-
Notifications
You must be signed in to change notification settings - Fork 280
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add azuread_directory_role_eligibility_schedule_request resource
- Loading branch information
Showing
8 changed files
with
403 additions
and
15 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -60,3 +60,5 @@ require ( | |
| ) | ||
|
|
||
| go 1.19 | ||
|
|
||
| replace github.com/manicminer/hamilton => ../hamilton | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
174 changes: 174 additions & 0 deletions
174
internal/services/directoryroles/directory_role_eligibility_schedule_request_resource.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,174 @@ | ||
| package directoryroles | ||
|
|
||
| import ( | ||
| "context" | ||
| "errors" | ||
| "fmt" | ||
| "log" | ||
| "net/http" | ||
| "time" | ||
|
|
||
| "github.com/hashicorp/go-azure-sdk/sdk/odata" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/diag" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/clients" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/tf" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/validate" | ||
| "github.com/manicminer/hamilton/msgraph" | ||
| ) | ||
|
|
||
| func directoryRoleEligibilityScheduleRequestResource() *schema.Resource { | ||
| return &schema.Resource{ | ||
| CreateContext: directoryRoleEligibilityScheduleRequestResourceCreate, | ||
| ReadContext: directoryRoleEligibilityScheduleRequestResourceRead, | ||
| DeleteContext: directoryRoleEligibilityScheduleRequestResourceDelete, | ||
|
|
||
| Timeouts: &schema.ResourceTimeout{ | ||
| Create: schema.DefaultTimeout(5 * time.Minute), | ||
| Read: schema.DefaultTimeout(5 * time.Minute), | ||
| Update: schema.DefaultTimeout(5 * time.Minute), | ||
| Delete: schema.DefaultTimeout(5 * time.Minute), | ||
| }, | ||
|
|
||
| Importer: tf.ValidateResourceIDPriorToImport(func(id string) error { | ||
| if id == "" { | ||
| return errors.New("id was empty") | ||
| } | ||
| return nil | ||
| }), | ||
|
|
||
| Schema: map[string]*schema.Schema{ | ||
| "role_definition_id": { | ||
| Description: "The object ID of the directory role for this assignment", | ||
| Type: schema.TypeString, | ||
| Required: true, | ||
| ForceNew: true, | ||
| ValidateDiagFunc: validate.UUID, | ||
| }, | ||
|
|
||
| "principal_id": { | ||
| Description: "The object ID of the member principal", | ||
| Type: schema.TypeString, | ||
| Required: true, | ||
| ForceNew: true, | ||
| ValidateDiagFunc: validate.UUID, | ||
| }, | ||
|
|
||
| "directory_scope_id": { | ||
| Description: "Identifier of the directory object representing the scope of the assignment", | ||
| Type: schema.TypeString, | ||
| Required: true, | ||
| ForceNew: true, | ||
| ValidateDiagFunc: validate.NoEmptyStrings, | ||
| }, | ||
|
|
||
| "justification": { | ||
| Description: "Justification for why the role is assigned", | ||
| Type: schema.TypeString, | ||
| Required: true, | ||
| ForceNew: true, | ||
| ValidateDiagFunc: validate.NoEmptyStrings, | ||
| }, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| func directoryRoleEligibilityScheduleRequestResourceCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { | ||
| client := meta.(*clients.Client).DirectoryRoles.RoleEligibilityScheduleRequestClient | ||
|
|
||
| roleDefinitionId := d.Get("role_definition_id").(string) | ||
| principalId := d.Get("principal_id").(string) | ||
| justification := d.Get("justification").(string) | ||
| directoryScopeId := d.Get("directory_scope_id").(string) | ||
|
|
||
| var expiration interface{} = struct { | ||
| Type string `json:"type"` | ||
| }{ | ||
| Type: "NoExpiration", | ||
| } | ||
| var scheduleInfo interface{} = struct { | ||
| StartDateTime string `json:"startDateTime"` | ||
| Expiration interface{} `json:"expiration"` | ||
| }{ | ||
| StartDateTime: time.Now().UTC().Format(time.RFC3339), | ||
| Expiration: expiration, | ||
| } | ||
|
|
||
| properties := msgraph.UnifiedRoleEligibilityScheduleRequest{ | ||
| RoleDefinitionId: &roleDefinitionId, | ||
| PrincipalId: &principalId, | ||
| Justification: &justification, | ||
| DirectoryScopeId: &directoryScopeId, | ||
| ScheduleInfo: &scheduleInfo, | ||
| } | ||
|
|
||
| assignment, status, err := client.Create(ctx, properties) | ||
| if err != nil { | ||
| return tf.ErrorDiagF(err, "Eligibility schedule request for role %q to principal %q, received %d with error: %+v", roleDefinitionId, principalId, status, err) | ||
| } | ||
| if assignment == nil || assignment.ID() == nil { | ||
| return tf.ErrorDiagF(errors.New("returned role assignment ID was nil"), "API Error") | ||
| } | ||
|
|
||
| d.SetId(*assignment.ID()) | ||
|
|
||
| deadline, ok := ctx.Deadline() | ||
| if !ok { | ||
| return tf.ErrorDiagF(errors.New("context has no deadline"), "Waiting for directory role %q eligibility schedule request to principal %q to take effect", roleDefinitionId, principalId) | ||
| } | ||
| timeout := time.Until(deadline) | ||
| _, err = (&resource.StateChangeConf{ | ||
| Pending: []string{"Waiting"}, | ||
