Skip to content

Commit 40bf5e9

Browse files
duedares-rvjErwinSteffens
duedares-rvj
and
ErwinSteffens
authored
Add tenant OIDC logout settings (#1192)
* Add tenant OIDC logout settings * Updated test and recordings --------- Co-authored-by: Erwin Steffens <[email protected]>
1 parent 3a22ee2 commit 40bf5e9

File tree

9 files changed

+165
-134
lines changed

9 files changed

+165
-134
lines changed

‎docs/data-sources/tenant.md

+9
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ data "auth0_tenant" "my_tenant" {}
3636
- `idle_session_lifetime` (Number) Number of hours during which a session can be inactive before the user must log in again.
3737
- `management_api_identifier` (String) The identifier value of the built-in Management API resource server, which can be used as an audience when configuring client grants.
3838
- `mtls` (List of Object) Configuration for mTLS. (see [below for nested schema](#nestedatt--mtls))
39+
- `oidc_logout` (List of Object) Settings related to OIDC RP-initiated Logout. (see [below for nested schema](#nestedatt--oidc_logout))
3940
- `picture_url` (String) URL of logo to be shown for the tenant. Recommended size is 150px x 150px. If no URL is provided, the Auth0 logo will be used.
4041
- `pushed_authorization_requests_supported` (Boolean) Enable pushed authorization requests.
4142
- `sandbox_version` (String) Selected sandbox version for the extensibility environment, which allows you to use custom scripts to extend parts of Auth0's functionality.
@@ -96,6 +97,14 @@ Read-Only:
9697
- `enable_endpoint_aliases` (Boolean)
9798

9899

100+
<a id="nestedatt--oidc_logout"></a>
101+
### Nested Schema for `oidc_logout`
102+
103+
Read-Only:
104+
105+
- `rp_logout_end_session_endpoint_discovery` (Boolean)
106+
107+
99108
<a id="nestedatt--session_cookie"></a>
100109
### Nested Schema for `session_cookie`
101110

‎docs/resources/tenant.md

+9
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ resource "auth0_tenant" "my_tenant" {
6969
- `friendly_name` (String) Friendly name for the tenant.
7070
- `idle_session_lifetime` (Number) Number of hours during which a session can be inactive before the user must log in again.
7171
- `mtls` (Block List, Max: 1) Configuration for mTLS. (see [below for nested schema](#nestedblock--mtls))
72+
- `oidc_logout` (Block List, Max: 1) Settings related to OIDC RP-initiated Logout. (see [below for nested schema](#nestedblock--oidc_logout))
7273
- `picture_url` (String) URL of logo to be shown for the tenant. Recommended size is 150px x 150px. If no URL is provided, the Auth0 logo will be used.
7374
- `pushed_authorization_requests_supported` (Boolean) Enable pushed authorization requests.
7475
- `sandbox_version` (String) Selected sandbox version for the extensibility environment, which allows you to use custom scripts to extend parts of Auth0's functionality.
@@ -133,6 +134,14 @@ Optional:
133134
- `enable_endpoint_aliases` (Boolean) Enable mTLS endpoint aliases.
134135

135136

137+
<a id="nestedblock--oidc_logout"></a>
138+
### Nested Schema for `oidc_logout`
139+
140+
Required:
141+
142+
- `rp_logout_end_session_endpoint_discovery` (Boolean) Enable the end_session_endpoint URL in the .well-known discovery configuration.
143+
144+
136145
<a id="nestedblock--session_cookie"></a>
137146
### Nested Schema for `session_cookie`
138147

‎go.mod

+9-9
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
module github.com/auth0/terraform-provider-auth0
22

3-
go 1.22.0
3+
go 1.23.0
44

5-
toolchain go1.22.5
5+
toolchain go1.23.7
66

77
require (
88
github.com/PuerkitoBio/rehttp v1.4.0
9-
github.com/auth0/go-auth0 v1.17.0
9+
github.com/auth0/go-auth0 v1.18.0
1010
github.com/google/go-cmp v0.7.0
1111
github.com/hashicorp/go-cty v1.4.1
1212
github.com/hashicorp/go-multierror v1.1.1
@@ -76,14 +76,14 @@ require (
7676
github.com/yuin/goldmark-meta v1.1.0 // indirect
7777
github.com/zclconf/go-cty v1.16.2 // indirect
7878
go.abhg.dev/goldmark/frontmatter v0.2.0 // indirect
79-
golang.org/x/crypto v0.33.0 // indirect
79+
golang.org/x/crypto v0.36.0 // indirect
8080
golang.org/x/exp v0.0.0-20240525044651-4c93da0ed11d // indirect
8181
golang.org/x/mod v0.22.0 // indirect
82-
golang.org/x/net v0.34.0 // indirect
83-
golang.org/x/oauth2 v0.26.0 // indirect
84-
golang.org/x/sync v0.11.0 // indirect
85-
golang.org/x/sys v0.30.0 // indirect
86-
golang.org/x/text v0.22.0 // indirect
82+
golang.org/x/net v0.37.0 // indirect
83+
golang.org/x/oauth2 v0.28.0 // indirect
84+
golang.org/x/sync v0.12.0 // indirect
85+
golang.org/x/sys v0.31.0 // indirect
86+
golang.org/x/text v0.23.0 // indirect
8787
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
8888
google.golang.org/appengine v1.6.8 // indirect
8989
google.golang.org/genproto/googleapis/rpc v0.0.0-20241015192408-796eee8c2d53 // indirect

