# keenauth_directory_role_mapping

The `keenauth_directory_role_mapping` resource maps a group of a SCIM directory to a role. The members of the group get the role in the directory's organization.

```terraform
resource "keenauth_role" "engineer" {
  key  = "engineer"
  name = "Engineer"
}

resource "keenauth_directory_role_mapping" "engineering" {
  directory_id       = keenauth_directory.acme_okta.id
  directory_group_id = "dsg_01j9zq3v8c5m2x7k4t6r1n0b3d"
  role_id            = keenauth_role.engineer.id
}
```

## Groups come from the identity provider

The identity provider provisions groups to the directory over SCIM, so the group must exist before you map it. List the groups of a directory with:

```shell
keenauth directories groups list <directory_id>
```

A group that is not in the directory is rejected with `422` (`unknown_group`). A group can be mapped once per directory, and a directory has at most 500 mappings.

## Create, read and delete only

The management API cannot change a mapping. Every argument (`directory_id`, `directory_group_id`, `role_id`) replaces the mapping when you change it. The provider reads the mapping from the directory's mapping list on every refresh; a mapping or directory deleted outside the provider is removed from state and planned again.

## Privileged roles

Mapping a privileged role needs an API key with `roles:write` in addition to `directories:write`; without it the API answers `403` (`privileged_role_mapping_forbidden`). Such a mapping is created approved.

If a role becomes privileged after the mapping was created, the mapping stays unapproved: `approved_at` is empty and the role is not granted. The provider does not approve mappings; recreate the mapping with a key that has `roles:write`.

## Arguments

- `role_id` is an environment role or a role of the directory's organization; any other role is rejected with `422` (`unknown_role`).
- `organization_id`, `role_privileged`, `approved_at`, `created_at` and `id` are read-only.

## Import

Import with the directory ID and the mapping ID:

```shell
tofu import keenauth_directory_role_mapping.engineering dir_01j9zq3v8c5m2x7k4t6r1n0b3d/rmp_01j9zq4a2b3c4d5e6f7g8h9j0k
```