A way to update existing keycloak_generic_protocol_mapper

[NargiT]

Description

For Saml client there is a default role_list client scope with a default mapper impossible to update with the provider.

Discussion

Unfortunately, current terraform provider is not able to toggle the "Single Role Attribute" to true.
I can create a new one, but there are service providers that expect only a list in Role attribute not multiple attribute.

Motivation

Cannot use terraform provider out of the box, need to manually interact with the web app.

Details

Peek.2024-11-20.14-40.mp4

Once I deleted the existing scope, I add this to my .tf and I am good.

resource "keycloak_saml_client_scope" "saml_role_list" {
  name                = "role_list"
  realm_id            = keycloak_realm.realm.id
  consent_screen_text = "$${samlRoleListScopeConsentText}"
  description         = "SAML role list"
}

resource "keycloak_generic_protocol_mapper" "saml_role_attribute_mapper" {
  realm_id        = keycloak_realm.realm.id
  client_scope_id = keycloak_saml_client_scope.saml_role_list.id
  protocol        = "saml"
  protocol_mapper = "saml-role-list-mapper"
  name            = "role"
  config = {
    "single"               = "true"
    "attribute.name"       = "Role"
    "attribute.nameformat" = "Basic"
  }
}