diff --git a/azurerm/internal/services/apimanagement/client/client.go b/azurerm/internal/services/apimanagement/client/client.go index 41ad41b3b116..500d7f31f6f7 100644 --- a/azurerm/internal/services/apimanagement/client/client.go +++ b/azurerm/internal/services/apimanagement/client/client.go @@ -18,6 +18,7 @@ type Client struct { DiagnosticClient *apimanagement.DiagnosticClient GroupClient *apimanagement.GroupClient GroupUsersClient *apimanagement.GroupUserClient + IdentityProviderClient *apimanagement.IdentityProviderClient LoggerClient *apimanagement.LoggerClient OpenIdConnectClient *apimanagement.OpenIDConnectProviderClient PolicyClient *apimanagement.PolicyClient @@ -70,6 +71,9 @@ func NewClient(o *common.ClientOptions) *Client { groupUsersClient := apimanagement.NewGroupUserClientWithBaseURI(o.ResourceManagerEndpoint, o.SubscriptionId) o.ConfigureClient(&groupUsersClient.Client, o.ResourceManagerAuthorizer) + identityProviderClient := apimanagement.NewIdentityProviderClientWithBaseURI(o.ResourceManagerEndpoint, o.SubscriptionId) + o.ConfigureClient(&identityProviderClient.Client, o.ResourceManagerAuthorizer) + loggerClient := apimanagement.NewLoggerClientWithBaseURI(o.ResourceManagerEndpoint, o.SubscriptionId) o.ConfigureClient(&loggerClient.Client, o.ResourceManagerAuthorizer) @@ -122,6 +126,7 @@ func NewClient(o *common.ClientOptions) *Client { DiagnosticClient: &diagnosticClient, GroupClient: &groupClient, GroupUsersClient: &groupUsersClient, + IdentityProviderClient: &identityProviderClient, LoggerClient: &loggerClient, OpenIdConnectClient: &openIdConnectClient, PolicyClient: &policyClient, diff --git a/azurerm/internal/services/apimanagement/registration.go b/azurerm/internal/services/apimanagement/registration.go index e14db112f0ab..03232eec7fdd 100644 --- a/azurerm/internal/services/apimanagement/registration.go +++ b/azurerm/internal/services/apimanagement/registration.go @@ -38,6 +38,7 @@ func (r Registration) SupportedResources() map[string]*schema.Resource { "azurerm_api_management_diagnostic": resourceArmApiManagementDiagnostic(), "azurerm_api_management_group": resourceArmApiManagementGroup(), "azurerm_api_management_group_user": resourceArmApiManagementGroupUser(), + "azurerm_api_management_identity_provider_aad": resourceArmApiManagementIdentityProviderAAD(), "azurerm_api_management_logger": resourceArmApiManagementLogger(), "azurerm_api_management_openid_connect_provider": resourceArmApiManagementOpenIDConnectProvider(), "azurerm_api_management_product": resourceArmApiManagementProduct(), diff --git a/azurerm/internal/services/apimanagement/resource_arm_api_management_identity_provider_aad.go b/azurerm/internal/services/apimanagement/resource_arm_api_management_identity_provider_aad.go new file mode 100644 index 000000000000..ca25fb914586 --- /dev/null +++ b/azurerm/internal/services/apimanagement/resource_arm_api_management_identity_provider_aad.go @@ -0,0 +1,171 @@ +package apimanagement + +import ( + "fmt" + "log" + "time" + + "github.com/Azure/azure-sdk-for-go/services/apimanagement/mgmt/2018-01-01/apimanagement" + "github.com/hashicorp/terraform-plugin-sdk/helper/schema" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/azure" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/tf" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/validate" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/clients" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/features" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/timeouts" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/utils" +) + +func resourceArmApiManagementIdentityProviderAAD() *schema.Resource { + return &schema.Resource{ + Create: resourceArmApiManagementIdentityProviderAADCreateUpdate, + Read: resourceArmApiManagementIdentityProviderAADRead, + Update: resourceArmApiManagementIdentityProviderAADCreateUpdate, + Delete: resourceArmApiManagementIdentityProviderAADDelete, + Importer: &schema.ResourceImporter{ + State: schema.ImportStatePassthrough, + }, + + Timeouts: &schema.ResourceTimeout{ + Create: schema.DefaultTimeout(30 * time.Minute), + Read: schema.DefaultTimeout(5 * time.Minute), + Update: schema.DefaultTimeout(30 * time.Minute), + Delete: schema.DefaultTimeout(30 * time.Minute), + }, + + Schema: map[string]*schema.Schema{ + "resource_group_name": azure.SchemaResourceGroupName(), + + "api_management_name": azure.SchemaApiManagementName(), + + "client_id": { + Type: schema.TypeString, + Required: true, + ValidateFunc: validate.GUID, + }, + + "client_secret": { + Type: schema.TypeString, + Required: true, + Sensitive: true, + ValidateFunc: validate.NoEmptyStrings, + }, + + "allowed_tenants": { + Type: schema.TypeList, + Required: true, + Elem: &schema.Schema{ + Type: schema.TypeString, + ValidateFunc: validate.GUID, + }, + }, + }, + } +} + +func resourceArmApiManagementIdentityProviderAADCreateUpdate(d *schema.ResourceData, meta interface{}) error { + client := meta.(*clients.Client).ApiManagement.IdentityProviderClient + ctx, cancel := timeouts.ForCreateUpdate(meta.(*clients.Client).StopContext, d) + defer cancel() + + resourceGroup := d.Get("resource_group_name").(string) + serviceName := d.Get("api_management_name").(string) + clientID := d.Get("client_id").(string) + clientSecret := d.Get("client_secret").(string) + allowedTenants := d.Get("allowed_tenants").([]interface{}) + + if features.ShouldResourcesBeImported() && d.IsNewResource() { + existing, err := client.Get(ctx, resourceGroup, serviceName, apimanagement.Aad) + if err != nil { + if !utils.ResponseWasNotFound(existing.Response) { + return fmt.Errorf("Error checking for presence of existing Identity Provider %q (API Management Service %q / Resource Group %q): %s", apimanagement.Aad, serviceName, resourceGroup, err) + } + } + + if existing.ID != nil && *existing.ID != "" { + return tf.ImportAsExistsError("azurerm_api_management_identity_provider_aad", *existing.ID) + } + } + + parameters := apimanagement.IdentityProviderContract{ + IdentityProviderContractProperties: &apimanagement.IdentityProviderContractProperties{ + ClientID: utils.String(clientID), + ClientSecret: utils.String(clientSecret), + Type: apimanagement.Aad, + AllowedTenants: utils.ExpandStringSlice(allowedTenants), + }, + } + + if _, err := client.CreateOrUpdate(ctx, resourceGroup, serviceName, apimanagement.Aad, parameters, ""); err != nil { + return fmt.Errorf("Error creating or updating Identity Provider %q (Resource Group %q / API Management Service %q): %+v", apimanagement.Aad, resourceGroup, serviceName, err) + } + + resp, err := client.Get(ctx, resourceGroup, serviceName, apimanagement.Aad) + if err != nil { + return fmt.Errorf("Error retrieving Identity Provider %q (Resource Group %q / API Management Service %q): %+v", apimanagement.Aad, resourceGroup, serviceName, err) + } + if resp.ID == nil { + return fmt.Errorf("Cannot read ID for Identity Provider %q (Resource Group %q / API Management Service %q)", apimanagement.Aad, resourceGroup, serviceName) + } + d.SetId(*resp.ID) + + return resourceArmApiManagementIdentityProviderAADRead(d, meta) +} + +func resourceArmApiManagementIdentityProviderAADRead(d *schema.ResourceData, meta interface{}) error { + client := meta.(*clients.Client).ApiManagement.IdentityProviderClient + ctx, cancel := timeouts.ForRead(meta.(*clients.Client).StopContext, d) + defer cancel() + + id, err := azure.ParseAzureResourceID(d.Id()) + if err != nil { + return err + } + resourceGroup := id.ResourceGroup + serviceName := id.Path["service"] + identityProviderName := id.Path["identityProviders"] + + resp, err := client.Get(ctx, resourceGroup, serviceName, apimanagement.IdentityProviderType(identityProviderName)) + if err != nil { + if utils.ResponseWasNotFound(resp.Response) { + log.Printf("[DEBUG] Identity Provider %q (Resource Group %q / API Management Service %q) was not found - removing from state!", identityProviderName, resourceGroup, serviceName) + d.SetId("") + return nil + } + + return fmt.Errorf("Error making Read request for Identity Provider %q (Resource Group %q / API Management Service %q): %+v", identityProviderName, resourceGroup, serviceName, err) + } + + d.Set("resource_group_name", resourceGroup) + d.Set("api_management_name", serviceName) + + if props := resp.IdentityProviderContractProperties; props != nil { + d.Set("client_id", props.ClientID) + d.Set("client_secret", props.ClientSecret) + d.Set("allowed_tenants", props.AllowedTenants) + } + + return nil +} + +func resourceArmApiManagementIdentityProviderAADDelete(d *schema.ResourceData, meta interface{}) error { + client := meta.