Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Discrete feature to create multiple AAD Group Owners #435

Open
nitmatgeo opened this issue May 17, 2021 · 7 comments
Open

Discrete feature to create multiple AAD Group Owners #435

nitmatgeo opened this issue May 17, 2021 · 7 comments

Comments

@nitmatgeo
Copy link

nitmatgeo commented May 17, 2021

Community Note

  • Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
  • Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
  • If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

I would like to recommend to add another Resource: azuread_group_owners similar to azuread_group_member. This will help to configure multiple owners or add/remove owners, otherwise, this is causing an issue when we use CSV files to create groups/owners.

Please let me know if this could be implemented, it should be easy and very similar to azuread_group_member.

New or Affected Resource(s)

  • azuread_group_owner

Potential Terraform Configuration

resource "azuread_group_owner" "test" {
  group_object_id  = azuread_group.example.id
  owner_object_id = data.azuread_user.example.id
}
@manicminer
Copy link
Contributor

Hi @nitmatgeo, thanks for requesting. I've gone ahead and updated your initial comment using our issue template for feature requests as this aids us in reviewing.

You are correct this should be a relatively straightforward resource to implement. At the moment, the AzureAD provider is in a feature freeze whilst we implement major changes for the ongoing Microsoft Graph transition. However, once we are able to merge new features we'll be able to work on this.

@manicminer
Copy link
Contributor

Due to ongoing API issues I'm going to mark this one as blocked for now.

For context, since moving to MS Graph and then again after adding support for unified groups (aka M365/O365 groups) we've had to take great care to conform to new constraints on group ownership whilst maintaining compatibility for Terraform users who may or may not have permissions to read/write all groups in their tenant. At this time we are complying with these constraints, however reports continue of potential API errors, and so to avoid breaking existing configurations this feature will be on hold until we have further clarification. Thanks!

@pcornelissen
Copy link

Well, the problem is still present in recent azuread terraform + public azure-api combinations.
Right now I can't create a group via terraform, because I the duplicate owner error with http status 400.
If there is right now a problem that somehow the owner get's assigned twice somewhere along the call chain, why is that not silently discarded at least until the internal problem is fixed.
The intent is to create the group and the desired owner is clearly present in the request (although it's duplicated, but still the intent is crystal clear). Why can't you just ignore the duplicate value in this case and treat it as "set" instead of a list?

@sumitkatre123
Copy link

any news/update it is pushing us away from terraform and forcing to do things manually ?

@sumitkatre123
Copy link

or any workaround would be great :)

@VPPetr
Copy link

VPPetr commented Jul 18, 2024

is there anything as a workaround?

@manicminer
Copy link
Contributor

This is blocked by various API issues including #1435

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants