Skip to content

Commit 9ee4f2d

Browse files
sebghtsebght
authored
Add support for the ExcludeIssuerFromAuthResponse option on OpenIdClient (#934)
Signed-off-by: Sébastien Gahat <[email protected]>
1 parent 2a6926d commit 9ee4f2d

5 files changed

+109
-5
lines changed

‎docs/resources/openid_client.md

+1
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ is set to `true`.
8787
- `direct_grant_id` - (Optional) Direct grant flow id (flow needs to exist)
8888
- `login_theme` - (Optional) The client login theme. This will override the default theme for the realm.
8989
- `exclude_session_state_from_auth_response` - (Optional) When `true`, the parameter `session_state` will not be included in OpenID Connect Authentication Response.
90+
- `exclude_issuer_from_auth_response` - (Optional) When `true`, the parameter `iss` will not be included in OpenID Connect Authentication Response.
9091
- `use_refresh_tokens` - (Optional) If this is `true`, a refresh_token will be created and added to the token response. If this is `false` then no refresh_token will be generated. Defaults to `true`.
9192
- `use_refresh_tokens_client_credentials` - (Optional) If this is `true`, a refresh_token will be created and added to the token response if the client_credentials grant is used and a user session will be created. If this is `false` then no refresh_token will be generated and the associated user session will be removed, in accordance with OAuth 2.0 RFC6749 Section 4.4.3. Defaults to `false`.
9293
- `oauth2_device_authorization_grant_enabled` - (Optional) Enables support for OAuth 2.0 Device Authorization Grant, which means that client is an application on device that has limited input capabilities or lack a suitable browser.

‎keycloak/openid_client.go

+1
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ type OpenidClient struct {
6161
type OpenidClientAttributes struct {
6262
PkceCodeChallengeMethod string `json:"pkce.code.challenge.method"`
6363
ExcludeSessionStateFromAuthResponse types.KeycloakBoolQuoted `json:"exclude.session.state.from.auth.response"`
64+
ExcludeIssuerFromAuthResponse types.KeycloakBoolQuoted `json:"exclude.issuer.from.auth.response"`
6465
AccessTokenLifespan string `json:"access.token.lifespan"`
6566
LoginTheme string `json:"login_theme"`
6667
ClientOfflineSessionIdleTimeout string `json:"client.offline.session.idle.timeout,omitempty"`

‎provider/data_source_keycloak_openid_client.go

+4
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,10 @@ func dataSourceKeycloakOpenidClient() *schema.Resource {
128128
Type: schema.TypeBool,
129129
Computed: true,
130130
},
131+
"exclude_issuer_from_auth_response": {
132+
Type: schema.TypeBool,
133+
Computed: true,
134+
},
131135
"resource_server_id": {
132136
Type: schema.TypeString,
133137
Computed: true,

‎provider/resource_keycloak_openid_client.go

+6
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,11 @@ func resourceKeycloakOpenidClient() *schema.Resource {
175175
Optional: true,
176176
Computed: true,
177177
},
178+
"exclude_issuer_from_auth_response": {
179+
Type: schema.TypeBool,
180+
Optional: true,
181+
Computed: true,
182+
},
178183
"resource_server_id": {
179184
Type: schema.TypeString,
180185
Computed: true,
@@ -356,6 +361,7 @@ func getOpenidClientFromData(data *schema.ResourceData) (*keycloak.OpenidClient,
356361
Attributes: keycloak.OpenidClientAttributes{
357362
PkceCodeChallengeMethod: data.Get("pkce_code_challenge_method").(string),
358363
ExcludeSessionStateFromAuthResponse: types.KeycloakBoolQuoted(data.Get("exclude_session_state_from_auth_response").(bool)),
364+
ExcludeIssuerFromAuthResponse: types.KeycloakBoolQuoted(data.Get("exclude_issuer_from_auth_response").(bool)),
359365
AccessTokenLifespan: data.Get("access_token_lifespan").(string),
360366
LoginTheme: data.Get("login_theme").(string),
361367
ClientOfflineSessionIdleTimeout: data.Get("client_offline_session_idle_timeout").(string),

