feat: add oidc_id_token to workspace_owner data source

rowansmithau · rowansmithau · commit 72305aa88411 · 2025-12-02T10:38:10.000+11:00
Adds support for the new CODER_WORKSPACE_OWNER_OIDC_ID_TOKEN environment
variable, exposing the OIDC ID token through the coder_workspace_owner
data source as oidc_id_token.

This complements the existing oidc_access_token field.
diff --git a/docs/data-sources/external_auth.md b/docs/data-sources/external_auth.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_external_auth Data Source - terraform-provider-coder"
+page_title: "coder_external_auth Data Source - coder"
 subcategory: ""
 description: |-
   Use this data source to require users to authenticate with an external service prior to workspace creation. This can be used to pre-authenticate external services https://coder.com/docs/admin/external-auth in a workspace. (e.g. Google Cloud, Github, Docker, etc.)
diff --git a/docs/data-sources/parameter.md b/docs/data-sources/parameter.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_parameter Data Source - terraform-provider-coder"
+page_title: "coder_parameter Data Source - coder"
 subcategory: ""
 description: |-
   Use this data source to configure editable options for workspaces.
diff --git a/docs/data-sources/provisioner.md b/docs/data-sources/provisioner.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_provisioner Data Source - terraform-provider-coder"
+page_title: "coder_provisioner Data Source - coder"
 subcategory: ""
 description: |-
   Use this data source to get information about the Coder provisioner.
diff --git a/docs/data-sources/task.md b/docs/data-sources/task.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_task Data Source - terraform-provider-coder"
+page_title: "coder_task Data Source - coder"
 subcategory: ""
 description: |-
   Use this data source to read information about Coder Tasks.
diff --git a/docs/data-sources/workspace.md b/docs/data-sources/workspace.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_workspace Data Source - terraform-provider-coder"
+page_title: "coder_workspace Data Source - coder"
 subcategory: ""
 description: |-
   Use this data source to get information for the active workspace build.
diff --git a/docs/data-sources/workspace_owner.md b/docs/data-sources/workspace_owner.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_workspace_owner Data Source - terraform-provider-coder"
+page_title: "coder_workspace_owner Data Source - coder"
 subcategory: ""
 description: |-
   Use this data source to fetch information about the workspace owner.
@@ -53,6 +53,7 @@ resource "coder_env" "git_author_email" {
 - `login_type` (String) The type of login the user has.
 - `name` (String) The username of the user.
 - `oidc_access_token` (String, Sensitive) A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.
+- `oidc_id_token` (String, Sensitive) A valid OpenID Connect ID token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.
 - `rbac_roles` (List of Object) The RBAC roles of which the user is assigned. (see [below for nested schema](#nestedatt--rbac_roles))
 - `session_token` (String, Sensitive) Session token for authenticating with a Coder deployment. It is regenerated every time a workspace is started.
 - `ssh_private_key` (String, Sensitive) The user's generated SSH private key.
diff --git a/docs/data-sources/workspace_preset.md b/docs/data-sources/workspace_preset.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_workspace_preset Data Source - terraform-provider-coder"
+page_title: "coder_workspace_preset Data Source - coder"
 subcategory: ""
 description: |-
   Use this data source to predefine common configurations for coder workspaces. Users will have the option to select a defined preset, which will automatically apply the selected configuration. Any parameters defined in the preset will be applied to the workspace. Parameters that are defined by the template but not defined by the preset will still be configurable when creating a workspace.
diff --git a/docs/data-sources/workspace_tags.md b/docs/data-sources/workspace_tags.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_workspace_tags Data Source - terraform-provider-coder"
+page_title: "coder_workspace_tags Data Source - coder"
 subcategory: ""
 description: |-
   Use this data source to configure workspace tags to select provisioners.
diff --git a/docs/resources/agent.md b/docs/resources/agent.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_agent Resource - terraform-provider-coder"
+page_title: "coder_agent Resource - coder"
 subcategory: ""
 description: |-
   Use this resource to associate an agent.
diff --git a/docs/resources/agent_instance.md b/docs/resources/agent_instance.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_agent_instance Resource - terraform-provider-coder"
+page_title: "coder_agent_instance Resource - coder"
 subcategory: ""
 description: |-
   Use this resource to associate an instance ID with an agent for zero-trust authentication. This association is done automatically for "google_compute_instance", "aws_instance", "azurerm_linux_virtual_machine", and "azurerm_windows_virtual_machine" resources.
diff --git a/docs/resources/ai_task.md b/docs/resources/ai_task.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_ai_task Resource - terraform-provider-coder"
+page_title: "coder_ai_task Resource - coder"
 subcategory: ""
 description: |-
   Use this resource to define Coder tasks.
diff --git a/docs/resources/app.md b/docs/resources/app.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_app Resource - terraform-provider-coder"
+page_title: "coder_app Resource - coder"
 subcategory: ""
 description: |-
   Use this resource to define shortcuts to access applications in a workspace.
diff --git a/docs/resources/devcontainer.md b/docs/resources/devcontainer.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_devcontainer Resource - terraform-provider-coder"
+page_title: "coder_devcontainer Resource - coder"
 subcategory: ""
 description: |-
   Define a Dev Container the agent should know of and attempt to autostart.
diff --git a/docs/resources/env.md b/docs/resources/env.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_env Resource - terraform-provider-coder"
+page_title: "coder_env Resource - coder"
 subcategory: ""
 description: |-
   Use this resource to set an environment variable in a workspace. Note that this resource cannot be used to overwrite existing environment variables set on the coder_agent resource.
diff --git a/docs/resources/external_agent.md b/docs/resources/external_agent.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_external_agent Resource - terraform-provider-coder"
+page_title: "coder_external_agent Resource - coder"
 subcategory: ""
 description: |-
   Define an external agent to be used in a workspace.
diff --git a/docs/resources/metadata.md b/docs/resources/metadata.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_metadata Resource - terraform-provider-coder"
+page_title: "coder_metadata Resource - coder"
 subcategory: ""
 description: |-
   Use this resource to attach metadata to a resource. They will be displayed in the Coder dashboard alongside the resource. The resource containing the agent, and it's metadata, will be shown by default.
diff --git a/docs/resources/script.md b/docs/resources/script.md
@@ -1,6 +1,6 @@
 ---
 # generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "coder_script Resource - terraform-provider-coder"
+page_title: "coder_script Resource - coder"
 subcategory: ""
 description: |-
   Use this resource to run a script from an agent. When multiple scripts are assigned to the same agent, they are executed in parallel.
diff --git a/provider/workspace_owner.go b/provider/workspace_owner.go
@@ -54,6 +54,7 @@ func workspaceOwnerDataSource() *schema.Resource {
 
