v1.0.0-beta.X

[sergiught]

🌍 Auth0 Terraform Provider Version 1 Beta Released! ​:earth_americas:

📢 We are thrilled to announce the highly anticipated BETA release of our Auth0 Terraform Provider v1! With the v1 release, managing your Auth0 resources using Terraform has never been easier. From provisioning clients, configuring connections, or setting up actions, the Auth0 Terraform Provider v1 empowers developers to streamline and automate your Auth0 infrastructure faster than ever before.

🔑 Key Highlights

💾 Data Sources for Resources: Easily fetch and reference data from existing Auth0 resources using data sources. Retrieve specific details or configuration settings of Auth0 entities and utilize them within your Terraform code, enhancing flexibility and integration.

🫂 Resource Relationships: Define and manage relationships between Auth0 resources effortlessly. With the ability to establish 1:1 and 1:many relationships, you can precisely model the connections and dependencies between resources, ensuring accurate provisioning and configuration.

​:closed_lock_with_key: Zero Downtime Client Secret Rotation: Seamlessly rotate client secrets with minimal disruption to applications and users. Includes built-in support for achieving zero downtime during client secret rotation, providing a smooth transition without impacting the availability or functionality of your applications.

🐞 Bug Fixes and Stability Enhancements: Auth0 Terraform Provider v1 emphasizes our dedication to delivering an enhanced, reliable tool. This version is laden with numerous improvements and comprehensive bug fixes, fortifying its stability and readiness to meet the diverse needs of the developer community.

---

Ready to get started? You can find the Auth0 Terraform Provider on the official Terraform Registry. We encourage everyone to try out the beta, send feedback, and help get the word out! If you are coming from a previous v0 build, be sure to check out the migration guide as this release includes breaking changes.

We also want to express our gratitude to our dedicated community and contributors for their valuable feedback and contributions that were critical to this release.

If you have any questions or need assistance, feel free to reach out here on GitHub in the Discussions thread.

Happy provisioning 🚀

📚 Resources

Quickstart | Documentation | Migration Guide | Changelog

---

This discussion was created from the release v1.0.0-beta.0.

[jmymy]

Getting this error when upgrading from version = "0.50.0"

╷
│ Warning: Missing resource schema from provider
│
│ No resource schema found for auth0_email when decoding prior state
╵
Failed generating plan JSON
Exit code: 1

Failed to marshal plan to json: error marshaling prior state: no schema found for auth0_email.mailgun_auth_email_provider (in provider registry.terraform.io/auth0/auth0)
Operation failed: 2 errors occurred:
	* failed running terraform plan (exit 1)
	* failed generating plan JSON: failed running command (exit 1)

terraform version
Terraform v1.5.3
on darwin_arm64
+ provider registry.terraform.io/auth0/auth0 v1.0.0-beta.0

[sergiught]

Hey @jmymy 👋🏻

The issue you're experience is caused by the fact that the auth0_email resource was renamed to auth0_email_provider (https://github.com/auth0/terraform-provider-auth0/blob/v1/MIGRATION_GUIDE.md#email-provider).

To fix this you can do one of the following:

• (Not recommended) Starting from provider version v1.0.0-beta.0, rename the auth0_email resource to auth0_email_provider and then inside your state file replace auth0_email with auth0_email_provider and remove the api_user field from the attributes section of the resource as this was also removed.

• (Recommended) Before upgrading while still on v0.50.0, run a terraform state rm auth0_email.mailgun_auth_email_provider and then rename inside your config auth0_email to auth0_email_provider. Then upgrade to v1.0.0-beta.0 and re-import the email provider resource using terraform import auth0_email_provider.mailgun_auth_email_provider <anyUUID for example: b4213dc2-2eed-42c3-9516-c6131a9ce0b0>.

Let me know if you have any questions, also appreciate you posting here as it gives us an opportunity now to improve the MIGRATION_GUIDE. 🙏🏻

[timothypgny]

I'm trying to use 1.0.0-beta.0 but got the following exception:

