Ab#82568

GNUmakefile

@@ -70,6 +70,62 @@ test:
 testacc:
 	TF_ACC=1 go test $(TEST) -v $(TESTARGS) -timeout 120m
 
+testunit:
+	go test ./keyfactor/ -run "TestUnit" -v $(TESTARGS) -timeout 30m
+
+testunit-record:
+	. $(KEYFACTOR_ENV_FILE) && RECORD_CASSETTES=1 go test ./keyfactor/ -run "TestUnit" -v -count=1 $(TESTARGS) -timeout 30m
+
+# Record a single unit test cassette. Usage: make testunit-record-one TEST_NAME=TestUnitFoo
+testunit-record-one:
+	@if [ -z "$(TEST_NAME)" ]; then echo "Usage: make testunit-record-one TEST_NAME=TestUnitFoo"; exit 1; fi
+	. $(KEYFACTOR_ENV_FILE) && RECORD_CASSETTES=1 go test ./keyfactor/ -run "$(TEST_NAME)" -v -count=1 -timeout 30m
+
+testunit-record-csr:
+	. $(KEYFACTOR_ENV_FILE) && RECORD_CASSETTES=1 go test ./keyfactor/ -run "TestUnitKeyfactorCertificateResource_CSR" -v -count=1 -timeout 30m
+
+# Run unit tests and display only failures (quiet mode)
+testunit-check:
+	go test ./keyfactor/ -run "TestUnit" -count=1 $(TESTARGS) -timeout 30m
+
+KEYFACTOR_ENV_FILE ?= ~/.env_ses2541
+KEYFACTOR_K8S_CREDENTIALS_FILE ?= $(HOME)/GolandProjects/terraform-keyfactor-provider-testing/examples/certs/deployment/k8s-creds.json
+
+testint:
+	. $(KEYFACTOR_ENV_FILE) && KEYFACTOR_K8S_CREDENTIALS_FILE=$(KEYFACTOR_K8S_CREDENTIALS_FILE) TF_ACC=1 go test ./keyfactor/ -run "TestInt" -v $(TESTARGS) -timeout 120m
+
+testint-check:
+	. $(KEYFACTOR_ENV_FILE) && KEYFACTOR_K8S_CREDENTIALS_FILE=$(KEYFACTOR_K8S_CREDENTIALS_FILE) TF_ACC=1 go test ./keyfactor/ -run "TestInt" -v -count=1 -timeout 120m
+
+testint-run:
+	@if [ -z "$(TEST_NAME)" ]; then echo "Usage: make testint-run TEST_NAME=TestIntFoo"; exit 1; fi
+	. $(KEYFACTOR_ENV_FILE) && KEYFACTOR_K8S_CREDENTIALS_FILE=$(KEYFACTOR_K8S_CREDENTIALS_FILE) TF_ACC=1 go test ./keyfactor/ -run "$(TEST_NAME)" -v -count=1 -timeout 120m
+
+testint-debug:
+	@if [ -z "$(TEST_NAME)" ]; then echo "Usage: make testint-debug TEST_NAME=TestIntFoo"; exit 1; fi
+	. $(KEYFACTOR_ENV_FILE) && KEYFACTOR_K8S_CREDENTIALS_FILE=$(KEYFACTOR_K8S_CREDENTIALS_FILE) TF_LOG=DEBUG TF_ACC=1 go test ./keyfactor/ -run "$(TEST_NAME)" -v -count=1 -timeout 120m 2>&1 | tee /tmp/tf-debug.log
+
+# Run a single integration test with TF debug logging. Usage: make testint-debug-run TEST_NAME=TestIntFoo
+testint-debug-run:
+	@if [ -z "$(TEST_NAME)" ]; then echo "Usage: make testint-debug-run TEST_NAME=TestIntFoo"; exit 1; fi
+	. $(KEYFACTOR_ENV_FILE) && KEYFACTOR_K8S_CREDENTIALS_FILE=$(KEYFACTOR_K8S_CREDENTIALS_FILE) TF_LOG=DEBUG TF_ACC=1 go test ./keyfactor/ -run "$(TEST_NAME)" -v -count=1 -timeout 120m 2>&1 | tee /tmp/tf-debug.log
+
+# Run all tests (unit + int + acc). Requires lab connection.
+testall:
+	$(MAKE) testunit
+	$(MAKE) testint-check
+
+# Lint the provider code
+lint:
+	@which golangci-lint > /dev/null 2>&1 || (echo "golangci-lint not found, install from https://golangci-lint.run/usage/install/"; exit 1)
+	golangci-lint run ./...
+
+# Format Go files and check for issues
+check: fmt vet
+
+vet:
+	go vet ./...
+
 fmtcheck:
 	@./scripts/gofmtcheck.sh
 
