Skip to content

Commit c2810f6

Browse files
modular-magicianmodular-magician
committed
Add session settings support to access context (#13523)
[upstream:d0f8dc4dd63e11d1b7cdabe28458f8c66f65140d] Signed-off-by: Modular Magician <[email protected]>
1 parent cfda71b commit c2810f6

5 files changed

+221
-14
lines changed

‎.changelog/13523.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
accesscontextmanager: added `session_settings` field to `gcp_user_access_binding` resource
3+
```

‎google-beta/services/accesscontextmanager/resource_access_context_manager_gcp_user_access_binding.go

+174-10
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ import (
3131

3232
"github.com/hashicorp/terraform-provider-google-beta/google-beta/tpgresource"
3333
transport_tpg "github.com/hashicorp/terraform-provider-google-beta/google-beta/transport"
34+
"github.com/hashicorp/terraform-provider-google-beta/google-beta/verify"
3435
)
3536

3637
func ResourceAccessContextManagerGcpUserAccessBinding() *schema.Resource {
@@ -51,16 +52,6 @@ func ResourceAccessContextManagerGcpUserAccessBinding() *schema.Resource {
5152
},
5253

5354
Schema: map[string]*schema.Schema{
54-
"access_levels": {
55-
Type: schema.TypeList,
56-
Required: true,
57-
Description: `Required. Access level that a user must have to be granted access. Only one access level is supported, not multiple. This repeated field must have exactly one element. Example: "accessPolicies/9522/accessLevels/device_trusted"`,
58-
MinItems: 1,
59-
MaxItems: 1,
60-
Elem: &schema.Schema{
61-
Type: schema.TypeString,
62-
},
63-
},
6455
"group_key": {
6556
Type: schema.TypeString,
6657
Required: true,
@@ -73,6 +64,52 @@ func ResourceAccessContextManagerGcpUserAccessBinding() *schema.Resource {
7364
ForceNew: true,
7465
Description: `Required. ID of the parent organization.`,
7566
},
67+
"access_levels": {
68+
Type: schema.TypeList,
69+
Optional: true,
70+
Description: `Optional. Access level that a user must have to be granted access. Only one access level is supported, not multiple. This repeated field must have exactly one element. Example: "accessPolicies/9522/accessLevels/device_trusted"`,
71+
MinItems: 1,
72+
MaxItems: 1,
73+
Elem: &schema.Schema{
74+
Type: schema.TypeString,
75+
},
76+
},
77+
"session_settings": {
78+
Type: schema.TypeList,
79+
Optional: true,
80+
Description: `Optional. The Google Cloud session length (GCSL) policy for the group key.`,
81+
MaxItems: 1,
82+
Elem: &schema.Resource{
83+
Schema: map[string]*schema.Schema{
84+
"max_inactivity": {
85+
Type: schema.TypeString,
86+
Optional: true,
87+
Description: `Optional. How long a user is allowed to take between actions before a new access token must be issued. Only set for Google Cloud apps.`,
88+
},
89+
"session_length": {
90+
Type: schema.TypeString,
91+
Optional: true,
92+
Description: `Optional. The session length. Setting this field to zero is equal to disabling session. Also can set infinite session by flipping the enabled bit to false below. If useOidcMaxAge is true, for OIDC apps, the session length will be the minimum of this field and OIDC max_age param.`,
93+
},
94+
"session_length_enabled": {
95+
Type: schema.TypeBool,
96+
Optional: true,
97+
Description: `Optional. This field enables or disables Google Cloud session length. When false, all fields set above will be disregarded and the session length is basically infinite.`,
98+
},
99+
"session_reauth_method": {
100+
Type: schema.TypeString,
101+
Optional: true,
102+
ValidateFunc: verify.ValidateEnum([]string{"LOGIN", "SECURITY_KEY", "PASSWORD", ""}),
103+
Description: `Optional. The session challenges proposed to users when the Google Cloud session length is up. Possible values: ["LOGIN", "SECURITY_KEY", "PASSWORD"]`,
104+
},
105+
"use_oidc_max_age": {
106+
Type: schema.TypeBool,
107+
Optional: true,
108+
Description: `Optional. Only useful for OIDC apps. When false, the OIDC max_age param, if passed in the authentication request will be ignored. When true, the re-auth period will be the minimum of the sessionLength field and the max_age OIDC param.`,
109+
},
110+
},
111+
},
112+
},
76113
"name": {
77114
Type: schema.TypeString,
78115
Computed: true,