../node_modules/.bin/cdktf get

⠸ downloading and generating modules and providers...
╷
│ Error: Failed to query available provider packages
│
│ Could not retrieve the list of available versions for provider auth0/auth0:
│ no available releases match the given constraints ~> 1.0.0-beta.0
╵
Error: non-zero exit code 1
at ChildProcess. (/app/node_modules/cdktf-cli/bundle/bin/cmds/handlers.js:46:2064)
at Object.onceWrapper (node:events:629:26)
at ChildProcess.emit (node:events:514:28)
at ChildProcess.emit (node:domain:489:12)
at maybeClose (node:internal/child_process:1091:16)
at ChildProcess._handle.onexit (node:internal/child_process:302:5) {
stderr: '\x1B[31m\x1B[31m╷\x1B[0m\x1B[0m\n' +
'\x1B[31m│\x1B[0m \x1B[0m\x1B[1m\x1B[31mError: \x1B[0m\x1B[0m\x1B[1mFailed to query available provider packages\x1B[0m\n' +
'\x1B[31m│\x1B[0m \x1B[0m\n' +
'\x1B[31m│\x1B[0m \x1B[0m\x1B[0mCould not retrieve the list of available versions for provider auth0/auth0:\n' +
'\x1B[31m│\x1B[0m \x1B[0mno available releases match the given constraints ~> 1.0.0-beta.0\n' +
'\x1B[31m╵\x1B[0m\x1B[0m\n' +
'\x1B[0m\x1B[0m\n'
}
⠸ downloading and generating modules and providers...
non-zero exit code 1

here is a portion of the cdktf.json:

{

"terraformProviders": ["auth0/auth0@~>1.0.0-beta.0"],

}

0.50.0 works:

{
"terraformProviders": ["auth0/auth0@~>0.50.0",
}

[sergiught]

Hey @timothypgny 👋🏻

The issue is due to the fact that you're fetching a beta release with version constraints ~> which is not allowed for betas, in order to avoid issues where another beta version might get released and you'd upgrade automatically without knowing. So simply remove ~> from the versions and leave 1.0.0-beta.0.

[timothypgny]

@sergiught

That worked. Thanks!

[timothypgny]

We use python to interact with the provider:

We have the following like for previous versions to create a regular web application:
from imports.auth0 import Client
from imports.auth0 import ClientAddOns

   web_client = Client(
        self,
        name="Application",
        id_="auth0_application",
        description="Web Application",
        app_type="regular_web",
        callbacks=["some url"],
        addons=ClientAddons(
            samlp={
                "create_upn_claim": False,
                "passthrough_claims_with_no_mapping": False,
                "map_identities": False,
                "name_identifier_format": "rn:oasis:names:tc:SAML:2.0:nameid-format:transient",
            }
        ),
    )

It used to work on previous versions, but on the beta version:

The regular web app is still being created but it seems like it is creating extra addons.

If I go to the Auth0 dashboard, in the AddOns tab, I see a lot of addons turned on instead of only the SAML2 web app as coded above.

Here's a snippet of the tfstate file:

       "addons": [
          {
            "aws": [
              {
                "lifetime_in_seconds": 0,
                "principal": "",
                "role": ""
              }
            ],
            "azure_blob": [
              {
                "account_name": "",
                "blob_delete": false,
                "blob_name": "",
                "blob_read": false,
                "blob_write": false,
                "container_delete": false,
                "container_list": false,
                "container_name": "",
                "container_read": false,
                "container_write": false,
                "expiration": 0,
                "signed_identifier": "",
                "storage_access_key": ""
              }
            ],
            "azure_sb": [
              {
                "entity_path": "",
                "expiration": 0,
                "namespace": "",
                "sas_key": "",
                "sas_key_name": ""
              }
            ],
            "box": [
              {}
            ],
            "cloudbees": [
              {}
            ],
            "concur": [
              {}
            ],
            "dropbox": [
              {}
            ],
            "echosign": [
              {
                "domain": ""
              }
            ],
            "egnyte": [
              {
                "domain": ""
              }
            ],
            "firebase": [
              {
                "client_email": "",
                "lifetime_in_seconds": 0,
                "private_key": "",
                "private_key_id": "",
                "secret": ""
              }
            ],
            "layer": [],
            "mscrm": [],
            "newrelic": [
              {
                "account": ""
              }
            ],
            "office365": [
              {
                "connection": "",
                "domain": ""
              }
            ],
            "rms": [],
            "salesforce": [
              {
                "entity_id": ""
              }
            ],
            "salesforce_api": [
              {
                "client_id": "",
                "community_name": "",
                "community_url_section": "",
                "principal": ""
              }
            ],
            "salesforce_sandbox_api": [
              {
                "client_id": "",
                "community_name": "",
                "community_url_section": "",
                "principal": ""
              }
            ],

The old tfstate for previous versions had:

      "aws": {},
            "azure_blob": {},
            "azure_sb": {},
            "box": {},
            "cloudbees": {},
            "concur": {},
            "dropbox": {},
            "echosign": {},
            "egnyte": {},
            "firebase": {},
            "layer": {},
            "mscrm": {},
            "newrelic": {},

One more observation:

I created an action with node js 18 beta version, but when the code is deployed, it does not change the version to node js 18 GA version. It leaves it as node js 18 beta version.

I have to test to see if it converts node js 16 to node js 18 GA as we currently use version 16 in our environments.

