group_membership_claims shouldn't be a string

[sioakim]

According to the TF documentation:
group_membership_claims - (Optional) Configures the groups claim issued in a user or OAuth 2.0 access token that the app expects. Defaults to SecurityGroup. Possible values are None, SecurityGroup, DirectoryRole, ApplicationGroup or All.

But it is not a string - it can have multiple values:
From Terraform plan for a resource I imported:
group_membership_claims = "SecurityGroup, DirectoryRole" -> "SecurityGroup"

Looking at the MS documentation we can see that through the Enterprise Applications settings the option is actually a Radio button which would make sense for the current Terraform implementation.

But through App Registrations the same option is actually multiple choice:

Hence I think this setting should be a different type in Terraform.

[manicminer]

Hi @sioakim, thanks for opening this issue. The API accepts this property as a string value, which is why it's represented as such in the provider. Have you tried specifying a comma-delimited string?

[sioakim]

Yes when I use the comma separated I get:

Error: expected group_membership_claims to be one of [All None SecurityGroup DirectoryRole ApplicationGroup], got SecurityGroup, DirectoryRole

BUT when I import from state it comes in as mentioned above as:
group_membership_claims = "SecurityGroup, DirectoryRole" (comma seperated)

[manicminer]

@sioakim Ah yes, replying in haste I forgot about the validation for that property, sorry about that.

Unfortunately the current SDK doesn't support setting combinations like this, and it appears that both the current API and the upcoming MS Graph API have the same limitation. This means we'll need API support before we'll be able to support different combinations of security/non-security groups, inferred groups and directory roles.

It's interesting though that multiple membership claim types are read back if you set them in the portal, I'll look into this further.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.