/sso/saml"
+  cert      = file("idp-cert.pem")
+
+  sign_request  = true
+  attribute_map = jsonencode({
+    email      = "nameID"
+    first_name = "firstName"
+    last_name  = "lastName"
+  })
+
+  allow_password_backdoor = false
+}
+
+
+// Okta (identical to SAML, different type value)
+
+resource "dbtcloud_auth_provider" "okta" {
+  type      = "okta"
+  entity_id = "http://www.okta.com/<okta_app_id>"
+  sso_url   = "https://<your-org>.okta.com/app/<app_path>/sso/saml"
+
+  cert_wo         = var.saml_cert
+  cert_wo_version = 1
+}
+
+
+// Azure AD — single tenant
+
+variable "azure_client_secret" {
+  type      = string
+  ephemeral = true
+}
+
+resource "dbtcloud_auth_provider" "azure_single_tenant" {
+  type      = "azure_single_tenant"
+  client_id = "00000000-0000-0000-0000-000000000000"
+  tenant_id = "11111111-1111-1111-1111-111111111111"
+
+  client_secret_wo         = var.azure_client_secret
+  client_secret_wo_version = 1
+
+  domain                  = "acme.com"
+  include_indirect_groups = true
+  max_groups_to_retrieve  = 500
+}
+
+
+// Azure AD — multi tenant (no tenant_id required)
+
+resource "dbtcloud_auth_provider" "azure_multi_tenant" {
+  type      = "azure_multi_tenant"
+  client_id = "00000000-0000-0000-0000-000000000000"
+
+  client_secret_wo         = var.azure_client_secret
+  client_secret_wo_version = 1
+}
+
+
+// Azure Active Directory
+
+resource "dbtcloud_auth_provider" "azure_active_directory" {
+  type      = "azure_active_directory"
+  client_id = "00000000-0000-0000-0000-000000000000"
+  tenant_id = "11111111-1111-1111-1111-111111111111"
+
+  client_secret_wo         = var.azure_client_secret
+  client_secret_wo_version = 1
+
+  domain = "acme.com"
+}
+
+
+// Google Workspace
+
+variable "gsuite_client_secret" {
+  type      = string
+  ephemeral = true
+}
+
+resource "dbtcloud_auth_provider" "gsuite" {
+  type      = "gsuite"
+  client_id = "000000000000-xxxx.apps.googleusercontent.com"
+
+  client_secret_wo         = var.gsuite_client_secret
+  client_secret_wo_version = 1
+
+  admin_refresh_token = "<oauth-refresh-token>"
+  domain              = "acme.com"
+  gsuite_admin_id     = "admin@acme.com"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `type` (String) The SSO provider type. One of: `saml`, `okta`, `gsuite`, `azure_single_tenant`, `azure_multi_tenant`, `azure_active_directory`. Changing this value forces a new resource.
+
+### Optional
+
+- `admin_refresh_token` (String, Sensitive) Google Workspace admin OAuth refresh token used to fetch group memberships.
+- `allow_password_backdoor` (Boolean) When true (default), users can still log in with email and password as a fallback. Set to false to enforce SSO-only access.
+- `attribute_map` (String) JSON map of SAML attribute names to dbt Cloud user fields.
+- `authorization_url` (String) OAuth authorization URL for Google Workspace. May be auto-populated server-side.
+- `cert` (String, Sensitive) SAML X.509 certificate (PEM format). Sensitive — stored in state. Consider using `cert_wo` instead. Conflicts with `cert_wo`.
+- `cert_wo` (String) Write-only alternative to `cert`. Not stored in state. Use `cert_wo_version` to trigger updates. Conflicts with `cert`.
+- `cert_wo_version` (Number) Increment to rotate `cert_wo` without changing the value.
+- `client_id` (String) OAuth client ID. Required for Azure AD and Google Workspace providers. Not returned by the API after save (encrypted at rest).
+- `client_secret` (String, Sensitive) OAuth client secret. Required for Azure AD and Google Workspace providers. Sensitive — stored in state. Consider using `client_secret_wo` instead. Conflicts with `client_secret_wo`.
+- `client_secret_wo` (String) Write-only alternative to `client_secret`. Not stored in state. Use `client_secret_wo_version` to trigger updates. Conflicts with `client_secret`.
+- `client_secret_wo_version` (Number) Increment to rotate `client_secret_wo` without changing the value.
+- `domain` (String) Primary domain for the Azure AD or Google Workspace tenant.
+- `entity_id` (String) SAML entity ID (Issuer) from your identity provider. Required for `saml` and `okta`.
+- `gsuite_admin_id` (String) Google Workspace admin email used to fetch group memberships.
+- `include_indirect_groups` (Boolean) Whether to include transitive (indirect) group memberships from Azure AD. Defaults to true.
+- `max_groups_to_retrieve` (Number) Maximum number of Azure AD groups to fetch per user. Defaults to 250.
+- `sign_request` (Boolean) Whether to sign SAML authentication requests. Defaults to false.
+- `slug` (String) URL-safe identifier used in the SSO login URL. Auto-generated if omitted. Immutable on accounts where auto-slug enforcement is enabled.
+- `sso_url` (String) SAML Single Sign-On URL from your identity provider. Required for `saml` and `okta`.
+- `tenant_id` (String, Sensitive) Azure AD tenant ID. Required for `azure_single_tenant`.
+
+### Read-Only
+
+- `cert_expiry_date` (String) Expiry date of the SAML X.509 certificate (SAML/Okta only).
