qumulo_saml_settings (Resource)

Manages SAML authentication settings on a Qumulo cluster.

This is a singleton resource (one per cluster). It configures SAML-based single sign-on (SSO) authentication with an external identity provider (IdP).

~> Warning: Setting require_sso = true will block password-based authentication for Active Directory users. If Terraform authenticates to this cluster using AD credentials, subsequent Terraform operations will fail. Use a local admin account for Terraform, or ensure SSO authentication is fully tested before enabling this setting.

~> Important: On terraform destroy, this resource disables SAML authentication (enabled = false). If the cluster had SAML configured before Terraform management, destroying this resource will break existing SSO access.

Example Usage

Installation

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

Basic SAML Configuration

resource "qumulo_saml_settings" "main" {
  connection_profile = "prod"

  enabled          = true
  idp_sso_url      = "https://idp.example.com/sso"
  idp_certificate  = file("${path.module}/idp-cert.pem")
  idp_entity_id    = "https://idp.example.com/entity"
  cluster_dns_name = "cluster.example.com"
  require_sso      = false
}

SAML with Required SSO

# WARNING: This will block password auth for AD users
# Ensure your connection profile uses a local admin, not an AD user
resource "qumulo_saml_settings" "strict" {
  connection_profile = "prod"

  enabled          = true
  idp_sso_url      = "https://idp.example.com/sso"
  idp_certificate  = file("${path.module}/idp-cert.pem")
  idp_entity_id    = "https://idp.example.com/entity"
  cluster_dns_name = "cluster.example.com"
  require_sso      = true
}

Multi-Cluster with for_each

variable "clusters" {
  type = set(string)
  default = ["prod", "dr"]
}

resource "qumulo_saml_settings" "main" {
  for_each = var.clusters

  connection_profile = each.value

  enabled          = true
  idp_sso_url      = "https://idp.example.com/sso"
  idp_certificate  = file("${path.module}/idp-cert.pem")
  idp_entity_id    = "https://idp.example.com/entity"
  cluster_dns_name = "cluster.example.com"
  require_sso      = false
}

Schema

Required

• connection_profile (String) Name of a connection profile defined in the provider block.

Connection profiles centralize cluster credentials at the provider level. Define profiles in the provider block:

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "prod"
      endpoint             = "https://cluster.example.com:8000"
      username             = "admin"
      password             = var.cluster_password
      insecure_skip_verify = true  # For self-signed certificates
    }
  ]
}

Optional

• cluster_dns_name (String) Cluster DNS name (e.g., 'cluster.domain.com'). Used to construct the Service Provider entity ID and assertion consumer service URL.
• enabled (Boolean) Enable SAML authentication. Defaults to false.
• idp_certificate (String, Sensitive) IdP X.509 certificate in PEM format. Used to validate SAML responses from the IdP. Marked sensitive to prevent display in logs (it's a public certificate, but multi-line).
• idp_entity_id (String) IdP entity ID (URI). This identifies the identity provider.
• idp_sso_url (String) Identity Provider SSO URL. This is the URL where authentication requests are sent.
• require_sso (Boolean) Require SSO for Active Directory users. When enabled, password-based authentication is blocked for AD users on the Web UI, qq CLI, and REST API. WARNING: If Terraform uses AD credentials to manage this cluster, enabling this will lock out Terraform. Defaults to false.