Skip to content

Commit 5a52620

Browse files
dal13002dal13002
authored
Fix: update sso resource to have correct validation and description within oidc section (#641)
1 parent e4d4455 commit 5a52620

File tree

3 files changed

+48
-58
lines changed

3 files changed

+48
-58
lines changed

‎docs/resources/sso.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -91,12 +91,12 @@ Required:
9191

9292
- `client_id` (String) Client ID for OIDC authentication.
9393
- `client_secret` (String, Sensitive) Client secret for OIDC authentication (sensitive).
94-
- `email` (String) User's email address retrieved from identity provider.
95-
- `first_name` (String) User's first name retrieved from identity provider.
94+
- `email` (String) The name of the claim that returns the user's email address from the identity provider.
95+
- `first_name` (String) The name of the claim that returns the user's first name from the identity provider.
9696
- `issuer_url` (String) URL of the OIDC issuer.
97-
- `last_name` (String) User's last name retrieved from identity provider.
97+
- `last_name` (String) The name of the claim that returns the user's last name from the identity provider.
9898
- `scopes` (Set of String) Scopes requested during OIDC authentication.
99-
- `spectro_team` (String) The SpectroCloud team the user belongs to.
99+
- `spectro_team` (String) The name of the claim that returns the user's group memberships from the Identity Provider. The values of this claim will map to SpectroCloud teams.
100100

101101
Optional:
102102

@@ -115,10 +115,10 @@ Read-Only:
115115

116116
Required:
117117

118-
- `email` (String) User's email address retrieved from identity provider.
119-
- `first_name` (String) User's first name retrieved from identity provider.
120-
- `last_name` (String) User's last name retrieved from identity provider.
121-
- `spectro_team` (String) The SpectroCloud team the user belongs to.
118+
- `email` (String) The name of the claim that returns the user's email address from the identity provider.
119+
- `first_name` (String) The name of the claim that returns the user's first name from the identity provider.
120+
- `last_name` (String) The name of the claim that returns the user's last name from the identity provider.
121+
- `spectro_team` (String) The name of the claim that returns the user's group memberships from the Identity Provider. The values of this claim will map to SpectroCloud teams.
122122

123123

124124

‎spectrocloud/resource_sso.go‎

Lines changed: 8 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -152,35 +152,30 @@ func resourceSSO() *schema.Resource {
152152
"first_name": {
153153
Type: schema.TypeString,
154154
Required: true,
155-
Description: "User's first name retrieved from identity provider.",
155+
Description: "The name of the claim that returns the user's first name from the identity provider.",
156156
},
157157
"last_name": {
158158
Type: schema.TypeString,
159159
Required: true,
160-
Description: "User's last name retrieved from identity provider.",
160+
Description: "The name of the claim that returns the user's last name from the identity provider.",
161161
},
162162
"email": {
163163
Type: schema.TypeString,
164164
Required: true,
165-
Description: "User's email address retrieved from identity provider.",
165+
Description: "The name of the claim that returns the user's email address from the identity provider.",
166166
ValidateFunc: func(val interface{}, key string) (warns []string, errs []error) {
167167
v := val.(string)
168168
if v == "" {
169169
errs = append(errs, fmt.Errorf("%q must not be empty", key))
170170
return
171171
}
172-
emailRegex := `^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$`
173-
matched, err := regexp.MatchString(emailRegex, v)
174-
if err != nil || !matched {
175-
errs = append(errs, fmt.Errorf("%q must be a valid email address", key))
176-
}
177172
return
178173
},
179174
},
180175
"spectro_team": {
181176
Type: schema.TypeString,
182177
Required: true,
183-
Description: "The SpectroCloud team the user belongs to.",
178+
Description: "The name of the claim that returns the user's group memberships from the Identity Provider. The values of this claim will map to SpectroCloud teams.",
184179
},
185180
"user_info_endpoint": {
186181
Type: schema.TypeList,
@@ -192,35 +187,30 @@ func resourceSSO() *schema.Resource {
192187
"first_name": {
193188
Type: schema.TypeString,
194189
Required: true,
195-
Description: "User's first name retrieved from identity provider.",
190+
Description: "The name of the claim that returns the user's first name from the identity provider.",
196191
},
197192
"last_name": {
198193
Type: schema.TypeString,
199194
Required: true,
200-
Description: "User's last name retrieved from identity provider.",
195+
Description: "The name of the claim that returns the user's last name from the identity provider.",
201196
},
202197
"email": {
203198
Type: schema.TypeString,
204199
Required: true,
205-
Description: "User's email address retrieved from identity provider.",
200+
Description: "The name of the claim that returns the user's email address from the identity provider.",
206201
ValidateFunc: func(val interface{}, key string) (warns []string, errs []error) {
207202
v := val.(string)
208203
if v == "" {
209204
errs = append(errs, fmt.Errorf("%q must not be empty", key))
210205
return
211206
}
212-
emailRegex := `^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$`
213-
matched, err := regexp.MatchString(emailRegex, v)
214-
if err != nil || !matched {
215-
errs = append(errs, fmt.Errorf("%q must be a valid email address", key))
216-
}
217207
return
218208
},
219209
},
220210
"spectro_team": {
221211
Type: schema.TypeString,
222212
Required: true,
223-
Description: "The SpectroCloud team the user belongs to.",
213+
Description: "The name of the claim that returns the user's group memberships from the Identity Provider. The values of this claim will map to SpectroCloud teams.",
224214
},
225215
},
226216
},

