Skip to content

feat: Add OAuth 2.0 support to mongodbatlas_metric_integration resource #4737

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marcabreracast merged 18 commits into from
Sep 18, 2026
Merged

feat: Add OAuth 2.0 support to mongodbatlas_metric_integration resource #4737

Show file tree
Hide file tree
Changes from 17 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
491431d
Generate OpenAPI spec from dev
marcabreracast Sep 15, 2026
2765560
Add override config for OAuth implementation
marcabreracast Sep 15, 2026
6b66d39
Autogenerate resource
marcabreracast Sep 15, 2026
790eb7b
Autogenerate singular and plural data sources
marcabreracast Sep 15, 2026
a696aa8
Add acceptance tests
marcabreracast Sep 16, 2026
193142a
Generate docs
marcabreracast Sep 16, 2026
1127531
Improve tests with provider consistency
marcabreracast Sep 16, 2026
cc6f5af
test: Gate OAuth metric integration tests to CI and refine error asse…
marcabreracast Sep 16, 2026
f5ff620
chore: Add changelog entry for OAuth metric integration support
marcabreracast Sep 16, 2026
85ab0e4
Refactor tests
marcabreracast Sep 16, 2026
85b96a4
test: Assert oauth fields on the plural metric integration data source
marcabreracast Sep 16, 2026
d70e289
fix: Clear oauth scopes and token_request_params when removed from co…
marcabreracast Sep 16, 2026
63eab95
Update internal/serviceapi/metricintegration/resource_test.go
marcabreracast Sep 17, 2026
3638661
Merge remote-tracking branch 'origin/dev/CLOUDP-412204_OAuth_Support_…
marcabreracast Sep 17, 2026
c1c7b03
chore: Reference CLOUDP-447244 in OAuth test CI gate TODO
marcabreracast Sep 17, 2026
328cf3d
chore: Enrich metric integration OAuth changelog entries
marcabreracast Sep 17, 2026
3dd8b4b
Add acceptance test for switch from OAuth2 to HEADER
marcabreracast Sep 18, 2026
677b705
Address PR comments
marcabreracast Sep 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .changelog/4737.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
```release-note:enhancement
resource/mongodbatlas_metric_integration: Adds OAuth 2.0 support via a new `oauth` block (client-secret or private-key JWT authentication)
```

```release-note:enhancement
data-source/mongodbatlas_metric_integration: Adds OAuth 2.0 support via a new `oauth` block (client-secret or private-key JWT authentication)
```

```release-note:enhancement
data-source/mongodbatlas_metric_integrations: Adds OAuth 2.0 support via a new `oauth` block (client-secret or private-key JWT authentication)
```
24 changes: 24 additions & 0 deletions docs/data-sources/metric_integration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ output "metric_integration_ids" {
- `headers_redacted` (Attributes List) HTTP headers for authentication and configuration. Values are redacted and never returned in plaintext. (see [below for nested schema](#nestedatt--headers_redacted))
- `integration_type` (String) Type of metric integration. Identifies which protocol will be used for the integration.
- `metric_selection` (Set of String) Array of metric categories to export. Determines which types of metrics are sent to the integration.
- `oauth` (Attributes) OAuth 2.0 configuration returned for a metric integration. Secrets are never returned. (see [below for nested schema](#nestedatt--oauth))

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should this say: Attributes list, like line 72 does?

Replace "see below for" with "To learn more, see [nested schema] ((#nestedatt--oauth))

- `provider_type` (String) The provider type for the metric integration. Identifies the third-party service provider.

<a id="nestedatt--headers_redacted"></a>
Expand All @@ -82,4 +83,27 @@ Read-Only:
- `name` (String) Header name.
- `value` (String) Redacted header value.


