feat(sso): add group mapping, settings, and global settings resources

sysdig/internal/client/v2/model.go

@@ -1285,3 +1285,32 @@ type SSOSamlConfig struct {
 	IsDestinationVerificationEnabled *bool  `json:"isDestinationVerificationEnabled,omitempty"`
 	IsEncryptionSupportEnabled       *bool  `json:"isEncryptionSupportEnabled,omitempty"`
 }
+
+// SSO Group Mapping (Platform API)
+type SSOGroupMapping struct {
+	ID               int                     `json:"id,omitempty"`
+	GroupName        string                  `json:"groupName"`
+	StandardTeamRole string                  `json:"standardTeamRole,omitempty"`
+	CustomTeamRoleID int                     `json:"customTeamRoleId,omitempty"`
+	IsAdmin          bool                    `json:"isAdmin"`
+	TeamMap          *SSOGroupMappingTeamMap `json:"teamMap"`
+	Weight           int                     `json:"weight,omitempty"`
+}
+
+type SSOGroupMappingTeamMap struct {
+	IsForAllTeams bool  `json:"isForAllTeams"`
+	TeamIDs       []int `json:"teamIds,omitempty"`
+}
+
+// SSO Group Mapping Settings (Platform API)
+type SSOGroupMappingSettings struct {
+	NoMappingStrategy              string `json:"noMappingStrategy"`
+	DifferentRolesSameTeamStrategy string `json:"differentRolesSameTeamStrategy"`
+	NoMappingsErrorRedirectURL     string `json:"noMappingsErrorRedirectUrl,omitempty"`
+}
+
+// SSO Global Settings (Platform API)
+type SSOGlobalSettings struct {
+	Product                string `json:"product,omitempty"`
+	IsPasswordLoginEnabled bool   `json:"isPasswordLoginEnabled"`
+}

sysdig/internal/client/v2/sso_global_settings.go

@@ -0,0 +1,68 @@
+package v2
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+)
+
+var ErrSSOGlobalSettingsNotFound = errors.New("SSO global settings not found")
+
+const (
+	ssoGlobalSettingsPath = "%s/platform/v1/global-sso-settings/%s"
+)
+
+type SSOGlobalSettingsInterface interface {
+	Base
+	GetSSOGlobalSettings(ctx context.Context, product string) (*SSOGlobalSettings, error)
+	UpdateSSOGlobalSettings(ctx context.Context, product string, settings *SSOGlobalSettings) (*SSOGlobalSettings, error)
+}
+
+func (c *Client) GetSSOGlobalSettings(ctx context.Context, product string) (result *SSOGlobalSettings, err error) {
+	response, err := c.requester.Request(ctx, http.MethodGet, c.ssoGlobalSettingsURL(product), nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if dErr := response.Body.Close(); dErr != nil {
+			err = fmt.Errorf("unable to close response body: %w", dErr)
+		}
+	}()
+
+	if response.StatusCode == http.StatusNotFound {
+		return nil, ErrSSOGlobalSettingsNotFound
+	}
+	if response.StatusCode != http.StatusOK {
+		return nil, c.ErrorFromResponse(response)
+	}
+
+	return Unmarshal[*SSOGlobalSettings](response.Body)
+}
+
+func (c *Client) UpdateSSOGlobalSettings(ctx context.Context, product string, settings *SSOGlobalSettings) (result *SSOGlobalSettings, err error) {
+	payload, err := Marshal(settings)
+	if err != nil {
+		return nil, err
+	}
+
+	response, err := c.requester.Request(ctx, http.MethodPut, c.ssoGlobalSettingsURL(product), payload)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if dErr := response.Body.Close(); dErr != nil {
+			err = fmt.Errorf("unable to close response body: %w", dErr)
+		}
+	}()
+
+	if response.StatusCode != http.StatusOK {
+		return nil, c.ErrorFromResponse(response)
+	}
+
+	return Unmarshal[*SSOGlobalSettings](response.Body)
+}
+
+func (c *Client) ssoGlobalSettingsURL(product string) string {
+	return fmt.Sprintf(ssoGlobalSettingsPath, c.config.url, product)
+}

sysdig/internal/client/v2/sso_group_mapping.go

@@ -0,0 +1,126 @@
+package v2
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+)
+
+var ErrSSOGroupMappingNotFound = errors.New("SSO group mapping not found")
+
+const (
+	createSSOGroupMappingPath = "%s/platform/v1/group-mappings"
+	getSSOGroupMappingPath    = "%s/platform/v1/group-mappings/%d"
+	updateSSOGroupMappingPath = "%s/platform/v1/group-mappings/%d"
+	deleteSSOGroupMappingPath = "%s/platform/v1/group-mappings/%d"
+)
+
+type SSOGroupMappingInterface interface {
+	Base
+	CreateSSOGroupMapping(ctx context.Context, gm *SSOGroupMapping) (*SSOGroupMapping, error)
+	GetSSOGroupMapping(ctx context.Context, id int) (*SSOGroupMapping, error)
+	UpdateSSOGroupMapping(ctx context.Context, id int, gm *SSOGroupMapping) (*SSOGroupMapping, error)
+	DeleteSSOGroupMapping(ctx context.Context, id int) error
+}
+
+func (c *Client) CreateSSOGroupMapping(ctx context.Context, gm *SSOGroupMapping) (result *SSOGroupMapping, err error) {
+	payload, err := Marshal(gm)
+	if err != nil {
+		return nil, err
+	}
+
+	response, err := c.requester.Request(ctx, http.MethodPost, c.createSSOGroupMappingURL(), payload)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if dErr := response.Body.Close(); dErr != nil {
+			err = fmt.Errorf("unable to close response body: %w", dErr)
+		}
+	}()
+
+	if response.StatusCode != http.StatusOK && response.StatusCode != http.StatusCreated {
+		return nil, c.ErrorFromResponse(response)
+	}
+
+	return Unmarshal[*SSOGroupMapping](response.Body)
+}
+
+func (c *Client) GetSSOGroupMapping(ctx context.Context, id int) (result *SSOGroupMapping, err error) {
+	response, err := c.requester.Request(ctx, http.MethodGet, c.getSSOGroupMappingURL(id), nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if dErr := response.Body.Close(); dErr != nil {
+			err = fmt.Errorf("unable to close response body: %w", dErr)
+		}
+	}()
+
+	if response.StatusCode == http.StatusNotFound {
+		return nil, ErrSSOGroupMappingNotFound
+	}
+	if response.StatusCode != http.StatusOK {
+		return nil, c.ErrorFromResponse(response)
+	}
+
+	return Unmarshal[*SSOGroupMapping](response.Body)
+}
+
+func (c *Client) UpdateSSOGroupMapping(ctx context.Context, id int, gm *SSOGroupMapping) (result *SSOGroupMapping, err error) {
+	payload, err := Marshal(gm)
+	if err != nil {
+		return nil, err
+	}
+
+	response, err := c.requester.Request(ctx, http.MethodPut, c.updateSSOGroupMappingURL(id), payload)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if dErr := response.Body.Close(); dErr != nil {
+			err = fmt.Errorf("unable to close response body: %w", dErr)
+		}
+	}()
+
+	if response.StatusCode != http.StatusOK {
+		return nil, c.ErrorFromResponse(response)
+	}
+
+	return Unmarshal[*SSOGroupMapping](response.Body)
+}
+
+func (c *Client) DeleteSSOGroupMapping(ctx context.Context, id int) (err error) {
+	response, err := c.requester.Request(ctx, http.MethodDelete, c.deleteSSOGroupMappingURL(id), nil)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if dErr := response.Body.Close(); dErr != nil {
+			err = fmt.Errorf("unable to close response body: %w", dErr)
+		}
+	}()
+
+	if response.StatusCode != http.StatusNoContent && response.StatusCode != http.StatusOK && response.StatusCode != http.StatusNotFound {
+		return c.ErrorFromResponse(response)
+	}
+
+	return nil
+}
+
+func (c *Client) createSSOGroupMappingURL() string {
+	return fmt.Sprintf(createSSOGroupMappingPath, c.config.url)
+}
+
+func (c *Client) getSSOGroupMappingURL(id int) string {
+	return fmt.Sprintf(getSSOGroupMappingPath, c.config.url, id)
+}
+
+func (c *Client) updateSSOGroupMappingURL(id int) string {
+	return fmt.Sprintf(updateSSOGroupMappingPath, c.config.url, id)
+}
+
+func (c *Client) deleteSSOGroupMappingURL(id int) string {
+	return fmt.Sprintf(deleteSSOGroupMappingPath, c.config.url, id)
+}

