Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use configured client_secret in state to properly handle changes #4500

Closed
wants to merge 2 commits into from
Closed

Use configured client_secret in state to properly handle changes #4500

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7413504
Use configured client_secret in state to properly handle changes
JonasBak Nov 4, 2024
c4346b3
Ignore change to imported client_secret in test
JonasBak Nov 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .changelog/4500.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:bug
resource/cloudflare_zero_trust_access_identity_provider: Fix `client_secret` attribute always causing update, even when not changed
```
6 changes: 3 additions & 3 deletions internal/sdkv2provider/resource_cloudflare_access_identity_provider.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ func resourceCloudflareAccessIdentityProviderRead(ctx context.Context, d *schema
d.Set("name", accessIdentityProvider.Name)
d.Set("type", accessIdentityProvider.Type)

config := convertAccessIDPConfigStructToSchema(accessIdentityProvider.Config)
config := convertAccessIDPConfigStructToSchema(d.Get("config.0.client_secret").(string), accessIdentityProvider.Config)
if configErr := d.Set("config", config); configErr != nil {
return diag.FromErr(fmt.Errorf("error setting Access Identity Provider configuration: %w", configErr))
}
Expand Down Expand Up @@ -285,7 +285,7 @@ func convertScimConfigSchemaToStruct(d *schema.ResourceData) cloudflare.AccessId
return ScimConfig
}

func convertAccessIDPConfigStructToSchema(options cloudflare.AccessIdentityProviderConfiguration) []interface{} {
func convertAccessIDPConfigStructToSchema(clientSecret string, options cloudflare.AccessIdentityProviderConfiguration) []interface{} {
attributes := make([]string, 0)
for _, value := range options.Attributes {
attributes = append(attributes, value)
Expand All @@ -301,7 +301,7 @@ func convertAccessIDPConfigStructToSchema(options cloudflare.AccessIdentityProvi
"centrify_app_id": options.CentrifyAppID,
"certs_url": options.CertsURL,
"client_id": options.ClientID,
"client_secret": options.ClientSecret,
"client_secret": clientSecret,
"claims": options.Claims,
"scopes": options.Scopes,
"directory_id": options.DirectoryID,
Expand Down
11 changes: 6 additions & 5 deletions internal/sdkv2provider/resource_cloudflare_access_identity_provider_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,11 +262,12 @@ func TestAccCloudflareAccessIdentityProvider_OAuth_Import(t *testing.T) {
Check: checkFn,
},
{
ImportState: true,
ImportStateVerify: true,
ResourceName: resourceName,
ImportStateIdPrefix: fmt.Sprintf("%s/", accountID),
Check: checkFn,
ImportState: true,
ImportStateVerify: true,
ImportStateVerifyIgnore: []string{"config.0.client_secret"},
ResourceName: resourceName,
ImportStateIdPrefix: fmt.Sprintf("%s/", accountID),
Check: checkFn,
},
},
})
Expand Down
11 changes: 3 additions & 8 deletions internal/sdkv2provider/schema_cloudflare_access_identity_provider.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,14 +83,9 @@ func resourceCloudflareAccessIdentityProviderSchema() map[string]*schema.Schema
Optional: true,
},
"client_secret": {
Type: schema.TypeString,
Optional: true,
// client_secret is a write only operation from the Cloudflare API
// and once it's set, it is no longer accessible. To avoid storing
// it and messing up the state, hardcode in the concealed version.
StateFunc: func(val interface{}) string {
return CONCEALED_STRING
},
Type: schema.TypeString,
Optional: true,
Sensitive: true,
},
"claims": {
Type: schema.TypeList,
Expand Down