Skip to content

Commit c5703c9

Browse files
hariarlahariarla
committed
feat(identity): add new account settings
Signed-off-by: Hari K Arla <[email protected]>
1 parent 1b88f3b commit c5703c9

11 files changed

+411
-19
lines changed

‎examples/ibm-iam-identity-account-settings-templates/main.tf‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,28 @@ provider "ibm" {
55
resource "ibm_iam_account_settings_template" "account_settings_template_instance" {
66
name = var.account_settings_template_name
77
account_settings {
8-
8+
restrict_create_service_id = "RESTRICTED"
9+
restrict_create_platform_apikey = "RESTRICTED"
10+
allowed_ip_addresses = "allowed_ip_addresses"
11+
mfa = "NONE"
12+
user_mfa {
13+
iam_id = "iam_id"
14+
mfa = "NONE"
15+
}
16+
session_expiration_in_seconds = "session_expiration_in_seconds"
17+
session_invalidation_in_seconds = "session_invalidation_in_seconds"
18+
max_sessions_per_identity = "max_sessions_per_identity"
19+
system_access_token_expiration_in_seconds = "system_access_token_expiration_in_seconds"
20+
system_refresh_token_expiration_in_seconds = "system_refresh_token_expiration_in_seconds"
21+
restrict_user_list_visibility = "RESTRICTED"
22+
restrict_user_domains {
23+
account_sufficient = true
24+
restrictions {
25+
realm_id = "IBMid"
26+
invitation_email_allow_patterns = *.*@company.com
27+
restrict_invitation = true
28+
}
29+
}
930
}
1031
}
1132

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ require (
2828
github.com/IBM/logs-router-go-sdk v1.0.8
2929
github.com/IBM/mqcloud-go-sdk v0.4.0
3030
github.com/IBM/networking-go-sdk v0.51.12
31-
github.com/IBM/platform-services-go-sdk v0.88.0
31+
github.com/IBM/platform-services-go-sdk v0.90.0
3232
github.com/IBM/project-go-sdk v0.3.9
3333
github.com/IBM/push-notifications-go-sdk v0.0.0-20210310100607-5790b96c47f5
3434
github.com/IBM/sarama v1.45.0

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -148,8 +148,8 @@ github.com/IBM/mqcloud-go-sdk v0.4.0 h1:BuZNXA6iYEg5OEPr13CMGrhH0ew4rH/4L56b1nFt
148148
github.com/IBM/mqcloud-go-sdk v0.4.0/go.mod h1:7zigCUz6k3eRrNE8KOcDkY72oPppEmoQifF+SB0NPRM=
149149
github.com/IBM/networking-go-sdk v0.51.12 h1:2qv6neG8msFR1dtf9v+rbaC2gIkw9HnzohvQpgVye5w=
150150
github.com/IBM/networking-go-sdk v0.51.12/go.mod h1:TAXWyBUk3C3R7aS1m84EfKdnDcBMZMAClwLfDj/SYZc=
151-
github.com/IBM/platform-services-go-sdk v0.88.0 h1:PZZYg+6FSvkiyLoRMabGHHzsR9OEwhUuTUsuKs3E4qg=
152-
github.com/IBM/platform-services-go-sdk v0.88.0/go.mod h1:aGD045m6I8pfcB77wft8w2cHqWOJjcM3YSSV55BX0Js=
151+
github.com/IBM/platform-services-go-sdk v0.90.0 h1:hsUkgZZBGYK+szFb0tF9Q7uy1VjMY+VlYAPgPwFPMrg=
152+
github.com/IBM/platform-services-go-sdk v0.90.0/go.mod h1:aGD045m6I8pfcB77wft8w2cHqWOJjcM3YSSV55BX0Js=
153153
github.com/IBM/project-go-sdk v0.3.9 h1:D/UfMMn+vMQyvYf9EfocV6HrD3HcVpeIVoUSjNKuROo=
154154
github.com/IBM/project-go-sdk v0.3.9/go.mod h1:FOJM9ihQV3EEAY6YigcWiTNfVCThtdY8bLC/nhQHFvo=
155155
github.com/IBM/push-notifications-go-sdk v0.0.0-20210310100607-5790b96c47f5 h1:NPUhkoOCRuv3OFWt19PmwjXGGTKlvmbuPg9fUrBUNe4=