@@ -103,6 +140,12 @@ func resourceAccessContextManagerGcpUserAccessBindingCreate(d *schema.ResourceDa
103140
} else if v, ok := d.GetOkExists("access_levels"); !tpgresource.IsEmptyValue(reflect.ValueOf(accessLevelsProp)) && (ok || !reflect.DeepEqual(v, accessLevelsProp)) {
104141
obj["accessLevels"] = accessLevelsProp
105142
}
143+
sessionSettingsProp, err := expandAccessContextManagerGcpUserAccessBindingSessionSettings(d.Get("session_settings"), d, config)
144+
if err != nil {
145+
return err
146+
} else if v, ok := d.GetOkExists("session_settings"); !tpgresource.IsEmptyValue(reflect.ValueOf(sessionSettingsProp)) && (ok || !reflect.DeepEqual(v, sessionSettingsProp)) {
147+
obj["sessionSettings"] = sessionSettingsProp
148+
}
106149

107150
url, err := tpgresource.ReplaceVars(d, config, "{{AccessContextManagerBasePath}}organizations/{{organization_id}}/gcpUserAccessBindings")
108151
if err != nil {
@@ -209,6 +252,9 @@ func resourceAccessContextManagerGcpUserAccessBindingRead(d *schema.ResourceData
209252
if err := d.Set("access_levels", flattenAccessContextManagerGcpUserAccessBindingAccessLevels(res["accessLevels"], d, config)); err != nil {
210253
return fmt.Errorf("Error reading GcpUserAccessBinding: %s", err)
211254
}
255+
if err := d.Set("session_settings", flattenAccessContextManagerGcpUserAccessBindingSessionSettings(res["sessionSettings"], d, config)); err != nil {
256+
return fmt.Errorf("Error reading GcpUserAccessBinding: %s", err)
257+
}
212258

213259
return nil
214260
}
@@ -229,6 +275,12 @@ func resourceAccessContextManagerGcpUserAccessBindingUpdate(d *schema.ResourceDa
229275
} else if v, ok := d.GetOkExists("access_levels"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, accessLevelsProp)) {
230276
obj["accessLevels"] = accessLevelsProp
231277
}
278+
sessionSettingsProp, err := expandAccessContextManagerGcpUserAccessBindingSessionSettings(d.Get("session_settings"), d, config)
279+
if err != nil {
280+
return err
281+
} else if v, ok := d.GetOkExists("session_settings"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, sessionSettingsProp)) {
282+
obj["sessionSettings"] = sessionSettingsProp
283+
}
232284

233285
url, err := tpgresource.ReplaceVars(d, config, "{{AccessContextManagerBasePath}}{{name}}")
234286
if err != nil {
@@ -242,6 +294,10 @@ func resourceAccessContextManagerGcpUserAccessBindingUpdate(d *schema.ResourceDa
242294
if d.HasChange("access_levels") {
243295
updateMask = append(updateMask, "accessLevels")
244296
}
297+
298+
if d.HasChange("session_settings") {
299+
updateMask = append(updateMask, "sessionSettings")
300+
}
245301
// updateMask is a URL parameter but not present in the schema, so ReplaceVars
246302
// won't set it
247303
url, err = transport_tpg.AddQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")})
@@ -364,10 +420,118 @@ func flattenAccessContextManagerGcpUserAccessBindingAccessLevels(v interface{},
364420
return v
365421
}
366422

423+
func flattenAccessContextManagerGcpUserAccessBindingSessionSettings(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
424+
if v == nil {
425+
return nil
426+
}
427+
original := v.(map[string]interface{})
428+
if len(original) == 0 {
429+
return nil
430+
}
431+
transformed := make(map[string]interface{})
432+
transformed["session_reauth_method"] =
433+
flattenAccessContextManagerGcpUserAccessBindingSessionSettingsSessionReauthMethod(original["sessionReauthMethod"], d, config)
434+
transformed["session_length"] =
435+
flattenAccessContextManagerGcpUserAccessBindingSessionSettingsSessionLength(original["sessionLength"], d, config)
436+
transformed["max_inactivity"] =
437+
flattenAccessContextManagerGcpUserAccessBindingSessionSettingsMaxInactivity(original["maxInactivity"], d, config)
438+
transformed["use_oidc_max_age"] =
439+
flattenAccessContextManagerGcpUserAccessBindingSessionSettingsUseOidcMaxAge(original["useOidcMaxAge"], d, config)
440+
transformed["session_length_enabled"] =
441+
flattenAccessContextManagerGcpUserAccessBindingSessionSettingsSessionLengthEnabled(original["sessionLengthEnabled"], d, config)
442+
return []interface{}{transformed}
443+
}
444+