+- `created_at` (String)
+- `id` (Number) The ID of the auth provider.
+- `login_url` (String) The SSO login URL for the account, auto-generated from the slug.
+- `state` (Number) The state of the auth provider (1 = active).
+- `updated_at` (String)
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# Import an existing auth provider by its numeric ID.
+# The ID can be found via the dbt Cloud API:
+#   GET /api/v3/accounts/{account_id}/auth-provider/
+
+terraform import dbtcloud_auth_provider.example 12345
+```

.gitignore

@@ -0,0 +1,94 @@
+---
+page_title: "dbtcloud_azure_ad_application Resource - dbtcloud"
+subcategory: ""
+description: |-
+  Manages an Azure Active Directory (Microsoft Entra ID) application registration for a dbt Cloud account. This enables Azure DevOps integration, allowing dbt Cloud to access Azure DevOps repositories for project setup.
+  The client_id, client_secret and tenant_id are encrypted at rest and never returned by the API. They are stored as sensitive values in Terraform state so they can be resent on every update — the API requires all three on both create and update.
+  Destroy behaviour: running terraform destroy calls the dbt Cloud DELETE endpoint, which marks the record as inactive. Due to a known dbt Cloud backend limitation, the underlying database row is retained and re-creating the resource against the same account without a backend cleanup will fail with a unique-constraint error. If you need to recreate the resource after a destroy, contact dbt Cloud support to have the orphaned record removed, or use terraform import to re-adopt the existing record ID.
+  Requires the Azure DevOps integration feature to be enabled on the account (enterprise plans only).
+---
+
+# dbtcloud_azure_ad_application (Resource)
+
+
+Manages an Azure Active Directory (Microsoft Entra ID) application registration for a dbt Cloud account. This enables Azure DevOps integration, allowing dbt Cloud to access Azure DevOps repositories for project setup.
+
+The `client_id`, `client_secret` and `tenant_id` are encrypted at rest and never returned by the API. They are stored as sensitive values in Terraform state so they can be resent on every update — the API requires all three on both create and update.
+
+**Destroy behaviour:** running `terraform destroy` calls the dbt Cloud DELETE endpoint, which marks the record as inactive. Due to a known dbt Cloud backend limitation, the underlying database row is retained and re-creating the resource against the same account without a backend cleanup will fail with a unique-constraint error. If you need to recreate the resource after a destroy, contact dbt Cloud support to have the orphaned record removed, or use `terraform import` to re-adopt the existing record ID.
+
+Requires the Azure DevOps integration feature to be enabled on the account (enterprise plans only).
+
+## Example Usage
+
+```terraform
+resource "dbtcloud_azure_ad_application" "this" {
+  organization_name = "my-azure-devops-org"
+  client_id         = "00000000-0000-0000-0000-000000000000"
+  client_secret     = var.azure_client_secret
+  tenant_id         = "00000000-0000-0000-0000-000000000001"
+
+  # Optional: defaults to "service_user". Set to "service_principal" to use
+  # service principal authentication instead.
+  azure_service_authentication_method = "service_user"
+}
+
+# NOTE: destroying this resource calls the dbt Cloud DELETE endpoint, which
+# marks the record as inactive but does not remove the underlying database row.
+# Re-creating the resource against the same account after a destroy will fail
+# with a unique-constraint error. To recover, ask dbt Cloud support to remove
+# the orphaned record, or use `terraform import` to re-adopt it:
+#
+#   terraform import dbtcloud_azure_ad_application.this <id>
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `client_id` (String, Sensitive) The client ID (application ID) of the Azure AD app registration. Stored as a sensitive value — the API never returns it.
+- `client_secret` (String, Sensitive) The client secret of the Azure AD app registration. Stored as a sensitive value — the API never returns it.
+- `organization_name` (String) The name of the Azure DevOps organization.
+- `tenant_id` (String, Sensitive) The tenant ID of the Azure AD directory. Stored as a sensitive value — the API never returns it.
+
+### Optional
+
+- `azure_service_authentication_method` (String) The method used for service authentication. One of: ~~~service_user~~~, ~~~service_principal~~~. Defaults to ~~~service_user~~~.
+
+### Read-Only
+
+- `account_id` (Number) The ID of the dbt Cloud account.
+- `created_at` (String) Timestamp when the application was created.
+- `id` (Number) The ID of the Azure AD application.
+- `oauth_redirect_uri_domain` (String) The domain used for the OAuth redirect URI. Set automatically by dbt Cloud based on the account's subdomain.
+- `updated_at` (String) Timestamp when the application was last updated.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# using import blocks (requires Terraform >= 1.5)
+import {
+  to = dbtcloud_azure_ad_application.this
+  id = "azure_ad_application_id"
+}
+
+import {
+  to = dbtcloud_azure_ad_application.this
+  id = "12345"
+}
+
+# using the older import command
+terraform import dbtcloud_azure_ad_application.this azure_ad_application_id
+terraform import dbtcloud_azure_ad_application.this 12345
+
+# NOTE: client_id, client_secret, and tenant_id will be empty after import —
+# the API never returns these values. You must set them in your config to
+# avoid drift on the next apply.
+#
+# Import is also the recovery path if destroy left an orphaned record in dbt
+# Cloud (the DELETE endpoint soft-deletes the row rather than removing it).
+# Find the existing record ID and import it instead of creating a new one.
+```