‎go.sum

+14-14
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew
2424
github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
2525
github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
2626
github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
27-
github.com/auth0/go-auth0 v1.17.0 h1:KPAGX4gpmJAMGL/1Z1iTtxMdxOO5lbpLQyie9u06zY4=
28-
github.com/auth0/go-auth0 v1.17.0/go.mod h1:f6wP4Hov4Be5AKK55tVhAHlKNltqXQIIc3QGfBbnvdU=
27+
github.com/auth0/go-auth0 v1.18.0 h1:GOuqS8N8oN3QElljGQv+r1AN0EFPQbnyCSsfGsPreLM=
28+
github.com/auth0/go-auth0 v1.18.0/go.mod h1:6g0NRYWA+rzTLG5AohwCJ0YCEqbzphKcdjt+PWrgcPk=
2929
github.com/aybabtme/iocontrol v0.0.0-20150809002002-ad15bcfc95a0 h1:0NmehRCgyk5rljDQLKUO+cRJCnduDyn11+zGZIc9Z48=
3030
github.com/aybabtme/iocontrol v0.0.0-20150809002002-ad15bcfc95a0/go.mod h1:6L7zgvqo0idzI7IO8de6ZC051AfXb5ipkIJ7bIA2tGA=
3131
github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
@@ -237,8 +237,8 @@ go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06F
237237
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
238238
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
239239
golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
240-
golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus=
241-
golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
240+
golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
241+
golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
242242
golang.org/x/exp v0.0.0-20240525044651-4c93da0ed11d h1:N0hmiNbwsSNwHBAvR3QB5w25pUwH4tK0Y/RltD1j1h4=
243243
golang.org/x/exp v0.0.0-20240525044651-4c93da0ed11d/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
244244
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -250,15 +250,15 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
250250
golang.org/x/net v0.0.0-20210510120150-4163338589ed/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
251251
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
252252
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
253-
golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
254-
golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
255-
golang.org/x/oauth2 v0.26.0 h1:afQXWNNaeC4nvZ0Ed9XvCCzXM6UHJG7iCg0W4fPqSBE=
256-
golang.org/x/oauth2 v0.26.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
253+
golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
254+
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
255+
golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
256+
golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
257257
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
258258
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
259259
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
260-
golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
261-
golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
260+
golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
261+
golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
262262
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
263263
golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
264264
golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -273,8 +273,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
273273
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
274274
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
275275
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
276-
golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
277-
golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
276+
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
277+
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
278278
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
279279
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
280280
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
@@ -285,8 +285,8 @@ golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
285285
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
286286
golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
287287
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
288-
golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
289-
golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
288+
golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
289+
golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
290290
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
291291
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
292292
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=

‎internal/auth0/tenant/expand.go

+16
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ func expandTenant(data *schema.ResourceData) *management.Tenant {
2929
Flags: expandTenantFlags(config.GetAttr("flags")),
3030
SessionCookie: expandTenantSessionCookie(config.GetAttr("session_cookie")),
3131
Sessions: expandTenantSessions(config.GetAttr("sessions")),
32+
OIDCLogout: expandTenantOIDCLogout(config.GetAttr("oidc_logout")),
3233
AllowOrgNameInAuthAPI: value.Bool(config.GetAttr("allow_organization_name_in_authentication_api")),
3334
CustomizeMFAInPostLoginAction: value.Bool(config.GetAttr("customize_mfa_in_postlogin_action")),
3435
PushedAuthorizationRequestsSupported: value.Bool(config.GetAttr("pushed_authorization_requests_supported")),
@@ -111,6 +112,21 @@ func expandTenantSessions(config cty.Value) *management.TenantSessions {
111112
return &sessions
112113
}
113114

115+
func expandTenantOIDCLogout(config cty.Value) *management.TenantOIDCLogout {
116+
var oidcLogout management.TenantOIDCLogout
117+
118+
config.ForEachElement(func(_ cty.Value, cfg cty.Value) (stop bool) {
119+
oidcLogout.OIDCResourceProviderLogoutEndSessionEndpointDiscovery = value.Bool(cfg.GetAttr("rp_logout_end_session_endpoint_discovery"))
120+
return stop
121+
})
122+
123+
if oidcLogout == (management.TenantOIDCLogout{}) {
124+
return nil
125+
}
126+
127+
return &oidcLogout
128+
}
129+
114130
func isACRValuesSupportedNull(data *schema.ResourceData) bool {
115131
if !data.IsNewResource() && !data.HasChange("disable_acr_values_supported") && !data.HasChange("acr_values_supported") {
116132
return false

