alekc
commented
2 years ago Sigh, yet again Auth0 shows that they disregard their own apis, they should really check for values instead of just blindly saving them as they are.
@mvanderlee I opened a PR with a fix, this is the rendered version
{
"tenant": "terraform-provider",
"global": false,
"is_token_endpoint_ip_header_trusted": true,
"name": "Acceptance Test - okendc",
"description": "Test Application Long Description",
"is_first_party": true,
"oidc_conformant": true,
"callbacks": [
"https://example.com/callback"
],
"allowed_clients": [
"https://allowed.example.com"
],
"allowed_logout_urls": [
"https://example.com"
],
"addons": {
"samlp": {
"audience": "https://example.com/saml",
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
"createUpnClaim": false,
"destination": "http://foo",
"digestAlgorithm": "sha1",
"includeAttributeNameFormat": true,
"lifetimeInSeconds": 180,
"logout": {
"callback": "http://example.com/callback",
"slo_enabled": true
},
"mapIdentities": false,
"mapUnknownClaimsAsIs": false,
"mappings": {
"email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
"name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
},
"nameIdentifierFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
"nameIdentifierProbes": [
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
],
"passthroughClaimsWithNoMapping": false,
"recipient": "http://foo",
"signResponse": false,
"signatureAlgorithm": "rsa-sha1",
"signingCert": "fakecertificate",
"typedAttributes": false
}
},
"client_metadata": {
"foo": "zoo"
},
"mobile": {
"ios": {
"app_bundle_identifier": "com.my.bundle.id",
"team_id": "9JA89QQLNQ"
}
},
"initiate_login_uri": "https://example.com/login",
"refresh_token": {
"expiration_type": "expiring",
"leeway": 42,
"token_lifetime": 424242,
"infinite_token_lifetime": true,
"infinite_idle_token_lifetime": false,
"idle_token_lifetime": 3600,
"rotation_type": "rotating"
},
"organization_usage": "deny",
"organization_require_behavior": "no_prompt",
"sso_disabled": false,
"cross_origin_auth": false,
"signing_keys": [
{
"cert": "-----BEGIN CERTIFICATE-----\r\nMIIDGTCCAgGgAwIBAgIJTv5+TI6JdOmiMA0GCSqGSIb3DQEBCwUAMCoxKDAmBgNV\r\nBAMTH3RlcnJhZm9ybS1wcm92aWRlci5ldS5hdXRoMC5jb20wHhcNMjExMDAxMTMz\r\nNjE1WhcNMzUwNjEwMTMzNjE1WjAqMSgwJgYDVQQDEx90ZXJyYWZvcm0tcHJvdmlk\r\nZXIuZXUuYXV0aDAuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA\r\nt/I5IvIjJxoKeso7wC7PKjZIRmcXWCsCTxazfIvtJA/11emG+5RPlY0OTnFvK/By\r\nDYwWc17k1phU6r0x8hMR9F9k9pPKzBOBn83Tm/WrhqTyGGhUfqWdSRfkJu2pxdhh\r\nsi6p+YXnHINPDi/Y2Yzf6kFZ6m03V8ET8xGZ9jGj39IorjGjwOhdrWRGoTQNvyt7\r\nyiAmm2bX3pETW6pDO04QbV/Z/OrLv7Pvf53h2eOqPBlLRr7UGgvvVMXEiG8yVENw\r\nd27T3KkoEDcqy0csW4yCfBOTzx11rlclO3VKeO3yU5D/jx9Nq3pmT3TFGAScCB7V\r\n1xv87wBAxXij8WEc54ir3QIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud\r\nDgQWBBRmV+xwzOVejJW7Gu/KOY3ZUS6WjDAOBgNVHQ8BAf8EBAMCAoQwDQYJKoZI\r\nhvcNAQELBQADggEBAAA/NUdeg4QShwGUQz7/ntzuiZNpKaYib/sBqYjdHOCEk9V0\r\nOASUQwWnbOcXXcAg4E3Xb28j0DE54nlHa5eSE5ZZyG8lbmA4Qur5P9XMNQb8UKLR\r\nnx030AVy1U+GQeS3u7iCoPp1SKzWUBv5EbBIlxt/9MhI8P2T9fKuGpQ1uybMcIuR\r\nhCNtAG/fypd7FtFzaZlxkGy6or1hp0Y1bWWumH4yzPQPZg9kNOVtMJw+ImIGJuqF\r\nz5hvZ7fbWsr8jiBAK340K4Dd6xUDkvizPm0mafASx47cGDZPJbNCHOR+x7UTr9SZ\r\npTNp+GlPQaQBBxAGWPmatSOagKgqjAXxdBRYoXA=\r\n-----END CERTIFICATE-----",
"pkcs7": "-----BEGIN PKCS7-----\r\nMIIDSAYJKoZIhvcNAQcCoIIDOTCCAzUCAQExADALBgkqhkiG9w0BBwGgggMdMIID\r\nGTCCAgGgAwIBAgIJTv5+TI6JdOmiMA0GCSqGSIb3DQEBCwUAMCoxKDAmBgNVBAMT\r\nH3RlcnJhZm9ybS1wcm92aWRlci5ldS5hdXRoMC5jb20wHhcNMjExMDAxMTMzNjE1\r\nWhcNMzUwNjEwMTMzNjE1WjAqMSgwJgYDVQQDEx90ZXJyYWZvcm0tcHJvdmlkZXIu\r\nZXUuYXV0aDAuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt/I5\r\nIvIjJxoKeso7wC7PKjZIRmcXWCsCTxazfIvtJA/11emG+5RPlY0OTnFvK/ByDYwW\r\nc17k1phU6r0x8hMR9F9k9pPKzBOBn83Tm/WrhqTyGGhUfqWdSRfkJu2pxdhhsi6p\r\n+YXnHINPDi/Y2Yzf6kFZ6m03V8ET8xGZ9jGj39IorjGjwOhdrWRGoTQNvyt7yiAm\r\nm2bX3pETW6pDO04QbV/Z/OrLv7Pvf53h2eOqPBlLRr7UGgvvVMXEiG8yVENwd27T\r\n3KkoEDcqy0csW4yCfBOTzx11rlclO3VKeO3yU5D/jx9Nq3pmT3TFGAScCB7V1xv8\r\n7wBAxXij8WEc54ir3QIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW\r\nBBRmV+xwzOVejJW7Gu/KOY3ZUS6WjDAOBgNVHQ8BAf8EBAMCAoQwDQYJKoZIhvcN\r\nAQELBQADggEBAAA/NUdeg4QShwGUQz7/ntzuiZNpKaYib/sBqYjdHOCEk9V0OASU\r\nQwWnbOcXXcAg4E3Xb28j0DE54nlHa5eSE5ZZyG8lbmA4Qur5P9XMNQb8UKLRnx03\r\n0AVy1U+GQeS3u7iCoPp1SKzWUBv5EbBIlxt/9MhI8P2T9fKuGpQ1uybMcIuRhCNt\r\nAG/fypd7FtFzaZlxkGy6or1hp0Y1bWWumH4yzPQPZg9kNOVtMJw+ImIGJuqFz5hv\r\nZ7fbWsr8jiBAK340K4Dd6xUDkvizPm0mafASx47cGDZPJbNCHOR+x7UTr9SZpTNp\r\n+GlPQaQBBxAGWPmatSOagKgqjAXxdBRYoXAxAA==\r\n-----END PKCS7-----\r\n",
"subject": "deprecated"
}
],
"allowed_origins": [
"https://example.com"
],
"client_id": "Fr4MS04tFIxi23n8PdZvRaX7gfBLhcKT",
"callback_url_template": false,
"client_secret": "Jcy3F9ubLimBRpyE7j9ONl-OK8aqEEkUbj0b87Sq1Bp20fxQose8qJu7iVdhA_pX",
"jwt_configuration": {
"scopes": {
"foo": "bar"
},
"alg": "RS256",
"lifetime_in_seconds": 300,
"secret_encoded": true
},
"token_endpoint_auth_method": "client_secret_post",
"app_type": "non_interactive",
"grant_types": [
"authorization_code",
"http://auth0.com/oauth/grant-type/password-realm",
"implicit",
"password",
"refresh_token"
],
"web_origins": [
"https://example.com"
],
"custom_login_page_on": true
}Are you able to build and test the version in PR to ensure that it's working properly for you? I do not have any real world samlp to test it against
mvanderlee
Description
The client resource configures the SAML logout property as a list instead of an object. This causes auth0 to ignore the configuration
From Auth0's doc in the SAML addon popup:
Terraform Version
Affected Resource(s)
Terraform Configuration Files
Expected Behavior
Resulting Auth0 config:
Actual Behavior
Resulting Auth0 config:
Steps to Reproduce
terraform applyDebug Output
NA
Panic Output
NA
Important Factoids
NA
References
Community Note