‎ibm/service/iamidentity/data_source_ibm_iam_account_settings_template.go‎

Lines changed: 86 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,50 @@ func DataSourceIBMAccountSettingsTemplate() *schema.Resource {
132132
Computed: true,
133133
Description: "Defines the refresh token expiration in seconds. Valid values: * Any whole number between '900' and '259200' * NOT_SET - To unset account setting and use service default.",
134134
},
135+
"restrict_user_list_visibility": {
136+
Type: schema.TypeString,
137+
Computed: true,
138+
Description: "Defines whether or not user visibility is access controlled. Valid values: * RESTRICTED - users can view only specific types of users in the account, such as those the user has invited to the account, or descendants of those users based on the classic infrastructure hierarchy * NOT_RESTRICTED - any user in the account can view other users from the Users page in IBM Cloud console * NOT_SET - to 'unset' a previous set value.",
139+
},
140+
"restrict_user_domains": {
141+
Type: schema.TypeList,
142+
Computed: true,
143+
Elem: &schema.Resource{
144+
Schema: map[string]*schema.Schema{
145+
"account_sufficient": &schema.Schema{
146+
Type: schema.TypeBool,
147+
Computed: true,
148+
},
149+
"restrictions": &schema.Schema{
150+
Type: schema.TypeList,
151+
Computed: true,
152+
Description: "Defines if account invitations are restricted to specified domains. To remove an entry for a realm_id, perform an update (PUT) request with only the realm_id set.",
153+
Elem: &schema.Resource{
154+
Schema: map[string]*schema.Schema{
155+
"realm_id": &schema.Schema{
156+
Type: schema.TypeString,
157+
Computed: true,
158+
Description: "The realm that the restrictions apply to.",
159+
},
160+
"invitation_email_allow_patterns": &schema.Schema{
161+
Type: schema.TypeList,
162+
Computed: true,
163+
Description: "The list of allowed email patterns. Wildcard syntax is supported, '*' represents any sequence of zero or more characters in the string, except for '.' and '@'. The sequence ends if a '.' or '@' was found. '**' represents any sequence of zero or more characters in the string - without limit.",
164+
Elem: &schema.Schema{
165+
Type: schema.TypeString,
166+
},
167+
},
168+
"restrict_invitation": &schema.Schema{
169+
Type: schema.TypeBool,
170+
Computed: true,
171+
Description: "When true invites will only be possible to the domain patterns provided, otherwise invites are unrestricted.",
172+
},
173+
},
174+
},
175+
},
176+
},
177+
},
178+
},
135179
},
136180
},
137181
},
@@ -323,7 +367,7 @@ func dataSourceIBMAccountSettingsTemplateRead(context context.Context, d *schema
323367
return nil
324368
}
325369

