Add support for group_membership_filter in azuread

[bigkevmcd]

Issue: rancher/rancher#46209

Problem

It's not currently possible to configure the user-group filter from Terraform.

Solution

This adds support for configuring the group_memembership_filter for Azure which configures a filter for querying groups for a user.

Testing

Engineering Testing

Manual Testing

Configured a simple "azuread" resource...

resource "rancher2_auth_config_azuread" "azuread" {
 // other fields omitted for simplicity
  group_membership_filter = "startswith(displayName,'admin')"
}

And confirmed that these are configured on the azuread AuthConfig resource, and that they are updated when changed.

Automated Testing

Tests were added for the new behaviour.

QA Testing Considerations

Regressions Considerations

[bigkevmcd]

There's an issue here, but it's not just this addition that's affected.

You can't clear the value once you've set it, you can change it, but not clear it.

There are a number of bugs that cause this...

1. The AzureADConfig field GroupMembershipFilter is declared with omitempty which means that if you set it to an empty string, it won't actually be marshalled.
2. Our code generation adds omitempty to every struct, field (it should really only be struct pointers that get omitempty) even if the field isn't declared as omitempty (I've tried stripping omitempty from the field, and the generated version gets omitempty), I have tried manually modifying the generated code to strip omitempty and this does fix the issue.
3. We can't calculate a patch either, because we don't support PATCHing the AuthConfigs

Error: [ERROR] Updating Auth Config azuread: Bad response statusCode [405]. Status [405 Method Not Allowed]. Body: [baseType=error, code=MethodNotAllow, message=Method PATCH not supported] from [https://rancher.bigkevmcd.com:8443/v3/azureADConfigs/azuread]

To be clear, this impacts on the other fields in the AzureAD config, you can't clear the optional fields used for custom endpoints either:

The following problems may be the cause of any confusing errors from downstream operations:
- .auth_endpoint: was cty.StringVal(""), but now cty.StringVal("https://example.com")

[enrichman]

LGTM ✔️

[alegrey91]

wdyt of using %w instead o %s?

[bigkevmcd]

That won't work?

https://go.dev/play/p/kOQqlRqoAIM

[alegrey91]

ops, sorry, my mistake

[alegrey91]

LGTM