 			_ = rd.Set("session_token", os.Getenv("CODER_WORKSPACE_OWNER_SESSION_TOKEN"))
 			_ = rd.Set("oidc_access_token", os.Getenv("CODER_WORKSPACE_OWNER_OIDC_ACCESS_TOKEN"))
+			_ = rd.Set("oidc_id_token", os.Getenv("CODER_WORKSPACE_OWNER_OIDC_ID_TOKEN"))
 
 			if loginType := os.Getenv("CODER_WORKSPACE_OWNER_LOGIN_TYPE"); loginType != "" {
 				_ = rd.Set("login_type", loginType)
@@ -123,6 +124,14 @@ func workspaceOwnerDataSource() *schema.Resource {
 					"If a valid token cannot be obtained, this value will be an empty string.",
 				Sensitive: true,
 			},
+			"oidc_id_token": {
+				Type:     schema.TypeString,
+				Computed: true,
+				Description: "A valid OpenID Connect ID token of the workspace owner. " +
+					"This is only available if the workspace owner authenticated with OpenID Connect. " +
+					"If a valid token cannot be obtained, this value will be an empty string.",
+				Sensitive: true,
+			},
 			"login_type": {
 				Type:        schema.TypeString,
 				Computed:    true,
diff --git a/provider/workspace_owner_test.go b/provider/workspace_owner_test.go
@@ -33,6 +33,7 @@ func TestWorkspaceOwnerDatasource(t *testing.T) {
 		t.Setenv("CODER_WORKSPACE_OWNER_GROUPS", `["group1", "group2"]`)
 		t.Setenv("CODER_WORKSPACE_OWNER_SESSION_TOKEN", `supersecret`)
 		t.Setenv("CODER_WORKSPACE_OWNER_OIDC_ACCESS_TOKEN", `alsosupersecret`)
+		t.Setenv("CODER_WORKSPACE_OWNER_OIDC_ID_TOKEN", `yetanothersecret`)
 		t.Setenv("CODER_WORKSPACE_OWNER_LOGIN_TYPE", `github`)
 		t.Setenv("CODER_WORKSPACE_OWNER_RBAC_ROLES", `[{"name":"member","org_id":"00000000-0000-0000-0000-000000000000"}]`)
 
@@ -61,6 +62,7 @@ func TestWorkspaceOwnerDatasource(t *testing.T) {
 					assert.Equal(t, `group2`, attrs["groups.1"])
 					assert.Equal(t, `supersecret`, attrs["session_token"])
 					assert.Equal(t, `alsosupersecret`, attrs["oidc_access_token"])
+					assert.Equal(t, `yetanothersecret`, attrs["oidc_id_token"])
 					assert.Equal(t, `github`, attrs["login_type"])
 					assert.Equal(t, `member`, attrs["rbac_roles.0.name"])
 					assert.Equal(t, `00000000-0000-0000-0000-000000000000`, attrs["rbac_roles.0.org_id"])
@@ -79,6 +81,7 @@ func TestWorkspaceOwnerDatasource(t *testing.T) {
 			"CODER_WORKSPACE_OWNER_SESSION_TOKEN",
 			"CODER_WORKSPACE_OWNER_GROUPS",
 			"CODER_WORKSPACE_OWNER_OIDC_ACCESS_TOKEN",
+			"CODER_WORKSPACE_OWNER_OIDC_ID_TOKEN",
 			"CODER_WORKSPACE_OWNER_SSH_PUBLIC_KEY",
 			"CODER_WORKSPACE_OWNER_SSH_PRIVATE_KEY",
 			"CODER_WORKSPACE_OWNER_LOGIN_TYPE",
@@ -112,6 +115,7 @@ func TestWorkspaceOwnerDatasource(t *testing.T) {
 					assert.Empty(t, attrs["groups.0"])
 					assert.Empty(t, attrs["session_token"])
 					assert.Empty(t, attrs["oidc_access_token"])
+					assert.Empty(t, attrs["oidc_id_token"])
 					assert.Empty(t, attrs["login_type"])
 					assert.Empty(t, attrs["rbac_roles.0"])
 					return nil
