OpenId and SAML Client's attributes

docs/resources/keycloak_openid_client.md

@@ -27,6 +27,11 @@ resource "keycloak_openid_client" "openid_client" {
     ]
 
     login_theme = "keycloak"
+
+    extra_config = {
+		"key1" = "value1"
+		"key2" = "value2"
+    }
 }
 ```
 
@@ -67,6 +72,7 @@ is set to `true`.
     - `browers_id` - (Optional) - Browser flow id, (flow needs to exist)
     - `direct_grant_id` - (Optional) - Direct grant flow id (flow needs to exist)
 - `login_theme` - (Optional) - Override realm login theme
+- `extra_config` - (Optional) A map of key/value pairs to set as custom attributes for the client.
 
 ### Attributes Reference
 

docs/resources/keycloak_saml_client.md

@@ -25,6 +25,11 @@ resource "keycloak_saml_client" "saml_client" {
 
 	signing_certificate = "${file("saml-cert.pem")}"
 	signing_private_key = "${file("saml-key.pem")}"
+
+	extra_config = {
+		"key1" = "value1"
+		"key2" = "value2"
+    }
 }
 ```
 
@@ -58,6 +63,7 @@ The following arguments are supported:
 - `logout_service_post_binding_url` - (Optional) SAML POST Binding URL for the client's single logout service.
 - `logout_service_redirect_binding_url` - (Optional) SAML Redirect Binding URL for the client's single logout service.
 - `full_scope_allowed` - (Optional) - Allow to include all roles mappings in the access token
+- `extra_config` - (Optional) A map of key/value pairs to set as custom attributes for the client.
 
 ### Import
 

example/main.tf

@@ -567,6 +567,11 @@ resource keycloak_attribute_importer_identity_provider_mapper oidc {
   claim_name              = "upn"
   identity_provider_alias = keycloak_oidc_identity_provider.oidc.alias
   user_attribute          = "email"
+
+  #KC10 support
+  extra_config = {
+    syncMode = "INHERIT"    
+  }
 }
 
 resource keycloak_attribute_to_role_identity_provider_mapper oidc {
@@ -576,20 +581,35 @@ resource keycloak_attribute_to_role_identity_provider_mapper oidc {
   identity_provider_alias = keycloak_oidc_identity_provider.oidc.alias
   claim_value             = "value"
   role                    = "testRole"
+
+  #KC10 support
+  extra_config = {
+    syncMode = "INHERIT"    
+  }  
 }
 
 resource keycloak_user_template_importer_identity_provider_mapper oidc {
   realm                   = keycloak_realm.test.id
   name                    = "userTemplate"
   identity_provider_alias = keycloak_oidc_identity_provider.oidc.alias
   template                = "$${ALIAS}/$${CLAIM.upn}"
+
+  #KC10 support
+  extra_config = {
+    syncMode = "INHERIT"    
+  }  
 }
 
 resource keycloak_hardcoded_role_identity_provider_mapper oidc {
   realm                   = keycloak_realm.test.id
   name                    = "hardcodedRole"
   identity_provider_alias = keycloak_oidc_identity_provider.oidc.alias
   role                    = "testrole"
+
+  #KC10 support
+  extra_config = {
+    syncMode = "INHERIT"    
+  }  
 }
 
 resource keycloak_hardcoded_attribute_identity_provider_mapper oidc {
@@ -599,6 +619,11 @@ resource keycloak_hardcoded_attribute_identity_provider_mapper oidc {
   attribute_name          = "attribute"
   attribute_value         = "value"
   user_session            = true
+
+  #KC10 support
+  extra_config = {
+    syncMode = "INHERIT"    
+  }  
 }
 
 resource keycloak_saml_identity_provider saml {
@@ -613,6 +638,11 @@ resource keycloak_attribute_importer_identity_provider_mapper saml {
   attribute_name          = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
   identity_provider_alias = keycloak_saml_identity_provider.saml.alias
   user_attribute          = "email"
+
+  #KC10 support
+  extra_config = {
+    syncMode = "INHERIT"    
+  }
 }
 
 resource keycloak_attribute_to_role_identity_provider_mapper saml {
@@ -622,20 +652,35 @@ resource keycloak_attribute_to_role_identity_provider_mapper saml {
   identity_provider_alias = keycloak_saml_identity_provider.saml.alias
   attribute_value         = "value"
   role                    = "testRole"
+
+  #KC10 support
+  extra_config = {
+    syncMode = "INHERIT"    
+  }
 }
 
 resource keycloak_user_template_importer_identity_provider_mapper saml {
   realm                   = keycloak_realm.test.id
   name                    = "userTemplate"
   identity_provider_alias = keycloak_saml_identity_provider.saml.alias
   template                = "$${ALIAS}/$${NAMEID}"
+
+  #KC10 support
+  extra_config = {
+    syncMode = "INHERIT"    
+  }  
 }
 
