Skip to content

refactor: share AuthenticationObj across muxed providers - #194

Closed
badarsebard wants to merge 1 commit into
BeyondTrust:mainfrom
badarsebard:feature/additional_auth_improvements
Closed

refactor: share AuthenticationObj across muxed providers#194
badarsebard wants to merge 1 commit into
BeyondTrust:mainfrom
badarsebard:feature/additional_auth_improvements

Conversation

@badarsebard

Copy link
Copy Markdown
Contributor

Purpose of the PR

Share a single AuthenticationObj (and therefore a single cookie jar / session) across both muxed providers so cross-provider Terraform applies stop hitting 401s.

Linked JIRA issue(s)

  • none

Summary of changes

This provider muxes provider_framework (terraform-plugin-framework) and provider_sdkv2 (terraform-plugin-sdk/v2) into a single binary. Before this change each provider built its own *AuthenticationObj in Configure, each with its own http.Client / cookie jar. A package-level refcount in providers/utils short-circuited the second provider's signin — but only to skip the API call, not to share the cookie. The result: whichever provider signed in second had the valid session; the other made API calls with an invalidated cookie and got 401s.

This PR replaces that machinery with a single shared session built lazily in Configure and torn down in main:

  • providers/utils/session.go (new): InitSharedAuth(cacheKey, build) builds the *AuthenticationObj, performs GetPasswordSafeAuthentication, and caches both under a mutex. Both providers' Configure methods call it; since they compute the same cacheKey from the provider block they hit the cache and reuse one session. ShutdownSharedAuth() signs that session out. ResetSharedAuthForTest() is a test-only escape hatch.
    • cacheKey is derived from URL + apiVersion + credentials + verify_ca + cert name. Acceptance tests that rotate httptest URLs between cases naturally produce a different key and trigger a clean re-init — no per-test plumbing required.
  • providers/utils/methods.go: removed Authenticate, SignOut, AuthMu, SignInCount, signAppinResponse, and DeleteAssetByID. File is now just TestResourceConfig + ValidateChangeFrequencyDays.
  • providers/provider_framework/provider.go: Configure calls InitSharedAuth instead of building + signing in inline.
  • providers/provider_sdkv2/provider.go + common.go: providerConfigure calls InitSharedAuth and returns a new *providerMeta{authObj, signAppin} instead of a raw *AuthenticationObj. The old authenticate(d, m) / signOut(d, m) wrappers in common.go are gone.
  • main.go: calls utils.ShutdownSharedAuth() after tf5server.Serve returns (before any log.Fatal).
  • All framework and sdkv2 resources / data sources / ephemerals: dropped the per-RPC utils.Authenticate(...) and utils.SignOut(...) calls. They now use the shared authenticationObj directly. SDKv2 sites changed m.(*auth.AuthenticationObj)m.(*providerMeta) and read .authObj / .signAppin.
  • providers/provider_framework/assets_resource.go: utils.DeleteAssetByID is gone; the 3 delete sites now call assets.NewAssetObj + DeleteAssetById inline.
  • providers/provider_framework/managed_systems_by_database_resource.go: getManagedSystemObj no longer signs in; APISignOut removed entirely and its 3 call sites cleaned up.
  • Tests: providers/utils/methods_test.go rewritten — old TestAuthenticate / TestSignOut / TestDeleteAssetByID removed, new TestInitSharedAuth_* and TestShutdownSharedAuth_* added. SDKv2 resource tests wrap their raw *AuthenticationObj in &providerMeta{authObj: …}. provider_test.go switched to a mock signin server since providerConfigure now performs the handshake.

Impacted areas: provider auth lifecycle (all resources/data sources across both providers). No user-facing schema changes; HCL is unchanged.

Checklist

Release

  • Priority release required due to Hot fix / Escalation / Critical bug
  • Priority release not required (can be released later with other stories or bugs fixes)

Testing

  • dev — go build ./..., go vet ./..., and TF_ACC=1 go test ./... all green locally (utils, provider_framework, provider_sdkv2)
  • automation (required for feature branch merges and significant changes)
  • manual (required for feature branch merges and significant changes) — needs a manual terraform plan / apply against a real Password Safe instance that mixes framework and sdkv2 resources in one config to confirm 401s are gone

Automation

  • no changes are required
  • existing tests have been updated
  • new tests have been added
  • further changes are required by the automation team

One signin in Configure, one signout in main, shared cookie jar. Fixes 401s caused by framework and sdkv2 each owning their own jar.
@btfhernandez

Copy link
Copy Markdown
Contributor

Replaced by: #196

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants