keenauth_directory_role_mapping

The keenauth_directory_role_mapping resource maps a group of a SCIM directory to a role. The members of the group get the role in the directory's organization.

resource "keenauth_role" "engineer" {
  key  = "engineer"
  name = "Engineer"
}

resource "keenauth_directory_role_mapping" "engineering" {
  directory_id       = keenauth_directory.acme_okta.id
  directory_group_id = "dsg_01j9zq3v8c5m2x7k4t6r1n0b3d"
  role_id            = keenauth_role.engineer.id
}

Groups come from the identity provider

The identity provider provisions groups to the directory over SCIM, so the group must exist before you map it. List the groups of a directory with:

keenauth directories groups list <directory_id>

A group that is not in the directory is rejected with 422 (unknown_group). A group can be mapped once per directory, and a directory has at most 500 mappings.

Create, read and delete only

The management API cannot change a mapping. Every argument (directory_id, directory_group_id, role_id) replaces the mapping when you change it. The provider reads the mapping from the directory's mapping list on every refresh; a mapping or directory deleted outside the provider is removed from state and planned again.

Privileged roles

Mapping a privileged role needs an API key with roles:write in addition to directories:write; without it the API answers 403 (privileged_role_mapping_forbidden). Such a mapping is created approved.

If a role becomes privileged after the mapping was created, the mapping stays unapproved: approved_at is empty and the role is not granted. The provider does not approve mappings; recreate the mapping with a key that has roles:write.

Arguments

• role_id is an environment role or a role of the directory's organization; any other role is rejected with 422 (unknown_role).
• organization_id, role_privileged, approved_at, created_at and id are read-only.

Import

Import with the directory ID and the mapping ID:

tofu import keenauth_directory_role_mapping.engineering dir_01j9zq3v8c5m2x7k4t6r1n0b3d/rmp_01j9zq4a2b3c4d5e6f7g8h9j0k