func flattenAccessContextManagerGcpUserAccessBindingSessionSettingsSessionReauthMethod(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
445+
return v
446+
}
447+
448+
func flattenAccessContextManagerGcpUserAccessBindingSessionSettingsSessionLength(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
449+
return v
450+
}
451+
452+
func flattenAccessContextManagerGcpUserAccessBindingSessionSettingsMaxInactivity(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
453+
return v
454+
}
455+
456+
func flattenAccessContextManagerGcpUserAccessBindingSessionSettingsUseOidcMaxAge(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
457+
return v
458+
}
459+
460+
func flattenAccessContextManagerGcpUserAccessBindingSessionSettingsSessionLengthEnabled(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
461+
return v
462+
}
463+
367464
func expandAccessContextManagerGcpUserAccessBindingGroupKey(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
368465
return v, nil
369466
}
370467

371468
func expandAccessContextManagerGcpUserAccessBindingAccessLevels(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
372469
return v, nil
373470
}
471+
472+
func expandAccessContextManagerGcpUserAccessBindingSessionSettings(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
473+
l := v.([]interface{})
474+
if len(l) == 0 || l[0] == nil {
475+
return nil, nil
476+
}
477+
raw := l[0]
478+
original := raw.(map[string]interface{})
479+
transformed := make(map[string]interface{})
480+
481+
transformedSessionReauthMethod, err := expandAccessContextManagerGcpUserAccessBindingSessionSettingsSessionReauthMethod(original["session_reauth_method"], d, config)
482+
if err != nil {
483+
return nil, err
484+
} else if val := reflect.ValueOf(transformedSessionReauthMethod); val.IsValid() && !tpgresource.IsEmptyValue(val) {
485+
transformed["sessionReauthMethod"] = transformedSessionReauthMethod
486+
}
487+
488+
transformedSessionLength, err := expandAccessContextManagerGcpUserAccessBindingSessionSettingsSessionLength(original["session_length"], d, config)
489+
if err != nil {
490+
return nil, err
491+
} else if val := reflect.ValueOf(transformedSessionLength); val.IsValid() && !tpgresource.IsEmptyValue(val) {
492+
transformed["sessionLength"] = transformedSessionLength
493+
}
494+
495+
transformedMaxInactivity, err := expandAccessContextManagerGcpUserAccessBindingSessionSettingsMaxInactivity(original["max_inactivity"], d, config)
496+
if err != nil {
497+
return nil, err
498+
} else if val := reflect.ValueOf(transformedMaxInactivity); val.IsValid() && !tpgresource.IsEmptyValue(val) {
499+
transformed["maxInactivity"] = transformedMaxInactivity
500+
}
501+
502+
transformedUseOidcMaxAge, err := expandAccessContextManagerGcpUserAccessBindingSessionSettingsUseOidcMaxAge(original["use_oidc_max_age"], d, config)
503+
if err != nil {
504+
return nil, err
505+
} else if val := reflect.ValueOf(transformedUseOidcMaxAge); val.IsValid() && !tpgresource.IsEmptyValue(val) {
506+
transformed["useOidcMaxAge"] = transformedUseOidcMaxAge
507+
}
508+
509+
transformedSessionLengthEnabled, err := expandAccessContextManagerGcpUserAccessBindingSessionSettingsSessionLengthEnabled(original["session_length_enabled"], d, config)
510+
if err != nil {
511+
return nil, err
512+
} else if val := reflect.ValueOf(transformedSessionLengthEnabled); val.IsValid() && !tpgresource.IsEmptyValue(val) {
513+
transformed["sessionLengthEnabled"] = transformedSessionLengthEnabled
514+
}
515+
516+
return transformed, nil
517+
}
518+
519+
func expandAccessContextManagerGcpUserAccessBindingSessionSettingsSessionReauthMethod(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
520+
return v, nil
521+
}
522+
523+
func expandAccessContextManagerGcpUserAccessBindingSessionSettingsSessionLength(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
524+
return v, nil
525+
}
526+
527+
func expandAccessContextManagerGcpUserAccessBindingSessionSettingsMaxInactivity(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
528+
return v, nil
529+
}
530+
531+
func expandAccessContextManagerGcpUserAccessBindingSessionSettingsUseOidcMaxAge(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
532+
return v, nil
533+
}
534+
535+