(*clients.Client).ApiManagement.IdentityProviderClient + ctx, cancel := timeouts.ForDelete(meta.(*clients.Client).StopContext, d) + defer cancel() + + id, err := azure.ParseAzureResourceID(d.Id()) + if err != nil { + return err + } + resourceGroup := id.ResourceGroup + serviceName := id.Path["service"] + identityProviderName := id.Path["identityProviders"] + + if resp, err := client.Delete(ctx, resourceGroup, serviceName, apimanagement.IdentityProviderType(identityProviderName), ""); err != nil { + if !utils.ResponseWasNotFound(resp) { + return fmt.Errorf("Error deleting Identity Provider %q (Resource Group %q / API Management Service %q): %+v", identityProviderName, resourceGroup, serviceName, err) + } + } + + return nil +} diff --git a/azurerm/internal/services/apimanagement/tests/resource_arm_api_management_identity_provider_aad_test.go b/azurerm/internal/services/apimanagement/tests/resource_arm_api_management_identity_provider_aad_test.go new file mode 100644 index 000000000000..4085fbe096ce --- /dev/null +++ b/azurerm/internal/services/apimanagement/tests/resource_arm_api_management_identity_provider_aad_test.go @@ -0,0 +1,208 @@ +package tests + +import ( + "fmt" + "testing" + + "github.com/Azure/azure-sdk-for-go/services/apimanagement/mgmt/2018-01-01/apimanagement" + "github.com/hashicorp/terraform-plugin-sdk/helper/resource" + "github.com/hashicorp/terraform-plugin-sdk/terraform" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/acceptance" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/clients" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/features" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/utils" +) + +func TestAccAzureRMApiManagementIdentityProviderAAD_basic(t *testing.T) { + data := acceptance.BuildTestData(t, "azurerm_api_management_identity_provider_aad", "test") + config := testAccAzureRMApiManagementIdentityProviderAAD_basic(data) + + resource.ParallelTest(t, resource.TestCase{ + PreCheck: func() { acceptance.PreCheck(t) }, + Providers: acceptance.SupportedProviders, + CheckDestroy: testCheckAzureRMApiManagementIdentityProviderAADDestroy, + Steps: []resource.TestStep{ + { + Config: config, + Check: resource.ComposeTestCheckFunc( + testCheckAzureRMApiManagementIdentityProviderAADExists(data.ResourceName), + ), + }, + data.ImportStep(), + }, + }) +} + +func TestAccAzureRMApiManagementIdentityProviderAAD_update(t *testing.T) { + data := acceptance.BuildTestData(t, "azurerm_api_management_identity_provider_aad", "test") + config := testAccAzureRMApiManagementIdentityProviderAAD_basic(data) + updateConfig := testAccAzureRMApiManagementIdentityProviderAAD_update(data) + + resource.ParallelTest(t, resource.TestCase{ + PreCheck: func() { acceptance.PreCheck(t) }, + Providers: acceptance.SupportedProviders, + CheckDestroy: testCheckAzureRMApiManagementIdentityProviderAADDestroy, + Steps: []resource.TestStep{ + { + Config: config, + Check: resource.ComposeTestCheckFunc( + testCheckAzureRMApiManagementIdentityProviderAADExists(data.ResourceName), + resource.TestCheckResourceAttr(data.ResourceName, "client_id", "00000000-0000-0000-0000-000000000000"), + resource.TestCheckResourceAttr(data.ResourceName, "client_secret", "00000000000000000000000000000000"), + resource.TestCheckResourceAttr(data.ResourceName, "allowed_tenants.#", "1"), + resource.TestCheckResourceAttr(data.ResourceName, "allowed_tenants.0", data.Client().TenantID), + ), + }, + { + Config: updateConfig, + Check: resource.ComposeTestCheckFunc( + testCheckAzureRMApiManagementIdentityProviderAADExists(data.ResourceName), + resource.TestCheckResourceAttr(data.ResourceName, "client_id", "11111111-1111-1111-1111-111111111111"), + resource.TestCheckResourceAttr(data.ResourceName, "client_secret", "11111111111111111111111111111111"), + resource.TestCheckResourceAttr(data.ResourceName, "allowed_tenants.