‎spectrocloud/resource_sso_test.go‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -51,17 +51,17 @@ func TestToOIDC(t *testing.T) {
5151
"insecure_skip_tls_verify": true,
5252
"issuer_url": "https://issuer.com",
5353
"logout_url": "https://example.com/logout",
54-
"email": "[email protected]",
55-
"first_name": "John",
56-
"last_name": "Doe",
57-
"spectro_team": "devops",
54+
"email": "email",
55+
"first_name": "given_name",
56+
"last_name": "family_name",
57+
"spectro_team": "groups",
5858
"scopes": schema.NewSet(schema.HashString, []interface{}{"openid", "profile"}),
5959
"user_info_endpoint": []interface{}{
6060
map[string]interface{}{
61-
"email": "[email protected]",
62-
"first_name": "John",
63-
"last_name": "Doe",
64-
"spectro_team": "devops",
61+
"email": "email",
62+
"first_name": "given_name",
63+
"last_name": "family_name",
64+
"spectro_team": "groups",
6565
},
6666
},
6767
},
@@ -83,14 +83,14 @@ func TestToOIDC(t *testing.T) {
8383
assert.Equal(t, true, *result.IssuerTLS.InsecureSkipVerify)
8484
assert.Equal(t, "https://issuer.com", result.IssuerURL)
8585
assert.Equal(t, "https://example.com/logout", result.LogoutURL)
86-
assert.Equal(t, "[email protected]", result.RequiredClaims.Email)
87-
assert.Equal(t, "John", result.RequiredClaims.FirstName)
88-
assert.Equal(t, "Doe", result.RequiredClaims.LastName)
89-
assert.Equal(t, "devops", result.RequiredClaims.SpectroTeam)
90-
assert.Equal(t, "[email protected]", result.UserInfo.Claims.Email)
91-
assert.Equal(t, "John", result.UserInfo.Claims.FirstName)
92-
assert.Equal(t, "Doe", result.UserInfo.Claims.LastName)
93-
assert.Equal(t, "devops", result.UserInfo.Claims.SpectroTeam)
86+
assert.Equal(t, "email", result.RequiredClaims.Email)
87+
assert.Equal(t, "given_name", result.RequiredClaims.FirstName)
88+
assert.Equal(t, "family_name", result.RequiredClaims.LastName)
89+
assert.Equal(t, "groups", result.RequiredClaims.SpectroTeam)
90+
assert.Equal(t, "email", result.UserInfo.Claims.Email)
91+
assert.Equal(t, "given_name", result.UserInfo.Claims.FirstName)
92+
assert.Equal(t, "family_name", result.UserInfo.Claims.LastName)
93+
assert.Equal(t, "groups", result.UserInfo.Claims.SpectroTeam)
9494
assert.Equal(t, true, *result.UserInfo.UseUserInfo)
9595
}
9696

@@ -146,18 +146,18 @@ func TestFlattenOidc(t *testing.T) {
146146
IssuerURL: "https://issuer.com",
147147
LogoutURL: "https://example.com/logout",
148148
RequiredClaims: &models.V1TenantOidcClaims{
149-
Email: "[email protected]",
150-
FirstName: "John",
151-
LastName: "Doe",
152-
SpectroTeam: "devops",
149+
Email: "email",
150+
FirstName: "given_name",
151+
LastName: "family_name",
152+
SpectroTeam: "groups",
153153
},
154154
Scopes: []string{"openid", "profile"},
155155
UserInfo: &models.V1OidcUserInfo{
156156
Claims: &models.V1TenantOidcClaims{
157-
Email: "[email protected]",
158-
FirstName: "John",
159-
LastName: "Doe",
160-
SpectroTeam: "devops",
157+
Email: "email",
158+
FirstName: "given_name",
159+
LastName: "family_name",
160+
SpectroTeam: "groups",
161161
},
162162
},
163163
}
@@ -174,17 +174,17 @@ func TestFlattenOidc(t *testing.T) {
174174
assert.Equal(t, true, flattened["insecure_skip_tls_verify"])
175175
assert.Equal(t, "https://issuer.com", flattened["issuer_url"])
176176
assert.Equal(t, "https://example.com/logout", flattened["logout_url"])
177-
assert.Equal(t, "[email protected]", flattened["email"])
178-
assert.Equal(t, "John", flattened["first_name"])
179-
assert.Equal(t, "Doe", flattened["last_name"])
180-
assert.Equal(t, "devops", flattened["spectro_team"])
177+
assert.Equal(t, "email", flattened["email"])
178+
assert.Equal(t, "given_name", flattened["first_name"])
179+
assert.Equal(t, "family_name", flattened["last_name"])
180+
assert.Equal(t, "groups", flattened["spectro_team"])
181181
assert.Equal(t, []interface{}{"openid", "profile"}, flattened["scopes"])
182182

183183
userInfo := flattened["user_info_endpoint"].([]interface{})[0].(map[string]interface{})
184-
assert.Equal(t, "[email protected]", userInfo["email"])
185-
assert.Equal(t, "John", userInfo["first_name"])
186-
assert.Equal(t, "Doe", userInfo["last_name"])
187-
assert.Equal(t, "devops", userInfo["spectro_team"])
184+
assert.Equal(t, "email", userInfo["email"])
185+
assert.Equal(t, "given_name", userInfo["first_name"])
186+
assert.Equal(t, "family_name", userInfo["last_name"])
187+
assert.Equal(t, "groups", userInfo["spectro_team"])
188188
}
189189

190190
func TestToSAML(t *testing.T) {

0 commit comments

Comments
 (0)