DisplayOnConsentScreen broken for resource keycloak_openid_client_scope

[vlaurin]

Details

It seems like recent versions of the provider have broken the ability to turn off the "Display On Consent Screen" flag in Client Scopes.

Here's an example of a resource:

resource "keycloak_openid_client_scope" "test_client_scope" {
  realm_id = keycloak_realm.realm.id
  name = "resource-server/test-client-scope"
  description = "A test client scope"
  include_in_token_scope = false
}

And the resulting Client Scope in Keycloak:

The "Display On Consent Screen" flag is "On" when it should be "Off" as consent_screen_text is null.

Hypothesis

Digging around a bit, I believe this issue is a side effect of commit 4206fa1

As part of this commit, the attribute DisplayOnConsentScreen was changed from a string to a KeycloakBoolQuoted (Source).

However, when marshalled to JSON, KeycloakBoolQuoted is serialising false values as an empty string "". (Source)

As a result, the DisplayOnConsentScreen attribute which was previously sent to Keycloak as "false" is now being sent as "" (Source). And it seems Keycloak is interpreting that empty string as a positive instead of a negative.

I don't know if this is a wider issue of KeycloakBoolQuoted which should be patched globally; or a specificity of DisplayOnConsentScreen which means that the marshalling behaviour of KeycloakBoolQuoted is not suitable for it.

[vlaurin]

Actually, looking at the example above "Include In Token Scope" presents the same issue. It's explicitly set as false but results as a "On" in Keycloak.