New Resources: `azuread_application_registration`, `azuread_application_from_template` and others #1214

manicminer · 2023-10-17T04:16:19Z

Rationale and Practitioner Benefits

We're adding these resources to complement the existing azuread_application resource. Whilst the existing monolithic resource is useful for declaring and managing the whole application manifest at once, these new resources offer a more composable approach and only manage a small set of properties each. They are intended for use both in simpler configurations, and in more advanced configs, the latter of which which might include:

where application properties need to self-reference values from the application that are only known after creation (e.g. the client ID)
where you need to create 2 or more applications that reference each other in certain property values, thereby creating a circular graph dependency
instantiating gallery applications from template, where properties are applied to the new application but the azuread_application resource removes them or otherwise updates them
where new applications are assigned an initial owner by the API but the azuread_application resource isn't able to detect this correctly, perhaps due to lack of API permissions
where you might want to retain any other default property value inherited by a new application but cannot or do not wish to add these to your Terraform configuration
where the linked service principal requires certain property values to be set before you can set a related property value on the application object
where you want to manage individual aspect of an application across more than one Terraform module, for example assigning owners or API permissions

Internal work

This includes some refactoring to accommodate these new resources and also to aid in moving over to new structured resource IDs

Updating github.com/manicminer/hamilton
Updating github.com/hashicorp/go-azure-sdk
Updating golangci-lint
Deprecating and removing the utils package which contained legacy helper funcs
Structured ID and state migration for application resource
Compatibility fixes for existing azuread_application_* resources as stopgap until v3.0
Fixing up some validation functions

More ID parser upgrades and state migrations to follow in separate PRs.

TODO

Upstream PR for Hamilton changes
Documentation

Changelog

FEATURES:

New Resource: azuread_application_api_access
New Resource: azuread_application_app_role
New Resource: azuread_application_fallback_public_client
New Resource: azuread_application_from_template
New Resource: azuread_application_identifier_uri
New Resource: azuread_application_known_clients
New Resource: azuread_application_owner
New Resource: azuread_application_permission_scope
New Resource: azuread_application_redirect_uris
New Resource: azuread_application_registration

ENHANCEMENTS:

data.azuread_application - export the client_id attribute, deprecate the application_id attribute
data.azuread_service_principal - support for the client_id property, deprecate the application_id property
data.azuread_service_principals - support for the client_ids property, deprecate the application_ids property
data.azuread_service_principals - export the client_id attribute in the service_principals block, deprecate the application_id attribute
azuread_application - export the client_id attribute, deprecate the application_id attribute
azuread_application_federated_identity_credential - support for the application_id property, deprecate the application_object_id property
azuread_application_certificate - support for the application_id property, deprecate the application_object_id property
azuread_application_password - support for the application_id property, deprecate the application_object_id property
azuread_application_pre_authorized - support for the application_id property, deprecate the application_object_id property
azuread_service_principal - support for the client_id property, deprecate the application_id property

Issues

Closes: #428
Closes: #501
Closes: #703
Closes: #773
Closes: #778
Closes: #797
Closes: #800
Closes: #834
Closes: #836
Closes: #852
Closes: #919
Closes: #924
Closes: #950
Closes: #1001
Closes: #1002
Closes: #1093

…url`

…rincipal`, `data.azure_ad_service_principals`

…/go-azure-sdk

manicminer · 2023-10-19T20:47:07Z

Test results

katbyte

Aside from some minor comments LGTM 🌵

katbyte · 2023-10-20T01:04:49Z

docs/data-sources/application.md

@@ -43,7 +44,8 @@ The following attributes are exported:
 * `api` - An `api` block as documented below.
 * `app_role_ids` - A mapping of app role values to app role IDs, intended to be useful when referencing app roles in other resources in your configuration.
 * `app_roles` - A collection of `app_role` blocks as documented below. For more information see [official documentation on Application Roles](https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/app-roles).
-* `application_id` - The Application ID (also called Client ID).
+* `application_id` - (Deprecated) The Client ID for the application.


should we just remove this like we do in rm as its deprecated? / should be deprecated in favour of X

katbyte · 2023-10-20T01:05:18Z

docs/data-sources/service_principal.md

 * `alternative_names` - A list of alternative names, used to retrieve service principals by subscription, identify resource group and full resource ids for managed identities.
-* `application_id` - The application ID (client ID) of the application associated with this service principal.
+* `application_id` - (Deprecated) The client ID of the application associated with this service principal.