 resource keycloak_hardcoded_role_identity_provider_mapper saml {
   realm                   = keycloak_realm.test.id
   name                    = "hardcodedRole"
   identity_provider_alias = keycloak_saml_identity_provider.saml.alias
   role                    = "testrole"
+
+  #KC10 support
+  extra_config = {
+    syncMode = "INHERIT"    
+  }  
 }
 
 resource keycloak_hardcoded_attribute_identity_provider_mapper saml {
@@ -645,6 +690,11 @@ resource keycloak_hardcoded_attribute_identity_provider_mapper saml {
   attribute_name          = "attribute"
   attribute_value         = "value"
   user_session            = false
+
+  #KC10 support
+  extra_config = {
+    syncMode = "INHERIT"    
+  }  
 }
 
 data "keycloak_openid_client" "broker" {

example/roles.tf

@@ -160,6 +160,44 @@ resource "keycloak_generic_client_role_mapper" "pet_app_pet_api_admin_role_mappi
   role_id   = keycloak_role.pet_api_admin.id
 }
 
+// Realm roles
+
+resource "keycloak_role" "realm_reader" {  
+  realm_id  = keycloak_realm.roles_example.id
+  name        = "realm_reader"
+  description = "Reader realm role"
+}
+
+resource "keycloak_role" "realm_writer" {
+  realm_id  = keycloak_realm.roles_example.id
+  name        = "realm_writer"
+  description = "Writer realm role"
+}
+
+resource "keycloak_role" "realm_admin" {
+  realm_id  = keycloak_realm.roles_example.id
+  name        = "realm_admin"
+  description = "Admin realm composite role"
+  composite_roles = [
+    keycloak_role.realm_reader.id,
+    keycloak_role.realm_writer.id
+  ]
+}
+
+// Client scope for realm roles mapping 
+
+resource "keycloak_openid_client_scope" "petstore_api_access_scope" {
+  realm_id  = keycloak_realm.roles_example.id
+  name        = "petstore-api-access"
+  description = "Optional scope offering additional information for petstore api access"
+}
+
+resource "keycloak_generic_client_role_mapper" "petstore_api_access_scope_admin" {
+    realm_id  = keycloak_realm.roles_example.id
+    client_scope_id =  keycloak_openid_client_scope.petstore_api_access_scope.id
+    role_id         = keycloak_role.realm_admin.id
+}
+
 // Users and groups
 
 resource "keycloak_group" "pet_api_base" {

keycloak/identity_provider_mapper.go

@@ -1,20 +1,25 @@
 package keycloak
 
 import (
+	"encoding/json"
 	"fmt"
 	"log"
+	"reflect"
+	"strconv"
+	"strings"
 )
 
 type IdentityProviderMapperConfig struct {
-	UserAttribute         string `json:"user.attribute,omitempty"`
-	Claim                 string `json:"claim,omitempty"`
-	ClaimValue            string `json:"claim.value,omitempty"`
-	HardcodedAttribute    string `json:"attribute,omitempty"`
-	Attribute             string `json:"attribute.name,omitempty"`
-	AttributeValue        string `json:"attribute.value,omitempty"`
-	AttributeFriendlyName string `json:"attribute.friendly.name,omitempty"`
-	Template              string `json:"template,omitempty"`
-	Role                  string `json:"role,omitempty"`
+	UserAttribute         string                 `json:"user.attribute,omitempty"`
+	Claim                 string                 `json:"claim,omitempty"`
+	ClaimValue            string                 `json:"claim.value,omitempty"`
+	HardcodedAttribute    string                 `json:"attribute,omitempty"`
+	Attribute             string                 `json:"attribute.name,omitempty"`
+	AttributeValue        string                 `json:"attribute.value,omitempty"`
+	AttributeFriendlyName string                 `json:"attribute.friendly.name,omitempty"`
+	Template              string                 `json:"template,omitempty"`
+	Role                  string                 `json:"role,omitempty"`
+	ExtraConfig           map[string]interface{} `json:"-"`
 }
 
