Client Secret is Empty for Application OIDC Resource Output

[andar1an]

Preflight Checklist

• [X] I could not find a solution in the documentation, the existing issues or discussions
• [X] I have joined the ZITADEL chat

Version

1.0.3

ZITADEL Version

v2.39.1

Describe the problem caused by this bug

Terraform Application OIDC output for client secret is empty.

I have read: https://github.com/zitadel/terraform-provider-zitadel/issues/110, and believe this is a bug as this value should be captured on creation of the resource for output.

To reproduce

To reproduce:

resource "zitadel_application_oidc" "default" {
  project_id = data.zitadel_project.default.id
  org_id     = data.zitadel_org.default.id

  name                        = "applicationoidc"
  redirect_uris               = ["https://localhost.com"]
  response_types              = ["OIDC_RESPONSE_TYPE_CODE"]
  grant_types                 = ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE"]
  post_logout_redirect_uris   = ["https://localhost.com"]
  app_type                    = "OIDC_APP_TYPE_WEB"
  auth_method_type            = "OIDC_AUTH_METHOD_TYPE_BASIC"
  version                     = "OIDC_VERSION_1_0"
  clock_skew                  = "0s"
  dev_mode                    = true
  access_token_type           = "OIDC_TOKEN_TYPE_BEARER"
  access_token_role_assertion = false
  id_token_role_assertion     = false
  id_token_userinfo_assertion = false
  additional_origins          = []
}

output "client_secret" {
  value       = nonsensitive(zitadel_application_oidc.default.client_secret)
  description = "The Client Secret"
}

Screenshots

Expected behavior

The secret is not empty on creation.

Relevant Configuration

No response

Additional Context

Currently, I have no way to get the client secret of the application. Digging into code now.

[andar1an]

Using data also doesn't work:

data "zitadel_application_oidc" "default" {
  org_id     = zitadel_org.default.id
  project_id = zitadel_project.default.id
  app_id     = zitadel_application_oidc.default.id
}

output "application_oidc" {
  value = nonsensitive(zitadel_application_oidc.default.client_secret)
}

[andar1an]

I am wondering if whatever call is happening for GetClientSecret() is not structured properly in the terraform? I am trying to tease it apart, but it seems like it aligns with grpc or api zitadel endpoints.

[andar1an]

In zitadel-go/pkg/client/zitadel/management.pb.go I have noticed:

func (x *AddOIDCAppResponse) GetClientSecret() string {
    if x != nil {
        return x.ClientSecret
    }
    return ""
}

type AddOIDCAppResponse struct {
        ...
    ClientSecret       string                      `protobuf:"bytes,4,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
        ...
}
}``` 
Which is leading me to believe that x is evaluating to nil. Tracing from here

[andar1an]

Will be diving into here later: https://github.com/zitadel/zitadel/tree/main/pkg/grpc

update to not forget: https://github.com/zitadel/zitadel/blob/main/internal/api/grpc/management/project_application.go#L96 -> https://github.com/zitadel/zitadel/blob/main/internal/command/project_application_oidc.go (Potentially relevant lines: 170, 175, 211)

[andar1an]

I need to compare calls from web client and calls from go client, but currently think that the Terraform and Web Client application uses the same code from Zitadel Repo. I have never written a Terraform Provider before, so I will try to determine what Terraform uses to interact with Zitadel host. I had trouble finding relevant code in Terraform module before, so I will look to imports. I thought it was using Go Client based on. Hoping this is just user error on my end, but don't know yet.

[andar1an]

Now on TF Provider 1.0.4 and Zitadel 2.40.2

[andar1an]

I have verified that secret is empty in state as well:

[andar1an]

I have also tried manually defining resource "zitadel_org_idp_oidc" with an explicit client id and secret, and the app secret is still empty.

[andar1an]

Could the Go crypto module be having issues

[andar1an]

Was crypto module recently upgraded? https://github.com/golang/go/issues/63987

[andar1an]

Crypto update 3 weeks ago to 0.14: on Oct 17, 2023 https://github.com/zitadel/zitadel/commit/3bbcc3434ab58d11bb24a07949f54eedcf3cea5b

[andar1an]

Regression tested with 2.38.1. Likely not crypto module. Will test with 2.37.3 just in case. 2.40.4 also didn't fix.

update: also tested with 2.37.3 - same issue.

Saw no issues @ /debug/metrics

[andar1an]

Closing this, and slightly angry at documentation or error messages. Please indicate that Zitadel PKCE does not return a client secret. Everywhere else I have used this auth method, I have had a client secret as well. Zitadel is the first place I have not used Client Secret with PKCE, and it is nice that I don't have to, but I definitely wasted days of time.