katbyte · 2023-10-20T01:05:26Z

docs/data-sources/service_principal.md

 * `app_role_assignment_required` - Whether this service principal requires an app role assignment to a user or group before Azure AD will issue a user or access token to the application.
 * `app_role_ids` - A mapping of app role values to app role IDs, as published by the associated application, intended to be useful when referencing app roles in other resources in your configuration.
 * `app_roles` - A list of app roles published by the associated application, as documented below. For more information [official documentation](https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/app-roles).
 * `application_tenant_id` - The tenant ID where the associated application is registered.
+* `client_id` - (Deprecated) The client ID of the application associated with this service principal.


katbyte · 2023-10-20T01:05:37Z

docs/data-sources/service_principals.md

 * `app_role_assignment_required` - Whether this service principal requires an app role assignment to a user or group before Azure AD will issue a user or access token to the application.
-* `application_id` - The application ID (client ID) of the application associated with this service principal.
+* `application_id` - (Deprecated) The client ID of the application associated with this service principal.


katbyte · 2023-10-20T01:06:06Z

docs/resources/application.md

@@ -324,7 +331,8 @@ The following arguments are supported:
 In addition to all arguments above, the following attributes are exported:

 * `app_role_ids` - A mapping of app role values to app role IDs, intended to be useful when referencing app roles in other resources in your configuration.
-* `application_id` - The Application ID (also called Client ID).
+* `application_id` - (Deprecated) The Client ID for the application.


katbyte · 2023-10-20T01:10:56Z

docs/resources/service_principal.md

+* `application_id` - (Optional, Deprecated) The client ID of the application for which to create a service principal.
+* `client_id` - (Optional) The client ID of the application for which to create a service principal.


and here etc,

i'd lean towards removal, but at least should indicate client id is replacement

<Actions> <action id="c2aadc6326b4b0bc58df11ee286b0f67ccdb5888bd77f391e6473570113337ec"> <h3>Bump Terraform `azuread` provider version</h3> <details id="1d9343c012f5434ac9fe8a98135bae3667b399259be16d9b14302ea3bd424a24"> <summary>Update Terraform lock file</summary> <p>"hashicorp/azuread" updated from "2.43.0" to "2.44.0" in file ".terraform.lock.hcl"</p> <details> <summary>2.44.0</summary> <pre>Changelog retrieved from:
	https://github.com/hashicorp/terraform-provider-azuread/releases/tag/v2.44.0
* Developer Note: the Typed Resource SDK, as also used in the AzureRM provider, is now the preferred way of introducing new resources ([#1188](https://github.com/hashicorp/terraform-provider-azuread/issues/1188))

FEATURES:

* **New Resource:** `azuread_application_api_access` ([#1214](hashicorp/terraform-provider-azuread#1214 **New Resource:** `azuread_application_app_role` ([#1214](hashicorp/terraform-provider-azuread#1214 **New Resource:** `azuread_application_fallback_public_client` ([#1214](hashicorp/terraform-provider-azuread#1214 **New Resource:** `azuread_application_from_template` ([#1214](hashicorp/terraform-provider-azuread#1214 **New Resource:** `azuread_application_identifier_uri` ([#1214](hashicorp/terraform-provider-azuread#1214 **New Resource:** `azuread_application_known_clients` ([#1214](hashicorp/terraform-provider-azuread#1214 **New Resource:** `azuread_application_owner` ([#1214](hashicorp/terraform-provider-azuread#1214 **New Resource:** `azuread_application_permission_scope ([#1214](https://github.com/hashicorp/terraform-provider-azuread/issues/1214))`
* **New Resource:** `azuread_application_redirect_uris` ([#1214](hashicorp/terraform-provider-azuread#1214 **New Resource:** `azuread_application_registration` ([#1214](hashicorp/terraform-provider-azuread#1214 **New Resource:** `azuread_authentication_strength_policy` ([#1171](https://github.com/hashicorp/terraform-provider-azuread/issues/1171))

ENHANCEMENTS:

* `data.azuread_application` - export the `client_id` attribute, deprecate the `application_id` attribute ([#1214](hashicorp/terraform-provider-azuread#1214 `data.azuread_service_principal` - support for the `client_id` property, deprecate the `application_id` property ([#1214](hashicorp/terraform-provider-azuread#1214 `data.azuread_service_principals` - support for the `client_ids` property, deprecate the `application_ids` property ([#1214](hashicorp/terraform-provider-azuread#1214 `data.azuread_service_principals` - export the `client_id` attribute in the `service_principals` block, deprecate the `application_id` attribute ([#1214](hashicorp/terraform-provider-azuread#1214 `azuread_application` - export the `client_id` attribute, deprecate the `application_id` attribute ([#1214](hashicorp/terraform-provider-azuread#1214 `azuread_application_federated_identity_credential` - support for the `application_id` property, deprecate the `application_object_id` property ([#1214](hashicorp/terraform-provider-azuread#1214 `azuread_application_certificate` - support for the `application_id` property, deprecate the `application_object_id` property ([#1214](hashicorp/terraform-provider-azuread#1214 `azuread_application_password` - support for the `application_id` property, deprecate the `application_object_id` property ([#1214](hashicorp/terraform-provider-azuread#1214 `azuread_application_pre_authorized` - support for the `application_id` property, deprecate the `application_object_id` property ([#1214](hashicorp/terraform-provider-azuread#1214 `azuread_service_principal` - support for the `client_id` property, deprecate the `application_id` property ([#1214](hashicorp/terraform-provider-azuread#1214 `azuread_conditional_access_policy` - support for the `authentication_strength_policy_id` property in the `grant_controls` block [GH_1171]

