XDR-3403: Change the type of group_membership_claims (major)

The default value has also been changed.
quantum-sec · May 26, 2022 · 399b142 · 399b142
1 parent 0c514cb
commit 399b142
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 5 deletions.
diff --git a/examples/azuread-application/vars.tf b/examples/azuread-application/vars.tf
@@ -48,8 +48,8 @@ variable "oauth2_implicit_flow_allow_access_token" {
 
 variable "group_membership_claims" {
   description = "Configures the `groups` claim issued in a user or OAuth 2.0 access token that the app expects. One of `None`, `SecurityGroup`, `DirectoryRole`, `ApplicationGroup`, or `All`."
-  type        = string
-  default     = null
+  type        = set(string)
+  default     = []
 }
 
 variable "owners" {

diff --git a/modules/azuread-application/main.tf b/modules/azuread-application/main.tf
@@ -17,7 +17,7 @@ resource "azuread_application" "app" {
   display_name    = var.display_name
   identifier_uris = var.identifier_uris
 
-  group_membership_claims = var.group_membership_claims == null ? [] : [var.group_membership_claims]
+  group_membership_claims = var.group_membership_claims
   owners                  = var.owners
 
   sign_in_audience               = var.sign_in_audience

diff --git a/modules/azuread-application/vars.tf b/modules/azuread-application/vars.tf
@@ -56,8 +56,12 @@ variable "oauth2_implicit_flow_allow_access_token" {
 
 variable "group_membership_claims" {
   description = "Configures the `groups` claim issued in a user or OAuth 2.0 access token that the app expects. One of `None`, `SecurityGroup`, `DirectoryRole`, `ApplicationGroup`, or `All`."
-  type        = string
-  default     = null
+  type        = set(string)
+  validation {
+    condition     = can([for c in var.group_membership_claims : contains(["None", "SecurityGroup", "DirectoryRole", "ApplicationGroup", "All"], c)])
+    error_message = "Allowed values for input_parameter are \"None\", \"SecurityGroup\", \"DirectoryRole\", \"ApplicationGroup\" or \"All\"."
+  }
+  default = []
 }
 
 variable "owners" {