Skip to content

Commit 933b7f4

Browse files
bsimonWallixbsimonWallix
authored
Merge pull request #70 from wallix/develop
Develop
2 parents 31ff5a3 + 4305a53 commit 933b7f4

File tree

4 files changed

+194
-28
lines changed

4 files changed

+194
-28
lines changed

‎CHANGELOG.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,13 @@
11
# changelog
22

3+
## 0.14.5 (August 25, 2025)
4+
5+
ENHANCEMENTS:
6+
7+
- **resource/wallix-bastion_authorization**: added support for session sharing functionality with new
8+
`authorize_session_sharing` (boolean) and `session_sharing_mode` (enum: "view_only", "view_control")
9+
arguments, enabling users to configure session sharing permissions for authorizations.
10+
311
## 0.14.4 (March 3, 2025)
412

513
FEATURES:

‎bastion/resource_authorization.go‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,13 @@ type jsonAuthorization struct {
1515
ApprovalRequired bool `json:"approval_required"`
1616
AuthorizePasswordRetrieval bool `json:"authorize_password_retrieval"`
1717
AuthorizeSessions bool `json:"authorize_sessions"`
18+
AuthorizeSessionSharing bool `json:"authorize_session_sharing"`
1819
IsCritical bool `json:"is_critical"`
1920
IsRecorded bool `json:"is_recorded"`
2021
ID string `json:"id,omitempty"`
2122
AuthorizationName string `json:"authorization_name"`
2223
Description string `json:"description"`
24+
SessionSharingMode string `json:"session_sharing_mode,omitempty"`
2325
TargetGroup string `json:"target_group,omitempty"`
2426
UserGroup string `json:"user_group,omitempty"`
2527
HasComment *bool `json:"has_comment,omitempty"`
@@ -73,6 +75,25 @@ func resourceAuthorization() *schema.Resource {
7375
RequiredWith: []string{"subprotocols"},
7476
AtLeastOneOf: []string{"authorize_sessions", "authorize_password_retrieval"},
7577
},
78+
"authorize_session_sharing": {
79+
Type: schema.TypeBool,
80+
Optional: true,
81+
RequiredWith: []string{"session_sharing_mode"},
82+
},
83+
"session_sharing_mode": {
84+
Type: schema.TypeString,
85+
Optional: true,
86+
ValidateFunc: func(val any, key string) ([]string, []error) {
87+
v := val.(string)
88+
var errs []error
89+
if v != "" && v != "view_only" && v != "view_control" {
90+
errs = append(errs, fmt.Errorf("%q must be either 'view_only' or 'view_control', got: %s", key, v))
91+
}
92+
93+
return nil, errs
94+
},
95+
RequiredWith: []string{"authorize_session_sharing"},
96+
},
7697
"subprotocols": {
7798
Type: schema.TypeSet,
7899
Optional: true,
@@ -337,7 +358,9 @@ func prepareAuthorizationJSON(d *schema.ResourceData, newResource bool) jsonAuth
337358
AuthorizationName: d.Get("authorization_name").(string),
338359
AuthorizePasswordRetrieval: d.Get("authorize_password_retrieval").(bool),
339360
AuthorizeSessions: d.Get("authorize_sessions").(bool),
361+
AuthorizeSessionSharing: d.Get("authorize_session_sharing").(bool),
340362
Description: d.Get("description").(string),
363+
SessionSharingMode: d.Get("session_sharing_mode").(string),
341364
ApprovalRequired: d.Get("approval_required").(bool),
342365
IsCritical: d.Get("is_critical").(bool),
343366
IsRecorded: d.Get("is_recorded").(bool),
@@ -428,6 +451,12 @@ func fillAuthorization(d *schema.ResourceData, jsonData jsonAuthorization) {
428451
if tfErr := d.Set("authorize_sessions", jsonData.AuthorizeSessions); tfErr != nil {
429452
panic(tfErr)
430453
}
454+
if tfErr := d.Set("authorize_session_sharing", jsonData.AuthorizeSessionSharing); tfErr != nil {
455+
panic(tfErr)
456+
}
457+
if tfErr := d.Set("session_sharing_mode", jsonData.SessionSharingMode); tfErr != nil {
458+
panic(tfErr)
459+
}
431460
if tfErr := d.Set("subprotocols", jsonData.SubProtocols); tfErr != nil {
432461
panic(tfErr)
433462
}