326-
func dataSourceIBMAccountSettingsTemplateAccountSettingsComponentToMap(model *iamidentityv1.AccountSettingsComponent) (map[string]interface{}, error) {
370+
func dataSourceIBMAccountSettingsTemplateAccountSettingsComponentToMap(model *iamidentityv1.TemplateAccountSettings) (map[string]interface{}, error) {
327371
modelMap := make(map[string]interface{})
328372
if model.RestrictCreateServiceID != nil {
329373
modelMap["restrict_create_service_id"] = model.RestrictCreateServiceID
@@ -363,6 +407,47 @@ func dataSourceIBMAccountSettingsTemplateAccountSettingsComponentToMap(model *ia
363407
if model.SystemRefreshTokenExpirationInSeconds != nil {
364408
modelMap["system_refresh_token_expiration_in_seconds"] = model.SystemRefreshTokenExpirationInSeconds
365409
}
410+
if model.RestrictUserListVisibility != nil {
411+
modelMap["restrict_user_list_visibility"] = *model.RestrictUserListVisibility
412+
}
413+
if model.RestrictUserDomains != nil {
414+
restrictUserDomainsMap, err := dataSourceIBMAccountSettingsTemplatesTemplateAccountSettingsRestrictUserDomainsToMap(model.RestrictUserDomains)
415+
if err != nil {
416+
return modelMap, err
417+
}
418+
modelMap["restrict_user_domains"] = []map[string]interface{}{restrictUserDomainsMap}
419+
}
420+
return modelMap, nil
421+
}
422+
423+
func dataSourceIBMAccountSettingsTemplatesTemplateAccountSettingsRestrictUserDomainsToMap(model *iamidentityv1.TemplateAccountSettingsRestrictUserDomains) (map[string]interface{}, error) {
424+
modelMap := make(map[string]interface{})
425+
if model.AccountSufficient != nil {
426+
modelMap["account_sufficient"] = *model.AccountSufficient
427+
}
428+
if model.Restrictions != nil {
429+
restrictions := []map[string]interface{}{}
430+
for _, restrictionsItem := range model.Restrictions {
431+
restrictionsItemMap, err := dataSourceIBMAccountSettingsTemplatesAccountSettingsUserDomainRestrictionToMap(&restrictionsItem) // #nosec G601
432+
if err != nil {
433+
return modelMap, err
434+
}
435+
restrictions = append(restrictions, restrictionsItemMap)
436+
}
437+
modelMap["restrictions"] = restrictions
438+
}
439+
return modelMap, nil
440+
}
441+
442+
func dataSourceIBMAccountSettingsTemplatesAccountSettingsUserDomainRestrictionToMap(model *iamidentityv1.AccountSettingsUserDomainRestriction) (map[string]interface{}, error) {
443+
modelMap := make(map[string]interface{})
444+
modelMap["realm_id"] = *model.RealmID
445+
if model.InvitationEmailAllowPatterns != nil {
446+
modelMap["invitation_email_allow_patterns"] = model.InvitationEmailAllowPatterns
447+
}
448+
if model.RestrictInvitation != nil {
449+
modelMap["restrict_invitation"] = *model.RestrictInvitation
450+
}
366451
return modelMap, nil
367452
}
368453

‎ibm/service/iamidentity/data_source_ibm_iam_account_settings_template_test.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,10 @@ func TestAccIBMAccountSettingsTemplateDataSourceAllArgs(t *testing.T) {
7070
resource.TestCheckResourceAttrSet("data.ibm_iam_account_settings_template.account_settings_template", "account_settings.0.max_sessions_per_identity"),
7171
resource.TestCheckResourceAttrSet("data.ibm_iam_account_settings_template.account_settings_template", "account_settings.0.system_access_token_expiration_in_seconds"),
7272
resource.TestCheckResourceAttrSet("data.ibm_iam_account_settings_template.account_settings_template", "account_settings.0.system_refresh_token_expiration_in_seconds"),
73+
resource.TestCheckResourceAttrSet("data.ibm_iam_account_settings_template.account_settings_template", "account_settings.0.restrict_user_list_visibility"),
74+
resource.TestCheckResourceAttrSet("data.ibm_iam_account_settings_template.account_settings_template", "account_settings.0.restrict_user_domains.#"),
75+
resource.TestCheckResourceAttrSet("data.ibm_iam_account_settings_template.account_settings_template", "account_settings.0.restrict_user_domains.0.account_sufficient"),
76+
resource.TestCheckResourceAttrSet("data.ibm_iam_account_settings_template.account_settings_template", "account_settings.0.restrict_user_domains.0.restrictions.0.realm_id"),
7377
resource.TestCheckResourceAttrSet("data.ibm_iam_account_settings_template.account_settings_template", "entity_tag"),
7478
resource.TestCheckResourceAttrSet("data.ibm_iam_account_settings_template.account_settings_template", "crn"),
7579
resource.TestCheckResourceAttrSet("data.ibm_iam_account_settings_template.account_settings_template", "created_at"),
@@ -119,6 +123,15 @@ func testAccCheckIBMAccountSettingsTemplateDataSourceConfig(enterpriseAccountId
119123
max_sessions_per_identity = "5"
120124
system_access_token_expiration_in_seconds = "NOT_SET"
121125
system_refresh_token_expiration_in_seconds = "NOT_SET"
126+
restrict_user_list_visibility = "RESTRICTED"
127+
restrict_user_domains {
128+
account_sufficient = true
129+
restrictions {
130+
realm_id = "IBMid"
131+
invitation_email_allow_patterns = ["*.*@company.com"]
132+
restrict_invitation = true
133+
}
134+
}
122135
}
123136
}
124137

