Skip to content

Commit 23ef18b

Browse files
dbonfdbonf
authored
add is_system attribute to sysdig_sso_saml and sysdig_sso_openid resources (#714)
In onprem installations regular sso settings are not usable, but users should use system sso settings for the same purpuse. System sso settings are identical to regular sso settings but they work at a different permission level. For this reason, we introduce a new attribute, `is_system`, to let onprem users create system sso settings.
1 parent f3586ff commit 23ef18b

10 files changed

Lines changed: 762 additions & 104 deletions

‎sysdig/internal/client/v2/sso_openid.go‎

Lines changed: 41 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -14,23 +14,28 @@ const (
1414
getSSOOpenIDPath = "%s/platform/v1/sso-settings/%d"
1515
updateSSOOpenIDPath = "%s/platform/v1/sso-settings/%d"
1616
deleteSSOOpenIDPath = "%s/platform/v1/sso-settings/%d"
17+
18+
createSystemSSOOpenIDPath = "%s/platform/v1/system-sso-settings/"
19+
getSystemSSOOpenIDPath = "%s/platform/v1/system-sso-settings/%d"
20+
updateSystemSSOOpenIDPath = "%s/platform/v1/system-sso-settings/%d"
21+
deleteSystemSSOOpenIDPath = "%s/platform/v1/system-sso-settings/%d"
1722
)
1823

1924
type SSOOpenIDInterface interface {
2025
Base
21-
CreateSSOOpenID(ctx context.Context, sso *SSOOpenID) (*SSOOpenID, error)
22-
GetSSOOpenID(ctx context.Context, id int) (*SSOOpenID, error)
23-
UpdateSSOOpenID(ctx context.Context, id int, sso *SSOOpenID) (*SSOOpenID, error)
24-
DeleteSSOOpenID(ctx context.Context, id int) error
26+
CreateSSOOpenID(ctx context.Context, isSystem bool, sso *SSOOpenID) (*SSOOpenID, error)
27+
GetSSOOpenID(ctx context.Context, isSystem bool, id int) (*SSOOpenID, error)
28+
UpdateSSOOpenID(ctx context.Context, isSystem bool, id int, sso *SSOOpenID) (*SSOOpenID, error)
29+
DeleteSSOOpenID(ctx context.Context, isSystem bool, id int) error
2530
}
2631

27-
func (c *Client) CreateSSOOpenID(ctx context.Context, sso *SSOOpenID) (result *SSOOpenID, err error) {
32+
func (c *Client) CreateSSOOpenID(ctx context.Context, isSystem bool, sso *SSOOpenID) (result *SSOOpenID, err error) {
2833
payload, err := Marshal(sso)
2934
if err != nil {
3035
return nil, err
3136
}
3237

33-
response, err := c.requester.Request(ctx, http.MethodPost, c.createSSOOpenIDURL(), payload)
38+
response, err := c.requester.Request(ctx, http.MethodPost, c.createSSOOpenIDURL(isSystem), payload)
3439
if err != nil {
3540
return nil, err
3641
}
@@ -47,8 +52,8 @@ func (c *Client) CreateSSOOpenID(ctx context.Context, sso *SSOOpenID) (result *S
4752
return Unmarshal[*SSOOpenID](response.Body)
4853
}
4954

50-
func (c *Client) GetSSOOpenID(ctx context.Context, id int) (result *SSOOpenID, err error) {
51-
response, err := c.requester.Request(ctx, http.MethodGet, c.getSSOOpenIDURL(id), nil)
55+
func (c *Client) GetSSOOpenID(ctx context.Context, isSystem bool, id int) (result *SSOOpenID, err error) {
56+
response, err := c.requester.Request(ctx, http.MethodGet, c.getSSOOpenIDURL(isSystem, id), nil)
5257
if err != nil {
5358
return nil, err
5459
}
@@ -68,13 +73,13 @@ func (c *Client) GetSSOOpenID(ctx context.Context, id int) (result *SSOOpenID, e
6873
return Unmarshal[*SSOOpenID](response.Body)
6974
}
7075