<a id="nestedatt--oauth"></a>
### Nested Schema for `oauth`

Read-Only:

- `client_auth_method` (String) How the client authenticates to the token endpoint.
- `client_id` (String) OAuth 2.0 client identifier registered with the token endpoint.
- `scopes` (Set of String) OAuth 2.0 scopes requested on the token.
- `signing_key_info` (Attributes) Read-only metadata for the Atlas-managed signing key used by `PRIVATE_KEY_JWT`. Present only for that method. Register the jwks_uri with your identity provider. Atlas rotates the underlying key without changing this URL. (see [below for nested schema](#nestedatt--oauth--signing_key_info))

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should this be Attributes list?

same comment re: learn more.
Question re:
Register the jwks_uri with your identity provider. -- I don't have context as a reader and would be confused. Might need a bit more explanation in words.

- `token_endpoint` (String) OAuth 2.0 token endpoint URL.
- `token_request_params` (Map of String) Provider-specific parameters added to the token request.

<a id="nestedatt--oauth--signing_key_info"></a>
### Nested Schema for `oauth.signing_key_info`

Read-Only:

- `algorithm` (String) Signing algorithm of the Atlas-managed key.
- `created_at` (String) When the currently active signing key was created. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The timestamp for when Atlas created the ....

- `jwks_uri` (String) Public JWKS URL serving this integration's signing keys. Fixed for the lifetime of the integration.

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what does "Fixed for the lifetime of the integration." mean?

might be worth rewording this.
Also this line 106 contains the definition in words for what is jwks uri -- consider using these same words Public JWKS URL in all other places too where this is discussed.

- `kid` (String) Key ID stamped on client assertions, the `SHA-1` thumbprint of the key certificate in uppercase hexadecimal. Changes when Atlas rotates the key.

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't ID in kid be capitalized? kID? Ignore if this is not possible or if this is already an established convention.
Reads strangely otherwise.

Also: Key ID stamped on client assertions, the SHA-1 thumbprint of the key certificate in uppercase hexadecimal. -- this is a run in sentence. Break into two. Start with the fact that this is the key ID that represents the SHA . then say that Atlas stamps it on client assertions. Then talk about its format.


For more information see: [MongoDB Atlas - OTel Integration](https://www.mongodb.com/docs/atlas/tutorial/otel-integration/) Documentation.
24 changes: 24 additions & 0 deletions docs/data-sources/metric_integrations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,7 @@ Read-Only:
- `integration_type` (String) Type of metric integration. Identifies which protocol will be used for the integration.
- `metric_integration_id` (String) Unique identifier of the metric integration configuration.
- `metric_selection` (Set of String) Array of metric categories to export. Determines which types of metrics are sent to the integration.
- `oauth` (Attributes) OAuth 2.0 configuration returned for a metric integration. Secrets are never returned. (see [below for nested schema](#nestedatt--results--oauth))

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same comment for To learn more, see

- `provider_type` (String) The provider type for the metric integration. Identifies the third-party service provider.

<a id="nestedatt--results--headers_redacted"></a>
Expand All @@ -96,4 +97,27 @@ Read-Only:
- `name` (String) Header name.
- `value` (String) Redacted header value.


<a id="nestedatt--results--oauth"></a>
### Nested Schema for `results.oauth`

Read-Only:

- `client_auth_method` (String) How the client authenticates to the token endpoint.
- `client_id` (String) OAuth 2.0 client identifier registered with the token endpoint.
- `scopes` (Set of String) OAuth 2.0 scopes requested on the token.
- `signing_key_info` (Attributes) Read-only metadata for the Atlas-managed signing key used by `PRIVATE_KEY_JWT`. Present only for that method. Register the jwks_uri with your identity provider. Atlas rotates the underlying key without changing this URL. (see [below for nested schema](#nestedatt--results--oauth--signing_key_info))

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same comments as above

- `token_endpoint` (String) OAuth 2.0 token endpoint URL.
- `token_request_params` (Map of String) Provider-specific parameters added to the token request.

<a id="nestedatt--results--oauth--signing_key_info"></a>
### Nested Schema for `results.oauth.signing_key_info`

Read-Only:

- `algorithm` (String) Signing algorithm of the Atlas-managed key.
- `created_at` (String) When the currently active signing key was created. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
- `jwks_uri` (String) Public JWKS URL serving this integration's signing keys. Fixed for the lifetime of the integration.
- `kid` (String) Key ID stamped on client assertions, the `SHA-1` thumbprint of the key certificate in uppercase hexadecimal. Changes when Atlas rotates the key.

