allow for mapping roles to users and service accounts

[mrparkers]

Discussion started in #143.

For mapping roles to a service account, it makes sense to make to have a data source to get the ID of that service account, and use a resource like keycloak_user_roles to map roles to it. It might look something like this:

resource "keycloak_openid_client" "client" {
  realm_id  = "${keycloak_realm.realm.id}"
  client_id = "client"
  name      = "client"

  enabled = true

  access_type   = "CONFIDENTIAL"
  client_secret = "secret"
  
  service_accounts_enabled = true
}

data "keycloak_service_account_user" "client_service_account" {
  client_id = "${keycloak_openid_client.client.id}"
}

resource "keycloak_role" "role" {
  realm_id = "${keycloak_realm.realm.id}"
  name     = "my-role"
}

resource "keycloak_user_roles" "client_service_account_roles" {
  realm_id = "${keycloak_realm.realm.id}"
  user_id  = "${data.keycloak_service_account_user.client_service_account.id}"

  roles = [
    "${keycloak_role.role.id}"
  ]
}

thoughts? cc @rlewan @camelpunch

[rlewan]

Totally makes sense, I like the simplicity 👍

[camelpunch]

LGTM!

[dimsedane]

I am looking into this a little as my first try with go and Terraform development since we need it for at project.

While my need is also for a service account, would it be better for the datasource to be for a generic keycloak user, not just a service account? You could still get the service account user from the naming convention, but it would be possible to apply it broader.

[mrparkers]

Hi @dimsedane, thanks for wanting to contribute! Feel free to post any questions you may have here along the way, I'll be happy to help.

I had initially considered a more generic keycloak_user data source as well, but my concern with using that for service accounts is that we would be relying on that naming convention which isn't guaranteed to remain consistent. I think ultimately there will be a generic keycloak_user data source regardless, and I suppose there would be nothing stopping people from using it that way, but I would probably still add a keycloak_service_account_user data source just for the extra safety.

[totobest]

Thank for the idea @mrparkers.

Would it better for the resource "keycloak_openid_client" to output an attribute service_account_user_id if service_accounts_enabled is set to true?

[languitar]

Any chance to get this going? We would need this.

[mrparkers]

Looks like this is being worked on in #247

[languitar]

As the #247 is closed now and #315 is merged, is this resolved now?