Add ability to set a client role with composite_roles = an empty list about terraform-provider-keycloak HOT 8 OPEN

Hi @trois-six, the role will not have any composite roles if you omit the composite_roles attribute completely. Let me know if that works for you.

from terraform-provider-keycloak.

Yes that works, but if I have a role that have composite roles and I want to remove the composite roles, I can't.

from terraform-provider-keycloak.

Omitting the attribute should remove all of that role's composites, can you give me the HCL you're using and explain the behavior you're getting verses the behavior you're expecting?

from terraform-provider-keycloak.

Also, my acceptance tests explicitly cover this scenario (adding composite roles and removing them all) so if you're noticing some strange behavior, it's probably a bug that I'd like to get fixed.

from terraform-provider-keycloak.

OK I confirm that omitting the attribute remove all the role's composites. That's not usual for a Terraform resource but it works. Thank you !

from terraform-provider-keycloak.

I'm open to allowing users to specify an empty list of composite_roles if that would make you feel better. I would also like to keep the behavior of removing composite roles if the attribute is not specified.

If this is something you want, you can re-open this issue and I'll work on it when I get a chance.

from terraform-provider-keycloak.

The way it is done, I can't use this resource inside a module with a default value, but I can workaround it for the moment.

from terraform-provider-keycloak.

That's a fair use case, I did not think about that.

I think with HCL2 you could do something like this (forgive me if the syntax is incorrect, I don't use HCL2 yet):

resource "keycloak_role" "role" {
    realm_id = "master"
    name     = "test"

    composite_roles = len(var.composites == 0) ? null : var.composites
}

I think with HCL1 (which is what I'm still using) you'd have to do something even worse due to the lack of the null type:

resource "keycloak_role" "role" {
    count    = "${len(var.composites) == 0 ? 1 : 0}"
    realm_id = "master"
    name     = "test"
}

resource "keycloak_role" "role_with_composites" {
    count    = "${len(var.composites) == 0 ? 0 : 1}"
    realm_id = "master"
    name     = "test"

    composite_roles = "${var.composites}"
}

In either case, I agree that it is silly to have to add logic to your HCL because the provider won't allow you to specify an empty list for this attribute.

Thanks for helping me understand your use case, I'll work on this when I have some free time.

from terraform-provider-keycloak.