iwarapter / terraform-provider-pingfederate Goto Github PK

View Code? Open in Web Editor NEW

17.0 2.0 7.0 17.32 MB

Ping Federate Terraform Provider

Home Page: https://registry.terraform.io/providers/iwarapter/pingfederate/latest/docs

License: MIT License

Makefile 0.13% HCL 1.99% Go 97.87%

pingfederate terraform terraform-provider

terraform-provider-pingfederate's Introduction

PingFederate Terraform Provider

Website: https://registry.terraform.io/providers/iwarapter/pingfederate/latest

The PingFederate provider has been archived, and is no longer under active maintainenance. Ping Identity are developing their own https://github.com/pingidentity/terraform-provider-pingfederate

Requirements

Terraform 0.12+
Go 1.16 (to build the provider plugin)

Using the Provider

Please see the terraform registry docs for detailed usage documentation: https://registry.terraform.io/providers/iwarapter/pingfederate/latest/docs

The provider is currently tested against the following versions of PingFederate

PingFederate	Status
~~9.3.3~~	PingIdentity no longer supply working containers for this version
~~10.0.6~~	PingIdentity no longer supply working containers for this version
~~10.1.5~~	PingIdentity no longer supply working containers for this version
10.2.7
10.3.7
11.0.4
11.1.1

Whilst 9.3.3 and 10.0.x should both still be compatible, PingIdentity no longer supply working docker images and so have been removed from the regression test pack.

Developing the Provider

If you wish to work on the provider, you'll first need Go installed on your machine (please check the requirements before proceeding).

Note: This project uses Go Modules making it safe to work with it outside of your existing GOPATH. The instructions that follow assume a directory in your home directory outside of the standard GOPATH (i.e $HOME/development/terraform-providers/).

Clone repository to: $HOME/development/terraform-providers/

$ git clone [email protected]:iwarapter/terraform-provider-pingfederate.git
...

To compile the provider, run make build. This will build the provider and put the provider binary in the local directory.

$ make build
...
$ terraform-provider-pingfederate
...

Using the Provider

Please see the terraform registry docs for detailed usage documentation: https://registry.terraform.io/providers/iwarapter/pingfederate/latest/docs

Testing the Provider

In order to test the provider, you can run make sweep test.

$ make sweep test

This will run the acceptance tests by initializing a local docker container to execute the functional tests against.

terraform-provider-pingfederate's People

Contributors

Stargazers

Watchers

Forkers

dnitsch mosersil carloprone ikemanuel ashhammond jknight-liatrio michaelarichard

terraform-provider-pingfederate's Issues

Tracked HTTP Params

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.12.25

Affected Resource(s)

pingfederate_authentication_policies with PF 10.0.2.2

Terraform Configuration Files

# Copy-paste your Terraform configurations here

resource "pingfederate_authentication_policies" "demo" {
  fail_if_no_selection    = false
  tracked_http_parameters = []

...truncated....

}

Debug Output

Panic Output

Expected Behavior

HTTP Params removed

Actual Behavior

HTTP Params not removed

Steps to Reproduce

Create resource to add params
Params added
Remove resource
Param not removed from PF

terraform apply

Important Factoids

References

#0000

Add support for oauth openid connect

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Add support for oauth openid connect
https://localhost:9999/pf-admin-api/api-docs/#!/oauthopenIdConnect

New or Affected Resource(s)

pingfederate_oauth_openid_connect_policy

Ping Federate 10 - Change in default values for oauth server settings

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.12.28

provider.pingaccess v0.7.0
provider.pingfederate v0.0.8

Affected Resource(s)

pingfederate_oauth_auth_server_settings.settings will be updated in-place

~ resource "pingfederate_oauth_auth_server_settings"

Terraform Configuration Files

resource "pingfederate_oauth_auth_server_settings" "settings" {

  scopes {
    name        = "openid"
    description = "openid"
  }
  scopes {
    name        = "profile"
    description = "profile"
  }
  scopes {
    name        = "email"
    description = "email"
  }
  scopes {
    name        = "address"
    description = "address"
  }
  scopes {
    name        = "phone"
    description = "phone"
  }
  scopes {
    name        = "email"
    description = "email"
  }
  scopes {
    name        = "idp"
    description = "idp"
  }

  exclusive_scopes {
    description = "Account Number"
    name        = "acc_no"
  }

  default_scope_description      = ""
  authorization_code_timeout     = 60
  authorization_code_entropy     = 30
  refresh_token_length           = 42
  refresh_rolling_interval       = 0
  persistent_grant_lifetime      = -1
  persistent_grant_lifetime_unit = "DAYS"
}

Debug Output

Panic Output

Expected Behavior

The defaults of unspecified values shouldn't cause an exception.

Actual Behavior

The provider tried to set invalid attribute values for the default and failed to apply

Steps to Reproduce

Create a resource pingfederate_oauth_auth_server_settings
Do not specify

  - persistent_grant_lifetime                  = -1 -> null
  - persistent_grant_lifetime_unit             = "DAYS" ->

And try and apply.

Important Factoids

References

#0000

Scope Management in OIDC Policy

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Adding scope management, will complete the ability to release attributes based on scope, with out this, the OIDC policy is limited.

New or Affected Resource(s)

All PingFederate versions.

Potential Terraform Configuration

 scope_attribute_mappings = { 
 address = ["foo", "bar"]
 }

References

#0000

Support Access Control Settings on Access Token Managers

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

I noticed that the provider does not currently support the ability to Restrict Allowed Clients.

https://localhost/pf-admin-api/v1/oauth/accessTokenManagers/testManager

...

"accessControlSettings": {
  "restrictClients": true,
  "allowedClients": [
    {
      "id": "allowed-client-1",
      "location": "https://localhost:443/pf-admin-api/v1/oauth/clients/allowed-client-1"
    },
    {
      "id": "hv-test-web",
      "location": "https://localhost:443/pf-admin-api/v1/oauth/clients/allowed-client-2"
    },
    {
      "id": "hv-test-web-public",
      "location": "https://localhost:443/pf-admin-api/v1/oauth/clients/allowed-client-3"
    }
  ]
},

...

New or Affected Resource(s)

pingfederate_oauth_access_token_manager

Potential Terraform Configuration

resource "pingfederate_oauth_access_token_manager" "test_manager" {

  ...

  access_control_settings {
    restrict_clients = true
  
    allowed_clients = [
      "allowed-client-1",
      "allowed-client-2",
      "allowed-client-3", 
    ]
  }
}

References

Persistant grants contract looping

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.12.25

Affected Resource(s)

pingfederate_oauth_auth_server_settings with PF 10.0.2.2

Terraform Configuration Files

# Copy-paste your Terraform configurations here

      - persistent_grant_contract {
          - extended_attributes = [] -> null
        }

Debug Output

Panic Output

Expected Behavior

Setting applied

Actual Behavior

Grant Setting applied and loops

Steps to Reproduce

Update oauth settings.

terraform apply

Important Factoids

References

#0000

pingfederate_password_credential_validator isn't documented but can be used

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Affected Resource(s)

pingfederate_XXXXX

Terraform Configuration Files

# Copy-paste your Terraform configurations here

Debug Output

Panic Output

Expected Behavior

Actual Behavior

Steps to Reproduce

terraform apply

Important Factoids

References

#0000

Data source to read LDAP data store ID

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

We need to create an OpenID connect policy that uses an LDAP data store created in a separate Terraform app. I'm thinking I need to add a new data resource to the provider, or is there another way.

New or Affected Resource(s)

pingfederate_ldap_data_store_definition

Potential Terraform Configuration

resource "pingfederate_oauth_openid_connect_policy" "this" {
  ...
  attribute_mapping {
    ldap_attribute_source {
      data_store_ref {
        id = data.pingfederate_ldap_data_store_definition.this.id
      }
    }
  }
}

data "pingfederate_ldap_data_store_definition" "this" {
  name = "myLDAPDataStoreName"
}

References

#0000

Support dynamic scopes

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Support for dynamic scopes

New or Affected Resource(s)

pingfederate_oauth_auth_server_settings

Potential Terraform Configuration

resource "pingfederate_oauth_auth_server_settings" "settings" {
		scopes {
			name        = "myscope:*"
			description = "A scope with dynamic namespace"
                        dynamic = true
		}
		
		(...)
	}

References

Race condition deleting signing keypair with sp connection

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Affected Resource(s)

pingfederate_keypair_signing
pingfederate_idp_sp_connection

Terraform Configuration Files

Any valid configuraiton

Debug Output


/opt/out/instance/log/admin-api.log:	2021-04-22 08:29:53,385| Administrator| Basic| 172.18.0.1| DELETE| /idp/spConnections/Kty3nLOafnwpz8wM9sCFFL-lMvx| 204 
/opt/out/instance/log/admin-api.log:	2021-04-22 08:29:53,397| Administrator| Basic| 172.18.0.1| DELETE| /keyPairs/signing/s8l17t5vyk6dunx1mas4v5sv9| 500 