71-
func (c *Client) UpdateSSOOpenID(ctx context.Context, id int, sso *SSOOpenID) (result *SSOOpenID, err error) {
76+
func (c *Client) UpdateSSOOpenID(ctx context.Context, isSystem bool, id int, sso *SSOOpenID) (result *SSOOpenID, err error) {
7277
payload, err := Marshal(sso)
7378
if err != nil {
7479
return nil, err
7580
}
7681

77-
response, err := c.requester.Request(ctx, http.MethodPut, c.updateSSOOpenIDURL(id), payload)
82+
response, err := c.requester.Request(ctx, http.MethodPut, c.updateSSOOpenIDURL(isSystem, id), payload)
7883
if err != nil {
7984
return nil, err
8085
}
@@ -91,8 +96,8 @@ func (c *Client) UpdateSSOOpenID(ctx context.Context, id int, sso *SSOOpenID) (r
9196
return Unmarshal[*SSOOpenID](response.Body)
9297
}
9398

94-
func (c *Client) DeleteSSOOpenID(ctx context.Context, id int) (err error) {
95-
response, err := c.requester.Request(ctx, http.MethodDelete, c.deleteSSOOpenIDURL(id), nil)
99+
func (c *Client) DeleteSSOOpenID(ctx context.Context, isSystem bool, id int) (err error) {
100+
response, err := c.requester.Request(ctx, http.MethodDelete, c.deleteSSOOpenIDURL(isSystem, id), nil)
96101
if err != nil {
97102
return err
98103
}
@@ -109,18 +114,34 @@ func (c *Client) DeleteSSOOpenID(ctx context.Context, id int) (err error) {
109114
return nil
110115
}
111116

112-
func (c *Client) createSSOOpenIDURL() string {
113-
return fmt.Sprintf(createSSOOpenIDPath, c.config.url)
117+
func (c *Client) createSSOOpenIDURL(isSystem bool) string {
118+
path := createSSOOpenIDPath
119+
if isSystem {
120+
path = createSystemSSOOpenIDPath
121+
}
122+
return fmt.Sprintf(path, c.config.url)
114123
}
115124

116-
func (c *Client) getSSOOpenIDURL(id int) string {
117-
return fmt.Sprintf(getSSOOpenIDPath, c.config.url, id)
125+
func (c *Client) getSSOOpenIDURL(isSystem bool, id int) string {
126+
path := getSSOOpenIDPath
127+
if isSystem {
128+
path = getSystemSSOOpenIDPath
129+
}
130+
return fmt.Sprintf(path, c.config.url, id)
118131
}
119132

120-
func (c *Client) updateSSOOpenIDURL(id int) string {
121-
return fmt.Sprintf(updateSSOOpenIDPath, c.config.url, id)
133+
func (c *Client) updateSSOOpenIDURL(isSystem bool, id int) string {
134+
path := updateSSOOpenIDPath
135+
if isSystem {
136+
path = updateSystemSSOOpenIDPath
137+
}
138+
return fmt.Sprintf(path, c.config.url, id)
122139
}
123140

124-
func (c *Client) deleteSSOOpenIDURL(id int) string {
125-
return fmt.Sprintf(deleteSSOOpenIDPath, c.config.url, id)
141+
func (c *Client) deleteSSOOpenIDURL(isSystem bool, id int) string {
142+
path := deleteSSOOpenIDPath
143+
if isSystem {
144+
path = deleteSystemSSOOpenIDPath
145+
}
146+
return fmt.Sprintf(path, c.config.url, id)
126147
}