‎bastion/resource_authorization_test.go‎

Lines changed: 128 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,41 @@ func TestAccResourceAuthorization_basic(t *testing.T) {
3232
})
3333
}
3434

35+
func TestAccResourceAuthorization_sessionSharing(t *testing.T) {
36+
resource.Test(t, resource.TestCase{
37+
PreCheck: func() { testAccPreCheck(t) },
38+
Providers: testAccProviders,
39+
Steps: []resource.TestStep{
40+
{
41+
Config: testAccResourceAuthorizationSessionSharingViewOnly(),
42+
Check: resource.ComposeTestCheckFunc(
43+
resource.TestCheckResourceAttrSet(
44+
"wallix-bastion_authorization.testacc_Authorization_sharing",
45+
"id"),
46+
resource.TestCheckResourceAttr(
47+
"wallix-bastion_authorization.testacc_Authorization_sharing",
48+
"authorize_session_sharing", "true"),
49+
resource.TestCheckResourceAttr(
50+
"wallix-bastion_authorization.testacc_Authorization_sharing",
51+
"session_sharing_mode", "view_only"),
52+
),
53+
},
54+
{
55+
Config: testAccResourceAuthorizationSessionSharingViewControl(),
56+
Check: resource.ComposeTestCheckFunc(
57+
resource.TestCheckResourceAttr(
58+
"wallix-bastion_authorization.testacc_Authorization_sharing",
59+
"authorize_session_sharing", "true"),
60+
resource.TestCheckResourceAttr(
61+
"wallix-bastion_authorization.testacc_Authorization_sharing",
62+
"session_sharing_mode", "view_control"),
63+
),
64+
},
65+
},
66+
PreventPostDestroyRefresh: true,
67+
})
68+
}
69+
3570
// nolint: lll, nolintlint
3671
func testAccResourceAuthorizationCreate() string {
3772
return `
@@ -41,8 +76,22 @@ resource "wallix-bastion_authorization" "testacc_Authorization" {
4176
target_group = wallix-bastion_targetgroup.testacc_Authorization.group_name
4277
authorize_sessions = true
4378
subprotocols = [
44-
"RDP_CLIPBOARD_UP", "RDP_CLIPBOARD_DOWN", "RDP_PRINTER", "RDP_COM_PORT", "RDP_DRIVE", "RDP_SMARTCARD", "RDP_CLIPBOARD_FILE", "RDP_AUDIO_OUTPUT",
45-
"SSH_SHELL_SESSION", "SSH_REMOTE_COMMAND", "SSH_SCP_UP", "SSH_SCP_DOWN", "SSH_X11", "SSH_DIRECT_TCPIP", "SSH_REVERSE_TCPIP", "SSH_AUTH_AGENT",
79+
"RDP_CLIPBOARD_UP",
80+
"RDP_CLIPBOARD_DOWN",
81+
"RDP_PRINTER",
82+
"RDP_COM_PORT",
83+
"RDP_DRIVE",
84+
"RDP_SMARTCARD",
85+
"RDP_CLIPBOARD_FILE",
86+
"RDP_AUDIO_OUTPUT",
87+
"SSH_SHELL_SESSION",
88+
"SSH_REMOTE_COMMAND",
89+
"SSH_SCP_UP",
90+
"SSH_SCP_DOWN",
91+
"SSH_X11",
92+
"SSH_DIRECT_TCPIP",
93+
"SSH_REVERSE_TCPIP",
94+
"SSH_AUTH_AGENT",
4695
"SFTP_SESSION",
4796
"RDP",
4897
"VNC",
@@ -51,10 +100,12 @@ resource "wallix-bastion_authorization" "testacc_Authorization" {
51100
"RAWTCPIP",
52101
]
53102
}
103+
54104
resource "wallix-bastion_usergroup" "testacc_Authorization" {
55105
group_name = "testacc_Authorization"
56106
timeframes = ["allthetime"]
57107
}
108+
58109
resource "wallix-bastion_targetgroup" "testacc_Authorization" {
59110
group_name = "testacc_Authorization"
60111
}
@@ -70,9 +121,25 @@ resource "wallix-bastion_authorization" "testacc_Authorization" {
70121
target_group = wallix-bastion_targetgroup.testacc_Authorization.group_name
71122
authorize_password_retrieval = true
72123
authorize_sessions = true
124+
authorize_session_sharing = true
125+
session_sharing_mode = "view_control"
73126
subprotocols = [
74-