func expandAccessContextManagerGcpUserAccessBindingSessionSettingsSessionLengthEnabled(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
536+
return v, nil
537+
}

‎google-beta/services/accesscontextmanager/resource_access_context_manager_gcp_user_access_binding_generated_meta.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,8 @@ fields:
1010
- field: 'name'
1111
- field: 'organization_id'
1212
provider_only: true
13+
- field: 'session_settings.max_inactivity'
14+
- field: 'session_settings.session_length'
15+
- field: 'session_settings.session_length_enabled'
16+
- field: 'session_settings.session_reauth_method'
17+
- field: 'session_settings.use_oidc_max_age'

‎google-beta/services/accesscontextmanager/resource_access_context_manager_gcp_user_access_binding_test.go

+7
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,13 @@ resource "google_access_context_manager_gcp_user_access_binding" "gcp_user_acces
9595
access_levels = [
9696
google_access_context_manager_access_level.tf_test_access_level_id_for_user_access_binding%{random_suffix}.name,
9797
]
98+
session_settings {
99+
max_inactivity = "300s"
100+
session_length = "1800s"
101+
session_length_enabled = true
102+
session_reauth_method = "LOGIN"
103+
use_oidc_max_age = false
104+
}
98105
}
99106
`, context)
100107
}

‎website/docs/r/access_context_manager_gcp_user_access_binding.html.markdown

+32-4
Original file line numberDiff line numberDiff line change
@@ -90,10 +90,6 @@ The following arguments are supported:
9090
(Required)
9191
Required. Immutable. Google Group id whose members are subject to this binding's restrictions. See "id" in the G Suite Directory API's Groups resource. If a group's email address/alias is changed, this resource will continue to point at the changed group. This field does not accept group email addresses or aliases. Example: "01d520gv4vjcrht"
9292

93-
* `access_levels` -
94-
(Required)
95-
Required. Access level that a user must have to be granted access. Only one access level is supported, not multiple. This repeated field must have exactly one element. Example: "accessPolicies/9522/accessLevels/device_trusted"
96-
9793
* `organization_id` -
9894
(Required)
9995
Required. ID of the parent organization.
@@ -102,6 +98,38 @@ The following arguments are supported:
10298
- - -
10399

104100

101+
* `access_levels` -
102+
(Optional)
103+
Optional. Access level that a user must have to be granted access. Only one access level is supported, not multiple. This repeated field must have exactly one element. Example: "accessPolicies/9522/accessLevels/device_trusted"
104+
105+
* `session_settings` -
106+
(Optional)
107+
Optional. The Google Cloud session length (GCSL) policy for the group key.
108+
Structure is [documented below](#nested_session_settings).
109+
110+
111+
<a name="nested_session_settings"></a>The `session_settings` block supports:
112+
113+
* `session_reauth_method` -
114+
(Optional)
115+
Optional. The session challenges proposed to users when the Google Cloud session length is up.
116+
Possible values are: `LOGIN`, `SECURITY_KEY`, `PASSWORD`.
117+
118+
* `session_length` -
119+
(Optional)
120+
Optional. The session length. Setting this field to zero is equal to disabling session. Also can set infinite session by flipping the enabled bit to false below. If useOidcMaxAge is true, for OIDC apps, the session length will be the minimum of this field and OIDC max_age param.
121+
122+
* `max_inactivity` -
123+
(Optional)
124+
Optional. How long a user is allowed to take between actions before a new access token must be issued. Only set for Google Cloud apps.
125+
126+
* `use_oidc_max_age` -
127+
(Optional)
128+
Optional. Only useful for OIDC apps. When false, the OIDC max_age param, if passed in the authentication request will be ignored. When true, the re-auth period will be the minimum of the sessionLength field and the max_age OIDC param.
129+
130+
* `session_length_enabled` -
131+
(Optional)
132+
Optional. This field enables or disables Google Cloud session length. When false, all fields set above will be disregarded and the session length is basically infinite.
105133

106134
## Attributes Reference
107135

0 commit comments

Comments
 (0)