/opt/out/instance/log/server.log:	2021-04-22 08:29:53,392  ERROR [com.pingidentity.pf.common.api.RuntimeExceptionMapper] API service runtime error occured:
/opt/out/instance/log/server.log:	java.lang.NullPointerException: null
/opt/out/instance/log/server.log:		at org.sourceid.saml20.domain.util.InUseDetectionUtil.isCertUsedInConnection(InUseDetectionUtil.java:158) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.sourceid.saml20.domain.util.InUseDetectionUtil.isDsigCertInUse(InUseDetectionUtil.java:239) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.sourceid.saml20.domain.mgmt.impl.DsigPkCertManager.isInUseById(DsigPkCertManager.java:80) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
/opt/out/instance/log/server.log:		at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:?]
/opt/out/instance/log/server.log:		at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
/opt/out/instance/log/server.log:		at java.lang.reflect.Method.invoke(Method.java:566) ~[?:?]
/opt/out/instance/log/server.log:		at com.pingidentity.hivemind.AutoReloadableServiceProxy.invoke(AutoReloadableServiceProxy.java:91) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at com.sun.proxy.$Proxy54.isInUseById(Unknown Source) ~[?:?]
/opt/out/instance/log/server.log:		at com.pingidentity.commonsvcs.certsvc.api.BaseKeyPairController.checkPkCertInUse(BaseKeyPairController.java:360) ~[ping-cert-svc.jar:?]
/opt/out/instance/log/server.log:		at com.pingidentity.commonsvcs.certsvc.api.BaseKeyPairController.deleteKeyPair(BaseKeyPairController.java:213) ~[ping-cert-svc.jar:?]
/opt/out/instance/log/server.log:		at com.pingidentity.pf.admin.rest.controller.PFBaseKeyPairController.deleteKeyPair(PFBaseKeyPairController.java:209) ~[?:?]
/opt/out/instance/log/server.log:		at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
/opt/out/instance/log/server.log:		at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:?]
/opt/out/instance/log/server.log:		at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
/opt/out/instance/log/server.log:		at java.lang.reflect.Method.invoke(Method.java:566) ~[?:?]
/opt/out/instance/log/server.log:		at com.sun.jersey.spi.container.JavaMethodInvokerFactory$1.invoke(JavaMethodInvokerFactory.java:60) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.model.method.dispatch.AbstractResourceMethodDispatchProvider$ResponseOutInvoker._dispatch(AbstractResourceMethodDispatchProvider.java:205) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.model.method.dispatch.ResourceJavaMethodDispatcher.dispatch(ResourceJavaMethodDispatcher.java:75) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.HttpMethodRule.accept(HttpMethodRule.java:302) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.ResourceClassRule.accept(ResourceClassRule.java:108) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.RootResourceClassesRule.accept(RootResourceClassesRule.java:84) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1542) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1473) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1419) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1409) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.spi.container.servlet.WebComponent.service(WebComponent.java:409) ~[jersey-servlet.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:558) ~[jersey-servlet.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:733) ~[jersey-servlet.jar:1.19]
/opt/out/instance/log/server.log:		at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) ~[servlet-api-3.1.jar:3.1.0]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:873) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1623) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at com.pingidentity.common.util.access.ExecutionContextFilter.doFilter(ExecutionContextFilter.java:51) ~[pf-commons.jar:?]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1610) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at com.pingidentity.pf.common.api.filter.RequestProxyFilter.doFilter(RequestProxyFilter.java:21) ~[pf-common-api.jar:?]
/opt/out/instance/log/server.log:		at org.sourceid.servlet.filter.AbstractHttpFilter.doFilter(AbstractHttpFilter.java:56) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1610) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.sourceid.saml20.domain.util.api.ws.ConsoleOnlyFilter.doFilter(ConsoleOnlyFilter.java:23) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.sourceid.servlet.filter.AbstractHttpFilter.doFilter(AbstractHttpFilter.java:56) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1610) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.sourceid.saml20.domain.log.ThreadContextCleanupFilter.doFilter(ThreadContextCleanupFilter.java:29) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1602) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:540) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:146) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:548) ~[jetty-security-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:257) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1700) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:255) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1345) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:203) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:480) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1667) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:201) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1247) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:144) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:220) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:152) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.Server.handle(Server.java:505) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:370) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:267) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:305) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:427) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:321) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:159) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:117) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:333) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:310) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:168) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:126) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:366) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:698) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:804) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at java.lang.Thread.run(Thread.java:834) [?:?]

Expected Behavior

Resources should be deleted

Actual Behavior

Signing Keypair fail to delete 500 Internal Server error

Error: unable to delete SigningKeypair: 500 Internal Server Error {"resultId":"server_error","message":"A server error has occurred. Check the server logs for details."}

Steps to Reproduce

This has begun to occur more regularly in the e2e CI examples

Important Factoids

This is actually a pingfederate bug, but perhaps we can mask it in the provider

Add support for authentication policies

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Add support for authentication policies
https://localhost:9999/pf-admin-api/api-docs/#!/authenticationPolicies

New or Affected Resource(s)

pingfederate_authentication_policies

Add support for resource owner credentials grant mappings

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Add support for resource owner credentials grant mappings
https://localhost:9999/pf-admin-api/api-docs/#!/oauthresourceOwnerCredentialsMappings

The Resource Owner Credential Grant has been deprecated by the IETF https://tools.ietf.org/html/draft-ietf-oauth-security-topics-16#section-2.4 however Ping Maintains this for backwards compatibility for clients that are using it.

We have some clients that have not yet migrated off ROPC.

Thanks,
Adrian

New or Affected Resource(s)

pingfederate_resource_owner_credentials_mappings

Potential Terraform Configuration

References

#0000

Add support for oauth access token mappings

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Add support for oauth access token managers
https://localhost:9999/pf-admin-api/api-docs/#!/oauthaccessTokenMappings

New or Affected Resource(s)

pingfederate_oauth_access_token_mappings

oauth client field missing

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

New or Affected Resource(s)

pingfederate_oauth_client

Potential Terraform Configuration

resource "pingfederate_oauth_client" "example" {
  ...
  restrict_to_default_access_token_manager = true
}

Support for incomingProxySettings

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

From PingFederate 10.1 incomming proxy settings are now configurable via the admin API. If the provider could support this, it would illuminate manual tasks post deployment, such as enabling certificate headers.

Potential Configuration

resource "pingfederate_incomming_proxy" "example" {
   http_header_for_client_ip = 10.0.0.1
   http_header_for_client_ip_use_last = true
   http_header_for_hostname = foo
   http_header_for_hostname_use last = true
   client_cert_header_name = x_client_cert
   client_cert_chain_header_name = x_client_chain 
   incomming_proxy_terminates_ssl = true
    }

New Resource

incomingProxySettings

pingfederate_10.1 >

Add version datasource

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Datasource to query the /version endpoint.

New or Affected Resource(s)

pingfederate_version

Importing 4096 bit KeyPair wrongly recognized as 2048 bit key size

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.14.10

Affected Resource(s)

pingfederate_keypair_signing

Terraform Configuration Files

/* note mykey.p12 is a 4096 bit lentgh RSA key */
resource "pingfederate_keypair_signing" "mosi_key" {
 file_data = filebase64("/path/to/mykey.p12")
 password = "whatever"
}

Debug Output

Panic Output

Expected Behavior

When running terraform plan, I would expect TF will try to create a new KeyPair with key size 4096 bit.

Actual Behavior

Terraform recognized the loaded key with key size 2048bit.

Steps to Reproduce

Generate 4096 bit keypair and configure resource as described above
terraform plan
check output of TF plan - note key_size is 2048

Important Factoids

References

Support Notification Publisher

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Please add support for notification publishers
https://localhost:9999/pf-admin-api/api-docs/#!/notificationPublishers

New or Affected Resource(s)

pingfederate_notification_publisher

Support static ID field when creating a data s tore

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

The Ping Federate Admin API has the ability to accept a pre-defined ID when creating a datasource LDAP or SQL. If the provider could support this, it would mean data sources could be created using the same ID rather than using a random system generated ID.

New or Affected Resource(s)

pingfederate_10.1 >

Potential Terraform Configuration

resource "pingfederate_jdbc_data_store" "foo" {
  name = "foo"
  id = "foo"
  user_name = "foouser"
  password = "foopassword"
  connection_url = "jdbc:foosql://db:5432/foodb"
  driver_class = "org.foofoo.Driver"

}

References

#0000

Support for Certificate Revocation Settings.

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Please could the provider support Ping Federate Revocation Settings for Certificates.

New or Affected Resource(s)

pingfederate_certificates_revocation_settings

Potential Terraform Configuration

resource "pingfederate_certificates_revocation_settings" "settings" {
  crl_settings {
    treatNonRetrievableCrlAsRevoked   = false
    verifyCrlSignature                = true
    nextRetryMinsWhenResolveFailed    = 1440
    nextRetryMinsWhenNextUpdateInPast = 60
  }
}

References

#0000

PingFederate dependancies not honoured

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.14.11

PingFederate

pingidentity/pingfederate:9.3.3-edge

Affected Resource(s)

pingfederate_authentication_policies
pingfederate_authentication_selector

A PingFederate authentication policy has been created that includes a selector, adapter and sp connection. These resource are created by using a terraform loop for_each, iterating over a list of strings.

If one of the string is removed from the list of strings, triggering a destroy of those resources, terraform tries to destroy the selector before destroying the policy, showing the below error.

Terraform Configuration Files

terraform {
  required_providers {
    pingfederate = {
      source  = "iwarapter/pingfederate"
      version = "~> 0.0.21"
    }
  }
}

provider "pingfederate" {
  username = "Administrator"
  password = "SuperSecure1234"
  base_url = "https://localhost:9999"
  context  = "/pf-admin-api/v1"
}

variable "connections" {

description = "number of connections to deploy"
type = list(string)
default = ["foo1", "foo2"]

}


resource "pingfederate_server_settings" "settings" {
  federation_info {
    base_url        = "https://foo.com"
    saml2_entity_id = "idp:foo"
  }
  roles_and_protocols {
    enable_idp_discovery = true
    idp_role {
      enable                       = true
      enable_outbound_provisioning = false
      enable_saml10                = false
      enable_saml11                = false
      enable_ws_fed                = false
      enable_ws_trust              = false
      saml20_profile {
        enable = true
      }
    }
    oauth_role {
      enable_oauth          = false
      enable_openid_connect = false
    }
    sp_role {
      enable                      = false
      enable_inbound_provisioning = false
      enable_openid_connect       = false
      enable_saml10               = false
      enable_saml11               = false
      enable_ws_fed               = false
      enable_ws_trust             = false
    }
  }
}

resource "pingfederate_authentication_policy_contract" "foo_pol_contract" {
  name = "foo_pol_contract"
  depends_on = [
    pingfederate_server_settings.settings
  ]
}

resource "pingfederate_keypair_signing" "foo_keypair" {
  city                      = "Test"
  common_name               = "Test"
  country                   = "GB"
  key_algorithm             = "RSA"
  key_size                  = 2048
  organization              = "Test"
  organization_unit         = "Test"
  state                     = "Test"
  valid_days                = 365
  subject_alternative_names = ["foo", "bar"]
}

resource "pingfederate_authentication_selector" "foo_selector" {
  for_each = toset(var.connections)
  name     = each.value
  plugin_descriptor_ref {
    id = "com.pingidentity.pf.selectors.connectionset.ConnectionSetAdapterSelector"
  }
  configuration {
    tables {
      name = "Connections"
      rows {
        fields {
          name  = "Connection"
          value = pingfederate_idp_sp_connection.foo_saml[each.value].entity_id
        }
      }
    }
  }
  depends_on = [
    pingfederate_server_settings.settings
  ]
}

resource "pingfederate_password_credential_validator" "foo_adapter" {
  name = "adapterfoo"
  plugin_descriptor_ref {
    id = "org.sourceid.saml20.domain.SimpleUsernamePasswordCredentialValidator"
  }
  configuration {
    tables {
      name = "Users"
      rows {
        fields {
          name  = "Username"
          value = "foo"
        }
        sensitive_fields {
          name  = "Password"
          value = "SuperSecure123ABC"
        }
        sensitive_fields {
          name  = "Confirm Password"
          value = "SuperSecure123ABC"
        }
        fields {

          name  = "Relax Password Requirements"
          value = "false"
        }
      }
    }
  }
  depends_on = [
    pingfederate_server_settings.settings
  ]
}

