Closed rgl closed 1 year ago
When I manually added the 'builtin' mappers for "X500 email" etc, the SAML attribute name format is blank. This goes against the Terraform Provider documentation which states that this attribute is required. I'm using keycloak v18, so they're not called "predefined" mappers, and the UI looks different. In fact, I don't see the 'long' form fo the format, I just see the options that the resource supports:
If the new Keycloak shows the long name format in the dropdown, perhaps that's the source of the confusion. In all of my cases, the realm export JSON shows that X500 protocol mappers use urn:oasis:names:tc:SAML:2.0:attrname-format:uri
but the UI field is blank. I presume that if I change mine to "URI Reference" they will still work.
Have you tried using "URI Reference" instead of "Basic"?
You could also try adding the mapper manually in the UI that works, and then importing it into Terraform as per the example:
terraform import keycloak_saml_user_property_protocol_mapper.saml_user_property_mapper my-realm/client/a7202154-8793-4656-b655-1dd18c181e14/71602afa-f7d1-4788-8c49-ef8fd00af0f4
If that works, then a terraform plan
might show you something useful.
That was it! I've somehow missed that we could use the URI Reference
value.
With:
# see https://registry.terraform.io/providers/mrparkers/keycloak/latest/docs/resources/saml_user_attribute_protocol_mapper
# see https://www.keycloak.org/docs-api/21.1.1/javadocs/org/keycloak/models/UserModel.html
resource "keycloak_saml_user_attribute_protocol_mapper" "example_go_saml_email" {
realm_id = keycloak_saml_client.example_go_saml.realm_id
client_id = keycloak_saml_client.example_go_saml.id
name = "email"
user_attribute = "email"
saml_attribute_name = "urn:oid:1.2.840.113549.1.9.1"
saml_attribute_name_format = "URI Reference"
}
It now returns the expected SAML attribute:
<Attribute
Name="urn:oid:1.2.840.113549.1.9.1"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">alice@example.com</AttributeValue>
</Attribute>
Thank You!
BTW, I'm playing with this at https://github.com/rgl/terraform-keycloak
Nice! I'll definitely be following your project because I have a ton of stuff to automate in Keycloak via Terraform.
How do we add SAML X500 Predefined mapper?
For example, at the SAML Client UI page,
Clients scopes
tab:Click the
example-go-saml-dedicated
(Dedicated scope and mappers for this client), and go to the page:Click the
Add predefined mapper
, and choose, for example,X500 email
:Then its added as:
The following does not work due to invalid
saml_attribute_name_format
:The following does not work either, because the SAML Assertion does not end up with the expected SAML attribute:
How to we replicate the UI actions?