BUG FIXES:

* `azuread_group_member` - resolve a bug when refreshing state if the group is missing ([#1198](https://github.com/hashicorp/terraform-provider-azuread/issues/1198))


</pre> </details> <details> <summary>2.44.1</summary> <pre>Changelog retrieved from:
	https://github.com/hashicorp/terraform-provider-azuread/releases/tag/v2.44.1
BUG FIXES:

* `azuread_application_certificate` - work around an unexpected diff with the `application_object_id` property ([#1221](hashicorp/terraform-provider-azuread#1221 `azuread_application_federated_identity_credential` - work around an unexpected diff with the `application_object_id` property ([#1221](hashicorp/terraform-provider-azuread#1221 `azuread_application_password` - work around an unexpected diff with the `application_object_id` property ([#1221](hashicorp/terraform-provider-azuread#1221 `azuread_application_pre_authorized` - work around an unexpected diff with the `application_object_id` property ([#1221](https://github.com/hashicorp/terraform-provider-azuread/issues/1221))


</pre> </details> </details> </action> </Actions> --- <table> <tr> <td width="77"> <img src="https://www.updatecli.io/images/updatecli.png" alt="Updatecli logo" width="50" height="50"> </td> <td> <p> Created automatically by <a href="https://www.updatecli.io/">Updatecli</a> </p> <details><summary>Options:</summary> <br /> <p>Most of Updatecli configuration is done via <a href="https://www.updatecli.io/docs/prologue/quick-start/">its manifest(s)</a>.</p> <ul> <li>If you close this pull request, Updatecli will automatically reopen it, the next time it runs.</li> <li>If you close this pull request and delete the base branch, Updatecli will automatically recreate it, erasing all previous commits made.</li> </ul> <p> Feel free to report any issues at <a href="https://github.com/updatecli/updatecli/issues">github.com/updatecli/updatecli</a>.<br /> If you find this tool useful, do not hesitate to star <a href="https://github.com/updatecli/updatecli/stargazers">our GitHub repository</a> as a sign of appreciation, and/or to tell us directly on our <a href="https://matrix.to/#/#Updatecli_community:gitter.im">chat</a>! </p> </details> </td> </tr> </table> --------- Co-authored-by: Jenkins Infra Bot (updatecli) <60776566+jenkins-infra-bot@users.noreply.github.com>

Israphel · 2023-10-25T16:28:47Z

Why the example still uses application_id? https://registry.terraform.io/providers/hashicorp/azuread/2.44.1/docs/resources/application
https://registry.terraform.io/providers/hashicorp/azuread/2.44.1/docs/resources/service_principal

manicminer · 2023-10-25T21:08:08Z

Hi @Israphel, unfortunately I missed these but @PseudoCoding caught them and fixed in #1220. The docs will be updated this week when the release goes out.

See - hashicorp/terraform-provider-azuread#1214 - https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application

manicminer added new-resource feature/applications labels Oct 17, 2023

github-actions bot added dependencies size/XL labels Oct 17, 2023

manicminer added this to the v2.44.0 milestone Oct 17, 2023

manicminer force-pushed the r/applications-gen3 branch from 009b180 to 9b0213c Compare October 17, 2023 14:02

manicminer changed the title ~~New Resources: azuread_application_registration, azuread_application_app_role, azuread_application_permission_scope~~ New Resources: azuread_application_registration, azuread_application_from_template and others Oct 18, 2023

manicminer added the upstream-hamilton label Oct 18, 2023

manicminer force-pushed the r/applications-gen3 branch from a6fa83e to c908ede Compare October 18, 2023 20:28

