Fix removed MSGraph param in Azure Secrets

vault/resource_azure_secret_backend.go

@@ -112,7 +112,7 @@ func azureSecretBackendCreate(d *schema.ResourceData, meta interface{}) error {
 	d.SetId(path)
 
 	log.Printf("[DEBUG] Writing Azure configuration to %q", configPath)
-	data := azureSecretBackendRequestData(d)
+	data := azureSecretBackendRequestData(d, meta)
 	if _, err := client.Logical().Write(configPath, data); err != nil {
 		return fmt.Errorf("error writing Azure configuration for %q: %s", path, err)
 	}
@@ -152,14 +152,24 @@ func azureSecretBackendRead(d *schema.ResourceData, meta interface{}) error {
 		return fmt.Errorf("error reading from Vault: %s", err)
 	}
 
-	for _, k := range []string{"client_id", "subscription_id", "tenant_id", "use_microsoft_graph_api"} {
+	for _, k := range []string{"client_id", "subscription_id", "tenant_id"} {
 		if v, ok := resp.Data[k]; ok {
 			if err := d.Set(k, v); err != nil {
 				return err
 			}
 		}
 	}
 
+	skipMSGraphAPI := provider.IsAPISupported(meta, provider.VaultVersion112)
+
+	if !skipMSGraphAPI {
+		if v, ok := resp.Data["use_microsoft_graph_api"]; ok {
+			if err := d.Set("use_microsoft_graph_api", v); err != nil {
+				return err
+			}
+		}
+	}
+
 	if v, ok := resp.Data["environment"]; ok && v.(string) != "" {
 		if err := d.Set("environment", v); err != nil {
 			return err
@@ -194,7 +204,7 @@ func azureSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error {
 		return err
 	}
 
-	data := azureSecretBackendRequestData(d)
+	data := azureSecretBackendRequestData(d, meta)
 	if len(data) > 0 {
 		_, err := client.Logical().Write(azureSecretBackendPath(path), data)
 		if err != nil {
@@ -244,16 +254,27 @@ func azureSecretBackendPath(path string) string {
 	return strings.Trim(path, "/") + "/config"
 }
 
-func azureSecretBackendRequestData(d *schema.ResourceData) map[string]interface{} {
+func azureSecretBackendRequestData(d *schema.ResourceData, meta interface{}) map[string]interface{} {
 	fields := []string{
 		"client_id",
 		"environment",
 		"tenant_id",
 		"client_secret",
-		"use_microsoft_graph_api",
 		"subscription_id",
 	}
 
+	skipMSGraphAPI := provider.IsAPISupported(meta, provider.VaultVersion112)
+
+	if _, ok := d.GetOk("use_microsoft_graph_api"); ok {
+		if skipMSGraphAPI {
+			log.Printf("ignoring this field because Vault version is greater than 1.12")
+		}
+	}
+
+	if !skipMSGraphAPI {
+		fields = append(fields, "use_microsoft_graph_api")
+	}
+
 	data := make(map[string]interface{})
 	for _, k := range fields {
 		if d.IsNewResource() {

vault/resource_azure_secret_backend_test.go

@@ -62,6 +62,42 @@ func TestAzureSecretBackend(t *testing.T) {
 			},
 		},
 	})
+	azureCheckFuncs := []resource.TestCheckFunc{
+		resource.TestCheckResourceAttr(resourceName, consts.FieldPath, path),
+		resource.TestCheckResourceAttr(resourceName, "subscription_id", "11111111-2222-3333-4444-111111111111"),
+		resource.TestCheckResourceAttr(resourceName, "tenant_id", "11111111-2222-3333-4444-222222222222"),
+		resource.TestCheckResourceAttr(resourceName, "client_id", "11111111-2222-3333-4444-333333333333"),
+		resource.TestCheckResourceAttr(resourceName, "client_secret", "12345678901234567890"),
+		resource.TestCheckResourceAttr(resourceName, "environment", "AzurePublicCloud"),
+	}
+
+	skipMSGraphCheck := provider.IsAPISupported(testProvider.Meta(), provider.VaultVersion112)
+	if !skipMSGraphCheck {
+		azureCheckFuncs = append(azureCheckFuncs,
+			resource.TestCheckResourceAttr(resourceName, "use_microsoft_graph_api", "false"))
+	}
+
+	resource.Test(t, resource.TestCase{
+		Providers: testProviders,
+		PreCheck: func() {
+			testutil.TestAccPreCheck(t)
+		},
+		CheckDestroy: testCheckMountDestroyed(resourceType, consts.MountTypeAzure, consts.FieldPath),
+		Steps: []resource.TestStep{
+			{
+				Config: testAzureSecretBackend_initialConfig(path),
+				Check:  resource.ComposeTestCheckFunc(azureCheckFuncs...),
+			},
+			{
+				Config: testAzureSecretBackend_updated(path),
+				Check:  resource.ComposeTestCheckFunc(azureCheckFuncs...),
+			},
+			{
+				Config: testAzureSecretBackend_updateSubscriptionID(path),
+				Check:  resource.ComposeTestCheckFunc(azureCheckFuncs...),
+			},
+		},
+	})
 }
 
 func TestAzureSecretBackend_remount(t *testing.T) {

website/docs/r/azure_secret_backend.html.md

@@ -61,7 +61,7 @@ The following arguments are supported:
 - `subscription_id` (`string: <required>`) - The subscription id for the Azure Active Directory.
 
 - `use_microsoft_graph_api` (`bool: <optional>`) - Use the Microsoft Graph API introduced in `vault-1.9`. 
-   Should be set to true for `vault-1.10+`
+   Should be set to true for `vault-1.10+`. This parameter has been deprecated and will be ignored in `vault-1.12+`.
 
 - `tenant_id` (`string: <required>`) - The tenant id for the Azure Active Directory.