Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Correct defaults on okta_idp_oidc, okta_idp_saml, and okta_idp_social. #1134

Merged
merged 1 commit into from
May 24, 2022
Merged

Correct defaults on okta_idp_oidc, okta_idp_saml, and okta_idp_social. #1134

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion examples/okta_idp_oidc/generic_oidc.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ resource "okta_idp_oidc" "test" {
jwks_binding = "HTTP-REDIRECT"
scopes = ["openid"]
client_id = "efg456"
client_secret = "efg456"
client_secret = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
issuer_url = "https://id.example.com"
username_template = "idpuser.email"
}
2 changes: 1 addition & 1 deletion examples/okta_idp_oidc/generic_oidc_updated.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ resource "okta_idp_oidc" "test" {
jwks_binding = "HTTP-REDIRECT"
scopes = ["openid"]
client_id = "efg456"
client_secret = "efg456"
client_secret = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
issuer_url = "https://id.example.com"
username_template = "idpuser.email"
}
62 changes: 43 additions & 19 deletions okta/idp.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,20 +80,6 @@ var (
Type: schema.TypeBool,
Optional: true,
},
"request_signature_algorithm": algorithmSchema,
"request_signature_scope": {
Type: schema.TypeString,
Optional: true,
Description: "algorithm to use to sign response",
ValidateDiagFunc: elemInSlice([]string{"REQUEST", ""}),
},
"response_signature_algorithm": algorithmSchema,
"response_signature_scope": {
Type: schema.TypeString,
Optional: true,
Description: "algorithm to use to sign response",
ValidateDiagFunc: elemInSlice([]string{"RESPONSE", "ANY", ""}),
},
}

actionSchema = &schema.Schema{
Expand All @@ -102,13 +88,51 @@ var (
Default: "NONE",
}

algorithmSchema = &schema.Schema{
samlRequestSignatureAlgorithmSchema = &schema.Schema{
Type: schema.TypeString,
Optional: true,
Description: "The XML digital Signature Algorithm used when signing an <AuthnRequest> message",
ValidateDiagFunc: elemInSlice([]string{"SHA-256", "SHA-1"}),
Default: "SHA-256",
}
samlRequestSignatureScopeSchema = &schema.Schema{
Type: schema.TypeString,
Optional: true,
Description: "Specifies whether to digitally sign <AuthnRequest> messages to the IdP",
ValidateDiagFunc: elemInSlice([]string{"REQUEST", "NONE"}),
Default: "REQUEST",
}

samlResponseSignatureAlgorithmSchema = &schema.Schema{
Type: schema.TypeString,
Optional: true,
Description: "algorithm to use to sign requests",
Description: "The minimum XML digital Signature Algorithm allowed when verifying a <SAMLResponse> message or <Assertion> element",
ValidateDiagFunc: elemInSlice([]string{"SHA-256", "SHA-1"}),
Default: "SHA-256",
}
samlResponseSignatureScopeSchema = &schema.Schema{
Type: schema.TypeString,
Optional: true,
Description: "Specifies whether to verify a <SAMLResponse> message or <Assertion> element XML digital signature",
ValidateDiagFunc: elemInSlice([]string{"RESPONSE", "ASSERTION", "ANY"}),
Default: "ANY",
}

oidcRequestSignatureAlgorithmSchema = &schema.Schema{
Type: schema.TypeString,
Optional: true,
Description: "The HMAC Signature Algorithm used when signing an authorization request",
ValidateDiagFunc: elemInSlice([]string{"HS256", "HS384", "HS512"}),
Default: "HS256",
}

oidcRequestSignatureScopeSchema = &schema.Schema{
Type: schema.TypeString,
Optional: true,
Description: "Specifies whether to digitally sign an authorization request to the IdP",
ValidateDiagFunc: elemInSlice([]string{"REQUEST", "NONE"}),
Default: "REQUEST",
}

optBindingSchema = &schema.Schema{
Type: schema.TypeString,
Expand Down Expand Up @@ -285,14 +309,14 @@ func buildAlgorithms(d *schema.ResourceData) *okta.ProtocolAlgorithms {