manicminer mentioned this pull request Oct 18, 2023

Bump golang.org/x/net from 0.13.0 to 0.17.0 #1213

Closed

manicminer added 12 commits October 18, 2023 22:27

dependencies: updating to v0.64.0 of github.com/manicminer/hamilton

28dbbde

Deprecate some utils functions

d2a1916

New Resource: azuread_application_registration

5d14083

New Resource: azuread_application_permission_scope

df0fe72

New Resource: azuread_application_app_role

58eae61

azuread_application_registration: support homepage_url and `logout_…

00d782a

…url`

fix up URL/URI validation

e5ceab8

New Resource: azuread_application_fallback_public_client

1eaef8b

New Resource: azuread_application_owner

7e3d001

New Resource: azuread_application_identifier_uri

7092d33

Fix bug in new ID validators

a1ae108

Fix up comments

d232e07

manicminer added 2 commits October 19, 2023 02:23

updated docs for azuread_service_principal, `data.azuread_service_p…

20a10e4

…rincipal`, `data.azure_ad_service_principals`

linting!

2c0407d

manicminer force-pushed the r/applications-gen3 branch from 2b6545a to 2c0407d Compare October 19, 2023 01:23

manicminer marked this pull request as ready for review October 19, 2023 01:24

manicminer requested a review from a team October 19, 2023 01:24

manicminer added 5 commits October 19, 2023 02:35

dependencies: updating to v0.20231018.1171511 of github.com/hashicorp…

8737b78

…/go-azure-sdk

remove final usages and delete the utils package

24e1971

docs: update permissions for service principal resources

f487c57

azuread_application test fixes

132386c

goimports

8d1a89b

katbyte approved these changes Oct 20, 2023

View reviewed changes

address review, undocument deprecated properties

bf00f05

manicminer merged commit d750b6d into main Oct 20, 2023
17 checks passed

manicminer deleted the r/applications-gen3 branch October 20, 2023 01:44

manicminer added a commit that referenced this pull request Oct 20, 2023

Changelog for #1214

19895e8

manicminer added a commit that referenced this pull request Oct 20, 2023

Changelog links for #1214

f999c1e

manicminer added the feature/service-principals label Oct 22, 2023

manicminer mentioned this pull request Oct 24, 2023

identifierUris and resourceAppId in requiredResourceAccess iuuse with creating along with application #905

Closed

manicminer mentioned this pull request Oct 25, 2023

AzureAD creating an ID with applications/GUID instead just GUID with latest version v2.44.1 #1227

Open

mloskot mentioned this pull request Nov 15, 2023

azuread_application attribute application_id has been deprecated claranet/terraform-azurerm-service-principal#1

Merged

4 tasks

JohannesRudolph mentioned this pull request Nov 22, 2023

Azure Bootstrap module uses deprecated azuread_service_principal attributes meshcloud/collie-hub#95

Closed

penenkel mentioned this pull request Apr 2, 2024

Reintroduce azuread_application_app_role #698

Open

github-actions bot locked as resolved and limited conversation to collaborators Oct 25, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New Resources: `azuread_application_registration`, `azuread_application_from_template` and others #1214

New Resources: `azuread_application_registration`, `azuread_application_from_template` and others #1214

manicminer commented Oct 17, 2023 •

edited

Loading

manicminer commented Oct 19, 2023

katbyte left a comment

katbyte Oct 20, 2023

katbyte Oct 20, 2023

katbyte Oct 20, 2023

katbyte Oct 20, 2023

katbyte Oct 20, 2023

katbyte Oct 20, 2023

Israphel commented Oct 25, 2023 •

edited

Loading

manicminer commented Oct 25, 2023

		* `application_id` - (Optional, Deprecated) The client ID of the application for which to create a service principal.
		* `client_id` - (Optional) The client ID of the application for which to create a service principal.

New Resources: azuread_application_registration, azuread_application_from_template and others #1214

New Resources: azuread_application_registration, azuread_application_from_template and others #1214

Conversation

manicminer commented Oct 17, 2023 • edited Loading

Rationale and Practitioner Benefits

Internal work

TODO

Changelog

Issues

manicminer commented Oct 19, 2023

katbyte left a comment

Choose a reason for hiding this comment

katbyte Oct 20, 2023

Choose a reason for hiding this comment

katbyte Oct 20, 2023

Choose a reason for hiding this comment

katbyte Oct 20, 2023

Choose a reason for hiding this comment

katbyte Oct 20, 2023

Choose a reason for hiding this comment

katbyte Oct 20, 2023

Choose a reason for hiding this comment

katbyte Oct 20, 2023

Choose a reason for hiding this comment

Israphel commented Oct 25, 2023 • edited Loading

manicminer commented Oct 25, 2023

New Resources: `azuread_application_registration`, `azuread_application_from_template` and others #1214

New Resources: `azuread_application_registration`, `azuread_application_from_template` and others #1214

manicminer commented Oct 17, 2023 •

edited

Loading

Israphel commented Oct 25, 2023 •

edited

Loading