feat(credentials): issue service principal client secrets

pkg/connector/connector.go

@@ -25,6 +25,7 @@ func (d *Databricks) ResourceSyncers(ctx context.Context) []connectorbuilder.Res
 		newAccountBuilder(d.client),
 		newGroupBuilder(d.client),
 		newServicePrincipalBuilder(d.client),
+		newServicePrincipalSecretBuilder(d.client),
 		newUserBuilder(d.client),
 		newWorkspaceBuilder(d.client),
 		newRoleBuilder(d.client),

pkg/connector/groups.go

@@ -48,11 +48,7 @@ func groupResource(ctx context.Context, group *databricks.Group, parent *v2.Reso
 		"parent_id":    parent.GetResource(),
 	}
 
-	groupTraitOptions := []rs.GroupTraitOption{
-		rs.WithGroupProfile(profile),
-	}
-
-	var options []rs.ResourceOption
+	options := []rs.ResourceOption{rs.WithResourceProfile(profile)}
 	if parent != nil {
 		options = append(options, rs.WithParentResourceID(parent))
 	}
@@ -62,7 +58,7 @@ func groupResource(ctx context.Context, group *databricks.Group, parent *v2.Reso
 		group.DisplayName,
 		groupResourceType,
 		groupId,
-		groupTraitOptions,
+		nil,
 		options...,
 	)
 

pkg/connector/resource_types.go

@@ -2,6 +2,7 @@ package connector
 
 import (
 	v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
+	"github.com/conductorone/baton-sdk/pkg/annotations"
 )
 
 var (
@@ -25,6 +26,17 @@ var (
 		Id:          "service_principal",
 		DisplayName: "Service Principal",
 		Traits:      []v2.ResourceType_Trait{v2.ResourceType_TRAIT_GROUP},
+		Annotations: annotations.New(&v2.ChildResourceType{ResourceTypeId: servicePrincipalSecretResourceType.Id}),
+	}
+
+	servicePrincipalSecretResourceType = &v2.ResourceType{
+		Id:          "service_principal_secret",
+		DisplayName: "Service Principal Secret",
+		Traits:      []v2.ResourceType_Trait{v2.ResourceType_TRAIT_SECRET},
+		Annotations: annotations.New(
+			&v2.SkipEntitlementsAndGrants{},
+			&v2.OptInRequired{},
+		),
 	}
 
 	// The role resource type is for all static roles and entitlements available in API.

pkg/connector/roles.go

@@ -57,16 +57,13 @@ func roleResource(ctx context.Context, role string, parent *v2.ResourceId) (*v2.
 		roleID = role
 	}
 
-	roleTraitOptions := []rs.RoleTraitOption{
-		rs.WithRoleProfile(profile),
-	}
-
 	resource, err := rs.NewRoleResource(
 		role,
 		roleResourceType,
 		roleID,
-		roleTraitOptions,
+		nil,
 		rs.WithParentResourceID(parent),
+		rs.WithResourceProfile(profile),
 	)
 
 	if err != nil {
@@ -136,12 +133,7 @@ func (r *roleBuilder) Entitlements(
 func (r *roleBuilder) Grants(ctx context.Context, resource *v2.Resource, attr rs.SyncOpAttrs) ([]*v2.Grant, *rs.SyncOpResults, error) {
 	var rv []*v2.Grant
 
-	roleTrait, err := rs.GetRoleTrait(resource)
-	if err != nil {
-		return nil, nil, fmt.Errorf("databricks-connector: failed to get role trait: %w", err)
-	}
-
-	parentType, parentID, err := getParentInfoFromProfile(roleTrait.Profile)
+	parentType, parentID, err := getParentInfoFromProfile(resource.GetProfile())
 	if err != nil {
 		return nil, nil, fmt.Errorf("databricks-connector: failed to get parent info from role profile: %w", err)
 	}
@@ -154,7 +146,7 @@ func (r *roleBuilder) Grants(ctx context.Context, resource *v2.Resource, attr rs
 		workspaceId = parentID
 	}
 
-	roleName, ok := rs.GetProfileStringValue(roleTrait.Profile, "role_name")
+	roleName, ok := rs.GetProfileStringValue(resource.GetProfile(), "role_name")
 	if !ok {
 		return nil, nil, fmt.Errorf("databricks-connector: failed to get role type from role profile")
 	}
@@ -313,12 +305,7 @@ func (r *roleBuilder) Grant(ctx context.Context, principal *v2.Resource, entitle
 		return nil, fmt.Errorf("databricks-connector: only users, groups and service principals can be granted role membership")
 	}
 
