Add support for customizing ADFS server lookup cookies #1298
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Dainius Serplis <[email protected]>
Signed-off-by: Dainius Serplis <[email protected]>
Signed-off-by: Dainius Serplis <[email protected]>
|
My terraform looks like Resource vcd_org is created sucessfull, but vcd_org_user is not: Cloud director log looks like: PS. Actually, even "testiranje123admin" vcd_org_user is created inside Cloud Director Organization "testiranje123", but terraform failed during creation. |
|
Here is tf debug log of the apply: |
|
Thank you - the first question to check - does the same script work if you don't use saml/adfs auth? |
|
Yes it does. |
|
I have tested resources
and data sources:
It seems that besides /cloudapi/1.0.0/sessions/current which was called from "vcd_org_user" resource, So in summary, situation is: URLs not working (HTTP 401): Is this helpful in any way? |
|
Hmm. This is very confusing at first looks. I have double checked and at first looks the ones that don't work use the same core low level API functions that handle headers. Could you try to run terraform with This should dump all headers (including the token, not the password as the variable hints). I wonder if the token is present in the API calls that fail. I don't expect you to share this as this will not hide sensitive data. What I am interested is why it fails, because in essence even when you do ADFS+SAML - it should just exchange token and use it in the end. It shouldn't differ that much after the initial negotiation. |
|
Hope this helps: |
|
And here are some that work well: |
|
@Didainius do you need me to run some other tests? |
Yeah, I still have to look at what could go wrong here. You're on 10.5.1, right? |
|
BTW. The |
|
Yes, VCD is 10.5.1, and X-Vcloud-Authorization is the same in all requests, 200 or 401 |
|
@mnspodrska , |
|
It couldn't work because we were not upgraded to VCD 10.5.1 as it was just published at the time. |
Ok, just in case - could you try our PR branch now? If you need - I can make a branch of Terraform that would consume yours. I am just curious if something slipped in the cracks of my implementation or it is instead a general issue that has to be tackled |
|
You want me to test if vmware/go-vcloud-director#637 works with 10.5.1? I will try do it by friday. |
|
@Didainius Sorry I couldn't get back on this as I promised. I have tested now to compile latest https://github.com/vmware/terraform-provider-vcd compiled with vmware/go-vcloud-director#637 and the results are the same as we saw in this PR - requests with Accept: [application/*+xml;version=37.0] are working, and requests with Accept: [application/json;version=38.1] are failing with "Response status 401 Unauthorized" and message |
Thank you! I will try to find out more about this. |
Signed-off-by: Dainius Serplis <[email protected]>
Didainius
force-pushed
the
adfs-saml-customisation
branch
from
5139ed5 to
7ebb6c3
Compare
|
@mnspodrska, |
|
It works! Than you very much! |
|
@Didainius feel free to tell me if you need me to provide more information or if anything else needs to be tested. |
Signed-off-by: Dainius Serplis <[email protected]>
Signed-off-by: Dainius Serplis <[email protected]>
Signed-off-by: Dainius Serplis <[email protected]>
I have improved tests in the SDK and will open up for final team reviews now. It should be good after that |
adambarreiro
approved these changes
Aug 27, 2024
Signed-off-by: Dainius Serplis <[email protected]>
Signed-off-by: Dainius Serplis <[email protected]>
Signed-off-by: Dainius Serplis <[email protected]>
lvirbalas
approved these changes
Sep 10, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Ref: vmware/go-vcloud-director#637
Originated from vmware/go-vcloud-director#637
Adds a
saml_adfs_cookieforproviderconfiguration so that a custom cookie can be injected.{{.Org}}will be replaced with specified Org for auth during runtime.No default tests as they require complex infrastructure.