resource "pingfederate_idp_sp_connection" "foo_saml" {
  for_each     = toset(var.connections)
  name         = each.value
  entity_id    = each.value
  active       = true
  base_url     = "https://anotherfoo.com"
  logging_mode = "STANDARD"
  credentials {
    signing_settings {
      signing_key_pair_ref {
        id = pingfederate_keypair_signing.foo_keypair.id
      }
      include_cert_in_signature    = false
      include_raw_key_in_signature = false
      algorithm                    = "SHA256withRSA"
    }
  }
  sp_browser_sso {
    protocol         = "SAML20"
    enabled_profiles = ["IDP_INITIATED_SSO"]
    sso_service_endpoints {
      binding    = "POST"
      url        = "/AssertionConsumer"
      is_default = true
      index      = 0
    }
    sign_assertions               = true
    sign_response_as_required     = true
    sp_saml_identity_mapping      = "STANDARD"
    require_signed_authn_requests = false
    assertion_lifetime {
      minutes_before = 5
      minutes_after  = 5
    }
    encryption_policy {
      encrypt_assertion             = false
      encrypt_slo_subject_name_id   = false
      slo_subject_name_id_encrypted = false
      encrypted_attributes          = []
    }
    attribute_contract {
      core_attributes {
        name        = "SAML_SUBJECT"
        name_format = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
      }
    }
    authentication_policy_contract_assertion_mappings {
      attribute_contract_fulfillment {
        key_name = "SAML_SUBJECT"
        source {
          type = "AUTHENTICATION_POLICY_CONTRACT"
        }
        value = "subject"
      }
      authentication_policy_contract_ref {
        id = pingfederate_authentication_policy_contract.foo_pol_contract.id
      }
      restrict_virtual_entity_ids        = false
      restricted_virtual_entity_ids      = []
      abort_sso_transaction_as_fail_safe = false
    }
  }
}

resource "pingfederate_idp_adapter" "foo_form_adapter" {
  name = "fooapter"
  plugin_descriptor_ref {
    id = "com.pingidentity.adapters.htmlform.idp.HtmlFormIdpAuthnAdapter"
  }

  configuration {
    tables {
      name = "Credential Validators"
      rows {
        fields {
          name  = "Password Credential Validator Instance"
          value = pingfederate_password_credential_validator.foo_adapter.id
        }
      }
    }

    fields {
      name  = "Challenge Retries"
      value = "8"
    }
    fields {
      name  = "Session State"
      value = "None"
    }
    fields {
      name  = "Session Timeout"
      value = "60"
    }
    fields {
      name  = "Session Max Timeout"
      value = "480"
    }
    fields {
      name  = "Allow Password Changes"
      value = "false"
    }
    fields {
      name = "Password Management System"
    }
    fields {
      name  = "Enable 'Remember My Username'"
      value = "false"
    }
    fields {
      name  = "Enable 'This is My Device'"
      value = "false"
    }
    fields {
      name  = "Change Password Email Notification"
      value = "false"
    }
    fields {
      name  = "Show Password Expiring Warning"
      value = "false"
    }
    fields {
      name  = "Password Reset Type"
      value = "NONE"
    }
    fields {
      name = "Password Reset Policy Contract"
    }
    fields {
      name  = "Account Unlock"
      value = "false"
    }
    fields {
      name = "Local Identity Profile"
    }
    fields {
      name = "Notification Publisher"
    }
    fields {
      name  = "Enable Username Recovery"
      value = "false"
    }
    fields {
      name  = "Login Template"
      value = "html.form.login.template.html"
    }
    fields {
      name = "Logout Path"
    }
    fields {
      name = "Logout Redirect"
    }
    fields {
      name  = "Logout Template"
      value = "idp.logout.success.page.template.html"
    }
    fields {
      name  = "Change Password Template"
      value = "html.form.change.password.template.html"
    }
    fields {
      name  = "Change Password Message Template"
      value = "html.form.message.template.html"
    }
    fields {
      name  = "Password Management System Message Template"
      value = "html.form.message.template.html"
    }
    fields {
      name  = "Change Password Email Template"
      value = "message-template-end-user-password-change.html"
    }
    fields {
      name  = "Expiring Password Warning Template"
      value = "html.form.password.expiring.notification.template.html"
    }
    fields {
      name  = "Threshold for Expiring Password Warning"
      value = "7"
    }
    fields {
      name  = "Snooze Interval for Expiring Password Warning"
      value = "24"
    }
    fields {
      name  = "Login Challenge Template"
      value = "html.form.login.challenge.template.html"
    }
    fields {
      name  = "'Remember My Username' Lifetime"
      value = "30"
    }
    fields {
      name  = "'This is My Device' Lifetime"
      value = "30"
    }
    fields {
      name  = "Allow Username Edits During Chaining"
      value = "false"
    }
    fields {
      name  = "Track Authentication Time"
      value = "true"
    }
    fields {
      name  = "Post-Password Change Re-Authentication Delay"
      value = "0"
    }
    fields {
      name  = "Password Reset Username Template"
      value = "forgot-password.html"
    }
    fields {
      name  = "Password Reset Code Template"
      value = "forgot-password-resume.html"
    }
    fields {
      name  = "Password Reset Template"
      value = "forgot-password-change.html"
    }
    fields {
      name  = "Password Reset Error Template"
      value = "forgot-password-error.html"
    }
    fields {
      name  = "Password Reset Success Template"
      value = "forgot-password-success.html"
    }
    fields {
      name  = "Account Unlock Template"
      value = "account-unlock.html"
    }
    fields {
      name  = "OTP Length"
      value = "8"
    }
    fields {
      name  = "OTP Time to Live"
      value = "10"
    }
    fields {
      name = "PingID Properties"
    }
    fields {
      name  = "Require Verified Email"
      value = "false"
    }
    fields {
      name  = "Username Recovery Template"
      value = "username.recovery.template.html"
    }
    fields {
      name  = "Username Recovery Info Template"
      value = "username.recovery.info.template.html"
    }
    fields {
      name  = "Username Recovery Email Template"
      value = "message-template-username-recovery.html"
    }
    fields {
      name  = "CAPTCHA for Authentication"
      value = "false"
    }
    fields {
      name  = "CAPTCHA for Password change"
      value = "false"
    }
    fields {
      name  = "CAPTCHA for Password Reset"
      value = "false"
    }
    fields {
      name  = "CAPTCHA for Username recovery"
      value = "false"
    }
  }

  attribute_mapping {
    attribute_contract_fulfillment {
      key_name = "policy.action"
      source {
        type = "ADAPTER"
      }
      value = "policy.action"
    }
    attribute_contract_fulfillment {
      key_name = "username"
      source {
        type = "ADAPTER"
      }
      value = "username"
    }

  }

  attribute_contract {
    core_attributes {
      name      = "policy.action"
      masked    = false
      pseudonym = false
    }
    core_attributes {
      name      = "username"
      masked    = false
      pseudonym = true
    }
  }
  depends_on = [
    pingfederate_server_settings.settings
  ]
}

resource "pingfederate_authentication_policies_settings" "policy_settings" {
  enable_idp_authn_selection = true
  enable_sp_authn_selection  = false

  depends_on = [
    pingfederate_server_settings.settings
  ]
}

resource "pingfederate_authentication_policies" "policies" {
  fail_if_no_selection = false
  dynamic "authn_selection_trees" {
    for_each = toset(var.connections)
    content {
      name    = authn_selection_trees.key
      enabled = true
      root_node {
        action {
          type = "AUTHN_SELECTOR"
          authentication_selector_ref {
            id = pingfederate_authentication_selector.foo_selector[authn_selection_trees.key].id
          }
        }
        children {
          action {
            type    = "CONTINUE"
            context = "No"
          }
        }
        children {
          action {
            type    = "AUTHN_SOURCE"
            context = "Yes"
            authentication_source {
              type = "IDP_ADAPTER"
              source_ref {
                id = pingfederate_idp_adapter.foo_form_adapter.id
              }
            }
          }
          children {
            action {
              type    = "DONE"
              context = "Fail"
            }
          }
          children {
            action {
              type    = "APC_MAPPING"
              context = "Success"
              authentication_policy_contract_ref {
                id = pingfederate_authentication_policy_contract.foo_pol_contract.id
              }
              attribute_mapping {
                attribute_contract_fulfillment {
                  key_name = "subject"
                  source {
                    type = "ADAPTER"
                    id   = pingfederate_idp_adapter.foo_form_adapter.id
                  }
                  value = "username"
                }
              }
            }
          }
        }
      }
    }
  }

}

Debug Output

pingfederate_authentication_selector.foo_selector["foo2"]: Destroying... [id=foo2]

Error: unable to delete AuthenticationSelectors: The Authentication Selector instance with ID 'foo2' is currently in use. The Authentication Selector must be unmapped before it is deleted.

Panic Output

Expected Behavior

Terraform honours the dependancies.

Actual Behavior

Terraform honours the dependancies.

Steps to Reproduce

Using the above replicator.

terraform apply
remove "foo2"
terraform apply`

Important Factoids

References

#0000

Race condition deleting authentication policy contract with sp connection

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Affected Resource(s)

pingfederate_authentication_policy_contract

Terraform Configuration Files

Any valid configuraiton

Debug Output

/opt/out/instance/log/server.log:	java.lang.NullPointerException: null
/opt/out/instance/log/server.log:		at com.pingidentity.c2ccontract.mgmt.impl.C2cContractManagerImpl.isContractInUse(C2cContractManagerImpl.java:268) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
/opt/out/instance/log/server.log:		at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:?]
/opt/out/instance/log/server.log:		at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
/opt/out/instance/log/server.log:		at java.lang.reflect.Method.invoke(Method.java:566) ~[?:?]
/opt/out/instance/log/server.log:		at com.pingidentity.hivemind.AutoReloadableServiceProxy.invoke(AutoReloadableServiceProxy.java:91) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at com.sun.proxy.$Proxy26.isContractInUse(Unknown Source) ~[?:?]
/opt/out/instance/log/server.log:		at com.pingidentity.pf.admin.rest.controller.AuthenticationPolicyContractController.deleteAuthenticationPolicyContract(AuthenticationPolicyContractController.java:299) ~[?:?]
/opt/out/instance/log/server.log:		at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
/opt/out/instance/log/server.log:		at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:?]
/opt/out/instance/log/server.log:		at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
/opt/out/instance/log/server.log:		at java.lang.reflect.Method.invoke(Method.java:566) ~[?:?]
/opt/out/instance/log/server.log:		at com.sun.jersey.spi.container.JavaMethodInvokerFactory$1.invoke(JavaMethodInvokerFactory.java:60) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.model.method.dispatch.AbstractResourceMethodDispatchProvider$ResponseOutInvoker._dispatch(AbstractResourceMethodDispatchProvider.java:205) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.model.method.dispatch.ResourceJavaMethodDispatcher.dispatch(ResourceJavaMethodDispatcher.java:75) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.HttpMethodRule.accept(HttpMethodRule.java:302) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.ResourceClassRule.accept(ResourceClassRule.java:108) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.RootResourceClassesRule.accept(RootResourceClassesRule.java:84) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1542) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1473) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1419) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1409) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.spi.container.servlet.WebComponent.service(WebComponent.java:409) ~[jersey-servlet.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:558) ~[jersey-servlet.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:733) ~[jersey-servlet.jar:1.19]
/opt/out/instance/log/server.log:		at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) ~[servlet-api-3.1.jar:3.1.0]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:873) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1623) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at com.pingidentity.common.util.access.ExecutionContextFilter.doFilter(ExecutionContextFilter.java:51) ~[pf-commons.jar:?]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1610) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at com.pingidentity.pf.common.api.filter.RequestProxyFilter.doFilter(RequestProxyFilter.java:21) ~[pf-common-api.jar:?]
/opt/out/instance/log/server.log:		at org.sourceid.servlet.filter.AbstractHttpFilter.doFilter(AbstractHttpFilter.java:56) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1610) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.sourceid.saml20.domain.util.api.ws.ConsoleOnlyFilter.doFilter(ConsoleOnlyFilter.java:23) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.sourceid.servlet.filter.AbstractHttpFilter.doFilter(AbstractHttpFilter.java:56) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1610) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.sourceid.saml20.domain.log.ThreadContextCleanupFilter.doFilter(ThreadContextCleanupFilter.java:29) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1602) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:540) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:146) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:548) ~[jetty-security-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:257) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1700) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:255) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1345) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:203) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:480) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1667) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:201) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1247) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:144) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:220) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:152) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.Server.handle(Server.java:505) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:370) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:267) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:305) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:427) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:321) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:159) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:117) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:333) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:310) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:168) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:126) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:366) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:698) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:804) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at java.lang.Thread.run(Thread.java:834) [?:?]