‎sysdig/internal/client/v2/sso_saml.go‎

Lines changed: 41 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -14,23 +14,28 @@ const (
1414
getSSOSamlPath = "%s/platform/v1/sso-settings/%d"
1515
updateSSOSamlPath = "%s/platform/v1/sso-settings/%d"
1616
deleteSSOSamlPath = "%s/platform/v1/sso-settings/%d"
17+
18+
createSystemSSOSamlPath = "%s/platform/v1/system-sso-settings/"
19+
getSystemSSOSamlPath = "%s/platform/v1/system-sso-settings/%d"
20+
updateSystemSSOSamlPath = "%s/platform/v1/system-sso-settings/%d"
21+
deleteSystemSSOSamlPath = "%s/platform/v1/system-sso-settings/%d"
1722
)
1823

1924
type SSOSamlInterface interface {
2025
Base
21-
CreateSSOSaml(ctx context.Context, sso *SSOSaml) (*SSOSaml, error)
22-
GetSSOSaml(ctx context.Context, id int) (*SSOSaml, error)
23-
UpdateSSOSaml(ctx context.Context, id int, sso *SSOSaml) (*SSOSaml, error)
24-
DeleteSSOSaml(ctx context.Context, id int) error
26+
CreateSSOSaml(ctx context.Context, isSystem bool, sso *SSOSaml) (*SSOSaml, error)
27+
GetSSOSaml(ctx context.Context, isSystem bool, id int) (*SSOSaml, error)
28+
UpdateSSOSaml(ctx context.Context, isSystem bool, id int, sso *SSOSaml) (*SSOSaml, error)
29+
DeleteSSOSaml(ctx context.Context, isSystem bool, id int) error
2530
}
2631

27-
func (c *Client) CreateSSOSaml(ctx context.Context, sso *SSOSaml) (result *SSOSaml, err error) {
32+
func (c *Client) CreateSSOSaml(ctx context.Context, isSystem bool, sso *SSOSaml) (result *SSOSaml, err error) {
2833
payload, err := Marshal(sso)
2934
if err != nil {
3035
return nil, err
3136
}
3237

33-
response, err := c.requester.Request(ctx, http.MethodPost, c.createSSOSamlURL(), payload)
38+
response, err := c.requester.Request(ctx, http.MethodPost, c.createSSOSamlURL(isSystem), payload)
3439
if err != nil {
3540
return nil, err
3641
}
@@ -47,8 +52,8 @@ func (c *Client) CreateSSOSaml(ctx context.Context, sso *SSOSaml) (result *SSOSa
4752
return Unmarshal[*SSOSaml](response.Body)
4853
}
4954

50-
func (c *Client) GetSSOSaml(ctx context.Context, id int) (result *SSOSaml, err error) {
51-
response, err := c.requester.Request(ctx, http.MethodGet, c.getSSOSamlURL(id), nil)
55+
func (c *Client) GetSSOSaml(ctx context.Context, isSystem bool, id int) (result *SSOSaml, err error) {
56+
response, err := c.requester.Request(ctx, http.MethodGet, c.getSSOSamlURL(isSystem, id), nil)
5257
if err != nil {
5358
return nil, err
5459
}
@@ -68,13 +73,13 @@ func (c *Client) GetSSOSaml(ctx context.Context, id int) (result *SSOSaml, err e
6873
return Unmarshal[*SSOSaml](response.Body)
6974
}
7075

71-
func (c *Client) UpdateSSOSaml(ctx context.Context, id int, sso *SSOSaml) (result *SSOSaml, err error) {
76+
func (c *Client) UpdateSSOSaml(ctx context.Context, isSystem bool, id int, sso *SSOSaml) (result *SSOSaml, err error) {
7277
payload, err := Marshal(sso)
7378
if err != nil {
7479
return nil, err
7580
}
7681

77-
response, err := c.requester.Request(ctx, http.MethodPut, c.updateSSOSamlURL(id), payload)
82+
response, err := c.requester.Request(ctx, http.MethodPut, c.updateSSOSamlURL(isSystem, id), payload)
7883
if err != nil {
7984
return nil, err
8085
}
@@ -91,8 +96,8 @@ func (c *Client) UpdateSSOSaml(ctx context.Context, id int, sso *SSOSaml) (resul
9196
return Unmarshal[*SSOSaml](response.Body)
9297
}
9398