"RDP_CLIPBOARD_UP", "RDP_CLIPBOARD_DOWN", "RDP_PRINTER", "RDP_COM_PORT", "RDP_DRIVE", "RDP_SMARTCARD", "RDP_CLIPBOARD_FILE", "RDP_AUDIO_OUTPUT",
75-
"SSH_SHELL_SESSION", "SSH_REMOTE_COMMAND", "SSH_SCP_UP", "SSH_SCP_DOWN", "SSH_X11", "SSH_DIRECT_TCPIP", "SSH_REVERSE_TCPIP", "SSH_AUTH_AGENT",
127+
"RDP_CLIPBOARD_UP",
128+
"RDP_CLIPBOARD_DOWN",
129+
"RDP_PRINTER",
130+
"RDP_COM_PORT",
131+
"RDP_DRIVE",
132+
"RDP_SMARTCARD",
133+
"RDP_CLIPBOARD_FILE",
134+
"RDP_AUDIO_OUTPUT",
135+
"SSH_SHELL_SESSION",
136+
"SSH_REMOTE_COMMAND",
137+
"SSH_SCP_UP",
138+
"SSH_SCP_DOWN",
139+
"SSH_X11",
140+
"SSH_DIRECT_TCPIP",
141+
"SSH_REVERSE_TCPIP",
142+
"SSH_AUTH_AGENT",
76143
"SFTP_SESSION",
77144
"RDP",
78145
"VNC",
@@ -93,16 +160,73 @@ resource "wallix-bastion_authorization" "testacc_Authorization" {
93160
mandatory_ticket = true
94161
single_connection = true
95162
}
163+
96164
resource "wallix-bastion_usergroup" "testacc_Authorization" {
97165
group_name = "testacc_Authorization"
98166
timeframes = ["allthetime"]
99167
}
168+
100169
resource "wallix-bastion_usergroup" "testacc_Authorization2" {
101170
group_name = "testacc_Authorization2"
102171
timeframes = ["allthetime"]
103172
}
173+
104174
resource "wallix-bastion_targetgroup" "testacc_Authorization" {
105175
group_name = "testacc_Authorization"
106176
}
107177
`
108178
}
179+
180+
// nolint: lll, nolintlint
181+
func testAccResourceAuthorizationSessionSharingViewOnly() string {
182+
return `
183+
resource "wallix-bastion_authorization" "testacc_Authorization_sharing" {
184+
authorization_name = "testacc_Authorization_sharing"
185+
user_group = wallix-bastion_usergroup.testacc_Authorization_sharing.group_name
186+
target_group = wallix-bastion_targetgroup.testacc_Authorization_sharing.group_name
187+
authorize_sessions = true
188+
authorize_session_sharing = true
189+
session_sharing_mode = "view_only"
190+
subprotocols = [
191+
"RDP",
192+
"SSH_SHELL_SESSION",
193+
]
194+
}
195+
196+
resource "wallix-bastion_usergroup" "testacc_Authorization_sharing" {
197+
group_name = "testacc_Authorization_sharing"
198+
timeframes = ["allthetime"]
199+
}
200+
201+
resource "wallix-bastion_targetgroup" "testacc_Authorization_sharing" {
202+
group_name = "testacc_Authorization_sharing"
203+
}
204+
`
205+
}
206+
207+
// nolint: lll, nolintlint
208+
func testAccResourceAuthorizationSessionSharingViewControl() string {
209+
return `
210+
resource "wallix-bastion_authorization" "testacc_Authorization_sharing" {
211+
authorization_name = "testacc_Authorization_sharing"
212+
user_group = wallix-bastion_usergroup.testacc_Authorization_sharing.group_name
213+
target_group = wallix-bastion_targetgroup.testacc_Authorization_sharing.group_name
214+
authorize_sessions = true
215+
authorize_session_sharing = true
216+
session_sharing_mode = "view_control"
217+
subprotocols = [
218+
"RDP",
219+
"SSH_SHELL_SESSION",
220+
]
221+
}
222+
223+
resource "wallix-bastion_usergroup" "testacc_Authorization_sharing" {
224+
group_name = "testacc_Authorization_sharing"
225+
timeframes = ["allthetime"]
226+
}
227+
228+
resource "wallix-bastion_targetgroup" "testacc_Authorization_sharing" {
229+
group_name = "testacc_Authorization_sharing"
230+
}
231+
`
232+
}