func buildProtocolAlgorithmType(d *schema.ResourceData, key string) *okta.ProtocolAlgorithmType {
scopeKey := fmt.Sprintf("%s_signature_scope", key)
scope := d.Get(scopeKey).(string)
if scope == "" {
scope, ok := d.GetOk(scopeKey)
if !ok || scope.(string) == "" {
return nil
}
return &okta.ProtocolAlgorithmType{
Signature: &okta.ProtocolAlgorithmTypeSignature{
Algorithm: d.Get(fmt.Sprintf("%s_signature_algorithm", key)).(string),
Scope: scope,
Scope: scope.(string),
},
}
}
Expand Down
2 changes: 2 additions & 0 deletions okta/resource_okta_idp_oidc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,8 @@ func resourceIdpOidc() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
"request_signature_algorithm": oidcRequestSignatureAlgorithmSchema,
"request_signature_scope": oidcRequestSignatureScopeSchema,
}),
}
}
Expand Down
4 changes: 2 additions & 2 deletions okta/resource_okta_idp_oidc_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ func TestAccOktaIdpOidc_crud(t *testing.T) {
resource.TestCheckResourceAttr(resourceName, "jwks_url", "https://idp.example.com/keys"),
resource.TestCheckResourceAttr(resourceName, "jwks_binding", "HTTP-REDIRECT"),
resource.TestCheckResourceAttr(resourceName, "client_id", "efg456"),
resource.TestCheckResourceAttr(resourceName, "client_secret", "efg456"),
resource.TestCheckResourceAttr(resourceName, "client_secret", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"),
resource.TestCheckResourceAttr(resourceName, "issuer_url", "https://id.example.com"),
resource.TestCheckResourceAttr(resourceName, "username_template", "idpuser.email"),
),
Expand All @@ -51,7 +51,7 @@ func TestAccOktaIdpOidc_crud(t *testing.T) {
resource.TestCheckResourceAttr(resourceName, "jwks_url", "https://idp.example.com/keys2"),
resource.TestCheckResourceAttr(resourceName, "jwks_binding", "HTTP-REDIRECT"),
resource.TestCheckResourceAttr(resourceName, "client_id", "efg456"),
resource.TestCheckResourceAttr(resourceName, "client_secret", "efg456"),
resource.TestCheckResourceAttr(resourceName, "client_secret", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"),
resource.TestCheckResourceAttr(resourceName, "issuer_url", "https://id.example.com"),
resource.TestCheckResourceAttr(resourceName, "username_template", "idpuser.email"),
),
Expand Down
4 changes: 4 additions & 0 deletions okta/resource_okta_idp_saml.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,10 @@ func resourceIdpSaml() *schema.Resource {
Type: schema.TypeString,
Computed: true,
},
"request_signature_algorithm": samlRequestSignatureAlgorithmSchema,
"request_signature_scope": samlRequestSignatureScopeSchema,
"response_signature_algorithm": samlResponseSignatureAlgorithmSchema,
"response_signature_scope": samlResponseSignatureScopeSchema,
}),
}
}
Expand Down
4 changes: 4 additions & 0 deletions website/docs/r/idp_oidc.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,10 @@ The following arguments are supported:

- `profile_master` - (Optional) Determines if the IdP should act as a source of truth for user profile attributes.

- `request_signature_algorithm` - (Optional) The HMAC Signature Algorithm used when signing an authorization request. It can be `"HS256"`, `"HS384"`, or `"HS512"`.

- `request_signature_scope` - (Optional) Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be `"REQUEST"` or `"NONE"`.

## Attributes Reference

- `id` - ID of the IdP.
Expand Down
4 changes: 2 additions & 2 deletions website/docs/r/idp_saml.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,11 +85,11 @@ The following arguments are supported:

- `profile_master` - (Optional) Determines if the IdP should act as a source of truth for user profile attributes.

- `request_signature_algorithm` - (Optional) The XML digital signature algorithm used when signing an AuthnRequest message.
- `request_signature_algorithm` - (Optional) The XML digital signature algorithm used when signing an AuthnRequest message. It can be `"SHA-256"` or `"SHA-1"`.

- `request_signature_scope` - (Optional) Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be `"REQUEST"` or `"NONE"`.

- `response_signature_algorithm` - (Optional) The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element.
- `response_signature_algorithm` - (Optional) The minimum XML digital signature algorithm allowed when verifying a SAMLResponse message or Assertion element. It can be `"SHA-256"` or `"SHA-1"`.

- `response_signature_scope` - (Optional) Specifies whether to verify a SAMLResponse message or Assertion element XML digital signature. It can be `"RESPONSE"`, `"ASSERTION"`, or `"ANY"`.

Expand Down