Deleting one client-level role (keycloak_generic_role_mapper resource) from client's scope deletes all of them.
When client A has two roles from client B assigned in it's scope, deleting one of them with terraform causes deletion of both.
This issue is similar to deleting realm-level role from client's scope, which was fixed with release of mrparkers/keycloak v4.1.0
Root cause
When deleting client-level role from client's scope, Keycloak API expects roles to be passed in request body as an array.
DELETE /{realm}/clients/{id}/scope-mappings/clients/{client}
I believe, that as in Issue 771 the request is sent without body.
Steps to reproduce
Define client backend-client and roles. backend-client is the owner of the roles.
Version
mrparkers/keycloak v4.2.0
Issue
Deleting one client-level role (
keycloak_generic_role_mapper
resource) from client's scope deletes all of them. When client A has two roles from client B assigned in it's scope, deleting one of them with terraform causes deletion of both. This issue is similar to deleting realm-level role from client's scope, which was fixed with release ofmrparkers/keycloak v4.1.0
Root cause
When deleting client-level role from client's scope, Keycloak API expects roles to be passed in request body as an array.
DELETE /{realm}/clients/{id}/scope-mappings/clients/{client}
I believe, that as in Issue 771 the request is sent without body.Steps to reproduce
backend-client
and roles.backend-client
is the owner of the roles.frontend-client
withfull_scope_allowed
set tofalse
and add the roles to it's scope.terraform apply
frontend-client
scope Plan shows that only onekeycloak_generic_role_mapper
resource will be deleted.Plan: 0 to add, 0 to change, 1 to destroy.
keycloak_generic_role_mapper.backend-1-role-2: Destroying... [id=master/client/e6406bcc-9ad5-4cb4-864b-ef94ff39c7f7/scope-mappings/47e78827-84fd-4224-b50e-20b96d36b69e/0ed7131d-c235-4481-a8c2-342e1ad18f46] keycloak_generic_role_mapper.backend-1-role-2: Destruction complete after 0s
Apply complete! Resources: 0 added, 0 changed, 1 destroyed.
keycloak_generic_role_mapper.backend-1-role-1 will be created
resource "keycloak_generic_role_mapper" "backend-1-role-1" {
keycloak_generic_role_mapper.backend-1-role-2 will be created
Plan: 2 to add, 0 to change, 0 to destroy.