‎internal/auth0/tenant/flatten.go

+8
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ func flattenTenant(data *schema.ResourceData, tenant *management.Tenant) error {
2323
data.Set("flags", flattenTenantFlags(tenant.GetFlags())),
2424
data.Set("session_cookie", flattenTenantSessionCookie(tenant.GetSessionCookie())),
2525
data.Set("sessions", flattenTenantSessions(tenant.GetSessions())),
26+
data.Set("oidc_logout", flattenTenantOidcLogout(tenant.GetOIDCLogout())),
2627
data.Set("allow_organization_name_in_authentication_api", tenant.GetAllowOrgNameInAuthAPI()),
2728
data.Set("customize_mfa_in_postlogin_action", tenant.GetCustomizeMFAInPostLoginAction()),
2829
data.Set("pushed_authorization_requests_supported", tenant.GetPushedAuthorizationRequestsSupported()),
@@ -101,6 +102,13 @@ func flattenTenantSessions(sessions *management.TenantSessions) []interface{} {
101102
return []interface{}{m}
102103
}
103104

105+
func flattenTenantOidcLogout(oidcLogout *management.TenantOIDCLogout) []interface{} {
106+
m := make(map[string]interface{})
107+
m["rp_logout_end_session_endpoint_discovery"] = oidcLogout.GetOIDCResourceProviderLogoutEndSessionEndpointDiscovery()
108+
109+
return []interface{}{m}
110+
}
111+
104112
func flattenMTLSConfiguration(mtls *management.TenantMTLSConfiguration) []interface{} {
105113
m := make(map[string]interface{})
106114
if mtls == nil {

‎internal/auth0/tenant/resource.go

+16
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,22 @@ func NewResource() *schema.Resource {
322322
},
323323
},
324324
},
325+
"oidc_logout": {
326+
Type: schema.TypeList,
327+
Optional: true,
328+
Computed: true,
329+
MaxItems: 1,
330+
Description: "Settings related to OIDC RP-initiated Logout.",
331+
Elem: &schema.Resource{
332+
Schema: map[string]*schema.Schema{
333+
"rp_logout_end_session_endpoint_discovery": {
334+
Type: schema.TypeBool,
335+
Required: true,
336+
Description: "Enable the end_session_endpoint URL in the .well-known discovery configuration.",
337+
},
338+
},
339+
},
340+
},
325341
"allow_organization_name_in_authentication_api": {
326342
Type: schema.TypeBool,
327343
Optional: true,

‎internal/auth0/tenant/resource_test.go

+10-1
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,10 @@ resource "auth0_tenant" "my_tenant" {
7070
mtls {
7171
enable_endpoint_aliases = true
7272
}
73+
74+
oidc_logout {
75+
rp_logout_end_session_endpoint_discovery = true
76+
}
7377
}
7478
`
7579

@@ -208,6 +212,10 @@ resource "auth0_tenant" "my_tenant" {
208212
show_log_link = false
209213
url = "https://mycompany.org/error"
210214
}
215+
216+
oidc_logout {
217+
rp_logout_end_session_endpoint_discovery = false
218+
}
211219
}
212220
`
213221

@@ -252,7 +260,6 @@ resource "auth0_tenant" "my_tenant" {
252260
mtls {
253261
enable_endpoint_aliases = true
254262
}
255-
256263
}
257264
`
258265

@@ -300,6 +307,7 @@ func TestAccTenant_Main(t *testing.T) {
300307
resource.TestCheckResourceAttr("auth0_tenant.my_tenant", "mtls.#", "1"),
301308
resource.TestCheckResourceAttr("auth0_tenant.my_tenant", "mtls.0.enable_endpoint_aliases", "true"),
302309
resource.TestCheckResourceAttr("auth0_tenant.my_tenant", "mtls.0.disable", "false"),
310+
resource.TestCheckResourceAttr("auth0_tenant.my_tenant", "oidc_logout.0.rp_logout_end_session_endpoint_discovery", "true"),
303311
),
304312
},
305313
{
@@ -338,6 +346,7 @@ func TestAccTenant_Main(t *testing.T) {
338346
resource.TestCheckResourceAttr("auth0_tenant.my_tenant", "error_page.0.html", "<html></html>"),
339347
resource.TestCheckResourceAttr("auth0_tenant.my_tenant", "error_page.0.show_log_link", "false"),
340348
resource.TestCheckResourceAttr("auth0_tenant.my_tenant", "error_page.0.url", "https://mycompany.org/error"),
349+
resource.TestCheckResourceAttr("auth0_tenant.my_tenant", "oidc_logout.0.rp_logout_end_session_endpoint_discovery", "false"),
341350
),
342351
},
343352
{

0 commit comments

Comments
 (0)