‎provider/resource_keycloak_openid_client_test.go

+97-5
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ func TestAccKeycloakOpenidClient_basic(t *testing.T) {
3131
ImportState: true,
3232
ImportStateVerify: true,
3333
ImportStateIdPrefix: testAccRealm.Realm + "/",
34-
ImportStateVerifyIgnore: []string{"exclude_session_state_from_auth_response"},
34+
ImportStateVerifyIgnore: []string{"exclude_session_state_from_auth_response", "exclude_issuer_from_auth_response"},
3535
},
3636
},
3737
})
@@ -55,7 +55,7 @@ func TestAccKeycloakOpenidClient_basic_with_consent(t *testing.T) {
5555
ImportState: true,
5656
ImportStateVerify: true,
5757
ImportStateIdPrefix: testAccRealm.Realm + "/",
58-
ImportStateVerifyIgnore: []string{"exclude_session_state_from_auth_response"},
58+
ImportStateVerifyIgnore: []string{"exclude_session_state_from_auth_response", "exclude_issuer_from_auth_response"},
5959
},
6060
},
6161
})
@@ -331,7 +331,7 @@ func TestAccKeycloakOpenidClient_AccessToken_basic(t *testing.T) {
331331
ImportState: true,
332332
ImportStateVerify: true,
333333
ImportStateIdPrefix: testAccRealm.Realm + "/",
334-
ImportStateVerifyIgnore: []string{"exclude_session_state_from_auth_response"},
334+
ImportStateVerifyIgnore: []string{"exclude_session_state_from_auth_response", "exclude_issuer_from_auth_response"},
335335
},
336336
},
337337
})
@@ -363,7 +363,7 @@ func TestAccKeycloakOpenidClient_ClientTimeouts_basic(t *testing.T) {
363363
ImportState: true,
364364
ImportStateVerify: true,
365365
ImportStateIdPrefix: testAccRealm.Realm + "/",
366-
ImportStateVerifyIgnore: []string{"exclude_session_state_from_auth_response"},
366+
ImportStateVerifyIgnore: []string{"exclude_session_state_from_auth_response", "exclude_issuer_from_auth_response"},
367367
},
368368
},
369369
})
@@ -399,7 +399,7 @@ func TestAccKeycloakOpenidClient_Device_basic(t *testing.T) {
399399
ImportState: true,
400400
ImportStateVerify: true,
401401
ImportStateIdPrefix: testAccRealm.Realm + "/",
402-
ImportStateVerifyIgnore: []string{"exclude_session_state_from_auth_response"},
402+
ImportStateVerifyIgnore: []string{"exclude_session_state_from_auth_response", "exclude_issuer_from_auth_response"},
403403
},
404404
},
405405
})
@@ -519,27 +519,31 @@ func TestAccKeycloakOpenidClient_pkceCodeChallengeMethod(t *testing.T) {
519519
Check: resource.ComposeTestCheckFunc(
520520
testAccCheckKeycloakOpenidClientHasPkceCodeChallengeMethod("keycloak_openid_client.client", ""),
521521
testAccCheckKeycloakOpenidClientHasExcludeSessionStateFromAuthResponse("keycloak_openid_client.client", false),
522+
testAccCheckKeycloakOpenidClientHasExcludeIssuerFromAuthResponse("keycloak_openid_client.client", false),
522523
),
523524
},
524525
{
525526
Config: testKeycloakOpenidClient_pkceChallengeMethod(clientId, "plain"),
526527
Check: resource.ComposeTestCheckFunc(
527528
testAccCheckKeycloakOpenidClientHasPkceCodeChallengeMethod("keycloak_openid_client.client", "plain"),
528529
testAccCheckKeycloakOpenidClientHasExcludeSessionStateFromAuthResponse("keycloak_openid_client.client", false),
530+
testAccCheckKeycloakOpenidClientHasExcludeIssuerFromAuthResponse("keycloak_openid_client.client", false),
529531
),
530532
},
531533
{
532534
Config: testKeycloakOpenidClient_pkceChallengeMethod(clientId, "S256"),
533535
Check: resource.ComposeTestCheckFunc(
534536
testAccCheckKeycloakOpenidClientHasPkceCodeChallengeMethod("keycloak_openid_client.client", "S256"),
535537
testAccCheckKeycloakOpenidClientHasExcludeSessionStateFromAuthResponse("keycloak_openid_client.client", false),
538+
testAccCheckKeycloakOpenidClientHasExcludeIssuerFromAuthResponse("keycloak_openid_client.client", false),
536539
),
537540
},
538541
{
539542
Config: testKeycloakOpenidClient_pkceChallengeMethod(clientId, ""),
540543
Check: resource.ComposeTestCheckFunc(
541544
testAccCheckKeycloakOpenidClientHasPkceCodeChallengeMethod("keycloak_openid_client.client", ""),
542545
testAccCheckKeycloakOpenidClientHasExcludeSessionStateFromAuthResponse("keycloak_openid_client.client", false),
546+
testAccCheckKeycloakOpenidClientHasExcludeIssuerFromAuthResponse("keycloak_openid_client.client", false),
543547
),
544548
},
545549
},
@@ -587,6 +591,47 @@ func TestAccKeycloakOpenidClient_excludeSessionStateFromAuthResponse(t *testing.
587591
})
588592
}
589593