sysdig/internal/client/v2/sso_group_mapping_settings.go

@@ -0,0 +1,72 @@
+package v2
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+)
+
+var ErrSSOGroupMappingSettingsNotFound = errors.New("SSO group mapping settings not found")
+
+const (
+	ssoGroupMappingSettingsPath = "%s/platform/v1/group-mappings-settings"
+)
+
+type SSOGroupMappingSettingsInterface interface {
+	Base
+	GetSSOGroupMappingSettings(ctx context.Context) (*SSOGroupMappingSettings, error)
+	UpdateSSOGroupMappingSettings(ctx context.Context, settings *SSOGroupMappingSettings) (*SSOGroupMappingSettings, error)
+}
+
+func (c *Client) GetSSOGroupMappingSettings(ctx context.Context) (result *SSOGroupMappingSettings, err error) {
+	response, err := c.requester.Request(ctx, http.MethodGet, c.getSSOGroupMappingSettingsURL(), nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if dErr := response.Body.Close(); dErr != nil {
+			err = fmt.Errorf("unable to close response body: %w", dErr)
+		}
+	}()
+
+	if response.StatusCode == http.StatusNotFound {
+		return nil, ErrSSOGroupMappingSettingsNotFound
+	}
+	if response.StatusCode != http.StatusOK {
+		return nil, c.ErrorFromResponse(response)
+	}
+
+	return Unmarshal[*SSOGroupMappingSettings](response.Body)
+}
+
+func (c *Client) UpdateSSOGroupMappingSettings(ctx context.Context, settings *SSOGroupMappingSettings) (result *SSOGroupMappingSettings, err error) {
+	payload, err := Marshal(settings)
+	if err != nil {
+		return nil, err
+	}
+
+	response, err := c.requester.Request(ctx, http.MethodPut, c.updateSSOGroupMappingSettingsURL(), payload)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if dErr := response.Body.Close(); dErr != nil {
+			err = fmt.Errorf("unable to close response body: %w", dErr)
+		}
+	}()
+
+	if response.StatusCode != http.StatusOK {
+		return nil, c.ErrorFromResponse(response)
+	}
+
+	return Unmarshal[*SSOGroupMappingSettings](response.Body)
+}
+
+func (c *Client) getSSOGroupMappingSettingsURL() string {
+	return fmt.Sprintf(ssoGroupMappingSettingsPath, c.config.url)
+}
+
+func (c *Client) updateSSOGroupMappingSettingsURL() string {
+	return fmt.Sprintf(ssoGroupMappingSettingsPath, c.config.url)
+}

sysdig/internal/client/v2/sysdig.go

@@ -25,6 +25,9 @@ type SysdigCommon interface {
 	GroupMappingInterface
 	IPFilteringSettingsInterface
 	IPFiltersInterface
+	SSOGlobalSettingsInterface
+	SSOGroupMappingInterface
+	SSOGroupMappingSettingsInterface
 	SSOOpenIDInterface
 	SSOSamlInterface
 	TeamServiceAccountInterface

