Update IdP identifiers to accept a list in access group schema

[Justin-Holmes]

This PR should clean up redundancy in our IdP policy rules and create an API that's consistent with our dashboard UI. Here is an example of the proposed change:

Current

include {
  gsuite {
    email                = "[email protected]"
    identity_provider_id = "xxxx-xxx-xxxx"
  }
  gsuite {
    email                = "[email protected]"
    identity_provider_id = "xxxx-xxx-xxxx"
  }
}

New

include {
  gsuite {
    email                = ["[email protected]", "[email protected]"]
    identity_provider_id = "xxxx-xxx-xxxx"
  }
}

Unfortunately, I wasn't able to run the acceptance tests but I was able to create resources in my local environment without any issues.

[jacobbednarz]

The current test suite is all green however we should probably a new test case to excercise multiple values in https://github.com/terraform-providers/terraform-provider-cloudflare/blob/master/cloudflare/resource_cloudflare_access_group_test.go.

[Justin-Holmes]

@jacobbednarz Sure thing. Do you know if those tests create/destroy actual resources? If so, I think these tests will require an IdP to be created beforehand (along with their respective IdP groups) and I'm not sure I know the best way to go about that.

[jacobbednarz]

Yep, the integration tests do create/destroy real resources however I think we can get away with dummy values like we already do at https://github.com/terraform-providers/terraform-provider-cloudflare/blob/55c2d9946b52853ebb4decaa542842ed72544eb9/cloudflare/resource_cloudflare_access_identity_provider_test.go#L174-L185

Within the test, you can try creating the fake IdP and then attaching the groups to it. I know I had issues with it in the past but I think that was for actual reproduction test cases and not integration testing (as we're really only asserting the Terraform state). Let me know if you have issues though and we can either rely on a mocked values or I'll setup a real SSO provider for it.

[Justin-Holmes]

@jacobbednarz it looks like the acceptance tests are failing because of missing credentials. Let me know if there is anything I can do on my end to help!

[jacobbednarz]

That's all good and thanks for the offer. Myself and @patryk (mainly @patryk though :p) moved the acceptance tests into GitHub Actions and forks don't get the credentials it needs as secrets aren't shared.

I'll run these locally shortly.

[jacobbednarz]

I've pushed up a fix for the resource naming but it still looks like teams/team is missing from the GitHub IdP which we will need. I'm not sure if you're intending on using team or teams but my vote would be for the latter as IIRC, you can have multiple teams.

[Justin-Holmes]

@jacobbednarz thank you, good catch!

[jacobbednarz]

we're green! thanks!

[analytically]

This PR breaks Cloudflare <> Okta for us. 'Error: missing expected [' even though the expected string to string array conversion is there.

[jacobbednarz]

@analytically are you able to provide a new issue with a reproduction case and I can take a look?

[groodt]

I see the same issue on Okta.

[jacobbednarz]

@groodt do you mind opening an issue with a reproduction test case and I'll dig into it?

[analytically]

Sorry don't have time.