-	roleTrait, err := rs.GetRoleTrait(entitlement.Resource)
-	if err != nil {
-		return nil, fmt.Errorf("databricks-connector: failed to get role trait: %w", err)
-	}
-
-	parentType, parentID, err := getParentInfoFromProfile(roleTrait.Profile)
+	parentType, parentID, err := getParentInfoFromProfile(entitlement.Resource.GetProfile())
 	if err != nil {
 		return nil, fmt.Errorf("databricks-connector: failed to get parent info from role profile: %w", err)
 	}
@@ -394,12 +381,7 @@ func (r *roleBuilder) Revoke(ctx context.Context, grant *v2.Grant) (annotations.
 		return nil, fmt.Errorf("databricks-connector: only users, groups and service principals can have role membership revoked")
 	}
 
-	roleTrait, err := rs.GetRoleTrait(entitlement.Resource)
-	if err != nil {
-		return nil, fmt.Errorf("databricks-connector: failed to get role trait: %w", err)
-	}
-
-	parentType, parentID, err := getParentInfoFromProfile(roleTrait.Profile)
+	parentType, parentID, err := getParentInfoFromProfile(entitlement.Resource.GetProfile())
 	if err != nil {
 		return nil, fmt.Errorf("databricks-connector: failed to get parent info from role profile: %w", err)
 	}

pkg/connector/service-principals.go

@@ -8,6 +8,7 @@ import (
 	"github.com/conductorone/baton-databricks/pkg/databricks"
 	v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
 	"github.com/conductorone/baton-sdk/pkg/annotations"
+	"github.com/conductorone/baton-sdk/pkg/connectorbuilder"
 	ent "github.com/conductorone/baton-sdk/pkg/types/entitlement"
 	"github.com/conductorone/baton-sdk/pkg/types/grant"
 	rs "github.com/conductorone/baton-sdk/pkg/types/resource"
@@ -21,6 +22,13 @@ type servicePrincipalBuilder struct {
 	resourceType *v2.ResourceType
 }
 
+type credentialIssuingServicePrincipalBuilder struct {
+	*servicePrincipalBuilder
+	createSecret func(context.Context, string, string) (*databricks.ServicePrincipalSecret, error)
+}
+
+var _ connectorbuilder.CredentialIssuerV2 = (*credentialIssuingServicePrincipalBuilder)(nil)
+
 func (s *servicePrincipalBuilder) ResourceType(ctx context.Context) *v2.ResourceType {
 	return servicePrincipalResourceType
 }
@@ -33,10 +41,6 @@ func (s *servicePrincipalBuilder) servicePrincipalResource(ctx context.Context,
 		"parent_id":      parent.Resource,
 	}
 
-	servicePrincipalTraitOptions := []rs.GroupTraitOption{
-		rs.WithGroupProfile(profile),
-	}
-
 	// keep the parent resource id, only if the parent resource is account
 	var options []rs.ResourceOption
 	if parent.ResourceType == accountResourceType.Id {
@@ -49,12 +53,13 @@ func (s *servicePrincipalBuilder) servicePrincipalResource(ctx context.Context,
 		v2.NonHumanIdentityTrait_NHI_TYPE_APP_REGISTRATION,
 		"databricks.service_principal",
 	))
+	options = append(options, rs.WithResourceProfile(profile))
 
 	resource, err := rs.NewGroupResource(
 		servicePrincipal.DisplayName,
 		servicePrincipalResourceType,
 		servicePrincipal.ID,
-		servicePrincipalTraitOptions,
+		nil,
 		options...,
 	)
 
@@ -116,12 +121,7 @@ func (s *servicePrincipalBuilder) List(ctx context.Context, parentResourceID *v2
 func (s *servicePrincipalBuilder) Entitlements(_ context.Context, resource *v2.Resource, _ rs.SyncOpAttrs) ([]*v2.Entitlement, *rs.SyncOpResults, error) {
 	var rv []*v2.Entitlement
 
-	groupTrait, err := rs.GetGroupTrait(resource)
-	if err != nil {
-		return nil, nil, fmt.Errorf("databricks-connector: failed to get group trait: %w", err)
-	}
-
-	parentType, parentID, err := getParentInfoFromProfile(groupTrait.Profile)
+	parentType, parentID, err := getParentInfoFromProfile(resource.GetProfile())
 	if err != nil {
 		return nil, nil, fmt.Errorf("databricks-connector: failed to get parent info from group profile: %w", err)
 	}
@@ -131,7 +131,7 @@ func (s *servicePrincipalBuilder) Entitlements(_ context.Context, resource *v2.R
 		workspaceId = parentID
 	}
 
-	applicationId, ok := rs.GetProfileStringValue(groupTrait.Profile, "application_id")
+	applicationId, ok := rs.GetProfileStringValue(resource.GetProfile(), "application_id")
 	if !ok {
 		return nil, nil, fmt.Errorf("databricks-connector: failed to get application_id from service principal profile")
 	}
@@ -161,12 +161,7 @@ func (s *servicePrincipalBuilder) Entitlements(_ context.Context, resource *v2.R
 func (s *servicePrincipalBuilder) Grants(ctx context.Context, resource *v2.Resource, _ rs.SyncOpAttrs) ([]*v2.Grant, *rs.SyncOpResults, error) {
 	l := ctxzap.Extract(ctx)
 
