reCAPTCHA values aren't populated in keycloak.authentication.ExecutionConfig

[shaidar]

Describe the bug

I use pulumi to manage Keycloak and ran into the following issue. Regardless of what values are passed in the config of keycloak.authentication.ExecutionConfig, when checking the Keycloak UI, the values are not populated and no error is thrown by pulumi during its run. Tried different string values with no success. In order to check whether that's a Pulumi issue or whether the main issue is coming from the terraform provider, I wrote a basic terraform script to try and populate the reCAPTCHA config values, however that was throwing the error below. Setting the values using the Keycloak API worked and I was also able to very that registration-recaptcha-action exists as a provider id.

keycloak_authentication_execution.recaptcha: Creating...
╷
│ Error: error sending POST request to /admin/realms/olapps/authentication/flows/recaptcha-only-flow/executions/execution: 400 Bad Request. Response body: {"error":"No authentication provider found for id: registration-recaptcha-action"}
│
│   with keycloak_authentication_execution.recaptcha,
│   on main.tf line 66, in resource "keycloak_authentication_execution" "recaptcha":
│   66: resource "keycloak_authentication_execution" "recaptcha" {

Version

26.0.7

Expected behavior

reCAPTCHA site and secret key are populated.

Actual behavior

reCAPTCHA site and secret key are blank.

How to Reproduce?

terraform {
  required_providers {
    keycloak = {
      source = "keycloak/keycloak"
      version = "5.0.0"
    }
  }
}

# Variables
variable "keycloak_url" {
  type        = string
  description = "The URL of the Keycloak instance"
  nullable    = false
}

variable "keycloak_realm" {
  type        = string
  description = "The Keycloak realm name"
  default     = "olapps"
}

variable "keycloak_client_id" {
  type        = string
  description = "The client ID for Keycloak authentication"
  nullable    = false
}

variable "keycloak_client_secret" {
  type        = string
  description = "The client secret for Keycloak authentication"
  sensitive   = true
  nullable    = false
}

variable "recaptcha_site_key" {
  type        = string
  description = "Google reCAPTCHA site key"
  nullable    = false
}

variable "recaptcha_secret_key" {
  type        = string
  description = "Google reCAPTCHA secret key"
  sensitive   = true
  nullable    = false
}

# Provider configuration
provider "keycloak" {
  client_id     = var.keycloak_client_id
  client_secret = var.keycloak_client_secret
  url           = var.keycloak_url
  realm         = var.keycloak_realm
}

# Create new authentication flow
resource "keycloak_authentication_flow" "recaptcha_flow" {
  realm_id    = var.keycloak_realm
  alias       = "recaptcha-only-flow"
  description = "Flow with only reCAPTCHA verification"
  provider_id = "client-flow"
}

# Add reCAPTCHA execution to the flow
resource "keycloak_authentication_execution" "recaptcha" {
  realm_id          = var.keycloak_realm
  parent_flow_alias = keycloak_authentication_flow.recaptcha_flow.alias
  authenticator     = "registration-recaptcha-action"  # Changed from registration-recaptcha-action
  requirement       = "REQUIRED"

  depends_on = [keycloak_authentication_flow.recaptcha_flow]
}

# Configure reCAPTCHA execution
resource "keycloak_authentication_execution_config" "recaptcha_config" {
  realm_id     = var.keycloak_realm
  execution_id = keycloak_authentication_execution.recaptcha.id
  alias        = "recaptcha-config"

  config = {
    "site.key"   = var.recaptcha_site_key
    "secret.key" = var.recaptcha_secret_key
  }

  depends_on = [keycloak_authentication_execution.recaptcha]
}

# Outputs
output "flow_id" {
  value       = keycloak_authentication_flow.recaptcha_flow.id
  description = "ID of the created authentication flow"
}

output "recaptcha_execution_id" {
  value       = keycloak_authentication_execution.recaptcha.id
  description = "ID of the reCAPTCHA execution"
}

output "recaptcha_config_id" {
  value       = keycloak_authentication_execution_config.recaptcha_config.id
  description = "ID of the reCAPTCHA configuration"
}

Anything else?

pulumi/pulumi-keycloak#655