Feature/ldap kerberos configuration

docs/resources/keycloak_ldap_user_federation.md

@@ -35,6 +35,12 @@ resource "keycloak_ldap_user_federation" "ldap_user_federation" {
 
 	connection_timeout      = "5s"
 	read_timeout            = "10s"
+
+    kerberos {
+        kerberos_realm = "FOO.LOCAL"
+        server_principal = "HTTP/host.foo.com@FOO.LOCAL"
+        keytab = "/etc/host.keytab"
+    }
 }
 ```
 
@@ -74,6 +80,11 @@ The following arguments are supported:
 - `full_sync_period` - (Optional) How frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync.
 - `changed_sync_period` - (Optional) How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync.
 - `cache_policy` - (Optional) Can be one of `DEFAULT`, `EVICT_DAILY`, `EVICT_WEEKLY`, `MAX_LIFESPAN`, or `NO_CACHE`. Defaults to `DEFAULT`.
+- `kerberos` - (Optional) A block containing the kerberos settings.
+  - `kerberos_realm` - (Required) The name of the kerberos realm, e.g. FOO.LOCAL.
+  - `server_principal` - (Required) The kerberos server principal, e.g. 'HTTP/host.foo.com@FOO.LOCAL'.
+  - `key_tab` - (Required) Path to the kerberos keytab file on the server with credentials of the service principal.
+  - `use_kerberos_for_password_authentication` - (Optional) Use kerberos login module instead of ldap service api. Defaults to `false`.
 
 ### Import
 

example/main.tf

@@ -242,6 +242,13 @@ resource "keycloak_ldap_user_federation" "openldap" {
   connection_timeout = "5s"
   read_timeout       = "10s"
 
+  kerberos {
+    server_principal = "HTTP/keycloak.local@FOO.LOCAL"
+    use_kerberos_for_password_authentication = false
+    key_tab = "/etc/keycloak.keytab"
+    kerberos_realm = "FOO.LOCAL"
+  }
+
   cache_policy = "NO_CACHE"
 }
 

keycloak/ldap_user_federation.go

@@ -36,6 +36,12 @@ type LdapUserFederation struct {
 	ReadTimeout            string // duration string (ex: 1h30m)
 	Pagination             bool
 
+	ServerPrincipal                      string
+	UseKerberosForPasswordAuthentication bool
+	AllowKerberosAuthentication          bool
+	KeyTab                               string
+	KerberosRealm                        string
+
 	BatchSizeForSync  int
 	FullSyncPeriod    int // either a number, in milliseconds, or -1 if full sync is disabled
 	ChangedSyncPeriod int // either a number, in milliseconds, or -1 if changed sync is disabled
@@ -102,6 +108,22 @@ func convertFromLdapUserFederationToComponent(ldap *LdapUserFederation) (*compon
 		"changedSyncPeriod": {
 			strconv.Itoa(ldap.ChangedSyncPeriod),
 		},
+
+		"serverPrincipal": {
+			ldap.ServerPrincipal,
+		},
+		"useKerberosForPasswordAuthentication": {
+			strconv.FormatBool(ldap.UseKerberosForPasswordAuthentication),
+		},
+		"allowKerberosAuthentication": {
+			strconv.FormatBool(ldap.AllowKerberosAuthentication),
+		},
+		"keyTab": {
+			ldap.KeyTab,
+		},
+		"kerberosRealm": {
+			ldap.KerberosRealm,
+		},
 	}
 
 	if ldap.BindDn != "" && ldap.BindCredential != "" {
@@ -209,6 +231,16 @@ func convertFromComponentToLdapUserFederation(component *component) (*LdapUserFe
 		return nil, err
 	}
 
+	useKerberosForPasswordAuthentication, err := parseBoolAndTreatEmptyStringAsFalse(component.getConfig("useKerberosForPasswordAuthentication"))
+	if err != nil {
+		return nil, err
+	}
+
+	allowKerberosAuthentication, err := parseBoolAndTreatEmptyStringAsFalse(component.getConfig("allowKerberosAuthentication"))
+	if err != nil {
+		return nil, err
+	}
+
 	ldap := &LdapUserFederation{
 		Id:      component.Id,
 		Name:    component.Name,
@@ -237,6 +269,12 @@ func convertFromComponentToLdapUserFederation(component *component) (*LdapUserFe
 		UseTruststoreSpi:       component.getConfig("useTruststoreSpi"),
 		Pagination:             pagination,
 
+		ServerPrincipal:                      component.getConfig("serverPrincipal"),
+		UseKerberosForPasswordAuthentication: useKerberosForPasswordAuthentication,
+		AllowKerberosAuthentication:          allowKerberosAuthentication,
+		KeyTab:                               component.getConfig("keyTab"),