594+
func TestAccKeycloakOpenidClient_excludeIssuerFromAuthResponse(t *testing.T) {
595+
t.Parallel()
596+
clientId := acctest.RandomWithPrefix("tf-acc")
597+
598+
resource.Test(t, resource.TestCase{
599+
ProviderFactories: testAccProviderFactories,
600+
PreCheck: func() { testAccPreCheck(t) },
601+
CheckDestroy: testAccCheckKeycloakOpenidClientDestroy(),
602+
Steps: []resource.TestStep{
603+
{
604+
Config: testKeycloakOpenidClient_omitExcludeIssuerFromAuthResponse(clientId, "plain"),
605+
Check: resource.ComposeTestCheckFunc(
606+
testAccCheckKeycloakOpenidClientHasExcludeIssuerFromAuthResponse("keycloak_openid_client.client", false),
607+
testAccCheckKeycloakOpenidClientHasPkceCodeChallengeMethod("keycloak_openid_client.client", "plain"),
608+
),
609+
},
610+
{
611+
Config: testKeycloakOpenidClient_excludeIssuerFromAuthResponse(clientId, false),
612+
Check: resource.ComposeTestCheckFunc(
613+
testAccCheckKeycloakOpenidClientHasExcludeIssuerFromAuthResponse("keycloak_openid_client.client", false),
614+
testAccCheckKeycloakOpenidClientHasPkceCodeChallengeMethod("keycloak_openid_client.client", ""),
615+
),
616+
},
617+
{
618+
Config: testKeycloakOpenidClient_excludeIssuerFromAuthResponse(clientId, true),
619+
Check: resource.ComposeTestCheckFunc(
620+
testAccCheckKeycloakOpenidClientHasExcludeIssuerFromAuthResponse("keycloak_openid_client.client", true),
621+
testAccCheckKeycloakOpenidClientHasPkceCodeChallengeMethod("keycloak_openid_client.client", ""),
622+
),
623+
},
624+
{
625+
Config: testKeycloakOpenidClient_excludeIssuerFromAuthResponse(clientId, false),
626+
Check: resource.ComposeTestCheckFunc(
627+
testAccCheckKeycloakOpenidClientHasExcludeIssuerFromAuthResponse("keycloak_openid_client.client", false),
628+
testAccCheckKeycloakOpenidClientHasPkceCodeChallengeMethod("keycloak_openid_client.client", ""),
629+
),
630+
},
631+
},
632+
})
633+
}
634+
590635
func TestAccKeycloakOpenidClient_authenticationFlowBindingOverrides(t *testing.T) {
591636
t.Parallel()
592637
clientId := acctest.RandomWithPrefix("tf-acc")
@@ -1086,6 +1131,21 @@ func testAccCheckKeycloakOpenidClientHasExcludeSessionStateFromAuthResponse(reso
10861131
}
10871132
}
10881133