 type IdentityProviderMapper struct {
@@ -59,3 +64,57 @@ func (keycloakClient *KeycloakClient) UpdateIdentityProviderMapper(identityProvi
 func (keycloakClient *KeycloakClient) DeleteIdentityProviderMapper(realm, alias, id string) error {
 	return keycloakClient.delete(fmt.Sprintf("/realms/%s/identity-provider/instances/%s/mappers/%s", realm, alias, id), nil)
 }
+
+func (f *IdentityProviderMapperConfig) UnmarshalJSON(data []byte) error {
+	f.ExtraConfig = map[string]interface{}{}
+	err := json.Unmarshal(data, &f.ExtraConfig)
+	if err != nil {
+		return err
+	}
+	v := reflect.ValueOf(f).Elem()
+	for i := 0; i < v.NumField(); i++ {
+		structField := v.Type().Field(i)
+		jsonKey := strings.Split(structField.Tag.Get("json"), ",")[0]
+		if jsonKey != "-" {
+			value, ok := f.ExtraConfig[jsonKey]
+			if ok {
+				field := v.FieldByName(structField.Name)
+				if field.IsValid() && field.CanSet() {
+					if field.Kind() == reflect.String {
+						field.SetString(value.(string))
+					} else if field.Kind() == reflect.Bool {
+						boolVal, err := strconv.ParseBool(value.(string))
+						if err == nil {
+							field.Set(reflect.ValueOf(KeycloakBoolQuoted(boolVal)))
+						}
+					}
+					delete(f.ExtraConfig, jsonKey)
+				}
+			}
+		}
+	}
+	return nil
+}
+
+func (f *IdentityProviderMapperConfig) MarshalJSON() ([]byte, error) {
+	out := map[string]interface{}{}
+
+	for k, v := range f.ExtraConfig {
+		out[k] = v
+	}
+	v := reflect.ValueOf(f).Elem()
+	for i := 0; i < v.NumField(); i++ {
+		jsonKey := strings.Split(v.Type().Field(i).Tag.Get("json"), ",")[0]
+		if jsonKey != "-" {
+			field := v.Field(i)
+			if field.IsValid() && field.CanSet() {
+				if field.Kind() == reflect.String {
+					out[jsonKey] = field.String()
+				} else if field.Kind() == reflect.Bool {
+					out[jsonKey] = KeycloakBoolQuoted(field.Bool())
+				}
+			}
+		}
+	}
+	return json.Marshal(out)
+}

keycloak/openid_client.go

@@ -1,7 +1,11 @@
 package keycloak
 
 import (
+	"encoding/json"
 	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
 )
 
 type OpenidClientRole struct {
@@ -54,10 +58,65 @@ type OpenidClient struct {
 }
 
 type OpenidClientAttributes struct {
-	PkceCodeChallengeMethod             string             `json:"pkce.code.challenge.method"`
-	ExcludeSessionStateFromAuthResponse KeycloakBoolQuoted `json:"exclude.session.state.from.auth.response"`
-	AccessTokenLifespan                 string             `json:"access.token.lifespan"`
-	LoginTheme                          string             `json:"login_theme"`
+	PkceCodeChallengeMethod             string                 `json:"pkce.code.challenge.method"`
+	ExcludeSessionStateFromAuthResponse KeycloakBoolQuoted     `json:"exclude.session.state.from.auth.response"`
+	AccessTokenLifespan                 string                 `json:"access.token.lifespan"`
+	LoginTheme                          string                 `json:"login_theme"`
+	ExtraConfig                         map[string]interface{} `json:"-"`
+}
+
+func (f *OpenidClientAttributes) UnmarshalJSON(data []byte) error {
+	f.ExtraConfig = map[string]interface{}{}
+	err := json.Unmarshal(data, &f.ExtraConfig)
+	if err != nil {
+		return err
+	}
+	v := reflect.ValueOf(f).Elem()
+	for i := 0; i < v.NumField(); i++ {
+		structField := v.Type().Field(i)
+		jsonKey := strings.Split(structField.Tag.Get("json"), ",")[0]
+		if jsonKey != "-" {
+			value, ok := f.ExtraConfig[jsonKey]
+			if ok {
+				field := v.FieldByName(structField.Name)
+				if field.IsValid() && field.CanSet() {
+					if field.Kind() == reflect.String {
+						field.SetString(value.(string))
+					} else if field.Kind() == reflect.Bool {
+						boolVal, err := strconv.ParseBool(value.(string))
+						if err == nil {
+							field.Set(reflect.ValueOf(KeycloakBoolQuoted(boolVal)))
+						}
+					}
+					delete(f.ExtraConfig, jsonKey)
+				}
+			}
+		}
+	}
+	return nil
+}
+
+func (f *OpenidClientAttributes) MarshalJSON() ([]byte, error) {
+	out := map[string]interface{}{}
+
+	for k, v := range f.ExtraConfig {
+		out[k] = v
+	}
+	v := reflect.ValueOf(f).Elem()
+	for i := 0; i < v.NumField(); i++ {
+		jsonKey := strings.Split(v.Type().Field(i).Tag.Get("json"), ",")[0]
+		if jsonKey != "-" {
+			field := v.Field(i)
+			if field.IsValid() && field.CanSet() {
+				if field.Kind() == reflect.String {
+					out[jsonKey] = field.String()
+				} else if field.Kind() == reflect.Bool {
+					out[jsonKey] = KeycloakBoolQuoted(field.Bool())
+				}
+			}
+		}
+	}
+	return json.Marshal(out)
 }
 
 type OpenidAuthenticationFlowBindingOverrides struct {