‎ibm/service/iamidentity/data_source_ibm_iam_effective_account_settings.go‎

Lines changed: 80 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,11 @@ func DataSourceIBMIamEffectiveAccountSettings() *schema.Resource {
146146
Description: "Input body parameters for the Account Settings REST request.",
147147
Elem: &schema.Resource{
148148
Schema: map[string]*schema.Schema{
149+
"account_id": {
150+
Type: schema.TypeString,
151+
Computed: true,
152+
Description: "Unique ID of the account.",
153+
},
149154
"entity_tag": {
150155
Type: schema.TypeString,
151156
Computed: true,
@@ -417,6 +422,45 @@ func DataSourceIBMIamEffectiveAccountSettings() *schema.Resource {
417422
},
418423
},
419424
},
425+
"restrict_user_domains": &schema.Schema{
426+
Type: schema.TypeList,
427+
Computed: true,
428+
Elem: &schema.Resource{
429+
Schema: map[string]*schema.Schema{
430+
"account_sufficient": &schema.Schema{
431+
Type: schema.TypeBool,
432+
Computed: true,
433+
},
434+
"restrictions": &schema.Schema{
435+
Type: schema.TypeList,
436+
Computed: true,
437+
Description: "Defines if account invitations are restricted to specified domains. To remove an entry for a realm_id, perform an update (PUT) request with only the realm_id set.",
438+
Elem: &schema.Resource{
439+
Schema: map[string]*schema.Schema{
440+
"realm_id": &schema.Schema{
441+
Type: schema.TypeString,
442+
Computed: true,
443+
Description: "The realm that the restrictions apply to.",
444+
},
445+
"invitation_email_allow_patterns": &schema.Schema{
446+
Type: schema.TypeList,
447+
Computed: true,
448+
Description: "The list of allowed email patterns. Wildcard syntax is supported, '*' represents any sequence of zero or more characters in the string, except for '.' and '@'. The sequence ends if a '.' or '@' was found. '**' represents any sequence of zero or more characters in the string - without limit.",
449+
Elem: &schema.Schema{
450+
Type: schema.TypeString,
451+
},
452+
},
453+
"restrict_invitation": &schema.Schema{
454+
Type: schema.TypeBool,
455+
Computed: true,
456+
Description: "When true invites will only be possible to the domain patterns provided, otherwise invites are unrestricted.",
457+
},
458+
},
459+
},
460+
},
461+
},
462+
},
463+
},
420464
},
421465
},
422466
},
@@ -536,7 +580,7 @@ func DataSourceIBMIamEffectiveAccountSettingsAccountSettingsEffectiveSectionToMa
536580

