Role Scopes: Allow specifying client scope instead of client

[dmeyerholt]

My first shot at extending this great provider.
Following #242 In addition to clients, I want to extend the keycloak_generic_client_role_mapper resource to also manage client roles for client scopes. This allows consolidation of client roles in dedicated client scopes.
Im no go developer and still need to extend the

• validation
• test cases
• documentation

[mrparkers]

Hey @dmeyerholt, thanks for opening this PR. Your changes look good so far.

I could be wrong, but I don't think you need to add any more validation on top of what you already have - all I would have expected to see was the ConflictsWith on the client id and client scope id attributes.

For the test cases, you should be able to copy/paste a lot of code in the resource_keycloak_generic_client_role_mapper_test.go file and replace the client_id attribute with client_scope_id in the HCL snippets, and add new assertions to make sure the correct value is set after tf apply runs. I'd also appreciate it if you could add an example HCL configuration within example/main.tf.

Let me know if you need any assistance with this.

[dmeyerholt]

Thanks @mrparkers,

• validation using ConflictsWith should be sufficient, right
• will provide more testcases
• additional HCL example coming up as well
  Hoping to finish in the next days :) and looking forward in providing more client scope related PRs as we use them a lot and they come in very handy when dealing with a lot of resources.

[dmeyerholt]

Hey @mrparkers I think it's done so far. for documentation I extended the pet examples in roles.tf. For that to work properly those changes were done

• on the app client: disabled full scope (so explicit roles have to be mapped into the client)
• Now map all pet_api client roles into the app client (realm role missing though, maybe another pr ;) )
• new optional client scope makes it possible to map the (new) client role read-pet-with-details into the tokens only, when that client scope is requested in the token request.

[mrparkers]

This looks great, thanks for the contribution!