Terraform-provider-vault: vault_jwt_auth_backend for type oidc: provider_config is parsing everything as String

Created on 28 Jan 2021 · 2Comments · Source: hashicorp/terraform-provider-vault

Hello,

following PR 943, and comments there, I face the following issue.

When trying to create a vault_jwt_auth_backend with oidc type for gsuite (documentation guide here, everything in "provider_config" gets parsed as String. This means that the boolean variables "fetch_groups" & "fetch_user_info" and the int variable "groups_recurse_max_depth" can not be used, as their respective value types are expected.

In addition, trying to customize/edit the provider I have stumbled upon an issue which may be a code bug, so I am reporting this as well. See below.

Terraform Version

terraform -v                                                         
Terraform v0.14.4
Your version of Terraform is out of date! The latest version
is 0.14.5. You can update by downloading from https://www.terraform.io/downloads.html

Affected Resource(s)

Please list the resources as a list, for example:
vault_jwt_auth_backend

Terraform Configuration Files

resource "vault_jwt_auth_backend" "this" {
  path                                = "oidc"
  type                                = "oidc"
  oidc_discovery_url         = "https://accounts.google.com"
  oidc_client_id                 =  "xxxxxx.apps.googleusercontent.com"
  oidc_client_secret          =  "xxxxxx"
  default_role                    = "xxxxxx"
  provider_config = {
    provider                                = "gsuite"
    gsuite_service_account       = "/path/to/service-account.json"
    gsuite_admin_impersonate  = "[email protected]"
    fetch_groups                        = true
    fetch_user_info                    = true
    groups_recurse_max_depth = 5
  }
}

Debug Output

See below.

Expected Behavior

Ideally, the oidc backend should be created, with the correct configuration.

Actual Behavior

  + resource "vault_jwt_auth_backend" "this" {
      + accessor           = (known after apply)
      + default_role       = "readonly"
      + id                 = (known after apply)
      + oidc_client_id     = "xxxxxxx"
      + oidc_client_secret = (sensitive value)
      + oidc_discovery_url = "xxxxxxx"
      + path               = "oidc"
      + provider_config    = {
          + "fetch_groups"             = "true"
          + "fetch_user_info"          = "true"
          + "groups_recurse_max_depth" = "5"
          + "gsuite_admin_impersonate" = "xxxxxx"
          + "gsuite_service_account"   = "/etc/config/vault-sa-key.json"
          + "provider"                 = "gsuite"
        }
      + tune               = (known after apply)
      + type               = "oidc"
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

vault_jwt_auth_backend.this: Creating...

Error: error updating configuration to Vault for path oidc: Error making API request.

URL: PUT https://xxxxxxxxxxxxxx/v1/auth/oidc/config

Code: 400. Errors:

* invalid provider_config: error initializing "gsuite" provider_config: 3 error(s) decoding:

* 'fetch_groups' expected type 'bool', got unconvertible type 'string'
* 'fetch_user_info' expected type 'bool', got unconvertible type 'string'
* 'groups_recurse_max_depth' expected type 'int', got unconvertible type 'string'

  on main.tf line 1, in resource "vault_jwt_auth_backend" "this":
   1: resource "vault_jwt_auth_backend" "this" {

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

Attempt to create a oidc auth backend of type gsuite.

Important Factoids

I have attempted to fix the issue in WIP: PR 953, but another error is thrown:

2021-01-26T11:49:39.481+0200 [DEBUG] plugin.terraform-provider-vault_v2.18.0_x4: 2021/01/26 11:49:39 [DEBUG] Updating auth oidc2 in Vault
2021/01/26 11:49:39 [DEBUG] vault_jwt_auth_backend.this: apply errored, but we're indicating that via the Error pointer rather than returning it: error updating configuration to Vault for path oidc2: json: unsupported type: schema.SchemaSetFunc
2021/01/26 11:49:39 [TRACE] EvalMaybeTainted: vault_jwt_auth_backend.this encountered an error during creation, so it is now marked as tainted
2021/01/26 11:49:39 [TRACE] EvalWriteState: recording 0 dependencies for vault_jwt_auth_backend.this
2021/01/26 11:49:39 [TRACE] EvalWriteState: writing current state object for vault_jwt_auth_backend.this
2021/01/26 11:49:39 [TRACE] EvalApplyProvisioners: vault_jwt_auth_backend.this is tainted, so skipping provisioning
2021/01/26 11:49:39 [TRACE] EvalMaybeTainted: vault_jwt_auth_backend.this was already tainted, so nothing to do
2021/01/26 11:49:39 [TRACE] EvalWriteState: recording 0 dependencies for vault_jwt_auth_backend.this
2021/01/26 11:49:39 [TRACE] EvalWriteState: writing current state object for vault_jwt_auth_backend.this
2021/01/26 11:49:39 [TRACE] vertex "vault_jwt_auth_backend.this": visit complete
2021/01/26 11:49:39 [TRACE] dag/walk: upstream of "provider[\"registry.terraform.io/hashicorp/vault\"] (close)" errored, so skipping
2021/01/26 11:49:39 [TRACE] dag/walk: upstream of "meta.count-boundary (EachMode fixup)" errored, so skipping
2021/01/26 11:49:39 [TRACE] dag/walk: upstream of "root" errored, so skipping
2021/01/26 11:49:39 [TRACE] statemgr.Filesystem: creating backup snapshot at terraform.tfstate.backup
2021/01/26 11:49:39 [TRACE] statemgr.Filesystem: state has changed since last snapshot, so incrementing serial to 5
2021/01/26 11:49:39 [TRACE] statemgr.Filesystem: writing snapshot at terraform.tfstate

2021/01/26 11:49:39 [TRACE] statemgr.Filesystem: removing lock metadata file .terraform.tfstate.lock.info
2021/01/26 11:49:39 [TRACE] statemgr.Filesystem: unlocking terraform.tfstate using fcntl flock
Error: error updating configuration to Vault for path oidc2: json: unsupported type: schema.SchemaSetFunc

on main.tf line 13, in resource "vault_jwt_auth_backend" "this":
13: resource "vault_jwt_auth_backend" "this" {