94-
func (c *Client) DeleteSSOSaml(ctx context.Context, id int) (err error) {
95-
response, err := c.requester.Request(ctx, http.MethodDelete, c.deleteSSOSamlURL(id), nil)
99+
func (c *Client) DeleteSSOSaml(ctx context.Context, isSystem bool, id int) (err error) {
100+
response, err := c.requester.Request(ctx, http.MethodDelete, c.deleteSSOSamlURL(isSystem, id), nil)
96101
if err != nil {
97102
return err
98103
}
@@ -109,18 +114,34 @@ func (c *Client) DeleteSSOSaml(ctx context.Context, id int) (err error) {
109114
return nil
110115
}
111116

112-
func (c *Client) createSSOSamlURL() string {
113-
return fmt.Sprintf(createSSOSamlPath, c.config.url)
117+
func (c *Client) createSSOSamlURL(isSystem bool) string {
118+
path := createSSOSamlPath
119+
if isSystem {
120+
path = createSystemSSOSamlPath
121+
}
122+
return fmt.Sprintf(path, c.config.url)
114123
}
115124

116-
func (c *Client) getSSOSamlURL(id int) string {
117-
return fmt.Sprintf(getSSOSamlPath, c.config.url, id)
125+
func (c *Client) getSSOSamlURL(isSystem bool, id int) string {
126+
path := getSSOSamlPath
127+
if isSystem {
128+
path = getSystemSSOSamlPath
129+
}
130+
return fmt.Sprintf(path, c.config.url, id)
118131
}
119132

120-
func (c *Client) updateSSOSamlURL(id int) string {
121-
return fmt.Sprintf(updateSSOSamlPath, c.config.url, id)
133+
func (c *Client) updateSSOSamlURL(isSystem bool, id int) string {
134+
path := updateSSOSamlPath
135+
if isSystem {
136+
path = updateSystemSSOSamlPath
137+
}
138+
return fmt.Sprintf(path, c.config.url, id)
122139
}
123140

124-
func (c *Client) deleteSSOSamlURL(id int) string {
125-
return fmt.Sprintf(deleteSSOSamlPath, c.config.url, id)
141+
func (c *Client) deleteSSOSamlURL(isSystem bool, id int) string {
142+
path := deleteSSOSamlPath
143+
if isSystem {
144+
path = deleteSystemSSOSamlPath
145+
}
146+
return fmt.Sprintf(path, c.config.url, id)
126147
}

‎sysdig/resource_sysdig_sso_openid.go‎

Lines changed: 35 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"context"
55
"fmt"
66
"strconv"
7+
"strings"
78
"time"
89

910
v2 "github.com/draios/terraform-provider-sysdig/sysdig/internal/client/v2"
@@ -21,7 +22,7 @@ func resourceSysdigSSOOpenID() *schema.Resource {
2122
UpdateContext: resourceSysdigSSOOpenIDUpdate,
2223
DeleteContext: resourceSysdigSSOOpenIDDelete,
2324
Importer: &schema.ResourceImporter{
24-
StateContext: schema.ImportStatePassthroughContext,
25+
StateContext: importSSOOpenIDState,
2526
},
2627
Timeouts: &schema.ResourceTimeout{
2728
Create: schema.DefaultTimeout(timeout),
@@ -50,6 +51,13 @@ func resourceSysdigSSOOpenID() *schema.Resource {
5051
},
5152

5253
// Optional base SSO fields
54+
"is_system": {
55+
Type: schema.TypeBool,
56+
Optional: true,
57+
Default: false,
58+
ForceNew: true,
59+
Description: "Whether this is a system SSO configuration (Only applicable to on-prem installations)",
60+
},
5361
"product": {
5462
Type: schema.TypeString,
5563
Optional: true,
@@ -185,6 +193,21 @@ func validateSSOOpenIDMetadata(_ context.Context, diff *schema.ResourceDiff, _ a
185193
return nil
186194
}
187195