[sergiught]

Hey @timothypgny 👋🏻 this should be now fixed https://registry.terraform.io/providers/auth0/auth0/1.0.0-beta.1. Please make sure you update the version in your terraform configs:

terraform {
  required_providers {
    auth0 = {
      source  = "auth0/auth0"
       version = "1.0.0-beta.1"
    }
  }
}

Please also check the migration guide: https://github.com/auth0/terraform-provider-auth0/blob/main/MIGRATION_GUIDE.md#client-addons.

Let us know if you have any other issues! 🙇🏻

[timothypgny]

Hi @sergiught ,

I just tested with 1.0.0-beta.1 and looks good to me. When will this go to GA?

[sergiught]

Hey @timothypgny 👋🏻

Much appreciated for taking the time to test the beta out 🙇🏻 . Your help is incredibly valuable for the upcoming GA. At the moment that's scheduled for the end of August. We'd like to give everyone enough time to try out the beta so we can iron out any issues anyone might encounter, both with the migration guide and the functionality itself.

We don't foresee any other breaking changes at the moment (unless some bug fixes require so) so staying on the v1.0.0-beta.1 until then should be safe. In case something pops up we'll make sure to be clear about it within the changelog and migration guides.

[timothypgny]

Hi @sergiught,

We will wait for the GA version before migrating all of the actions to node 18 before September 11.

Are there any plans to remove the beta versions in the registry once GA is available?

[sergiught]

Hey @timothypgny 👋🏻

We will not be removing the beta versions from the registry after GA, they'll still be available for download.

[timothypgny]

I did more debugging above.

the SAML2 web app settings were created like so in the previous versions:

{
"createUpnClaim": false,
"digestAlgorithm": "sha1",
"includeAttributeNameFormat": true,
"lifetimeInSeconds": 3600,
"logout": {},
"mapIdentities": false,
"mapUnknownClaimsAsIs": false,
"nameIdentifierFormat": "rn:oasis:names:tc:SAML:2.0:nameid-format:transient",
"passthroughClaimsWithNoMapping": false,
"signatureAlgorithm": "rsa-sha1",
"typedAttributes": true
}

It matches the settings as described in the Auth0 dashboard, but on the beta version, the settings created were like so:

{
"create_upn_claim": false,
"map_unknown_claims_as_is": false,
"passthrough_claims_with_no_mapping": false,
"map_identities": false,
"signature_algorithm": "rsa-sha1",
"digest_algorithm": "sha1",
"lifetime_in_seconds": 3600,
"name_identifier_format": "rn:oasis:names:tc:SAML:2.0:nameid-format:transient",
"typed_attributes": true,
"include_attribute_name_format": true
}

The generated settings do not match the settings as per the Auth0 dashboard.

[timothypgny]

I'm trying a real scenario where i'm trying to update the actions from node 16 to node 18 GA version.

We have actions for the following flows:

1. login
2. pre user registration
3. post user registration
4. machine to machine
5. send phone message

It seems like all of the actions for all of the flows got changes to node 18, but all of the actions for login were not changed. They are still on Node 16.

cdktf deploy shows the following:

           │ Error: 400 Bad Request: Invalid Argument
           │ 
           │   with auth0_action.auth0_action_log_post_login (auth0_action_log_post_login),
           │   on cdk.tf.json line 278, in resource.auth0_action.auth0_action_log_post_login (auth0_action_log_post_login):
           │  278:       },
           │ 
           ╵

It does not say which argument is the invalid one. Where can I get a list of valid arguments so I can figure out where it is failing?

[sergiught]

@timothypgny, are you able to provide a sample config for those that fail?

[timothypgny]

@sergiught,

The post login code (and other actions) look like below:

    log_post_login_action = Action(
        self,
        id_="auth0_action_log_post_login",
        name="Log Successful Login",
        code="some js code",
        dependencies=[
            ActionDependencies(
                name="axios",
                version="1.4",
            ),
        ],
        deploy=True,
        runtime="node18",
        secrets=[
            ActionSecrets(name="APP_ENV", value="dev")
        ],
        supported_triggers=ActionSupportedTriggers(
            id="post-login",
            version="v2",
        ),
    )

[sergiught]

Hey @timothypgny 👋🏻

So after looking at this the first issue I'm seeing is that the v2 of the post-login doesn't support node18 runtime. Could you try modifying that so it uses v3? You can follow this guide to check what runtime versions are supported for each trigger type version: https://registry.terraform.io/providers/auth0/auth0/latest/docs/guides/action_triggers or use the auth0-cli and run auth0 api actions/triggers

[timothypgny]

Hi @sergiught,

Yup, I switched to v3 and all is ok now.

[sergiught]

Awesomes @timothypgny , glad to hear that! 🥳