537581
func DataSourceIBMIamEffectiveAccountSettingsAccountSettingsAccountSectionToMap(model *iamidentityv1.AccountSettingsResponse) (map[string]interface{}, error) {
538582
modelMap := make(map[string]interface{})
539-
583+
modelMap["account_id"] = "testString"
540584
modelMap["entity_tag"] = *model.EntityTag
541585
if model.History != nil {
542586
var history []map[string]interface{}
@@ -598,15 +642,11 @@ func DataSourceIBMIamEffectiveAccountSettingsAccountSettingsAssignedTemplatesSec
598642
modelMap["restrict_user_list_visibility"] = *model.RestrictUserListVisibility
599643
}
600644
if model.RestrictUserDomains != nil {
601-
var restrictUserDomains []map[string]interface{}
602-
for _, restrictUserDomainsItem := range model.RestrictUserDomains {
603-
restrictUserDomainsItemMap, err := AccountSettingsUserDomainRestrictionToMap(&restrictUserDomainsItem)
604-
if err != nil {
605-
return modelMap, err
606-
}
607-
restrictUserDomains = append(restrictUserDomains, restrictUserDomainsItemMap)
645+
restrictUserDomainsMap, err := DataSourceIBMEffectiveAccountSettingsAssignedTemplatesAccountSettingsRestrictUserDomainsToMap(model.RestrictUserDomains)
646+
if err != nil {
647+
return modelMap, err
608648
}
609-
modelMap["restrict_user_domains"] = restrictUserDomains
649+
modelMap["restrict_user_domains"] = []map[string]interface{}{restrictUserDomainsMap}
610650
}
611651
if model.AllowedIPAddresses != nil {
612652
modelMap["allowed_ip_addresses"] = *model.AllowedIPAddresses
@@ -642,3 +682,34 @@ func DataSourceIBMIamEffectiveAccountSettingsAccountSettingsAssignedTemplatesSec
642682
}
643683
return modelMap, nil
644684
}
685+
686+
func DataSourceIBMEffectiveAccountSettingsAssignedTemplatesAccountSettingsRestrictUserDomainsToMap(model *iamidentityv1.AssignedTemplatesAccountSettingsRestrictUserDomains) (map[string]interface{}, error) {
687+
modelMap := make(map[string]interface{})
688+
if model.AccountSufficient != nil {
689+
modelMap["account_sufficient"] = *model.AccountSufficient
690+
}
691+
if model.Restrictions != nil {
692+
restrictions := []map[string]interface{}{}
693+
for _, restrictionsItem := range model.Restrictions {
694+
restrictionsItemMap, err := DataSourceIBMEffectiveAccountSettingsAccountSettingsUserDomainRestrictionToMap(&restrictionsItem) // #nosec G601
695+
if err != nil {
696+
return modelMap, err
697+
}
698+
restrictions = append(restrictions, restrictionsItemMap)
699+
}
700+
modelMap["restrictions"] = restrictions
701+
}
702+
return modelMap, nil
703+
}
704+
705+
func DataSourceIBMEffectiveAccountSettingsAccountSettingsUserDomainRestrictionToMap(model *iamidentityv1.AccountSettingsUserDomainRestriction) (map[string]interface{}, error) {
706+
modelMap := make(map[string]interface{})
707+
modelMap["realm_id"] = *model.RealmID
708+
if model.InvitationEmailAllowPatterns != nil {
709+
modelMap["invitation_email_allow_patterns"] = model.InvitationEmailAllowPatterns
710+
}
711+
if model.RestrictInvitation != nil {
712+
modelMap["restrict_invitation"] = *model.RestrictInvitation
713+
}
714+
return modelMap, nil
715+
}

‎ibm/service/iamidentity/data_source_ibm_iam_effective_account_settings_test.go‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -217,7 +217,19 @@ func TestDataSourceIBMIamEffectiveAccountSettingsAccountSettingsAssignedTemplate
217217
model["restrict_create_service_id"] = "NOT_SET"
218218
model["restrict_create_platform_apikey"] = "NOT_SET"
219219
model["restrict_user_list_visibility"] = "NOT_RESTRICTED"
220-
model["restrict_user_domains"] = []map[string]interface{}{accountSettingsUserDomainRestrictionModel}
220+
//model["restrict_user_domains"] = []map[string]interface{}{accountSettingsUserDomainRestrictionModel}
221+
model["restrict_user_domains"] = []map[string]interface{}{
222+
{
223+
"account_sufficient": true,
224+
"restrictions": []map[string]interface{}{
225+
{
226+
"realm_id": "IBMid",
227+
"invitation_email_allow_patterns": []string{"*.*@company.com"},
228+
"restrict_invitation": true,
229+
},
230+
},
231+
},
232+
}
221233
model["allowed_ip_addresses"] = "testString"
222234
model["mfa"] = "NONE"
223235
model["session_expiration_in_seconds"] = "86400"
@@ -250,7 +262,13 @@ func TestDataSourceIBMIamEffectiveAccountSettingsAccountSettingsAssignedTemplate
250262
model.RestrictCreateServiceID = core.StringPtr("NOT_SET")
251263
model.RestrictCreatePlatformApikey = core.StringPtr("NOT_SET")
252264
model.RestrictUserListVisibility = core.StringPtr("NOT_RESTRICTED")
253-
model.RestrictUserDomains = []iamidentityv1.AccountSettingsUserDomainRestriction{*accountSettingsUserDomainRestrictionModel}
265+
restrictUserDomains := &iamidentityv1.AssignedTemplatesAccountSettingsRestrictUserDomains{
266+
AccountSufficient: core.BoolPtr(true),
267+
Restrictions: []iamidentityv1.AccountSettingsUserDomainRestriction{
268+
*accountSettingsUserDomainRestrictionModel,
269+
},
270+
}
271+
model.RestrictUserDomains = restrictUserDomains
254272
model.AllowedIPAddresses = core.StringPtr("testString")
255273
model.Mfa = core.StringPtr("NONE")
256274
model.SessionExpirationInSeconds = core.StringPtr("86400")

0 commit comments

Comments
 (0)