#", "2"), + resource.TestCheckResourceAttr(data.ResourceName, "allowed_tenants.0", data.Client().TenantID), + resource.TestCheckResourceAttr(data.ResourceName, "allowed_tenants.1", data.Client().TenantID), + ), + }, + data.ImportStep(), + }, + }) +} + +func TestAccAzureRMApiManagementIdentityProviderAAD_requiresImport(t *testing.T) { + if !features.ShouldResourcesBeImported() { + t.Skip("Skipping since resources aren't required to be imported") + return + } + data := acceptance.BuildTestData(t, "azurerm_api_management_identity_provider_aad", "test") + + resource.ParallelTest(t, resource.TestCase{ + PreCheck: func() { acceptance.PreCheck(t) }, + Providers: acceptance.SupportedProviders, + CheckDestroy: testCheckAzureRMApiManagementIdentityProviderAADDestroy, + Steps: []resource.TestStep{ + { + Config: testAccAzureRMApiManagementIdentityProviderAAD_basic(data), + Check: resource.ComposeTestCheckFunc( + testCheckAzureRMApiManagementIdentityProviderAADExists(data.ResourceName), + ), + }, + data.RequiresImportErrorStep(testAccAzureRMApiManagementIdentityProviderAAD_requiresImport), + }, + }) +} + +func testCheckAzureRMApiManagementIdentityProviderAADDestroy(s *terraform.State) error { + client := acceptance.AzureProvider.Meta().(*clients.Client).ApiManagement.IdentityProviderClient + for _, rs := range s.RootModule().Resources { + if rs.Type != "azurerm_api_management_identity_provider_aad" { + continue + } + + resourceGroup := rs.Primary.Attributes["resource_group_name"] + serviceName := rs.Primary.Attributes["api_management_name"] + + ctx := acceptance.AzureProvider.Meta().(*clients.Client).StopContext + resp, err := client.Get(ctx, resourceGroup, serviceName, apimanagement.Aad) + + if err != nil { + if !utils.ResponseWasNotFound(resp.Response) { + return err + } + } + + return nil + } + return nil +} + +func testCheckAzureRMApiManagementIdentityProviderAADExists(resourceName string) resource.TestCheckFunc { + return func(s *terraform.State) error { + rs, ok := s.RootModule().Resources[resourceName] + if !ok { + return fmt.Errorf("Not found: %s", resourceName) + } + + resourceGroup := rs.Primary.Attributes["resource_group_name"] + serviceName := rs.Primary.Attributes["api_management_name"] + + client := acceptance.AzureProvider.Meta().(*clients.Client).ApiManagement.IdentityProviderClient + ctx := acceptance.AzureProvider.Meta().(*clients.Client).StopContext + resp, err := client.Get(ctx, resourceGroup, serviceName, apimanagement.Aad) + if err != nil { + if utils.ResponseWasNotFound(resp.Response) { + return fmt.Errorf("Bad: API Management Identity Provider %q (Resource Group %q / API Management Service %q) does not exist", apimanagement.Aad, resourceGroup, serviceName) + } + return fmt.Errorf("Bad: Get on apiManagementIdentityProviderClient: %+v", err) + } + + return nil + } +} + +func testAccAzureRMApiManagementIdentityProviderAAD_basic(data acceptance.TestData) string { + return fmt.Sprintf(` +resource "azurerm_resource_group" "test" { + name = "acctestRG-api-%d" + location = "%s" +} + +resource "azurerm_api_management" "test" { + name = "acctestAM-%d" + location = "${azurerm_resource_group.test.location}" + resource_group_name = "${azurerm_resource_group.test.name}" + publisher_name = "pub1" + publisher_email = "pub1@email.com" + sku_name = "Developer_1" +} + +resource "azurerm_api_management_identity_provider_aad" "test" { + resource_group_name = "${azurerm_resource_group.test.name}" + api_management_name = "${azurerm_api_management.test.name}" + client_id = "00000000-0000-0000-0000-000000000000" + client_secret = "00000000000000000000000000000000" + allowed_tenants = ["%s"] +} +`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.Client().TenantID) +} + +func testAccAzureRMApiManagementIdentityProviderAAD_update(data acceptance.TestData) string { + return fmt.Sprintf(` +resource "azurerm_resource_group" "test" { + name = "acctestRG-api-%d" + location = "%s" +} + +resource "azurerm_api_management" "test" { + name = "acctestAM-%d" + location = "${azurerm_resource_group.test.location}" + resource_group_name = "${azurerm_resource_group.test.name}" + publisher_name = "pub1" + publisher_email = "pub1@email.com" + sku_name = "Developer_1" +} + +resource "azurerm_api_management_identity_provider_aad" "test" { + resource_group_name = "${azurerm_resource_group.test.name}" + api_management_name = "${azurerm_api_management.test.name}" + client_id = "11111111-1111-1111-1111-111111111111" + client_secret = "11111111111111111111111111111111" + allowed_tenants = ["%s", "%s"] +} +`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.Client().TenantID, data.Client().TenantID) +} + +func testAccAzureRMApiManagementIdentityProviderAAD_requiresImport(data acceptance.TestData) string { + template := testAccAzureRMApiManagementIdentityProviderAAD_basic(data) + return fmt.Sprintf(` +%s + +resource "azurerm_api_management_identity_provider_aad" "import" { + resource_group_name = "${azurerm_api_management_identity_provider_aad.test.resource_group_name}" + api_management_name = "${azurerm_api_management_identity_provider_aad.test.api_management_name}" + client_id = "${azurerm_api_management_identity_provider_aad.test.client_id}" + client_secret = "${azurerm_api_management_identity_provider_aad.test.client_secret}" + allowed_tenants = "${azurerm_api_management_identity_provider_aad.test.allowed_tenants}" +} +`, template) +} diff --git a/website/azurerm.erb b/website/azurerm.erb index f3506a70cbc4..5c618bfc3cb6 100644 --- a/website/azurerm.erb +++ b/website/azurerm.erb @@ -561,6 +561,10 @@ azurerm_api_management_group_user +
  • + azurerm_api_management_identity_provider_aad +
    • +
  • azurerm_api_management_logger
    • diff --git a/website/docs/r/api_management_identity_provider_aad.html.markdown b/website/docs/r/api_management_identity_provider_aad.html.markdown new file mode 100644 index 000000000000..4f2e1cb764f6 --- /dev/null +++ b/website/docs/r/api_management_identity_provider_aad.html.markdown @@ -0,0 +1,68 @@ +--- +subcategory: "API Management" +layout: "azurerm" +page_title: "Azure Resource Manager: azurerm_api_management_identity_provider_aad" +sidebar_current: "docs-azurerm-resource-api-management-identity-provider-aad" +description: |- + Manages an API Management AAD Identity Provider. +--- + +# azurerm_api_management_identity_provider_aad + +Manages an API Management AAD Identity Provider. + +## Example Usage + +```hcl +resource "azurerm_resource_group" "example" { + name = "example-resources" + location = "West Europe" +} + +resource "azurerm_api_management" "example" { + name = "example-apim" + location = "${azurerm_resource_group.example.location}" + resource_group_name = "${azurerm_resource_group.example.name}" + publisher_name = "My Company" + publisher_email = "company@terraform.io" + sku_name = "Developer_1" +} + +resource "azurerm_api_management_identity_provider_aad" "example" { + resource_group_name = "${azurerm_resource_group.example.name}" + api_management_name = "${azurerm_api_management.example.name}" + client_id = "00000000-0000-0000-0000-000000000000" + client_secret = "00000000000000000000000000000000" + allowed_tenants = ["00000000-0000-0000-0000-000000000000"] +} +``` + +## Argument Reference + +The following arguments are supported: + +* `api_management_name` - (Required) The Name of the API Management Service where this AAD Identity Provider should be created. Changing this forces a new resource to be created. + +* `resource_group_name` - (Required) The Name of the Resource Group where the API Management Service exists. Changing this forces a new resource to be created. + +* `client_id` - (Required) Client Id of the Application in the AAD Identity Provider. + +* `client_secret` - (Required) Client secret of the Application in the AAD Identity Provider. + +* `allowed_tenants` - (Required) List of allowed AAD Tenants. + +--- + +## Attributes Reference + +In addition to all arguments above, the following attributes are exported: + +* `id` - The ID of the API Management AAD Identity Provider. + +## Import + +API Management AAD Identity Provider can be imported using the `resource id`, e.g. + +```shell +terraform import azurerm_api_management_identity_provider_aad.example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mygroup1/providers/Microsoft.ApiManagement/service/instance1/identityProviders/aad +```