Expected Behavior

Resources should be deleted

Actual Behavior

Policy Contract fails to delete 500 Internal Server error

Error: unable to delete AuthenticationPolicyContracts: 500 Internal Server Error {"resultId":"server_error","message":"A server error has occurred. Check the server logs for details."}

Important Factoids

This is actually a pingfederate bug, but perhaps we can mask it in the provider

Terraform crash in case of empty contact info block

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

0.14.10

Affected Resource(s)

ppingfederate_idp_sp_connection

Terraform Configuration Files

resource "pingfederate_idp_sp_connection" "pf_idp_sp_connection" {
  active             = true
  base_url           = "https://sptest.iamshowcase.com"
  entity_id          = "IAMShowcase"
  logging_mode       = "STANDARD"
  name               = "IAMShowcase"
  type               = "SP"
  virtual_entity_ids = []

  contact_info {
  }

  credentials {

    signing_settings {
      algorithm                    = "SHA256withRSA"
      include_cert_in_signature    = false
      include_raw_key_in_signature = false

      signing_key_pair_ref {
        id       = pingfederate_keypair_signing.spcondefault.id
      }
    }
  }

  sp_browser_sso {
    enabled_profiles              = [
      "IDP_INITIATED_SSO",
    ]
    protocol                      = "SAML20"
    require_signed_authn_requests = false
    sign_assertions               = true
    sign_response_as_required     = false
    sp_saml_identity_mapping      = "STANDARD"

    assertion_lifetime {
      minutes_after  = 5
      minutes_before = 5
    }

    attribute_contract {
      core_attributes {
        name        = "SAML_SUBJECT"
        name_format = "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
      }
    }

    authentication_policy_contract_assertion_mappings {
      abort_sso_transaction_as_fail_safe = false
      restrict_virtual_entity_ids        = false
      restricted_virtual_entity_ids      = []

      attribute_contract_fulfillment {
        key_name = "SAML_SUBJECT"
        value    = "subject"

        source {
          type = "AUTHENTICATION_POLICY_CONTRACT"
        }
      }
     

      authentication_policy_contract_ref {
        id       = pingfederate_authentication_policy_contract.eiam_sp_connection_default_contract.id
      }
      
    }

    encryption_policy {
      encrypt_assertion             = false
      encrypt_slo_subject_name_id   = false
      encrypted_attributes          = []
      slo_subject_name_id_encrypted = false
    }

    sso_service_endpoints {
      binding    = "POST"
      index      = 0
      is_default = true
      url        = "/acs"
    }
  }
}

Debug Output

Panic Output

Expected Behavior

Either treat empty contact information equally as if its omitted or display validation error that empty contact info block is invalid

Actual Behavior

Terraform crash

Steps to Reproduce

Create resource as above
terraform plan
terraform apply

Important Factoids

References

#0000

PingOne integration on Terraform

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

It would be nice if PingOne was added as a terraform resource for PF

New or Affected Resource(s)

pingfederate_XXXXX

Potential Terraform Configuration

# Copy-paste your Terraform configurations here

References

#0000

Support for Datastore type "REST API"

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Would be nice to have a possibility to manage next to LDAP and JDBC datastore also REST API (Custom) datastore by terraform.

New or Affected Resource(s)

New resource, probably sth like

pingfederate_custom_data_store

Potential Terraform Configuration

# Copy-paste your Terraform configurations here
resource "pingfederate_custom_data_store" "demo" {
  name = "Demo REST API Datasource"
  type = "CUSTOM"
  configuration {
    tables {
      name = "Base URLs and Tags"
      rows {
        fields {
          name  = "Base URL"
          value = "https://mybaseurl.uri.com"
        }
        fields {
          name  = "Tags"
          value = ""
        }
      }
    }

   tables {
      name = "Attributes"
      rows {
        fields {
          name  = "Local Attribute"
          value = "foo"
        }
        fields {
          name  = "JSON Response Attribute Path"
          value = "/bar"
        }
      }
    }
  (...)
}

References

Failed to destroy access token mapping using application policy contract context

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

$ terraform -v
Terraform v0.14.6

provider registry.terraform.io/iwarapter/pingfederate v0.0.10

Affected Resource(s)

pingfederate_oauth_access_token_mappings

Terraform Configuration Files

resource "pingfederate_oauth_access_token_mappings" "authentication_policy_contract" {
  access_token_manager_ref {
    id = pingfederate_oauth_access_token_manager.this.id
  }

...
  context {
    type = "AUTHENTICATION_POLICY_CONTRACT"

    context_ref {
      id = var.authentication_policy_contract_id
    }
  }
}

Debug Output

https://gist.github.com/adrianwalmsley/88b110089c2586e3679516015e2a9acc

Panic Output

Expected Behavior

Expected the access token mapping to be destroyed.

Actual Behavior

The access token mapping is removed from PingFederate, but the mapping is still in the state, and the destroy is aborted.

module.system.pingfederate_jdbc_data_store.this: Destroying... [id=JDBC-589F4F8419E1E6B144344ED1185483C75519E182]
module.authentication.pingfederate_oauth_authentication_policy_contract_mapping.this: Destroying... [id=vaXeQcliaMj3y2br]
module.system.pingfederate_oauth_auth_server_settings.this: Destroying... [id=OauthAuthServerSettings]
module.system.pingfederate_oauth_auth_server_settings.this: Destruction complete after 0s
module.application.pingfederate_oauth_access_token_mappings.authentication_policy_contract: Destroying... [id=authz_req|apc.vaXeQcliaMj3y2br|terraformdemo]
module.application.pingfederate_oauth_openid_connect_policy.this: Destroying... [id=terraformdemo]
module.authentication.pingfederate_authentication_policies.this: Destroying... [id=default_authentication_policies]
module.system.pingfederate_jdbc_data_store.this: Destruction complete after 0s
module.authentication.pingfederate_oauth_authentication_policy_contract_mapping.this: Destruction complete after 0s
module.application.pingfederate_oauth_openid_connect_policy.this: Destruction complete after 0s
module.authentication.pingfederate_authentication_policies.this: Destruction complete after 0s
module.authentication.pingfederate_idp_adapter.this: Destroying... [id=terraformdemo]
module.authentication.pingfederate_idp_adapter.this: Destruction complete after 1s
module.system.pingfederate_password_credential_validator.this: Destroying... [id=terraformdemo]
module.system.pingfederate_password_credential_validator.this: Destruction complete after 0s
module.system.pingfederate_ldap_data_store.this: Destroying... [id=LDAP-D9639300E991365E2A15F0230E502DB64AC5E79B]
module.system.pingfederate_ldap_data_store.this: Destruction complete after 0s

Error: unable to delete OauthAccessTokenMappings: The resource with ID 'authz_req|apc.vaXeQcliaMj3y2br|terraformdemo' is not found. Please specify a recognized resource ID.


$ terraform state list
module.application.pingfederate_oauth_access_token_manager.this
module.application.pingfederate_oauth_access_token_mappings.authentication_policy_contract
module.authentication.pingfederate_authentication_policy_contract.this

Steps to Reproduce

terraform destroy

Important Factoids

References

#0000

Support cluster replication

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

When deploying configuration in a cluster pingfederate, replication after a successful apply is required.

This should support the following use cases:

Replication is performed after all resources requiring change have completed successfully.
Any failed apply results in no replication.
This should all be achieved within a single apply i.e dont apply then need to plan & apply afterwards to detect the requirement to replicate.

References

Empty inbound_mapping on a LOCAL_IDENTITY_MAPPING type causes a validation error

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

0.15.0

Affected Resource(s)

pingfederate_authentication_polocies

Terraform Configuration Files

children {
        action {
          context = "Registration"
          type    = "LOCAL_IDENTITY_MAPPING"
          inbound_mapping {
          }
         }
}

Debug Output

Panic Output

Expected Behavior

It is valid to have no inbound mapping on the contract fulfillment for a Local Identity Profile within an authentication policy. Terraform should not throw an error or should not show a diff when the inbound_mapping is excluded.

Actual Behavior

When importing authentication policies into state and running a terraform plan an empty inbound_mapping is shown as being removed if there is no inbound_mapping in the TF file. If you add the empty inbound_mapping to the tf file on the appropriate child section terraform then throws an error when you run terraform plan.

Steps to Reproduce

Create a policy in Ping Federate with a Registration step linking to a Local Identity Profile and do not set any inbound mappings within the Inbound Identity Mapping contract fulfillment
Import auth policies into tf state
Comment out the policy resource and run terraform plan to get the structure
UnComment and copy the output from plan reformatting as necessary and removing generated properties (This will include an empty inbound_mapping object on the Local Identity Profile step
Run terraform plan again (Terraform will show a validation error that indicates that inbound_mapping requires an attribute_contract_fulfillment

╷
│ Error: Missing required argument
│ 
│   on authentication-policies.tf line 171, in resource "pingfederate_authentication_policies" "authentication_policies":
│  171:           inbound_mapping {
│ 
│ The argument "authn_selection_trees.1.root_node.0.children.1.action.0.inbound_mapping.0.attribute_contract_fulfillment" is required, but no definition was found.

Important Factoids

References

#0000

Documentation for IDP SP Connection

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Affected Resource(s)

pingfederate_idp_sp_connection

The documentation on https://registry.terraform.io/providers/iwarapter/pingfederate/latest/docs/resources/pingfederate_idp_sp_connections#attributes-reference
is incorrect. Specifically for the SpBrowserSso - the fields listed as being a part of this do not match those expected in the code

#0000

OIDC connect policy computed core attributes.

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.14.5

Affected Resource(s)

pingfederate_10.x has been used here.

When using a pingfederate_oauth_openid_connect_policy if only core attributes are used, an empty attribute_contract block must be supplied. If this block is not supplied, the provider will loop over the attributes wanting to remove subject/sub resulting in a configuration that never completes.

