Update bindpass in vault_ldap_auth_backend

- Set the attribute to sensitive
- Do not read back from the API since the API does not return it

vault/resource_ldap_auth_backend.go

@@ -58,9 +58,10 @@ func ldapAuthBackendResource() *schema.Resource {
 				Computed: true,
 			},
 			"bindpass": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
+				Type:      schema.TypeString,
+				Optional:  true,
+				Computed:  true,
+				Sensitive: true,
 			},
 			"userdn": {
 				Type:     schema.TypeString,
@@ -254,7 +255,6 @@ func ldapAuthBackendRead(d *schema.ResourceData, meta interface{}) error {
 	d.Set("insecure_tls", resp.Data["insecure_tls"])
 	d.Set("certificate", resp.Data["certificate"])
 	d.Set("binddn", resp.Data["binddn"])
-	d.Set("bindpass", resp.Data["bindpass"])
 	d.Set("userdn", resp.Data["userdn"])
 	d.Set("userattr", resp.Data["userattr"])
 	d.Set("discoverdn", resp.Data["discoverdn"])
@@ -264,6 +264,9 @@ func ldapAuthBackendRead(d *schema.ResourceData, meta interface{}) error {
 	d.Set("groupdn", resp.Data["groupdn"])
 	d.Set("groupattr", resp.Data["groupattr"])
 
+	// `bindpass` cannot be read out from the API
+	// So... if they drift, they drift.
+
 	return nil
 }
 

website/docs/r/ldap_auth_backend.html.md

@@ -69,6 +69,11 @@ The following arguments are supported:
 
 For more details on the usage of each argument consult the [Vault LDAP API documentation](https://www.vaultproject.io/api/auth/ldap/index.html).
 
+~> **Important** Because Vault does not support reading the configured
+credentials back from the API, Terraform cannot detect and correct drift
+on `bindpass`. Changing the values, however, _will_ overwrite the
+previously stored values.
+
 ## Attribute Reference
 
 No additional attributes are exposed by this resource.