Data source vault auth backends

vault/data_source_auth_backends.go

@@ -0,0 +1,80 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package vault
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/provider"
+)
+
+func authBackendsDataSource() *schema.Resource {
+	return &schema.Resource{
+		Read: ReadWrapper(authBackendsDataSourceRead),
+		Schema: map[string]*schema.Schema{
+			"paths": {
+				Type:        schema.TypeList,
+				Computed:    true,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+				Description: "The auth backend mount points.",
+			},
+			"type": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "The name of the auth backend.",
+			},
+			"accessors": {
+				Type:        schema.TypeList,
+				Computed:    true,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+				Description: "The accessors of the auth backends.",
+			},
+		},
+	}
+}
+
+func authBackendsDataSourceRead(d *schema.ResourceData, meta interface{}) error {
+	client, e := provider.GetClient(d, meta)
+	if e != nil {
+		return e
+	}
+
+	targetType := d.Get("type").(string)
+
+	auths, err := client.Sys().ListAuth()
+	if err != nil {
+		return fmt.Errorf("error reading from Vault: %s", err)
+	}
+
+	var paths, accessors []string
+
+	for path, auth := range auths {
+
+		path = strings.TrimSuffix(path, "/")
+
+		if targetType == "" {
+			paths = append(paths, path)
+			accessors = append(accessors, auth.Accessor)
+			// we do this to make test assertions easier
+			// this is not required
+			sort.Strings(paths)
+		} else if auth.Type == targetType {
+			paths = append(paths, path)
+			accessors = append(accessors, auth.Accessor)
+		}
+	}
+
+	// Single instance data source - defaulting ID to 'default'
+	d.SetId("default")
+	d.Set("paths", paths)
+	d.Set("type", targetType)
+	d.Set("accessors", accessors)
+
+	// If we fell out here then we didn't find our Auth in the list.
+	return nil
+}

vault/data_source_auth_backends_test.go

@@ -0,0 +1,96 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package vault
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	r "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+
+	"github.com/hashicorp/terraform-provider-vault/testutil"
+)
+
+func TestDataSourceAuthBackends(t *testing.T) {
+	userpassPath := acctest.RandomWithPrefix("foo")
+	approlePath := acctest.RandomWithPrefix("foo")
+	ds := "data.vault_auth_backends.test"
+
+	r.Test(t, r.TestCase{
+		Providers: testProviders,
+		PreCheck:  func() { testutil.TestAccPreCheck(t) },
+		Steps: []r.TestStep{
+			{
+				Config: testDataSourceAuthBackendsBasic,
+				// The token auth method is built-in and automatically enabled
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(ds, "paths.#", "1"),
+					resource.TestCheckResourceAttr(ds, "paths.0", "token"),
+					resource.TestCheckResourceAttr(ds, "accessors.#", "1"),
+				),
+			},
+			{
+				Config: testDataSourceAuthBackendsBasic_config,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(ds, "paths.#", "3"),
+					resource.TestCheckResourceAttr(ds, "paths.0", "approle"),
+					resource.TestCheckResourceAttr(ds, "paths.1", "token"),
+					resource.TestCheckResourceAttr(ds, "paths.2", "userpass"),
+					resource.TestCheckResourceAttr(ds, "accessors.#", "3"),
+					resource.TestCheckResourceAttr(ds, "type", ""),
+				),
+			},
+			{
+				Config: testDataSourceAuthBackends_config([]string{userpassPath, approlePath}, "userpass"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(ds, "paths.#", "1"),
+					resource.TestCheckResourceAttr(ds, "paths.0", userpassPath),
+					resource.TestCheckResourceAttr(ds, "accessors.#", "1"),
+					resource.TestCheckResourceAttr(ds, "type", "userpass"),
+				),
+			},
+		},
+	})
+}
+
+var testDataSourceAuthBackendsBasic = `
+data "vault_auth_backends" "test" {}
+`
+
+var testDataSourceAuthBackendsBasic_config = `
+resource "vault_auth_backend" "userpass" {
+	type = "userpass"
+}
+resource "vault_auth_backend" "approle" {
+	type = "approle"
+}
+data "vault_auth_backends" "test" {
+	depends_on = [
+		"vault_auth_backend.userpass",
+		"vault_auth_backend.approle",
+	]
+}
+`
+
+func testDataSourceAuthBackends_config(path []string, typ string) string {
+	return fmt.Sprintf(`
+resource "vault_auth_backend" "test-foo" {
+	path = "%s"
+	type = "userpass"
+}
+resource "vault_auth_backend" "test-bar" {
+	path = "%s"
+	type = "approle"
+}
+data "vault_auth_backends" "test" {
+	depends_on = [
+		"vault_auth_backend.test-foo",
+		"vault_auth_backend.test-bar",
+	]
+	type = "%s"
+}
+`, path[0], path[1], typ)
+}

vault/provider.go

@@ -287,6 +287,10 @@ var (
 			Resource:      UpdateSchemaResource(authBackendDataSource()),
 			PathInventory: []string{"/sys/auth"},
 		},
+		"vault_auth_backends": {
+			Resource:      UpdateSchemaResource(authBackendsDataSource()),
+			PathInventory: []string{"/sys/auth"},
+		},
 		"vault_transit_encrypt": {
 			Resource:      UpdateSchemaResource(transitEncryptDataSource()),
 			PathInventory: []string{"/transit/encrypt/{name}"},

website/docs/d/auth_backends.html.md

@@ -0,0 +1,39 @@
+---
+layout: "vault"
+page_title: "Vault: vault_auth_backends data source"
+sidebar_current: "docs-vault-datasource-auth-backends"
+description: |-
+  List Auth Backends from Vault
+---
+
+# vault\_auth\_backends
+
+## Example Usage
+
+```hcl
+data "vault_auth_backends" "example" {}
+```
+
+```hcl
+data "vault_auth_backends" "example-filter" {
+  type = "kubernetes"
+}
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `namespace` - (Optional) The namespace of the target resource.
+  The value should not contain leading or trailing forward slashes.
+  The `namespace` is always relative to the provider's configured [namespace](/docs/providers/vault#namespace).
+  *Available only for Vault Enterprise*.
+
+* `type` - (Optional) The name of the auth method type.
+
+## Attributes Reference
+
+In addition to the fields above, the following attributes are exported:
+
+* `accessors` - The accessors for this auth methods.
+
+* `paths` - List of auth backend mount points.