1134+
func testAccCheckKeycloakOpenidClientHasExcludeIssuerFromAuthResponse(resourceName string, excludeIssuerFromAuthResponse types.KeycloakBoolQuoted) resource.TestCheckFunc {
1135+
return func(s *terraform.State) error {
1136+
client, err := getOpenidClientFromState(s, resourceName)
1137+
if err != nil {
1138+
return err
1139+
}
1140+
1141+
if client.Attributes.ExcludeIssuerFromAuthResponse != excludeIssuerFromAuthResponse {
1142+
return fmt.Errorf("expected openid client %s to have exclude_issuer_from_auth_response value of %t, but got %t", client.ClientId, excludeIssuerFromAuthResponse, client.Attributes.ExcludeIssuerFromAuthResponse)
1143+
}
1144+
1145+
return nil
1146+
}
1147+
}
1148+
10891149
func testAccCheckKeycloakOpenidClientAuthenticationFlowBindingOverrides(resourceName, flowResourceName string) resource.TestCheckFunc {
10901150
return func(s *terraform.State) error {
10911151
client, err := getOpenidClientFromState(s, resourceName)
@@ -1381,6 +1441,22 @@ resource "keycloak_openid_client" "client" {
13811441
`, testAccRealm.Realm, clientId, excludeSessionStateFromAuthResponse)
13821442
}
13831443

1444+
func testKeycloakOpenidClient_excludeIssuerFromAuthResponse(clientId string, excludeIssuerFromAuthResponse bool) string {
1445+
1446+
return fmt.Sprintf(`
1447+
data "keycloak_realm" "realm" {
1448+
realm = "%s"
1449+
}
1450+
1451+
resource "keycloak_openid_client" "client" {
1452+
client_id = "%s"
1453+
realm_id = data.keycloak_realm.realm.id
1454+
access_type = "CONFIDENTIAL"
1455+
exclude_issuer_from_auth_response = %t
1456+
}
1457+
`, testAccRealm.Realm, clientId, excludeIssuerFromAuthResponse)
1458+
}
1459+
13841460
func testKeycloakOpenidClient_omitPkceChallengeMethod(clientId string) string {
13851461

13861462
return fmt.Sprintf(`
@@ -1412,6 +1488,22 @@ resource "keycloak_openid_client" "client" {
14121488
`, testAccRealm.Realm, clientId, pkceChallengeMethod)
14131489
}
14141490

1491+
func testKeycloakOpenidClient_omitExcludeIssuerFromAuthResponse(clientId, pkceChallengeMethod string) string {
1492+
1493+
return fmt.Sprintf(`
1494+
data "keycloak_realm" "realm" {
1495+
realm = "%s"
1496+
}
1497+
1498+
resource "keycloak_openid_client" "client" {
1499+
client_id = "%s"
1500+
realm_id = data.keycloak_realm.realm.id
1501+
access_type = "CONFIDENTIAL"
1502+
pkce_code_challenge_method = "%s"
1503+
}
1504+
`, testAccRealm.Realm, clientId, pkceChallengeMethod)
1505+
}
1506+
14151507
func testKeycloakOpenidClient_updateRealmBefore(clientId string) string {
14161508
return fmt.Sprintf(`
14171509
data "keycloak_realm" "realm_1" {

0 commit comments

Comments
 (0)