Terraform Provider OIDC Claim Support

TiHoll · May 21, 2021, 9:52am

Hey Guys,

are there any plans to upgrade the terraform/boundary provider to support the new claim-maps and claim-scopes settings for oidc?

github.com/hashicorp/boundary

OIDC: add support for account claim maps

hashicorp:main ← hashicorp:jimlambrt-oidc-acct-claim-map

opened 01:49PM - 01 May 21 UTC

jimlambrt

+1456 -200

Account claim maps are optional claim maps from custom claims to the standard cl…aims of sub, name and email. These maps are represented as key=value where the key equals the from_claim and the value equals the to_claim. For example "oid=sub". We've added this new feature to support Providers like Azure, which have non-deterministic/discoverable subjects claims. Azure for instance, provides no method to determine a user's subject within a relying party unless you have the user's id_token. This makes it impossible to pre-provision Azure OIDC accounts within Boundary unless you support mapping some other discoverable claim to the account's subject. Here is where account claim maps come to play. One important note: Boundary admins are free create new OIDC auth methods with an account claim map for the to_claim of `sub`. But once an auth-method has been created, Boundary will restrict any updates that would change the account claim maps for the to_claim of `sub`. If you need to change which inbound claims are mapped to the `sub` claim, you'll need to recreate the auth-method with the mapping required for the claim `sub`. The other maps to `name` and `email` are unrestricted and can be updated anytime.

would be awesome

Thanks

malnick · May 21, 2021, 2:14pm

Thanks for submitting this. We are working on this and will have an update for it soon.

malnick · May 21, 2021, 2:57pm

Update for the claim maps: Add account claim maps to OIDC auth method by malnick · Pull Request #111 · hashicorp/terraform-provider-boundary · GitHub

Update for claims scopes: Add claim scopes attribute by malnick · Pull Request #112 · hashicorp/terraform-provider-boundary · GitHub

Both should be merged by EOD today, thanks for raising this!

TiHoll · June 23, 2021, 7:36am

Hi Malnick,

thanks for updating the claims feature. Are there plan to update the official Registry Boundary Provider?

Would be easier than cloning and building from source.

Thanks
Tim

louisruch · June 23, 2021, 6:08pm

Hi @TiHoll,

Louis from the Boundary team here. Sorry about dropping the ball and not releasing a interim TF provider with these changes! We have a release schedule for next week that will include these changes.