@@ -84,14 +140,121 @@ setversion:
 	sed -i '' -e 's/VERSION = ".*"/VERSION = "$(VERSION)"/' keyfactor/version.go
 	@sed -i '' -e 's/TAG_VERSION=v*.*/TAG_VERSION=v$(VERSION)/' tag.sh
 
+tidy:
+	go mod tidy
+
 vendor:
 	rm -rf vendor
 	go mod vendor
 
+vendor-dev:
+	go mod tidy
+	./vendor_dev.sh
+
 tag:
 	git tag -d v$(VERSION) || true
 	git push origin v$(VERSION) || true
 	git tag v$(VERSION) || true
 	git push origin v$(VERSION) || true
 
-.PHONY: build release install test testacc fmtcheck fmt tag setversion vendor
+showlines:
+	@if [ -z "$(FILE)" ] || [ -z "$(FROM)" ] || [ -z "$(TO)" ]; then \
+		echo "Usage: make showlines FILE=<path> FROM=<line> TO=<line>"; \
+		exit 1; \
+	fi
+	@sed -n '$(FROM),$(TO)p' $(FILE) | cat -v
+
+# ---------------------------------------------------------------------------
+# Applications API debugging targets (uses KEYFACTOR_ENV_FILE credentials)
+# Usage examples:
+#   make api-list-applications
+#   make api-get-application APP_ID=9
+#   make api-create-application APP_NAME=my-app
+#   make api-update-application APP_ID=9 APP_NAME=my-app APP_INTERVAL=30
+#   make api-delete-application APP_ID=9
+#   make api-options-application
+# ---------------------------------------------------------------------------
+APP_ID ?= 1
+APP_NAME ?= test-application
+APP_INTERVAL ?= 60
+APP_DAILY_TIME ?=
+APP_OVERWRITE ?= false
+
+# Internal helper: get OAuth token from env file
+define get_token
+	. $(KEYFACTOR_ENV_FILE) && TOKEN=$$(curl -sk -X POST "$$KEYFACTOR_AUTH_TOKEN_URL" \
+		-d "grant_type=client_credentials&client_id=$$KEYFACTOR_AUTH_CLIENT_ID&client_secret=$$KEYFACTOR_AUTH_CLIENT_SECRET" \
+		| jq -r '.access_token')
+endef
+
+api-list-applications:
+	@. $(KEYFACTOR_ENV_FILE) && TOKEN=$$(curl -sk -X POST "$$KEYFACTOR_AUTH_TOKEN_URL" \
+		-d "grant_type=client_credentials&client_id=$$KEYFACTOR_AUTH_CLIENT_ID&client_secret=$$KEYFACTOR_AUTH_CLIENT_SECRET" \
+		| jq -r '.access_token') && \
+	curl -sk "https://$$KEYFACTOR_HOSTNAME/$${KEYFACTOR_API_PATH:-Keyfactor/API}/Applications" \
+		-H "x-keyfactor-requested-with: APIClient" \
+		-H "x-keyfactor-api-version: 1" \
+		-H "Authorization: Bearer $$TOKEN" | jq .
+
+api-get-application:
+	@if [ -z "$(APP_ID)" ]; then echo "Usage: make api-get-application APP_ID=<id>"; exit 1; fi
+	@. $(KEYFACTOR_ENV_FILE) && TOKEN=$$(curl -sk -X POST "$$KEYFACTOR_AUTH_TOKEN_URL" \
+		-d "grant_type=client_credentials&client_id=$$KEYFACTOR_AUTH_CLIENT_ID&client_secret=$$KEYFACTOR_AUTH_CLIENT_SECRET" \
+		| jq -r '.access_token') && \
+	curl -sk "https://$$KEYFACTOR_HOSTNAME/$${KEYFACTOR_API_PATH:-Keyfactor/API}/Applications/$(APP_ID)" \
+		-H "x-keyfactor-requested-with: APIClient" \
+		-H "x-keyfactor-api-version: 1" \
+		-H "Authorization: Bearer $$TOKEN" | jq .
+
+api-create-application:
+	@. $(KEYFACTOR_ENV_FILE) && TOKEN=$$(curl -sk -X POST "$$KEYFACTOR_AUTH_TOKEN_URL" \
+		-d "grant_type=client_credentials&client_id=$$KEYFACTOR_AUTH_CLIENT_ID&client_secret=$$KEYFACTOR_AUTH_CLIENT_SECRET" \
+		| jq -r '.access_token') && \
+	curl -sk -w "\nHTTP_STATUS: %{http_code}\n" -X POST \
+		"https://$$KEYFACTOR_HOSTNAME/$${KEYFACTOR_API_PATH:-Keyfactor/API}/Applications" \
+		-H "x-keyfactor-requested-with: APIClient" \
+		-H "x-keyfactor-api-version: 1" \