‎docs/resources/authorization.md‎

Lines changed: 29 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -30,57 +30,62 @@ The following arguments are supported:
3030

3131
-> **Note:** At least one of `authorize_password_retrieval` or `authorize_sessions` arguments is required.
3232

33-
- **authorization_name** (Required, String)
33+
- **authorization_name** (Required, String)
3434
The authorization name.
35-
- **user_group** (Required, String, Forces new resource)
35+
- **user_group** (Required, String, Forces new resource)
3636
The user group.
37-
- **target_group** (Required, String, Force new resource)
37+
- **target_group** (Required, String, Force new resource)
3838
The target group.
39-
- **description** (Optional, String)
39+
- **description** (Optional, String)
4040
The authorization description.
41-
- **authorize_password_retrieval** (Optional, Boolean)
41+
- **authorize_password_retrieval** (Optional, Boolean)
4242
Authorize password retrieval.
43-
- **authorize_sessions** (Optional, Boolean)
43+
- **authorize_sessions** (Optional, Boolean)
4444
Authorize sessions via proxies.
4545
`subprotocols` need to be set.
46-
- **subprotocols** (Optional, List of String)
47-
The authorization subprotocols.
48-
- **is_critical** (Optional, Boolean)
46+
- **authorize_session_sharing** (Optional, Boolean)
47+
Enable Session Sharing.
48+
- **session_sharing_mode** (Optional, String)
49+
The Session Sharing Mode. Must be `view_only` or `view_control`
50+
`authorize_session_sharing` need to be enabled.
51+
- **subprotocols** (Optional, List of String)
52+
The authorization subprotocols.
53+
- **is_critical** (Optional, Boolean)
4954
Define if it's critical.
50-
- **is_recorded** (Optional, Boolean)
55+
- **is_recorded** (Optional, Boolean)
5156
Define if it's recorded.
52-
- **approval_required** (Optional, Boolean)
57+
- **approval_required** (Optional, Boolean)
5358
Approval is required to connect to targets.
5459
`approvers` need to be set.
55-
- **approvers** (Optional, List of String)
56-
The approvers user groups.
60+
- **approvers** (Optional, List of String)
61+
The approvers user groups.
5762
`approval_required` need to be set.
58-
- **active_quorum** (Optional, Number)
63+
- **active_quorum** (Optional, Number)
5964
The quorum for active periods (-1: approval workflow with automatic approval,
60-
0: no approval workflow (direct connection), > 0: quorum to reach).
65+
0: no approval workflow (direct connection), > 0: quorum to reach).
6166
Defaults to `-1`.
62-
- **inactive_quorum** (Optional, Number)
67+
- **inactive_quorum** (Optional, Number)
6368
The quorum for inactive periods (-1: approval workflow with automatic approval,
64-
0: no connection allowed, > 0: quorum to reach).
69+
0: no connection allowed, > 0: quorum to reach).
6570
Defaults to `-1`.
66-
- **approval_timeout** (Optional, Number)
71+
- **approval_timeout** (Optional, Number)
6772
Set a timeout in minutes after which the approval will be automatically closed info connection has
6873
been initiated (i.e. the user won't be able to connect). 0: no timeout.
69-
- **has_comment** (Optional, Boolean)
74+
- **has_comment** (Optional, Boolean)
7075
Comment is allowed in approval.
71-
- **has_ticket** (Optional, Boolean)
76+
- **has_ticket** (Optional, Boolean)
7277
Ticket is allowed in approval.
73-
- **mandatory_comment** (Optional, Boolean)
78+
- **mandatory_comment** (Optional, Boolean)
7479
Comment is mandatory in approval.
75-
- **mandatory_ticket** (Optional, Boolean)
80+
- **mandatory_ticket** (Optional, Boolean)
7681
Ticket is mandatory in approval.
77-
- **single_connection** (Optional, Boolean)
82+
- **single_connection** (Optional, Boolean)
7883
Limit to one single connection during the approval period (i.e. if the user disconnects, he will
7984
not be allowed to start a new session during the original requested time).
8085

8186
## Attribute Reference
8287

83-
- **id** (String)
88+
- **id** (String)
8489
Internal id of authorization in bastion.
8590

8691
## Import

0 commit comments

Comments
 (0)