-	groupTrait, err := rs.GetGroupTrait(resource)
-	if err != nil {
-		return nil, nil, fmt.Errorf("databricks-connector: failed to get group trait: %w", err)
-	}
-
-	parentType, parentID, err := getParentInfoFromProfile(groupTrait.Profile)
+	parentType, parentID, err := getParentInfoFromProfile(resource.GetProfile())
 	if err != nil {
 		return nil, nil, fmt.Errorf("databricks-connector: failed to get parent info from group profile: %w", err)
 	}
@@ -176,7 +171,7 @@ func (s *servicePrincipalBuilder) Grants(ctx context.Context, resource *v2.Resou
 		workspaceId = parentID
 	}
 
-	applicationId, ok := rs.GetProfileStringValue(groupTrait.Profile, "application_id")
+	applicationId, ok := rs.GetProfileStringValue(resource.GetProfile(), "application_id")
 	if !ok {
 		return nil, nil, fmt.Errorf("databricks-connector: failed to get application_id from service principal profile")
 	}
@@ -235,12 +230,7 @@ func (s *servicePrincipalBuilder) Grant(ctx context.Context, principal *v2.Resou
 		return nil, fmt.Errorf("databricks-connector: only users, groups and service principals can be granted service principal permissions")
 	}
 
-	groupTrait, err := rs.GetGroupTrait(entitlement.Resource)
-	if err != nil {
-		return nil, fmt.Errorf("databricks-connector: failed to get group trait: %w", err)
-	}
-
-	parentType, parentID, err := getParentInfoFromProfile(groupTrait.Profile)
+	parentType, parentID, err := getParentInfoFromProfile(entitlement.Resource.GetProfile())
 	if err != nil {
 		return nil, fmt.Errorf("databricks-connector: failed to get parent info from group profile: %w", err)
 	}
@@ -250,7 +240,7 @@ func (s *servicePrincipalBuilder) Grant(ctx context.Context, principal *v2.Resou
 		workspaceId = parentID
 	}
 
-	applicationId, ok := rs.GetProfileStringValue(groupTrait.Profile, "application_id")
+	applicationId, ok := rs.GetProfileStringValue(entitlement.Resource.GetProfile(), "application_id")
 	if !ok {
 		return nil, fmt.Errorf("databricks-connector: failed to get application_id from service principal profile")
 	}
@@ -318,12 +308,7 @@ func (s *servicePrincipalBuilder) Revoke(ctx context.Context, grant *v2.Grant) (
 		return nil, fmt.Errorf("databricks-connector: only users, groups and service principals can have service principal permissions revoked")
 	}
 
-	groupTrait, err := rs.GetGroupTrait(entitlement.Resource)
-	if err != nil {
-		return nil, fmt.Errorf("databricks-connector: failed to get group trait: %w", err)
-	}
-
-	parentType, parentID, err := getParentInfoFromProfile(groupTrait.Profile)
+	parentType, parentID, err := getParentInfoFromProfile(entitlement.Resource.GetProfile())
 	if err != nil {
 		return nil, fmt.Errorf("databricks-connector: failed to get parent info from group profile: %w", err)
 	}
@@ -333,7 +318,7 @@ func (s *servicePrincipalBuilder) Revoke(ctx context.Context, grant *v2.Grant) (
 		workspaceId = parentID
 	}
 
-	applicationId, ok := rs.GetProfileStringValue(groupTrait.Profile, "application_id")
+	applicationId, ok := rs.GetProfileStringValue(entitlement.Resource.GetProfile(), "application_id")
 	if !ok {
 		return nil, fmt.Errorf("databricks-connector: failed to get application_id from service principal profile")
 	}
@@ -393,9 +378,16 @@ func (s *servicePrincipalBuilder) Revoke(ctx context.Context, grant *v2.Grant) (
 	return nil, nil
 }
 
-func newServicePrincipalBuilder(client *databricks.Client) *servicePrincipalBuilder {
-	return &servicePrincipalBuilder{
+func newServicePrincipalBuilder(client *databricks.Client) connectorbuilder.ResourceSyncerV2 {
+	base := &servicePrincipalBuilder{
 		client:       client,
 		resourceType: servicePrincipalResourceType,
 	}
+	if !client.HasAccountConfiguration() {
+		return base
+	}
+	return &credentialIssuingServicePrincipalBuilder{
+		servicePrincipalBuilder: base,
+		createSecret:            client.CreateServicePrincipalSecret,
+	}
 }