Terraform Configuration Files

resource "pingfederate_oauth_openid_connect_policy" "oidc_cheese_policy" {
  name                      = "cheesePolicy"
  policy_id                 = "cheesePolicy"
  include_sri_in_id_token   = false
  include_user_in_id_token  = false
  include_shash_in_id_token = false

  access_token_manager_ref {
    id = pingfederate_oauth_access_token_manager.cheese.id
  }
  attribute_contract {

  }
  attribute_mapping {
    attribute_contract_fulfillment {
      key_name = "sub"
      source {
        type = "TOKEN"
      }
      value = "subject"
    }
  }
}

Debug Output

      - attribute_contract {
          - core_attributes {
              - include_in_id_token       = false -> null
              - include_in_user_info      = false -> null
              - name                      = "sub" -> null
              - override_default_delivery = false -> null
            }
        }

Panic Output

Expected Behavior

The resource is created and core attributes come from the computed list.

Actual Behavior

If this block is not supplied, the provider will loop over the attributes wanting to remove subject/sub resulting in a configuration that never completes.

Steps to Reproduce

resource "pingfederate_oauth_openid_connect_policy" "oidc_cheese_policy" {
  name                      = "cheesePolicy"
  policy_id                 = "cheesePolicy"
  include_sri_in_id_token   = false
  include_user_in_id_token  = false
  include_shash_in_id_token = false

  access_token_manager_ref {
    id = pingfederate_oauth_access_token_manager.cheese.id
  }
  attribute_mapping {
    attribute_contract_fulfillment {
      key_name = "sub"
      source {
        type = "TOKEN"
      }
      value = "subject"
    }
  }
}

Configurable Instance ID on resources such as IdP adapter

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

The Instance ID on a resource (such as an IdP Adapter) is configurable when using the user interface or management API but then becomes an immutable field on that instance once created. The Ping Federate provider does not allow this initial configuration of the instance ID and it is copied from the name value, which is not always desired.

Please could a configuration option be added to support this.

New or Affected Resource(s)

resource "pingfederate_idp_adapter" and others.

Potential Terraform Configuration

resource "pingfederate_idp_adapter" "cheese" {
  name = "cheeseidpadapter"
  instance = "cheese"
  plugin_descriptor_ref {
    id = "com.pingidentity.pf.adapters.referenceid.IdpBackchannelReferenceAuthnAdapter"
  }

References

#0000

Issuance Criteria applying ordering.

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Affected Resource(s)

pingfederate_XXXXX

All issuance_criteria based resources

Terraform Configuration Files

# Copy-paste your Terraform configurations here

Debug Output

                                  ~ issuance_criteria {
                                      ~ conditional_criteria {
                                            ~ value          = "user1" -> "user2"
                                            # (2 unchanged attributes hidden)

                                            # (1 unchanged block hidden)
                                        }
                                      ~ conditional_criteria {
                                          ~ value          = "user2" -> "user1"
                                            # (2 unchanged attributes hidden)

                                            # (1 unchanged block hidden)
                                        }
                                        # (5 unchanged blocks hidden)
                                    }

                                    # (2 unchanged blocks hidden)
                                }

Panic Output

Expected Behavior

The provider should not enforce ordering.

Actual Behavior

PingFederate resources have a section called issuance criteria, this allowed conditions to be met or not met, to decide if some thing should happen, i.e. allow a user to authenticate.

The provider is applying ordering to this data, which is not available in the UI and API.

Steps to Reproduce

Create the following issuance criteria:

issuance_criteria {
          
                      conditional_criteria {
                        attribute_name = "username"
                        condition      = "EQUALS_CASE_INSENSITIVE"
                        value          = "user1"
                        source {
                          id   = pingfederate_idp_adapter.form_adapt.id
                          type = "ADAPTER"
                        }
                      }
                      conditional_criteria {
                        attribute_name = "username"
                        condition      = "EQUALS_CASE_INSENSITIVE"
                        value          = "user2
                        source {
                          id   = pingfederate_idp_adapter.form_adapt.id
                          type = "ADAPTER"
                        }
                      }
 }

terraform apply
Switch user1 and user2 ordering.
terraform plan
plan is non empty

Important Factoids

References

#0000

Attribute Contract Ordering - Constant Reordering

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.12.25

Affected Resource(s)

pingfederate_oauth_access_token_mappings
pingfederate_oauth_access_token_manager

Terraform Configuration Files

resource "pingfederate_oauth_access_token_manager" "reftokenmgr" {
  instance_id = "reftokenmgr"
  name        = "reftokenmgr"

  plugin_descriptor_ref {
    id = "org.sourceid.oauth20.token.plugin.impl.ReferenceBearerAccessTokenManagementPlugin"
  }

  configuration {
    fields {
      name  = "Token Length"
      value = "28"
    }

    fields {
      name  = "Token Lifetime"
      value = "120"
    }

    fields {
      name  = "Lifetime Extension Policy"
      value = "ALL"
    }

    fields {
      name  = "Maximum Token Lifetime"
      value = ""
    }

    fields {
      name  = "Lifetime Extension Threshold Percentage"
      value = "30"
    }

    fields {
      name  = "Mode for Synchronous RPC"
      value = "3"
    }

    fields {
      name  = "RPC Timeout"
      value = "500"
    }

    fields {
      name  = "Expand Scope Groups"
      value = "false"
    }
  }

  attribute_contract {
    extended_attributes = ["sub", "attr1", "attr2"]
  }
}

resource "pingfederate_oauth_access_token_mappings" "reftokenmgrcc" {
  access_token_manager_ref {
    id = pingfederate_oauth_access_token_manager.reftokenmgr.id
  }

  context {
    type = "CLIENT_CREDENTIALS"
  }
  attribute_contract_fulfillment {
    key_name = "sub"
    source {
      type = "CONTEXT"
    }
    value = "ClientId"
  }
  attribute_contract_fulfillment {
    key_name = "attr1"
    source {
      type = "TEXT"
    }
    value = "Homer"
  }
  attribute_contract_fulfillment {
    key_name = "attr2"
    source {
      type = "TEXT"
    }
    value = "Simpson"
  }
}

Debug Output

Panic Output

Expected Behavior

Nothing after the initial plan as been executed and applied, attributes should be static

Actual Behavior

Constant repeat of trying to reorder to attributes when generating a plan, yet no TF changes

Steps to Reproduce

terraform plan
terraform apply

Constant repeat of trying to reorder to attributes

Terraform will perform the following actions:

  # pingfederate_oauth_access_token_manager.reftokenmgr will be updated in-place
  ~ resource "pingfederate_oauth_access_token_manager" "reftokenmgr" {
        id          = "reftokenmgr"
        instance_id = "reftokenmgr"
        name        = "reftokenmgr"

      ~ attribute_contract {
          ~ extended_attributes = [
                "sub",
              - "attr2",
                "attr1",
              + "attr2",
            ]
        }

Important Factoids

References

#0000

TEXT not accepted as valid type in AttributeContractFulfillment

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

For AttributeFulfillment, the source type "TEXT" is not accepted by the latest version of the provider. The API documentation of PF is a bit misleading, as there is obviously a missing line break :)

Affected Resource(s)

pingfederate_idp_adapter

Terraform Configuration Files

(...)
attribute_mapping {
  attribute_contract_fulfillment {
     key_name = "foo"
     value = "bar"
     source {
        type = "TEXT"
     }
}
(...)

Debug Output

Panic Output

Expected Behavior

For attribute_contract_fulfillment, source type "TEXT" should be accepted

Actual Behavior

Validation error occures

Steps to Reproduce

terraform apply

Important Factoids

References

#0000

adding entries to an exisiting pingfederate_authentication_selector

How can we one add a new entry to an existing pingfederate_authentication_selector without importing? I'm trying to create a new SP connection and the same to the pingfederate_authentication_selector. At this time, unless the existing pingfederate_authentication_selector is imported, I'm unable to add it, which makes the process manual, is there any other solution. Thanks!

Sypport OAuth Client Settings and Dynamic Client Registration (/oauth/clientSettings PF API)

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Introduce a new singleton resource to manage the "OAuth Client Settings" configuration on PingFederate, using the /oauth/clientSettings API.

New or Affected Resource(s)

pingfederate_oauth_auth_client_settings

Potential Terraform Configuration

resource "pingfederate_oauth_auth_client_settings" "settings" {

client_metadata = [
  {
    parameter: "custom_client_param_1"
    description: "custom client parameter 1's description"
    multiValued: true
  },
  {
    parameter: "custom_client_param_2"
    description: "custom client parameter 2's description"
    multiValued: false
  }
]

dynamic_client_registration = {
  initial_access_token_scope = "my_default_scope"
  restrict_common_scopes = false
  allowed_exclusive_scopers = [
    "my_allowed_scope",
    "another_one"
  ]
 ...
 }

}

References

https://docs.pingidentity.com/bundle/pingfederate-103/page/dsr1564002991052.htm

pingfederate_oauth_clientsettings_apidoc_operationmodel.pdf
l

Support Default Token Manager

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

PingFederate has the ability to specify which access token manager is the default. If no default is specified, the first created access token manager becomes the default. This is not a reliable method when using Terraform as the creation is down to the order the terraform executes.

New or Affected Resource(s)

pingfederate_oauth_access_token_manager
pingfederate_oauth_auth_server_settings

Potential Terraform Configuration

# Copy-paste your Terraform configurations here

resource "pingfederate_oauth_auth_server_settings" "settings" {

default_token_manager = pingfederate_oauth_access_token_manager.foo.id
...

}

References

#0000

Provider defaults authentication policy to false

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.0.6

Affected Resource(s)

pingfederate_authentication_policies

Terraform Configuration Files

resource "pingfederate_authentication_policies" "policies" {
authn_selection_trees {
    name    = "foo_policy"
    enabled = true
    
    ....
   
    }
 }

Debug Output

Panic Output

Expected Behavior

Provider should honor the API defaults.

Actual Behavior

Prior to version 21 of the provider, authentication_policies would default to enabled when created and enabled = true was not required. From version 21 of the provider, the provider is defaulting policies to to false. The API default is true. It seems the provider is overriding the default of the API.

A work around to this is to enforce enabled = true in the resource. However, if existing users upgrade and dont specify this. Their authentication policies will be disabled.

Steps to Reproduce

Create

resource "pingfederate_authentication_policies" "policies" {
authn_selection_trees {
    name    = "foo_policy"
 
    ....
   
    }
 }

terraform apply
Policy is created disabled

Important Factoids

References

#0000

Add Support for Fragments in latest for PF 10.2.1.1 +

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

It would be great to have support for creating policy fragments via terraform

GET: https://pf-base-url/pf-admin-api/v1/authenticationPolicies/fragments
POST: https://pf-base-url/pf-admin-api/v1/authenticationPolicies/fragments

GET/PUT/DELETE: https://pf-base-url/pf-admin-api/v1/authenticationPolicies/fragments/{id}

Don't mind extending and logging the above in the Go SDK repo for pingfed

New or Affected Resource(s)

suggested resource name would be something like:

pingfederate_auth_policy_fragment

Potential Terraform Configuration

# Copy-paste your Terraform configurations here

All configurable attributes would be exposed that map to the API

References

#0000

Support for oauth openid static keys endpoint

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

If the provider could support enabling and disabling of staticJwksEnabled
/pf-admin-api/v1/keyPairs/oauthOpenIdConnect

New or Affected Resource(s)

pingfederate_9.x >
suggested pingfederate_keypairs_oauth_openid_connect

Potential Terraform Configuration

resource "pingfederate_keypairs_oauth_openid_connect" "static_key" {

  staticJwksEnabled = true
  
}

Ordering of SP connection attributes leaves an non-empty plan

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

hashicorp/terraform:0.14.6 docker image

Affected Resource(s)

PingFederate 9.3.3-P4

Terraform Configuration Files

resource "pingfederate_idp_sp_connection" "foo_connection" {
  entity_id = "foo"
  active    = true
  base_url     = "https://some.url"
  logging_mode = "STANDARD"
  contact_info {}
  credentials {
    signing_settings {
      signing_key_pair_ref {
        id = pingfederate_keypair_signing.id
      }
      include_cert_in_signature    = false
      include_raw_key_in_signature = false
      algorithm                    = "SHA256withRSA"
    }
    certs {
      active_verification_cert    = true
      encryption_cert             = false
      primary_verification_cert   = true
      secondary_verification_cert = false
      x509_file {
        file_data = file("/sp.pem")
      }
    }
  }
  sp_browser_sso {
    protocol          = "SAML20"
    incoming_bindings = ["REDIRECT"]
    enabled_profiles  = ["SP_INITIATED_SSO"]
    sso_service_endpoints {
      binding    = "POST"
      url        = "/saml/acs"
      is_default = true
      index      = 0
    }
    sign_assertions               = true
    sign_response_as_required     = true
    sp_saml_identity_mapping      = "STANDARD"
    require_signed_authn_requests = true
    assertion_lifetime {
      minutes_before = 5
      minutes_after  = 5
    }
    encryption_policy {
      encrypt_assertion             = false
      encrypt_slo_subject_name_id   = false
      slo_subject_name_id_encrypted = false
      encrypted_attributes          = []
    }
    attribute_contract {
      core_attributes {
        name        = "SAML_SUBJECT"
        name_format = "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
      }
      extended_attributes {
        name        = "realName"
        name_format = "urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
      }
      extended_attributes {
        name        = "role"
        name_format = "urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
      }
      extended_attributes {
        name        = "mail"
        name_format = "urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
      }
    }
    authentication_policy_contract_assertion_mappings {
      attribute_contract_fulfillment {
        key_name = "SAML_SUBJECT"
        source {
          type = "AUTHENTICATION_POLICY_CONTRACT"
        }
        value = "subject"
      }
      attribute_contract_fulfillment {
        key_name = "mail"
        source {
          type = "AUTHENTICATION_POLICY_CONTRACT"
        }
        value = "mail"
      }
      attribute_contract_fulfillment {
        key_name = "realName"
        source {
          type = "AUTHENTICATION_POLICY_CONTRACT"
        }
        value = "realName"
      }
      attribute_contract_fulfillment {
        key_name = "role"
        source {
          type = "AUTHENTICATION_POLICY_CONTRACT"
        }
        value = "role"
      }
      authentication_policy_contract_ref {
        id = pingfederate_authentication_policy_contract.foo.id
      }
      restrict_virtual_entity_ids        = false
      restricted_virtual_entity_ids      = []
      abort_sso_transaction_as_fail_safe = false
    }
  }
}

Debug Output

Panic Output

Expected Behavior

Terraform applies the change, next time a plan is run, no changes are needed and an empty plan is returned.

Actual Behavior

  # pingfederate_idp_sp_connection.foo_connection["fooEntityId"] will be updated in-place
  ~ resource "pingfederate_idp_sp_connection" "foo_connection" {
        id                 = "mqH1y0D6bunn2B_HLsMQjwXyccE"
        name               = "foo connection"
        # (7 unchanged attributes hidden)

      ~ sp_browser_sso {
            # (7 unchanged attributes hidden)

          ~ attribute_contract {

              ~ extended_attributes {
                  ~ name        = "realName" -> "role"
                    # (1 unchanged attribute hidden)
                }
              ~ extended_attributes {
                  ~ name        = "role" -> "realName"
                    # (1 unchanged attribute hidden)
                }
                # (2 unchanged blocks hidden)
            }

            # (4 unchanged blocks hidden)
        }
        # (2 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions in workspace "compose"?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.

Enter a value: yes

pingfederate_idp_sp_connection.foo_connection["fooEntityId"]: Modifying... [id=mqH1y0D6bunn2B_HLsMQjwXyccE]
pingfederate_idp_sp_connection.foo_connection["fooEntityId"]: Modifications complete after 0s [id=mqH1y0D6bunn2B_HLsMQjwXyccE]

Steps to Reproduce

Create an SP connection with the following attributes and apply the terraform.
Change the order of the attributes and run a plan/apply
Terraform will notice there is a change and attempt to make this change.
The change is applied to the resource.
Run a new plan and terraform reports the same change is required.
Change the order back to the original order and terraform reports no changes.

Important Factoids

The attribute contract in PingFederate is an ordered list, if the order changes in the provider, a loop of a non empty plan is always returned.

References

#0000

JDBC data store is always updated on terraform apply

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.14.6

Affected Resource(s)

pingfederate_jdbc_data_store

Terraform Configuration Files

resource "pingfederate_jdbc_data_store" "this" {
  name           = "test"
  driver_class   = var.jdbc_driver_class
  user_name      = var.jdbc_username
  password       = var.jdbc_password
  max_pool_size  = 10
  connection_url = var.jdbc_connection_url
  connection_url_tags {
    connection_url = var.jdbc_connection_url
    default_source = true
  }
}

Debug Output

Panic Output

Expected Behavior

Expected no update if Terraform configuration file not changed.

Actual Behavior

$ terraform apply
pingfederate_jdbc_data_store.this: Refreshing state... [id=JDBC-E463B3A46AFCDB3261A3355C02D346A22A8F8642]

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # pingfederate_jdbc_data_store.this will be updated in-place
  ~ resource "pingfederate_jdbc_data_store" "this" {
      - encrypted_password           = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2Iiwia2lkIjoiMEh4WHlYR2RvWSIsInZlcnNpb24iOiIxMC4xLjIuMCJ9..8TWYRLLJt_ZNigxlQsSyww.rBO00UfGWaA5ek1a0UeMyxfb3whxlsN44xYvAjCdFBg.AJE30fRpPDRiNYbqDAgY9A" -> null
        id                           = "JDBC-E463B3A46AFCDB3261A3355C02D346A22A8F8642"
        name                         = "test"
        # (10 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

pingfederate_jdbc_data_store.this: Modifying... [id=JDBC-E463B3A46AFCDB3261A3355C02D346A22A8F8642]
pingfederate_jdbc_data_store.this: Modifications complete after 0s [id=JDBC-E463B3A46AFCDB3261A3355C02D346A22A8F8642]

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.
$ terraform apply
pingfederate_jdbc_data_store.this: Refreshing state... [id=JDBC-E463B3A46AFCDB3261A3355C02D346A22A8F8642]

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # pingfederate_jdbc_data_store.this will be updated in-place
  ~ resource "pingfederate_jdbc_data_store" "this" {
      - encrypted_password           = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2Iiwia2lkIjoiMEh4WHlYR2RvWSIsInZlcnNpb24iOiIxMC4xLjIuMCJ9..i0UVOvUPWrmyv-TuvJ22jw.elM-K-InzRF4FrPAnOnm12gaor53tfQsBl9Clmutz-E.sS5pt0bpiRkcCxZEtieDjQ" -> null
        id                           = "JDBC-E463B3A46AFCDB3261A3355C02D346A22A8F8642"
        name                         = "test"
        # (10 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

pingfederate_jdbc_data_store.this: Modifying... [id=JDBC-E463B3A46AFCDB3261A3355C02D346A22A8F8642]
pingfederate_jdbc_data_store.this: Modifications complete after 0s [id=JDBC-E463B3A46AFCDB3261A3355C02D346A22A8F8642]

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Steps to Reproduce

repeat terraform apply without modifying Terraform configuration file

Important Factoids

References

#0000

Failed to create access token mapping using password credential validator context

The mapping fails to create when using the PCV context. The logs show the PCV is created before the mapping create is requested. This is our full configuration, but have tested with a simplified configuration, single PCV and ATM, and that fails also.

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.14.6

provider registry.terraform.io/iwarapter/pingfederate v0.0.10

Affected Resource(s)

pingfederate_oauth_access_token_mappings

Terraform Configuration Files

resource "pingfederate_oauth_access_token_mappings" "password_credential_validator" {
  access_token_manager_ref {
    id = pingfederate_oauth_access_token_manager.this.id
  }

...
  context {
    type = "PCV"

    context_ref {
      id = var.password_credential_validator_id
    }
  }
}

resource "pingfederate_password_credential_validator" "this" {
  name = var.password_credential_validator_name

...
  plugin_descriptor_ref {
    id = "org.sourceid.saml20.domain.LDAPUsernamePasswordCredentialValidator"
  }
}

Debug Output

https://gist.github.com/adrianwalmsley/86c50a61e65591e18ff7bc52c1e025e7

Panic Output

Expected Behavior

Expected the access token mapping would be created.

Actual Behavior

The create failed:

module.system.pingfederate_jdbc_data_store.this: Creating...
module.authentication.pingfederate_authentication_policy_contract.this: Creating...
module.system.pingfederate_ldap_data_store.this: Creating...
module.system.pingfederate_oauth_auth_server_settings.this: Creating...
module.authentication.pingfederate_authentication_policy_contract.this: Creation complete after 0s [id=vaXeQcliaMj3y2br]
module.authentication.pingfederate_oauth_authentication_policy_contract_mapping.this: Creating...
module.system.pingfederate_jdbc_data_store.this: Creation complete after 0s [id=JDBC-589F4F8419E1E6B144344ED1185483C75519E182]
module.application.pingfederate_oauth_access_token_manager.this: Creating...
module.system.pingfederate_ldap_data_store.this: Creation complete after 0s [id=LDAP-D9639300E991365E2A15F0230E502DB64AC5E79B]
module.authentication.pingfederate_oauth_authentication_policy_contract_mapping.this: Creation complete after 0s [id=vaXeQcliaMj3y2br]
module.system.pingfederate_oauth_auth_server_settings.this: Creation complete after 0s [id=OauthAuthServerSettings]
module.system.pingfederate_password_credential_validator.this: Creating...
module.application.pingfederate_oauth_access_token_manager.this: Creation complete after 0s [id=terraformdemo]
module.application.pingfederate_oauth_access_token_mappings.authentication_policy_contract: Creating...
module.application.pingfederate_oauth_openid_connect_policy.this: Creating...
module.application.pingfederate_oauth_access_token_mappings.authentication_policy_contract: Creation complete after 1s [id=authz_req|apc.vaXeQcliaMj3y2br|terraformdemo]
module.system.pingfederate_password_credential_validator.this: Creation complete after 1s [id=terraformdemo]
module.application.pingfederate_oauth_openid_connect_policy.this: Creation complete after 1s [id=terraformdemo]
module.application.pingfederate_oauth_access_token_mappings.password_credential_validator: Creating...
module.authentication.pingfederate_idp_adapter.this: Creating...
module.authentication.pingfederate_idp_adapter.this: Creation complete after 1s [id=terraformdemo]
module.authentication.pingfederate_authentication_policies.this: Creating...
module.authentication.pingfederate_authentication_policies.this: Creation complete after 0s [id=default_authentication_policies]

Error: unable to create OauthAccessTokenMappings: Validation error(s) occurred. Please review the error(s) and address accordingly.
Invalid access token mapping context ID.

Steps to Reproduce

terraform apply

Important Factoids

References

#0000

Race condition deleting data store with sp connection

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Affected Resource(s)

pingfederate_jdbc_data_store
pingfederate_ldap_data_store
pingfederate_idp_sp_connection

Terraform Configuration Files

Any valid configuraiton

Debug Output

/opt/out/instance/log/admin-api.log:	2021-04-02 12:07:25,732| Administrator| Basic| 172.17.0.1| DELETE| /idp/spConnections/deleteme| 204 
/opt/out/instance/log/admin-api.log:	2021-04-02 12:07:25,744| Administrator| Basic| 172.17.0.1| DELETE| /dataStores/deleteme| 500 
/opt/out/instance/log/server.log:	2021-04-02 12:07:24,980  DEBUG [org.sourceid.saml20.domain.mgmt.impl.DataSourceManagerImpl] Saving JDBC DataSource deleteme...
/opt/out/instance/log/server.log:	2021-04-02 12:07:24,981  DEBUG [org.sourceid.saml20.domain.datasource.tag.DataSourceTagUtil] No matching tags. Returning default connection: jdbc:hsqldb:mem:mymemdb
/opt/out/instance/log/server.log:	2021-04-02 12:07:24,982  DEBUG [org.sourceid.saml20.domain.mgmt.impl.DBCPDataSourceDeployer] Deployed datasource: deleteme
/opt/out/instance/log/server.log:	2021-04-02 12:07:24,982  DEBUG [org.sourceid.saml20.domain.mgmt.impl.DBCPDataSourceDeployer] Touch /opt/out/instance/server/default/data/module/provisioner-notify.txt
/opt/out/instance/log/server.log:	2021-04-02 12:07:24,983  DEBUG [org.sourceid.saml20.domain.mgmt.impl.DataSourceManagerImpl] Saving JDBC DataSources...
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,053  DEBUG [org.sourceid.saml20.domain.mgmt.impl.DataSourceManagerImpl] Saving JDBC DataSources...
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,071  DEBUG [org.sourceid.saml20.metadata.partner.impl.MetadataDirectoryHybridDbImpl] Deleting SP connection foo
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,072  DEBUG [com.pingidentity.common.util.timers.EventTimer] DSEventTimer{dataStoreName='PFIndexDS', dataStoreType='JDBC', dataStoreUsedBy='connection-index-db', eventType='execute-query', timeSpentMs='1'}
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,075  DEBUG [com.pingidentity.common.util.timers.EventTimer] DSEventTimer{dataStoreName='PFIndexDS', dataStoreType='JDBC', dataStoreUsedBy='connection-index-db', eventType='execute', timeSpentMs='0'}
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,076  DEBUG [com.pingidentity.common.util.timers.EventTimer] DSEventTimer{dataStoreName='PFIndexDS', dataStoreType='JDBC', dataStoreUsedBy='connection-index-db', eventType='execute-query', timeSpentMs='0'}
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,076  DEBUG [org.sourceid.saml20.metadata.partner.impl.MetadataDirectoryHybridDbImpl] Saving delta replication state
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,584  DEBUG [com.pingidentity.common.util.timers.EventTimer] DSEventTimer{dataStoreName='PFIndexDS', dataStoreType='JDBC', dataStoreUsedBy='connection-index-db', eventType='execute-query', timeSpentMs='0'}
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,585  DEBUG [com.pingidentity.common.util.timers.EventTimer] DSEventTimer{dataStoreName='PFIndexDS', dataStoreType='JDBC', dataStoreUsedBy='connection-index-db', eventType='execute-query', timeSpentMs='0'}
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,588  DEBUG [com.pingidentity.common.util.timers.EventTimer] DSEventTimer{dataStoreName='PFIndexDS', dataStoreType='JDBC', dataStoreUsedBy='connection-index-db', eventType='execute-query', timeSpentMs='0'}
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,588  DEBUG [org.sourceid.saml20.metadata.partner.impl.MetadataDirectoryHybridDbImpl] Saving SP connection foo
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,591  DEBUG [com.pingidentity.common.util.timers.EventTimer] DSEventTimer{dataStoreName='PFIndexDS', dataStoreType='JDBC', dataStoreUsedBy='connection-index-db', eventType='execute', timeSpentMs='1'}
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,591  DEBUG [com.pingidentity.common.util.timers.EventTimer] DSEventTimer{dataStoreName='PFIndexDS', dataStoreType='JDBC', dataStoreUsedBy='connection-to-connection-mapping-index-db', eventType='execute', timeSpentMs='0'}
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,591  DEBUG [org.sourceid.saml20.metadata.partner.impl.MetadataDirectoryHybridDbImpl] Saving delta replication state
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,592  DEBUG [com.pingidentity.common.util.timers.EventTimer] DSEventTimer{dataStoreName='PFIndexDS', dataStoreType='JDBC', dataStoreUsedBy='connection-index-db', eventType='execute-query', timeSpentMs='0'}
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,648  DEBUG [org.sourceid.saml20.domain.mgmt.impl.DataSourceManagerImpl] Saving JDBC DataSource deleteme...
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,648  DEBUG [org.sourceid.saml20.domain.datasource.tag.DataSourceTagUtil] No matching tags. Returning default connection: jdbc:hsqldb:mem:mymemdb
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,648  DEBUG [org.sourceid.saml20.domain.mgmt.impl.DBCPDataSourceDeployer] Deployed datasource: deleteme
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,649  DEBUG [org.sourceid.saml20.domain.mgmt.impl.DBCPDataSourceDeployer] Touch /opt/out/instance/server/default/data/module/provisioner-notify.txt
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,649  DEBUG [org.sourceid.saml20.domain.mgmt.impl.DataSourceManagerImpl] Saving JDBC DataSources...
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,728  DEBUG [org.sourceid.saml20.metadata.partner.impl.MetadataDirectoryHybridDbImpl] Deleting SP connection foo
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,728  DEBUG [com.pingidentity.common.util.timers.EventTimer] DSEventTimer{dataStoreName='PFIndexDS', dataStoreType='JDBC', dataStoreUsedBy='connection-index-db', eventType='execute-query', timeSpentMs='0'}
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,730  DEBUG [com.pingidentity.common.util.timers.EventTimer] DSEventTimer{dataStoreName='PFIndexDS', dataStoreType='JDBC', dataStoreUsedBy='connection-index-db', eventType='execute', timeSpentMs='0'}
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,730  DEBUG [com.pingidentity.common.util.timers.EventTimer] DSEventTimer{dataStoreName='PFIndexDS', dataStoreType='JDBC', dataStoreUsedBy='connection-index-db', eventType='execute-query', timeSpentMs='0'}
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,730  DEBUG [org.sourceid.saml20.metadata.partner.impl.MetadataDirectoryHybridDbImpl] Saving delta replication state
/opt/out/instance/log/server.log:	2021-04-02 12:07:25,743  ERROR [com.pingidentity.pf.common.api.RuntimeExceptionMapper] API service runtime error occured:
/opt/out/instance/log/server.log:	java.lang.NullPointerException: null
/opt/out/instance/log/server.log:		at org.sourceid.saml20.domain.util.InUseDetectionUtil.isDataSourceInUseBySpConnection(InUseDetectionUtil.java:584) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.sourceid.saml20.domain.util.InUseDetectionUtil.isDataSourceInUse(InUseDetectionUtil.java:371) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.sourceid.saml20.domain.mgmt.impl.DataSourceManagerImpl.isInUse(DataSourceManagerImpl.java:1020) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at $DataSourceManager_1788f2ac80a.isInUse($DataSourceManager_1788f2ac80a.java) ~[?:?]
/opt/out/instance/log/server.log:		at org.sourceid.saml20.domain.mgmt.proxy.CopyingDSMgrProxy.isInUse(CopyingDSMgrProxy.java:119) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at com.pingidentity.pf.admin.rest.controller.DataStoreController.deleteDataStore(DataStoreController.java:468) ~[?:?]
/opt/out/instance/log/server.log:		at jdk.internal.reflect.GeneratedMethodAccessor674.invoke(Unknown Source) ~[?:?]
/opt/out/instance/log/server.log:		at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
/opt/out/instance/log/server.log:		at java.lang.reflect.Method.invoke(Method.java:566) ~[?:?]
/opt/out/instance/log/server.log:		at com.sun.jersey.spi.container.JavaMethodInvokerFactory$1.invoke(JavaMethodInvokerFactory.java:60) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.model.method.dispatch.AbstractResourceMethodDispatchProvider$ResponseOutInvoker._dispatch(AbstractResourceMethodDispatchProvider.java:205) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.model.method.dispatch.ResourceJavaMethodDispatcher.dispatch(ResourceJavaMethodDispatcher.java:75) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.HttpMethodRule.accept(HttpMethodRule.java:302) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.ResourceClassRule.accept(ResourceClassRule.java:108) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.uri.rules.RootResourceClassesRule.accept(RootResourceClassesRule.java:84) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1542) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1473) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1419) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1409) ~[jersey-server.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.spi.container.servlet.WebComponent.service(WebComponent.java:409) ~[jersey-servlet.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:558) ~[jersey-servlet.jar:1.19]
/opt/out/instance/log/server.log:		at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:733) ~[jersey-servlet.jar:1.19]
/opt/out/instance/log/server.log:		at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) ~[servlet-api-3.1.jar:3.1.0]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:873) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1623) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at com.pingidentity.common.util.access.ExecutionContextFilter.doFilter(ExecutionContextFilter.java:51) ~[pf-commons.jar:?]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1610) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at com.pingidentity.pf.common.api.filter.RequestProxyFilter.doFilter(RequestProxyFilter.java:21) ~[pf-common-api.jar:?]
/opt/out/instance/log/server.log:		at org.sourceid.servlet.filter.AbstractHttpFilter.doFilter(AbstractHttpFilter.java:56) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1610) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.sourceid.saml20.domain.util.api.ws.ConsoleOnlyFilter.doFilter(ConsoleOnlyFilter.java:23) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.sourceid.servlet.filter.AbstractHttpFilter.doFilter(AbstractHttpFilter.java:56) ~[pf-protocolengine.jar:?]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1602) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:540) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:146) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:548) ~[jetty-security-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:257) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1700) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:255) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1345) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:203) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:480) ~[jetty-servlet-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1667) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:201) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1247) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:144) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:220) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:152) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.Server.handle(Server.java:505) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:370) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:267) ~[jetty-server-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:305) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:427) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:321) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:159) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:117) ~[jetty-io-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:333) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:310) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:168) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:126) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:366) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:698) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:804) ~[jetty-util-9.4.18.v20190429patch5.jar:9.4.18.v20190429patch5]
/opt/out/instance/log/server.log:		at java.lang.Thread.run(Thread.java:834) [?:?]

Expected Behavior

Resources should be deleted

Actual Behavior

Data stores fail to delete 500 Internal Server error

Error: unable to delete JdbcDataStores: 500 Internal Server Error {"resultId":"server_error","message":"A server error has occurred. Check the server logs for details."}

Steps to Reproduce

curl -i -k -X POST -H "X-Bypassexternalvalidation: true" -H "X-XSRF-Header: pingfederate" -H "Content-Type: application/json" --user Administrator:2FederateM0re -d '{"type":"SP","id":"deleteme","name":"acc_test_foo","entityId":"foo","active":true,"loggingMode":"STANDARD","virtualEntityIds":[],"credentials":{"certs":[{"primaryVerificationCert":false,"secondaryVerificationCert":false,"x509File":{"id":"mw96rsfecl1fg956e9ypgns5q","fileData":"-----BEGIN CERTIFICATE-----\nMIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsFADA5MQswCQYD\nVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24gUm9vdCBDQSAxMB4XDTE1\nMDUyNjAwMDAwMFoXDTM4MDExNzAwMDAwMFowOTELMAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpv\nbjEZMBcGA1UEAxMQQW1hem9uIFJvb3QgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\nggEBALJ4gHHKeNXjca9HgFB0fW7Y14h29Jlo91ghYPl0hAEvrAIthtOgQ3pOsqTQNroBvo3bSMgH\nFzZM9O6II8c+6zf1tRn4SWiw3te5djgdYZ6k/oI2peVKVuRF4fn9tBb6dNqcmzU5L/qwIFAGbHrQ\ngLKm+a/sRxmPUDgH3KKHOVj4utWp+UhnMJbulHheb4mjUcAwhmahRWa6VOujw5H5SNz/0egwLX0t\ndHA114gk957EWW67c4cX8jJGKLhD+rcdqsq08p8kDi1L93FcXmn/6pUCyziKrlA4b9v7LWIbxcce\nVOF34GfID5yHI9Y/QCB/IIDEgEw+OyQmjgSubJrIqg0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB\n/zAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0OBBYEFIQYzIU07LwMlJQuCFmcx7IQTgoIMA0GCSqGSIb3\nDQEBCwUAA4IBAQCY8jdaQZChGsV2USggNiMOruYou6r4lK5IpDB/G/wkjUu0yKGX9rbxenDIU5PM\nCCjjmCXPI6T53iHTfIUJrU6adTrCC2qJeHZERxhlbI1Bjjt/msv0tadQ1wUsN+gDS63pYaACbvXy\n8MWy7Vu33PqUXHeeE6V/Uq2V8viTO96LXFvKWlJbYK8U90vvo/ufQJVtMVT8QtPHRh8jrdkPSHCa\n2XV4cdFyQzR1bldZwgJcJmApzyMZFo6IQ6XU5MsI+yMRQ+hDKXJioaldXgjUkK642M4UwtBV8ob2\nxJNDd2ZhwLnoQdeXeGADbkpyrqXRfboQnoZsG4q5WTP468SQvvG5\n-----END CERTIFICATE-----\n"},"activeVerificationCert":false,"encryptionCert":false}],"inboundBackChannelAuth":{"type":"INBOUND","digitalSignature":false,"verificationSubjectDN":"cn=foo","requireSsl":false}},"attributeQuery":{"attributeSources":[{"type":"JDBC","dataStoreRef":{"id":"ProvisionerDS","location":"https://localhost:9999/pf-admin-api/v1/dataStores/ProvisionerDS"},"id":"foo","description":"foo","schema":"INFORMATION_SCHEMA","table":"ADMINISTRABLE_ROLE_AUTHORIZATIONS","filter":"*"}],"attributeContractFulfillment":{"foo":{"source":{"type":"JDBC_DATA_STORE","id":"foo"},"value":"GRANTEE"}},"issuanceCriteria":{"conditionalCriteria":[]},"attributes":["foo"],"policy":{"signResponse":false,"signAssertion":false,"encryptAssertion":false,"requireSignedAttributeQuery":false,"requireEncryptedNameId":false}}}' https://localhost:9999/pf-admin-api/v1/idp/spConnections
curl -i -k -X POST -H "X-Bypassexternalvalidation: true" -H "X-XSRF-Header: pingfederate" -H "Content-Type: application/json" --user Administrator:2FederateM0re -d '{"id": "deleteme","allowMultiValueAttributes":true,"blockingTimeout":5000,"connectionUrl":"jdbc:hsqldb:mem:mymemdb","connectionUrlTags":[{"connectionUrl":"jdbc:hsqldb:mem:mymemdb","defaultSource":true,"tags":""}],"driverClass":"org.hsqldb.jdbcDriver","idleTimeout":5,"maskAttributeValues":false,"maxPoolSize":100,"minPoolSize":10,"name":"terraform","password":"secret","type":"JDBC","userName":"sa"}' https://localhost:9999/pf-admin-api/v1/dataStores

curl -i -k -X DELETE -H "X-XSRF-Header: pingfederate" --user Administrator:2FederateM0re https://localhost:9999/pf-admin-api/v1/idp/spConnections/deleteme &
curl -i -k -X DELETE -H "X-XSRF-Header: pingfederate" --user Administrator:2FederateM0re https://localhost:9999/pf-admin-api/v1/dataStores/deleteme &

Important Factoids

This is actually a pingfederate bug, but perhaps we can mask it in the provider

Support 'PAR Status' as an Authorization Server Settings

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Please could the provider support 'PAR status' as a configuration option on the pingfederate_oauth_auth_server_settings resource.

New or Affected Resource(s)

pingfederate_oauth_auth_server_settings PingFederate 10.2 >

Potential Terraform Configuration

resource "pingfederate_oauth_auth_server_settings" "settings" {

par_status   = "REQUIRED"

}

References

#0000

certificates_ca api is not thread safe

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Affected Resource(s)

pingfederate_certificates_ca

Terraform Configuration Files

Deploy multiple cert ca's

Expected Behavior

Create appears to work

pingfederate_certificates_ca.demo[2]: Creation complete after 2s [id=example2]
pingfederate_certificates_ca.demo[15]: Creating...
pingfederate_certificates_ca.demo[19]: Creating...
pingfederate_certificates_ca.demo[12]: Creation complete after 3s [id=example12]
pingfederate_certificates_ca.demo[14]: Creation complete after 1s [id=example14]
pingfederate_certificates_ca.demo[16]: Creating...
pingfederate_certificates_ca.demo[19]: Creation complete after 4s [id=example19]
pingfederate_certificates_ca.demo[7]: Creation complete after 5s [id=example7]
pingfederate_certificates_ca.demo[13]: Creation complete after 6s [id=example13]
pingfederate_certificates_ca.demo[4]: Creation complete after 4s [id=example4]
pingfederate_certificates_ca.demo[10]: Creation complete after 4s [id=example10]
pingfederate_certificates_ca.demo[9]: Creation complete after 4s [id=example9]
pingfederate_certificates_ca.demo[16]: Creation complete after 3s [id=example16]
pingfederate_certificates_ca.demo[11]: Creation complete after 4s [id=example11]
pingfederate_certificates_ca.demo[15]: Creation complete after 4s [id=example15]

Further plans should work successfully

Actual Behavior

Error: unable to read CertificatesCa: The resource with ID 'example17' is not found. Please specify a recognized resource ID.
Error: unable to read CertificatesCa: The resource with ID 'example0' is not found. Please specify a recognized resource ID.
Error: unable to read CertificatesCa: The resource with ID 'example1' is not found. Please specify a recognized resource ID.

If the certs have a chained dependency this works everytime.

Steps to Reproduce

Deploy around 10/20 cert ca's

terraform apply
terraform plan

Apple Silicon (darwin/arm64) support

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Please could you add support for Apple Silicon (aka release darwin/arm64 binaries) - this would require adopting Go 1.16

References

Goes along with hashicorp/terraform#27257

Provider Handling Default Rows In Tables

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform 0.13.

Affected Resource(s)

pingfederate_oauth_access_token_manager
pingfederate_authentication_selector

et al

Terraform Configuration Files

resource "pingfederate_authentication_selector" "my_selector" {
  name  = "my_selector"
  plugin_descriptor_ref {
    id = "com.pingidentity.pf.selectors.connectionset.ConnectionSetAdapterSelector"
  }
  configuration {
    tables {
      name = "Connections"
        content {
          fields {
            name  = "Connection"
            value = pingfederate_idp_sp_connection.foo.entity_id
          }
        }
    }
  }
}

Debug Output

Error: unable to create AuthenticationSelectors: Validation error(s) occurred. Please review the error(s) and address accordingly.
The JSON field 'configuration.tables[0].rows[0].defaultRow' is not recognized. Please remove this field and try again.

 in resource "pingfederate_authentication_selector" "my_selector":
 389: resource "pingfederate_authentication_selector" "my_selector" {

Panic Output

Expected Behavior

Provider should not expect this to be provided for versions that it is not applicable for.

Actual Behavior

Version 10 of PingFederate introduces a concept of a default row within a table when configuring a resource that is configured by a plugin. When using an older version of PingFederate this is not handled by the provider.

Provider expect a default row to be provided for older versions pf PF, when it is not available in the API schema.

Steps to Reproduce

terraform apply

Important Factoids

References

#0000

PingFederate OAuth Client Management API PVC not enabled in the resource.

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.14.11

Affected Resource(s)

pingfederate_oauth_auth_server_settings

pingfederate_10.2.2.0

Terraform Configuration Files

resource "pingfederate_oauth_auth_server_settings" "settings" {

  admin_web_service_pcv_ref = pingfederate_password_credential_validator.client_manager_pvc.name
}

Debug Output

Panic Output

Expected Behavior

Expected behaviour is for the provider to change the PingFederate oauth server settings to update the client management pcv when declared in the resource block.

Actual Behavior

The provider does not change the PingFederate oauth server settings to update the client management pcv when declared in the resource block.

Steps to Reproduce

Declare the resource with the pvc
terraform apply
The plan shows 0 items to change.

Important Factoids

The looks enabled in the resource:

https://github.com/iwarapter/terraform-provider-pingfederate/blob/master/pingfederate/resource_pingfederate_oauth_auth_server_settings.go#L174

But also commented out in the update.

https://github.com/iwarapter/terraform-provider-pingfederate/blob/master/pingfederate/resource_pingfederate_oauth_auth_server_settings.go#L209

References

#0000

Configurable ID when creating new authentication policy contract resource

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

A persistent grant might contain a reference to an authentication policy contract (APC) ID. In a scenario where persistent grants have been issued based based on an APC, and for some reason the APC is being re-created, it will result in a new APC with a new, randomly generated ID. This in turn will result in errors when a client tries to refresh an access grant that has been issued against the previous APC ID. Hence it would be helpful if the ID of a APC could be configured in the resource, to ensure we have a constant ID.

New or Affected Resource(s)

pingfederate_authentication_policy_contract

Potential Terraform Configuration

resource "pingfederate_authentication_policy_contract" "demo" {
  id = "cheese"
  name = "MyAPC"
}