Add support for managing vCenter Single Sign-on domain local users and groups

[dbond007]

Description

Add support to create local user and groups in SSO

Currently you can create roles and apply permissions which require users or groups, but I can't see any way to actually create local users or groups for these resources.

Potential Terraform Configuration

resource vsphere_sso_user "user" {
  name = "Johnny.Appleseed"
  password = "VMw@re1!"
  description = "Terraform"
  first_name = "Johnny"
  last_name = "Appleseed"
}

resource vsphere_sso_group "group" {
  name = "my_group"
  members = ["Johnny.Appleseed"]
}

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[tenthirtyam]

A resource to:

• Add / remove / update custom groups in vCenter Single Sign-on.
• Add / remove users or groups to / from the vCenter Single Sign-on from the default IdP (vsphere.local), external identity source (e.g. rainpole.io), or localos.

A data source to:

• Return all vCenter Single Sign-on groups.
• Return all vCenter Single Sign-on groups members

Ryan

[FlxPeters]

I'm currently working on this issue because we have a demand to manage the local users by Terraform.
It's a bit tricky since the API requires an additional authentication, but this should be possible to implement.

GOVC has the code in place, I just need to adapt it for the Terraform provider: https://github.com/vmware/govmomi/blob/35b0fff9184dc7d7e0c7ef31c86242d138170f68/govc/sso/client.go#L42

Another issue is that there are two kinds on local users: personal users (like the Administrator) and service users used for vCenter extensions etc.
I will focus on the personal users first, but should be possible to extend it to service users as well.

[lagebj]

@FlxPeters Awesome! Keep us posted and let us know if you need help with testing :)

[FlxPeters]

Here is a first approach how to solve the issue: #2054

I mostly reuse the way how govc does it and issue an SSO admin token each time the client is used.
We cannot use a prepared client in the config (like the rest client etc.), since most of the time users shouldn't have proper permissions to even issue an SSO admin token. So my approach is to provide a config wrapper including all required parts to issue a token on demand in the helper.

What do you think about that? If it's fine I will move on with implementing further resources and data sources.