| Target: []string{"Done"}, | ||
| Timeout: timeout, | ||
| MinTimeout: 1 * time.Second, | ||
| ContinuousTargetOccurence: 3, | ||
| Refresh: func() (interface{}, string, error) { | ||
| _, status, err := client.Get(ctx, *assignment.ID(), odata.Query{}) | ||
| if err != nil { | ||
| if status == http.StatusNotFound { | ||
| return "stub", "Waiting", nil | ||
| } | ||
| return nil, "Error", fmt.Errorf("retrieving role assignment") | ||
| } | ||
| return "stub", "Done", nil | ||
| }, | ||
| }).WaitForStateContext(ctx) | ||
| if err != nil { | ||
| return tf.ErrorDiagF(err, "Waiting for role eligibility schedule request for %q to reflect in directory role %q", principalId, roleDefinitionId) | ||
| } | ||
|
|
||
| return directoryRoleEligibilityScheduleRequestResourceRead(ctx, d, meta) | ||
| } | ||
|
|
||
| func directoryRoleEligibilityScheduleRequestResourceRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { | ||
| client := meta.(*clients.Client).DirectoryRoles.RoleEligibilityScheduleRequestClient | ||
|
|
||
| id := d.Id() | ||
| assignment, status, err := client.Get(ctx, id, odata.Query{}) | ||
| if err != nil { | ||
| if status == http.StatusNotFound { | ||
| log.Printf("[DEBUG] Assignment with ID %q was not found - removing from state", id) | ||
| d.SetId("") | ||
| return nil | ||
| } | ||
| return tf.ErrorDiagF(err, "Retrieving role assignment %q", id) | ||
| } | ||
|
|
||
| tf.Set(d, "role_definition_id", assignment.RoleDefinitionId) | ||
| tf.Set(d, "principal_id", assignment.PrincipalId) | ||
| tf.Set(d, "justification", assignment.Justification) | ||
| tf.Set(d, "directory_scope_id", assignment.DirectoryScopeId) | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func directoryRoleEligibilityScheduleRequestResourceDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { | ||
| client := meta.(*clients.Client).DirectoryRoles.RoleEligibilityScheduleRequestClient | ||
|
|
||
| if _, err := client.Delete(ctx, d.Id()); err != nil { | ||
| return tf.ErrorDiagF(err, "Deleting role assignment %q: %+v", d.Id(), err) | ||
| } | ||
| return nil | ||
| } |
74 changes: 74 additions & 0 deletions
74
...rnal/services/directoryroles/directory_role_eligibility_schedule_request_resource_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| package directoryroles_test | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "net/http" | ||
| "testing" | ||
|
|
||
| "github.com/hashicorp/go-azure-sdk/sdk/odata" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" | ||
| "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/acceptance" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/acceptance/check" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/clients" | ||
| "github.com/hashicorp/terraform-provider-azuread/internal/utils" | ||
| ) | ||
|
|
||
| type RoleEligibilityScheduleRequestResource struct{} | ||
|
|
||
| func TestAccRoleEligibilityScheduleRequest_basic(t *testing.T) { | ||
| data := acceptance.BuildTestData(t, "azuread_directory_role_eligibility_schedule_request", "test") | ||
| r := RoleEligibilityScheduleRequestResource{} | ||
|
|
||
| data.ResourceTestIgnoreDangling(t, r, []resource.TestStep{ | ||
| { | ||
| Config: r.basic(data), | ||
| Check: resource.ComposeTestCheckFunc( | ||
| check.That(data.ResourceName).ExistsInAzure(r), | ||
| ), | ||
| }, | ||
| }) | ||
| } | ||
|
|
||
| func (r RoleEligibilityScheduleRequestResource) Exists(ctx context.Context, clients *clients.Client, state *terraform.InstanceState) (*bool, error) { | ||
| client := clients.DirectoryRoles.RoleEligibilityScheduleRequestClient | ||
|
|
||
| resr, status, err := client.Get(ctx, state.ID, odata.Query{}) | ||
| if err != nil { | ||
| fmt.Printf("%s, %v\n", err.Error(), status) | ||
| if status == http.StatusNotFound { | ||
| return nil, fmt.Errorf("Role Eligibility Schedule Request with ID %q does not exist", state.ID) | ||
| } | ||
| return nil, fmt.Errorf("failed to retrieve Role Eligibility Schedule Request with object ID %q: %+v", state.ID, err) | ||
| } | ||
|
|
||
| return utils.Bool(resr.ID() != nil && *resr.ID() == state.ID), nil | ||
| } | ||
|
|
||
| func (r RoleEligibilityScheduleRequestResource) basic(data acceptance.TestData) string { | ||
| return fmt.Sprintf(` | ||
| provider "azuread" {} | ||
| data "azuread_domains" "test" { | ||
| only_initial = true | ||
| } | ||
| resource "azuread_user" "test" { | ||
| user_principal_name = "acctestManager.%[1]d@${data.azuread_domains.test.domains.0.domain_name}" | ||
| display_name = "acctestManager-%[1]d" | ||
| password = "%[2]s" | ||
| } | ||
| resource "azuread_directory_role" "test" { | ||
| display_name = "Application Administrator" | ||
| } | ||
| resource "azuread_directory_role_eligibility_schedule_request" "test" { | ||
| role_definition_id = azuread_directory_role.test.template_id | ||
| principal_id = azuread_user.test.object_id | ||
| directory_scope_id = "/" | ||
| justification = "abc" | ||
| } | ||
| `, data.RandomInteger, data.RandomPassword) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Oops, something went wrong.