+		-H "Content-Type: application/json" \
+		-H "Authorization: Bearer $$TOKEN" \
+		-d "{\"Name\":\"$(APP_NAME)\",\"OverwriteSchedules\":$(APP_OVERWRITE),\"Schedule\":{\"Interval\":{\"Minutes\":$(APP_INTERVAL)}}}" | jq .
+
+api-update-application:
+	@if [ -z "$(APP_ID)" ]; then echo "Usage: make api-update-application APP_ID=<id> [APP_NAME=...] [APP_INTERVAL=...]"; exit 1; fi
+	@. $(KEYFACTOR_ENV_FILE) && TOKEN=$$(curl -sk -X POST "$$KEYFACTOR_AUTH_TOKEN_URL" \
+		-d "grant_type=client_credentials&client_id=$$KEYFACTOR_AUTH_CLIENT_ID&client_secret=$$KEYFACTOR_AUTH_CLIENT_SECRET" \
+		| jq -r '.access_token') && \
+	curl -sk -w "\nHTTP_STATUS: %{http_code}\n" -X PUT \
+		"https://$$KEYFACTOR_HOSTNAME/$${KEYFACTOR_API_PATH:-Keyfactor/API}/Applications" \
+		-H "x-keyfactor-requested-with: APIClient" \
+		-H "x-keyfactor-api-version: 1" \
+		-H "Content-Type: application/json" \
+		-H "Authorization: Bearer $$TOKEN" \
+		-d "{\"Id\":$(APP_ID),\"Name\":\"$(APP_NAME)\",\"OverwriteSchedules\":$(APP_OVERWRITE),\"Schedule\":{\"Interval\":{\"Minutes\":$(APP_INTERVAL)}}}" | jq .
+
+api-delete-application:
+	@if [ -z "$(APP_ID)" ]; then echo "Usage: make api-delete-application APP_ID=<id>"; exit 1; fi
+	@. $(KEYFACTOR_ENV_FILE) && TOKEN=$$(curl -sk -X POST "$$KEYFACTOR_AUTH_TOKEN_URL" \
+		-d "grant_type=client_credentials&client_id=$$KEYFACTOR_AUTH_CLIENT_ID&client_secret=$$KEYFACTOR_AUTH_CLIENT_SECRET" \
+		| jq -r '.access_token') && \
+	curl -sk -w "\nHTTP_STATUS: %{http_code}\n" -X DELETE \
+		"https://$$KEYFACTOR_HOSTNAME/$${KEYFACTOR_API_PATH:-Keyfactor/API}/Applications/$(APP_ID)" \
+		-H "x-keyfactor-requested-with: APIClient" \
+		-H "x-keyfactor-api-version: 1" \
+		-H "Authorization: Bearer $$TOKEN"
+
+api-options-application:
+	@. $(KEYFACTOR_ENV_FILE) && TOKEN=$$(curl -sk -X POST "$$KEYFACTOR_AUTH_TOKEN_URL" \
+		-d "grant_type=client_credentials&client_id=$$KEYFACTOR_AUTH_CLIENT_ID&client_secret=$$KEYFACTOR_AUTH_CLIENT_SECRET" \
+		| jq -r '.access_token') && \
+	echo "--- OPTIONS /Applications ---" && \
+	curl -sk -i -X OPTIONS "https://$$KEYFACTOR_HOSTNAME/$${KEYFACTOR_API_PATH:-Keyfactor/API}/Applications" \
+		-H "x-keyfactor-requested-with: APIClient" \
+		-H "x-keyfactor-api-version: 1" \
+		-H "Authorization: Bearer $$TOKEN" 2>&1 | grep -i "^allow:" && \
+	echo "--- OPTIONS /Applications/$(APP_ID) ---" && \
+	curl -sk -i -X OPTIONS "https://$$KEYFACTOR_HOSTNAME/$${KEYFACTOR_API_PATH:-Keyfactor/API}/Applications/$(APP_ID)" \
+		-H "x-keyfactor-requested-with: APIClient" \
+		-H "x-keyfactor-api-version: 1" \
+		-H "Authorization: Bearer $$TOKEN" 2>&1 | grep -i "^allow:"
+
+.PHONY: build release install test testacc testunit testunit-record testunit-record-one testunit-record-csr testunit-check testint testint-check testint-run testint-debug testint-debug-run testall lint check vet fmtcheck fmt tag setversion vendor vendor-dev showlines api-list-applications api-get-application api-create-application api-update-application api-delete-application api-options-application

README.md

@@ -27,6 +27,74 @@ resources become available.
 * If you want to contribute bug fixes or proposed enhancements, see the [Contributing Guidelines](CONTRIBUTING.md) and
   create a [Pull request](../../pulls).
 
