Skip to content

Commit 61e701e

Browse files
hod-alperthod-alpert
committed
NSOF-5930 user_settings: introduce user settings resource and data-source
1 parent 9fddaf0 commit 61e701e

File tree

12 files changed

+740
-0
lines changed

12 files changed

+740
-0
lines changed

‎docs/data-sources/user_settings.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "pfptmeta_user_settings Data Source - terraform-provider-pfptmeta"
4+
subcategory: "Administration"
5+
description: |-
6+
The pfptmeta_user_settings resource is a tool with which the administrator can configure specific user settings for particular groups.
7+
For example, an organization’s security policy may require that a specific contractor’s group is prompted for re-authentication after x minutes, or that this group of users can only log in from a single device or x number of devices.
8+
In addition, the administrator can choose the type of authentication factor that should be applied or if users can only log in using SSO.
9+
---
10+
11+
# pfptmeta_user_settings (Data Source)
12+
13+
The `pfptmeta_user_settings` resource is a tool with which the administrator can configure specific user settings for particular groups.
14+
For example, an organization’s security policy may require that a specific contractor’s group is prompted for re-authentication after x minutes, or that this group of users can only log in from a single device or x number of devices.
15+
In addition, the administrator can choose the type of authentication factor that should be applied or if users can only log in using SSO.
16+
17+
## Example Usage
18+
19+
```terraform
20+
data "pfptmeta_user_settings" "settings" {
21+
id = "ds-123abc"
22+
}
23+
24+
output "settings" {
25+
value = data.pfptmeta_user_settings.settings
26+
}
27+
```
28+
29+
<!-- schema generated by tfplugindocs -->
30+
## Schema
31+
32+
### Required
33+
34+
- **id** (String) The ID of this resource.
35+
36+
### Read-Only
37+
38+
- **allowed_factors** (List of String) When users are configured to authenticate locally with MFA, you can choose which second authentication factors will be visible to this user group. The allowed values are: `SMS`, `SOFTWARE_TOTP`, `VOICECALL`, `EMAIL`.
39+
This applies ONLY to local Proofpoint accounts, not to accounts that authenticate via external IdPs (SSO).
40+
- **apply_on_org** (Boolean) Indicates whether this user setting applies to the entire org. Note: this attribute overrides `apply_to_entities`.
41+
- **apply_to_entities** (List of String) Entities (users, groups or network elements) that the user settings will be applied to.
42+
- **description** (String)
43+
- **enabled** (Boolean)
44+
- **max_devices_per_user** (Number) Provides the administrator the flexibility to restrict how many devices the user can own or authenticate from.
45+
- **mfa_required** (Boolean) Forces the user for second factor authentication when logging in to Proofpoint NaaS. Enabling this enforces the user to authenticate also by a second factor, as specified by `allowed_factors` parameter.
46+
- **name** (String)
47+
- **password_expiration** (Number) Allows the administrator to set how often (in days) the end user should set a new login password.
48+
- **prohibited_os** (List of String) Allows the administrator to select operating systems which are prohibited from onboarding. ENUM: `Android`, `macOS`, `iOS`, `Linux`, `Windows`, `ChromeOS`
49+
- **proxy_pops** (String) Type of proxy_pops the user will use:
50+
- **ALL_POPS** - connect to the nearest Point-of-Presence regardless to whether this PoP was upgraded for static IP use or not. - **POPS_WITH_DEDICATED_IPS** - enable the use of PoPs with dedicated IP ranges provided by Proofpoint.
51+
- **sso_mandatory** (Boolean) Force the user into SSO authentication, via the configured IdP. If this option is enabled and the user attempts to login without SSO, the following message is displayed: *Login without SSO is not allowed by system administrator*.

‎docs/resources/user_settings.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "pfptmeta_user_settings Resource - terraform-provider-pfptmeta"
4+
subcategory: "Administration"
5+
description: |-
6+
The pfptmeta_user_settings resource is a tool with which the administrator can configure specific user settings for particular groups.
7+
For example, an organization’s security policy may require that a specific contractor’s group is prompted for re-authentication after x minutes, or that this group of users can only log in from a single device or x number of devices.
8+
In addition, the administrator can choose the type of authentication factor that should be applied or if users can only log in using SSO.
9+
---
10+
11+
# pfptmeta_user_settings (Resource)
12+
13+
The `pfptmeta_user_settings` resource is a tool with which the administrator can configure specific user settings for particular groups.
14+
For example, an organization’s security policy may require that a specific contractor’s group is prompted for re-authentication after x minutes, or that this group of users can only log in from a single device or x number of devices.
15+
In addition, the administrator can choose the type of authentication factor that should be applied or if users can only log in using SSO.
16+
17+
## Example Usage
18+
19+
```terraform
20+
resource "pfptmeta_user_settings" "swg_settings" {
21+
name = "SWG settings"
22+
description = "device settings description"
23+
apply_on_org = true
24+
proxy_pops = "POPS_WITH_DEDICATED_IPS"
25+
}
26+
27+
resource "pfptmeta_group" "ztna_group" {
28+
name = "group"
29+
}
30+
31+
resource "pfptmeta_user_settings" "ztna_settings" {
32+
name = "ZTNA settings"
33+
apply_to_entities = [pfptmeta_group.ztna_group.id]
34+
max_devices_per_user = 5
35+
prohibited_os = ["macOS", "iOS"]
36+
}
37+
38+
resource "pfptmeta_user_settings" "login_settings" {
39+
name = "Login settings"
40+
apply_on_org = true
41+
sso_mandatory = true
42+
mfa_required = true
43+
allowed_factors = ["SMS"]
44+
password_expiration = 30
45+
}
46+
```
47+
48+
<!-- schema generated by tfplugindocs -->
49+
## Schema
50+
51+
### Required
52+
53+
- **name** (String)
54+
55+
### Optional
56+
57+
- **allowed_factors** (List of String) When users are configured to authenticate locally with MFA, you can choose which second authentication factors will be visible to this user group. The allowed values are: `SMS`, `SOFTWARE_TOTP`, `VOICECALL`, `EMAIL`.
58+
This applies ONLY to local Proofpoint accounts, not to accounts that authenticate via external IdPs (SSO).
59+
- **apply_on_org** (Boolean) Indicates whether this user setting applies to the entire org. Note: this attribute overrides `apply_to_entities`.
60+
- **apply_to_entities** (List of String) Entities (users, groups or network elements) that the user settings will be applied to.
61+
- **description** (String)
62+
- **enabled** (Boolean)
63+
- **max_devices_per_user** (Number) Provides the administrator the flexibility to restrict how many devices the user can own or authenticate from.
64+
- **mfa_required** (Boolean) Forces the user for second factor authentication when logging in to Proofpoint NaaS. Enabling this enforces the user to authenticate also by a second factor, as specified by `allowed_factors` parameter.
65+
- **password_expiration** (Number) Allows the administrator to set how often (in days) the end user should set a new login password.
66+
- **prohibited_os** (List of String) Allows the administrator to select operating systems which are prohibited from onboarding. ENUM: `Android`, `macOS`, `iOS`, `Linux`, `Windows`, `ChromeOS`
67+
- **proxy_pops** (String) Type of proxy_pops the user will use:
68+
- **ALL_POPS** - connect to the nearest Point-of-Presence regardless to whether this PoP was upgraded for static IP use or not. - **POPS_WITH_DEDICATED_IPS** - enable the use of PoPs with dedicated IP ranges provided by Proofpoint.
69+
- **sso_mandatory** (Boolean) Force the user into SSO authentication, via the configured IdP. If this option is enabled and the user attempts to login without SSO, the following message is displayed: *Login without SSO is not allowed by system administrator*.
70+
71+
### Read-Only
72+
73+
- **id** (String) The ID of this resource.

‎examples/data-sources/pfptmeta_user_settings/data-source.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
data "pfptmeta_user_settings" "settings" {
2+
id = "ds-123abc"
3+
}
4+
5+
output "settings" {
6+
value = data.pfptmeta_user_settings.settings
7+
}

‎examples/resources/pfptmeta_user_settings/resource.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
resource "pfptmeta_user_settings" "swg_settings" {
2+
name = "SWG settings"
3+
description = "device settings description"
4+
apply_on_org = true
5+
proxy_pops = "POPS_WITH_DEDICATED_IPS"
6+
}
7+
8+
resource "pfptmeta_group" "ztna_group" {
9+
name = "group"
10+
}
11+
12+
resource "pfptmeta_user_settings" "ztna_settings" {
13+
name = "ZTNA settings"
14+
apply_to_entities = [pfptmeta_group.ztna_group.id]
15+
max_devices_per_user = 5
16+
prohibited_os = ["macOS", "iOS"]
17+
}
18+
19+
resource "pfptmeta_user_settings" "login_settings" {
20+
name = "Login settings"
21+
apply_on_org = true
22+
sso_mandatory = true
23+
mfa_required = true
24+
allowed_factors = ["SMS"]
25+
password_expiration = 30
26+
}