196+
func importSSOOpenIDState(_ context.Context, d *schema.ResourceData, _ any) ([]*schema.ResourceData, error) {
197+
importID := d.Id()
198+
if strings.HasPrefix(importID, "system/") {
199+
if err := d.Set("is_system", true); err != nil {
200+
return nil, err
201+
}
202+
d.SetId(strings.TrimPrefix(importID, "system/"))
203+
} else {
204+
if err := d.Set("is_system", false); err != nil {
205+
return nil, err
206+
}
207+
}
208+
return []*schema.ResourceData{d}, nil
209+
}
210+
188211
func resourceSysdigSSOOpenIDRead(ctx context.Context, d *schema.ResourceData, m any) diag.Diagnostics {
189212
client, err := m.(SysdigClients).sysdigCommonClientV2()
190213
if err != nil {
@@ -196,7 +219,9 @@ func resourceSysdigSSOOpenIDRead(ctx context.Context, d *schema.ResourceData, m
196219
return diag.FromErr(err)
197220
}
198221

199-
sso, err := client.GetSSOOpenID(ctx, id)
222+
isSystem := d.Get("is_system").(bool)
223+
224+
sso, err := client.GetSSOOpenID(ctx, isSystem, id)
200225
if err != nil {
201226
if err == v2.ErrSSOOpenIDNotFound {
202227
d.SetId("")
@@ -214,9 +239,10 @@ func resourceSysdigSSOOpenIDCreate(ctx context.Context, d *schema.ResourceData,
214239
return diag.FromErr(err)
215240
}
216241

242+
isSystem := d.Get("is_system").(bool)
217243
sso := ssoOpenIDFromResourceData(d)
218244

219-
created, err := client.CreateSSOOpenID(ctx, sso)
245+
created, err := client.CreateSSOOpenID(ctx, isSystem, sso)
220246
if err != nil {
221247
return diag.FromErr(err)
222248
}
@@ -237,11 +263,12 @@ func resourceSysdigSSOOpenIDUpdate(ctx context.Context, d *schema.ResourceData,
237263
return diag.FromErr(err)
238264
}
239265

266+
isSystem := d.Get("is_system").(bool)
240267
sso := ssoOpenIDFromResourceData(d)
241268
sso.ID = id
242269
sso.Version = d.Get("version").(int)
243270

244-
_, err = client.UpdateSSOOpenID(ctx, id, sso)
271+
_, err = client.UpdateSSOOpenID(ctx, isSystem, id, sso)
245272
if err != nil {
246273
return diag.FromErr(err)
247274
}
@@ -260,6 +287,8 @@ func resourceSysdigSSOOpenIDDelete(ctx context.Context, d *schema.ResourceData,
260287
return diag.FromErr(err)
261288
}
262289

290+
isSystem := d.Get("is_system").(bool)
291+
263292
// API requires disabling SSO config before deletion
264293
// We need to build the object from ResourceData to include client_secret
265294
// (which is not returned by GET but is required for PUT)
@@ -269,13 +298,13 @@ func resourceSysdigSSOOpenIDDelete(ctx context.Context, d *schema.ResourceData,
269298
sso.Version = d.Get("version").(int)
270299
sso.IsActive = false
271300

272-
_, err = client.UpdateSSOOpenID(ctx, id, sso)
301+
_, err = client.UpdateSSOOpenID(ctx, isSystem, id, sso)
273302
if err != nil {
274303
return diag.Errorf("failed to disable SSO config before deletion: %s", err)
275304
}
276305
}
277306

278-
err = client.DeleteSSOOpenID(ctx, id)
307+
err = client.DeleteSSOOpenID(ctx, isSystem, id)
279308
if err != nil {
280309
return diag.FromErr(err)
281310
}

0 commit comments

Comments
 (0)