+## Authentication
+
+The provider supports three authentication methods. Kerberos is evaluated first when any Kerberos field is set, then Basic, then OAuth.
+
+### Basic Auth
+
+```terraform
+provider "keyfactor" {
+  hostname = "mykfinstance.kfdelivery.com"
+  username = "COMMAND\\svc_terraform"
+  password = "your_password"
+  domain   = "COMMAND"
+}
+```
+
+Environment variables: `KEYFACTOR_HOSTNAME`, `KEYFACTOR_USERNAME`, `KEYFACTOR_PASSWORD`, `KEYFACTOR_DOMAIN`
+
+### OAuth
+
+```terraform
+provider "keyfactor" {
+  hostname      = "mykfinstance.kfdelivery.com"
+  client_id     = "my_client_id"
+  client_secret = "my_client_secret"
+  token_url     = "https://idp.example.com/realms/Keyfactor/protocol/openid-connect/token"
+  scopes        = "enroll,agents,cert:admin"
+}
+```
+
+Environment variables: `KEYFACTOR_AUTH_CLIENT_ID`, `KEYFACTOR_AUTH_CLIENT_SECRET`, `KEYFACTOR_AUTH_TOKEN_URL`, `KEYFACTOR_AUTH_SCOPES`
+
+### Kerberos / SPNEGO
+
+Three sub-modes are supported — the provider selects automatically based on which fields are set:
+
+| Sub-mode | Required fields |
+|----------|----------------|
+| Password | `kerberos_realm` + `kerberos_username` + `kerberos_password` |
+| Keytab   | `kerberos_realm` + `kerberos_username` + `kerberos_keytab` |
+| CCache   | `kerberos_ccache` |
+
+```terraform
+# Password-based
+provider "keyfactor" {
+  hostname          = "mykfinstance.kfdelivery.com"
+  kerberos_realm    = "EXAMPLE.COM"
+  kerberos_username = "svc_terraform"
+  kerberos_password = "your_kerberos_password"
+  # kerberos_disable_pafxfast = true  # required for some Active Directory environments
+}
+
+# Keytab-based
+provider "keyfactor" {
+  hostname          = "mykfinstance.kfdelivery.com"
+  kerberos_realm    = "EXAMPLE.COM"
+  kerberos_username = "svc_terraform"
+  kerberos_keytab   = "/etc/keyfactor/svc_terraform.keytab"
+}
+
+# CCache (after running kinit)
+provider "keyfactor" {
+  hostname        = "mykfinstance.kfdelivery.com"
+  kerberos_ccache = "/tmp/krb5cc_1000"
+}
+```
+
+Environment variables: `KEYFACTOR_AUTH_KRB_REALM`, `KEYFACTOR_AUTH_KRB_USERNAME`, `KEYFACTOR_AUTH_KRB_PASSWORD`, `KEYFACTOR_AUTH_KRB_KEYTAB`, `KEYFACTOR_AUTH_KRB_CCACHE`, `KEYFACTOR_AUTH_KRB_CONFIG`, `KEYFACTOR_AUTH_KRB_SPN`, `KEYFACTOR_AUTH_KRB_DISABLE_PAFXFAST`
+
 ## Usage
 
 * [Documentation](https://registry.terraform.io/providers/keyfactor-pub/keyfactor/latest/docs)

docs/data-sources/application.md

@@ -0,0 +1,55 @@
+---
+page_title: "keyfactor_application Data Source - terraform-provider-keyfactor"
+subcategory: ""
+description: |-
+  Reads an existing Keyfactor Command Application (certificate store container) by name or integer ID. Requires Keyfactor Command v25.0+.
+---
+
+# keyfactor_application (Data Source)
+
+Reads an existing Keyfactor Command Application (certificate store container).
+
+> [!NOTE]
+> Applications are only available in Keyfactor Command v25.0+
+
+## Example Usage
+
+```terraform
+# Look up an application by name
+data "keyfactor_application" "by_name" {
+  identifier = "My App"
+}
+
+# Look up an application by integer ID
+data "keyfactor_application" "by_id" {
+  identifier = "42"
+}
+
+# Reference a managed application resource via the data source
+resource "keyfactor_application" "example" {
+  name = "My App"
+}
+
+data "keyfactor_application" "example" {
+  identifier = keyfactor_application.example.name
+}
+
+output "store_ids" {
+  value = data.keyfactor_application.example.certificate_store_ids
+}
+```
+
+## Schema
+
+### Required
+
+- `identifier` (String) The name or integer ID of the application to look up.
+
+### Read-Only
+
+- `certificate_store_ids` (List of String) List of certificate store GUIDs (UUIDs) assigned to this application.
+- `id` (Number) Integer ID of the application in Keyfactor Command.
+- `name` (String) Name of the application.
+- `overwrite_schedules` (Boolean) Whether the application schedule overwrites member certificate store schedules.
+- `schedule_daily_time` (String) Inventory schedule daily time as an ISO 8601 datetime string, if a daily schedule is configured.
+- `schedule_interval_minutes` (Number) Inventory schedule interval in minutes, if an interval-based schedule is configured.