sysdig/provider.go

@@ -115,16 +115,19 @@ func (p *SysdigProvider) Provider() *schema.Provider {
 			},
 		},
 		ResourcesMap: map[string]*schema.Resource{
-			"sysdig_agent_access_key":      resourceSysdigAgentAccessKey(),
-			"sysdig_custom_role":           resourceSysdigCustomRole(),
-			"sysdig_group_mapping":         resourceSysdigGroupMapping(),
-			"sysdig_group_mapping_config":  resourceSysdigGroupMappingConfig(),
-			"sysdig_ip_filter":             resourceSysdigIPFilter(),
-			"sysdig_ip_filtering_settings": resourceSysdigIPFilteringSettings(),
-			"sysdig_sso_openid":            resourceSysdigSSOOpenID(),
-			"sysdig_sso_saml":              resourceSysdigSSOSaml(),
-			"sysdig_team_service_account":  resourceSysdigTeamServiceAccount(),
-			"sysdig_user":                  resourceSysdigUser(),
+			"sysdig_agent_access_key":           resourceSysdigAgentAccessKey(),
+			"sysdig_custom_role":                resourceSysdigCustomRole(),
+			"sysdig_group_mapping":              resourceSysdigGroupMapping(),
+			"sysdig_group_mapping_config":       resourceSysdigGroupMappingConfig(),
+			"sysdig_ip_filter":                  resourceSysdigIPFilter(),
+			"sysdig_ip_filtering_settings":      resourceSysdigIPFilteringSettings(),
+			"sysdig_sso_global_settings":        resourceSysdigSSOGlobalSettings(),
+			"sysdig_sso_group_mapping":          resourceSysdigSSOGroupMapping(),
+			"sysdig_sso_group_mapping_settings": resourceSysdigSSOGroupMappingSettings(),
+			"sysdig_sso_openid":                 resourceSysdigSSOOpenID(),
+			"sysdig_sso_saml":                   resourceSysdigSSOSaml(),
+			"sysdig_team_service_account":       resourceSysdigTeamServiceAccount(),
+			"sysdig_user":                       resourceSysdigUser(),
 
 			"sysdig_monitor_alert_v2_change":                               resourceSysdigMonitorAlertV2Change(),
 			"sysdig_monitor_alert_v2_downtime":                             resourceSysdigMonitorAlertV2Downtime(),

sysdig/resource_sysdig_group_mapping.go

@@ -14,10 +14,11 @@ func resourceSysdigGroupMapping() *schema.Resource {
 	timeout := 5 * time.Minute
 
 	return &schema.Resource{
-		ReadContext:   resourceSysdigGroupMappingRead,
-		CreateContext: resourceSysdigGroupMappingCreate,
-		UpdateContext: resourceSysdigGroupMappingUpdate,
-		DeleteContext: resourceSysdigGroupMappingDelete,
+		ReadContext:        resourceSysdigGroupMappingRead,
+		CreateContext:      resourceSysdigGroupMappingCreate,
+		UpdateContext:      resourceSysdigGroupMappingUpdate,
+		DeleteContext:      resourceSysdigGroupMappingDelete,
+		DeprecationMessage: "Use sysdig_sso_group_mapping instead. This resource will be removed in a future version.",
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},

sysdig/resource_sysdig_group_mapping_config.go

@@ -12,10 +12,11 @@ import (
 func resourceSysdigGroupMappingConfig() *schema.Resource {
 	timeout := 5 * time.Minute
 	return &schema.Resource{
-		ReadContext:   resourceSysdigGroupMappingConfigRead,
-		CreateContext: resourceSysdigGroupMappingConfigCreate,
-		UpdateContext: resourceSysdigGroupMappingConfigUpdate,
-		DeleteContext: resourceSysdigGroupMappingConfigDelete,
+		ReadContext:        resourceSysdigGroupMappingConfigRead,
+		CreateContext:      resourceSysdigGroupMappingConfigCreate,
+		UpdateContext:      resourceSysdigGroupMappingConfigUpdate,
+		DeleteContext:      resourceSysdigGroupMappingConfigDelete,
+		DeprecationMessage: "Use sysdig_sso_group_mapping_settings instead. This resource will be removed in a future version.",
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},