+		KerberosRealm:                        component.getConfig("kerberosRealm"),
+
 		BatchSizeForSync:  batchSizeForSync,
 		FullSyncPeriod:    fullSyncPeriod,
 		ChangedSyncPeriod: changedSyncPeriod,

provider/resource_keycloak_ldap_user_federation.go

@@ -2,10 +2,11 @@ package provider
 
 import (
 	"fmt"
+	"strings"
+
 	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/helper/validation"
 	"github.com/mrparkers/terraform-provider-keycloak/keycloak"
-	"strings"
 )
 
 var (
@@ -189,6 +190,38 @@ func resourceKeycloakLdapUserFederation() *schema.Resource {
 				Description:  "How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync.",
 			},
 
+			"kerberos": {
+				Type:        schema.TypeSet,
+				Optional:    true,
+				MaxItems:    1,
+				Description: "Settings regarding kerberos authentication for this realm.",
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"kerberos_realm": {
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: "The name of the kerberos realm, e.g. FOO.LOCAL",
+						},
+						"server_principal": {
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: "The kerberos server principal, e.g. 'HTTP/host.foo.com@FOO.LOCAL'.",
+						},
+						"key_tab": {
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: "Path to the kerberos keytab file on the server with credentials of the service principal.",
+						},
+						"use_kerberos_for_password_authentication": {
+							Type:        schema.TypeBool,
+							Optional:    true,
+							Default:     false,
+							Description: "Use kerberos login module instead of ldap service api. Defaults to `false`.",
+						},
+					},
+				},
+			},
+
 			"cache_policy": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -219,7 +252,7 @@ func getLdapUserFederationFromData(data *schema.ResourceData) *keycloak.LdapUser
 		userObjectClasses = append(userObjectClasses, userObjectClass.(string))
 	}
 
-	return &keycloak.LdapUserFederation{
+	ldapUserFederation := &keycloak.LdapUserFederation{
 		Id:      data.Id(),
 		Name:    data.Get("name").(string),
 		RealmId: data.Get("realm_id").(string),
@@ -255,6 +288,21 @@ func getLdapUserFederationFromData(data *schema.ResourceData) *keycloak.LdapUser
 
 		CachePolicy: data.Get("cache_policy").(string),
 	}
+
+	if kerberos, ok := data.GetOk("kerberos"); ok {
+		ldapUserFederation.AllowKerberosAuthentication = true
+		kerberosSettingsData := kerberos.(*schema.Set).List()[0]
+		kerberosSettings := kerberosSettingsData.(map[string]interface{})
+
+		ldapUserFederation.KerberosRealm = kerberosSettings["kerberos_realm"].(string)
+		ldapUserFederation.ServerPrincipal = kerberosSettings["server_principal"].(string)
+		ldapUserFederation.UseKerberosForPasswordAuthentication = kerberosSettings["use_kerberos_for_password_authentication"].(bool)
+		ldapUserFederation.KeyTab = kerberosSettings["key_tab"].(string)
+	} else {
+		ldapUserFederation.AllowKerberosAuthentication = false
+	}
+
+	return ldapUserFederation
 }
 
 func setLdapUserFederationData(data *schema.ResourceData, ldap *keycloak.LdapUserFederation) {
@@ -288,6 +336,20 @@ func setLdapUserFederationData(data *schema.ResourceData, ldap *keycloak.LdapUse
 	data.Set("read_timeout", ldap.ReadTimeout)
 	data.Set("pagination", ldap.Pagination)
 
+	if ldap.AllowKerberosAuthentication {
+		kerberosSettingsData := make([]interface{}, 1)
+		kerberosSettings := make(map[string]interface{})
+		kerberosSettingsData[0] = kerberosSettings
+
+		kerberosSettings["server_principal"] = ldap.ServerPrincipal
+		kerberosSettings["use_kerberos_for_password_authentication"] = ldap.UseKerberosForPasswordAuthentication
+		kerberosSettings["allow_kerberos_authentication"] = ldap.AllowKerberosAuthentication
+		kerberosSettings["key_tab"] = ldap.KeyTab
+		kerberosSettings["kerberos_realm"] = ldap.KerberosRealm
+
+		data.Set("kerberos", kerberosSettingsData)
+	}
+
 	data.Set("batch_size_for_sync", ldap.BatchSizeForSync)
 	data.Set("full_sync_period", ldap.FullSyncPeriod)
 	data.Set("changed_sync_period", ldap.ChangedSyncPeriod)