docs/index.md

@@ -93,6 +93,29 @@ provider "keyfactor" {
 
   alias = "keyfactor_command_oauth" # This isn't required
 }
+
+# kerberos auth - password-based
+provider "keyfactor" {
+  hostname                  = "mykfinstance.kfdelivery.com"
+  kerberos_realm            = "EXAMPLE.COM"
+  kerberos_username         = "svc_terraform"
+  kerberos_password         = "your_kerberos_password"
+  kerberos_disable_pafxfast = true # required for most Active Directory environments
+}
+
+# kerberos auth - keytab-based
+provider "keyfactor" {
+  hostname          = "mykfinstance.kfdelivery.com"
+  kerberos_realm    = "EXAMPLE.COM"
+  kerberos_username = "svc_terraform"
+  kerberos_keytab   = "/etc/keyfactor/svc_terraform.keytab"
+}
+
+# kerberos auth - credential cache (after running kinit)
+provider "keyfactor" {
+  hostname        = "mykfinstance.kfdelivery.com"
+  kerberos_ccache = "/tmp/krb5cc_1000"
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -117,6 +140,14 @@ provider "keyfactor" {
 - `pfx_password_min_uppercases` (Number) The minimum number of uppercase letters to use when generating a PFX password. Default value is `4`.
 - `request_timeout` (Number) Global timeout for HTTP requests to Keyfactor Command instance. This can also be set via the `KEYFACTOR_CLIENT_TIMEOUT` environment variable.Default value is `60`.
 - `scopes` (String) A list of comma separated OAuth scopes to request when authenticating. This can also be set via the `KEYFACTOR_AUTH_SCOPES` environment variable.
+- `kerberos_ccache` (String) Path to the Kerberos credential cache file for ccache-based authentication. This can also be set via the `KEYFACTOR_AUTH_KRB_CCACHE` environment variable.
+- `kerberos_config` (String) Path to the krb5.conf Kerberos configuration file. Defaults to /etc/krb5.conf. This can also be set via the `KEYFACTOR_AUTH_KRB_CONFIG` environment variable.
+- `kerberos_disable_pafxfast` (Boolean) Disable PA-FX-FAST for Active Directory Kerberos compatibility. Default value is `false`.
+- `kerberos_keytab` (String) Path to the Kerberos keytab file for keytab-based authentication. This can also be set via the `KEYFACTOR_AUTH_KRB_KEYTAB` environment variable.
+- `kerberos_password` (String, Sensitive) Password for password-based Kerberos authentication. This can also be set via the `KEYFACTOR_AUTH_KRB_PASSWORD` environment variable.
+- `kerberos_realm` (String) Kerberos realm for Kerberos/SPNEGO authentication (e.g. EXAMPLE.COM). This can also be set via the `KEYFACTOR_AUTH_KRB_REALM` environment variable.
+- `kerberos_spn` (String) Service Principal Name for Kerberos authentication. Auto-generated from hostname if omitted. This can also be set via the `KEYFACTOR_AUTH_KRB_SPN` environment variable.
+- `kerberos_username` (String) Kerberos principal username for password or keytab-based authentication. Accepts user@REALM format. This can also be set via the `KEYFACTOR_AUTH_KRB_USERNAME` environment variable.
 - `skip_tls_verify` (Boolean) Skip TLS verification when connecting to Keyfactor Command API and identity provider.Default value is `false`.This can also be set via the `KEYFACTOR_SKIP_VERIFY` environment variable.
 - `token_url` (String) OAuth token URL for Keyfactor Command instance. This can also be set via the `KEYFACTOR_AUTH_TOKEN_URL` environment variable.
 - `username` (String) Username of Keyfactor Command service account. This can also be set via the `KEYFACTOR_USERNAME` environment variable.