‎internal/client/user_settings.go‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
package client
2+
3+
import (
4+
"bytes"
5+
"context"
6+
"encoding/json"
7+
"fmt"
8+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
9+
"io/ioutil"
10+
"net/http"
11+
)
12+
13+
const userSettingsEndpoint = "v1/settings/user"
14+
15+
type UserSettings struct {
16+
ID string `json:"id,omitempty"`
17+
Name string `json:"name,omitempty"`
18+
Description string `json:"description"`
19+
Enabled bool `json:"enabled"`
20+
ApplyOnOrg bool `json:"apply_on_org"`
21+
ApplyToEntities []string `json:"apply_to_entities"`
22+
AllowedFactors []string `json:"allowed_factors,omitempty"`
23+
MaxDevicesPerUser *int `json:"max_devices_per_user,omitempty"`
24+
MfaRequired *bool `json:"mfa_required,omitempty"`
25+
PasswordExpiration *int `json:"password_expiration,omitempty"`
26+
ProhibitedOs []string `json:"prohibited_os,omitempty"`
27+
ProxyPops *string `json:"proxy_pops,omitempty"`
28+
SsoMandatory *bool `json:"sso_mandatory,omitempty"`
29+
}
30+
31+
func NewUserSettings(d *schema.ResourceData) *UserSettings {
32+
res := &UserSettings{}
33+
if d.HasChange("name") {
34+
res.Name = d.Get("name").(string)
35+
}
36+
res.Description = d.Get("description").(string)
37+
res.Enabled = d.Get("enabled").(bool)
38+
res.ApplyOnOrg = d.Get("apply_on_org").(bool)
39+
res.ApplyToEntities = ConfigToStringSlice("apply_to_entities", d)
40+
_, exists := d.GetOk("allowed_factors")
41+
if exists {
42+
res.AllowedFactors = ConfigToStringSlice("allowed_factors", d)
43+
}
44+
mdpu, exists := d.GetOk("max_devices_per_user")
45+
if exists {
46+
maxDevicesPerUser := mdpu.(int)
47+
res.MaxDevicesPerUser = &maxDevicesPerUser
48+
}
49+
mfar, exists := d.GetOk("mfa_required")
50+
if exists {
51+
mfaRequired := mfar.(bool)
52+
res.MfaRequired = &mfaRequired
53+
}
54+
pw, exists := d.GetOk("password_expiration")
55+
if exists {
56+
passwordExpiration := pw.(int)
57+
res.PasswordExpiration = &passwordExpiration
58+
}
59+
_, exists = d.GetOk("prohibited_os")
60+
if exists {
61+
res.ProhibitedOs = ConfigToStringSlice("prohibited_os", d)
62+
}
63+
pp, exists := d.GetOk("proxy_pops")
64+
if exists {
65+
proxyPops := pp.(string)
66+
res.ProxyPops = &proxyPops
67+
}
68+
ssoM, exists := d.GetOk("sso_mandatory")
69+
if exists {
70+
ssoMandatory := ssoM.(bool)
71+
res.MfaRequired = &ssoMandatory
72+
}
73+
return res
74+
}
75+
76+
func parseUserSettings(resp *http.Response) (*UserSettings, error) {
77+
defer resp.Body.Close()
78+
body, err := ioutil.ReadAll(resp.Body)
79+
if err != nil {
80+
return nil, fmt.Errorf("could not read user settings response: %v", err)
81+
}
82+
ds := &UserSettings{}
83+
err = json.Unmarshal(body, ds)
84+
if err != nil {
85+
return nil, fmt.Errorf("could not parse user settings response: %v", err)
86+
}
87+
return ds, nil
88+
}
89+
90+
func CreateUserSettings(ctx context.Context, c *Client, ds *UserSettings) (*UserSettings, error) {
91+
url := fmt.Sprintf("%s/%s", c.BaseURL, userSettingsEndpoint)
92+
body, err := json.Marshal(ds)
93+
if err != nil {
94+
return nil, fmt.Errorf("could not convert user settings to json: %v", err)
95+
}
96+
resp, err := c.Post(ctx, url, bytes.NewReader(body))
97+
if err != nil {
98+
return nil, err
99+
}
100+
return parseUserSettings(resp)
101+
}
102+
103+
func UpdateUserSettings(ctx context.Context, c *Client, dsID string, ds *UserSettings) (*UserSettings, error) {
104+
url := fmt.Sprintf("%s/%s/%s", c.BaseURL, userSettingsEndpoint, dsID)
105+
body, err := json.Marshal(ds)
106+
if err != nil {
107+
return nil, fmt.Errorf("could not convert user settings to json: %v", err)
108+
}
109+
resp, err := c.Patch(ctx, url, bytes.NewReader(body))
110+
if err != nil {
111+
return nil, err
112+
}
113+
return parseUserSettings(resp)
114+
}
115+
116+
func GetUserSettings(ctx context.Context, c *Client, dsID string) (*UserSettings, error) {
117+
url := fmt.Sprintf("%s/%s/%s", c.BaseURL, userSettingsEndpoint, dsID)
118+
resp, err := c.Get(ctx, url, nil)
119+
if err != nil {
120+
return nil, err
121+
}
122+
return parseUserSettings(resp)
123+
}
124+
125+
func DeleteUserSettings(ctx context.Context, c *Client, dsID string) (*UserSettings, error) {
126+
url := fmt.Sprintf("%s/%s/%s", c.BaseURL, userSettingsEndpoint, dsID)
127+
resp, err := c.Delete(ctx, url, nil)
128+
if err != nil {
129+
return nil, err
130+
}
131+
return parseUserSettings(resp)
132+
}

0 commit comments

Comments
 (0)