auth/jwt: adds user_claim_json_pointer and max_age to roles

[austingebauer]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Relates OR Closes: N/A

Release note for CHANGELOG:

* `resource/vault_jwt_auth_backend`: Adds support for `user_claim_json_pointer` and `max_age` (#1478)

Output from acceptance testing:

$ make testacc TESTARGS='-count=1 -run=TestAccJWTAuth'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test -v -count=1 -run=TestAccJWTAuth -timeout 30m ./...
=== RUN   TestAccJWTAuthBackendRole_import
--- PASS: TestAccJWTAuthBackendRole_import (1.62s)
=== RUN   TestAccJWTAuthBackendRole_basic
--- PASS: TestAccJWTAuthBackendRole_basic (1.07s)
=== RUN   TestAccJWTAuthBackendRole_update
--- PASS: TestAccJWTAuthBackendRole_update (1.91s)
=== RUN   TestAccJWTAuthBackendRole_full
--- PASS: TestAccJWTAuthBackendRole_full (1.10s)
=== RUN   TestAccJWTAuthBackendRoleOIDC_full
--- PASS: TestAccJWTAuthBackendRoleOIDC_full (1.57s)
=== RUN   TestAccJWTAuthBackendRoleOIDC_disableParsing
--- PASS: TestAccJWTAuthBackendRoleOIDC_disableParsing (1.24s)
=== RUN   TestAccJWTAuthBackendRole_fullUpdate
--- PASS: TestAccJWTAuthBackendRole_fullUpdate (2.81s)
=== RUN   TestAccJWTAuthBackend
--- PASS: TestAccJWTAuthBackend (3.89s)
=== RUN   TestAccJWTAuthBackendProviderConfig
--- PASS: TestAccJWTAuthBackendProviderConfig (1.11s)
=== RUN   TestAccJWTAuthBackend_OIDC
--- PASS: TestAccJWTAuthBackend_OIDC (1.17s)
=== RUN   TestAccJWTAuthBackend_invalid
--- PASS: TestAccJWTAuthBackend_invalid (0.30s)
=== RUN   TestAccJWTAuthBackend_missingMandatory
--- PASS: TestAccJWTAuthBackend_missingMandatory (1.91s)
=== RUN   TestAccJWTAuthBackendProviderConfigConversionBool
--- PASS: TestAccJWTAuthBackendProviderConfigConversionBool (0.00s)
=== RUN   TestAccJWTAuthBackendProviderConfigConversionInt
--- PASS: TestAccJWTAuthBackendProviderConfigConversionInt (0.00s)
=== RUN   TestAccJWTAuthBackendProviderConfig_negative
    resource_jwt_auth_backend_test.go:380: true
--- SKIP: TestAccJWTAuthBackendProviderConfig_negative (0.00s)
PASS
ok      github.com/hashicorp/terraform-provider-vault/vault     21.384s

[austingebauer]

Looks like the TestAccJWTAuthBackendRole_import test failed in CI. This is likely because the test is using Vault 1.10 and the new role parameter is not released yet. The test passed when ran locally.

[vinay-gopalan]

Looks like the TestAccJWTAuthBackendRole_import test failed in CI. This is likely because the test is using Vault 1.10 and the new role parameter is not released yet. The test passed when ran locally.

Ah, yes. This is expected until we have access to Vault builds built off of the main branch running in containers for our CI!

For 1.10, we made use of the testutil.SkipTestEnvSet util function to skip tests and then populated an environment variable in CI. I believe we'll be doing something similar for 1.11 tests :)

[benashz]

Looking good. A few minor suggestions/comments. Then +1

[austingebauer]

@vinay-gopalan - Thanks for the explanation about the test skipping. Makes sense 👍 Any immediate suggestion? I could also hold on merging this until things are set up / ready.

[benashz]

@vinay-gopalan - Thanks for the explanation about the test skipping. Makes sense 👍 Any immediate suggestion? I could also hold on merging this until things are set up / ready.

We use this env var to work around the lack of a vault dev instance to test against:

terraform-provider-vault/testutil/testutil.go

Line 23 in 7205d99

EnvVarSkipVaultNext = "SKIP_VAULT_NEXT_TESTS"

You can use that with

terraform-provider-vault/testutil/testutil.go

Line 45 in 7205d99

func SkipTestEnvSet(t *testing.T, envVars ...string) []string {

[austingebauer]

@benashz - Thanks, that's what I was looking for. I've updated the tests that depend on a Vault 1.11 build to use that env var in 2fd9a5b.

[benashz]

LGTM!