For more information see: [MongoDB Atlas - OTel Integration](https://www.mongodb.com/docs/atlas/tutorial/otel-integration/) Documentation.
37 changes: 36 additions & 1 deletion docs/resources/metric_integration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,13 +64,17 @@ output "metric_integration_ids" {
### Required

- `aggregation_temporality` (String) The temporality to send to the metric integration.
- `auth_type` (String) Authentication method the integration uses when exporting metrics to the endpoint. `HEADER` authenticates with the static HTTP headers provided in the `headers` field, which must be set when this value is used.
- `auth_type` (String) Authentication method the integration uses when exporting metrics to the endpoint. `HEADER` authenticates with the static HTTP headers provided in the `headers` field, which must be set when this value is used. `OAUTH2` acquires a bearer token from an OAuth 2.0 token endpoint using the `oauth` field.

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is a run in sentence: HEADER authenticates with the static HTTP headers provided in the headers field, which must be set when this value is used. Break it into two, and name what you mean when you say "which" -- start a new sentence. Then see if the order of these must be changed, so it is logical.

Re last sentence about OATH2, -- does this mean that we have some other oath, and that behaves differently but we only mention the new one but don't qualify the existing one? This will look like it is missing context to the reader who may need to compare. Please consider adding parallel structures:
For this type, ... this behavior happens
For this type (oath2,) this behavior happens

- `endpoint` (String) OpenTelemetry collector endpoint URL. Must use HTTPS.
- `integration_type` (String) Type of metric integration. Identifies which protocol will be used for the integration. This value cannot be modified after the integration is created.
- `metric_selection` (Set of String) Array of metric categories to export. Determines which types of metrics are sent to the integration.
- `project_id` (String) Unique 24-hexadecimal digit string that identifies your project, also known as `groupId` in the official documentation.
- `provider_type` (String) The provider type for the metric integration. Identifies the third-party service provider.

### Optional

@AgustinBettati AgustinBettati Sep 16, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

q: Any examples worth adjusting to cover OAuth?

@marcabreracast marcabreracast Sep 17, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, this will be addressed in CLOUDP-445734


- `oauth` (Attributes) OAuth 2.0 client credentials configuration. Required when auth_type is `OAUTH2`. Secrets are never returned. (see [below for nested schema](#nestedatt--oauth))

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Required -- active voice -- we are asking to specify them.
Secrets are never returned -- active voice -- who never returns them? Atlas never returns secrets.


<!-- polymorphic attributes restructured by docpostprocess -->
The following attributes depend on the value of `auth_type`:

Expand All @@ -93,6 +97,37 @@ Required:
- `value` (String, Sensitive) Header value.


<a id="nestedatt--oauth"></a>
### Nested Schema for `oauth`

Required:

- `client_auth_method` (String) How the client authenticates to the token endpoint. `CLIENT_SECRET` sends a shared secret. `PRIVATE_KEY_JWT` signs a client assertion with an Atlas-generated, Atlas-managed key. Register the returned JWKS URL with your identity provider.

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should registering happen first? I am not sure about the order here.

- `client_id` (String) OAuth 2.0 client identifier registered with the token endpoint.
- `token_endpoint` (String) OAuth 2.0 token endpoint URL. Must use HTTPS.

Optional:

- `client_secret` (String, Sensitive) Shared client secret. Required when client_auth_method is `CLIENT_SECRET`, and rejected for `PRIVATE_KEY_JWT`. Encrypted at rest and never returned.

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

active voice re who encrypts and who never returns.

not clear about the rejected part -- might need a few more details.

- `scopes` (Set of String) Optional OAuth 2.0 scopes requested on the token, sent as a space delimited `scope` parameter. Applies to both client authentication methods.

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

which "both methods" are implied here?
Name them?

Are there any other params that apply to both? Existing params that haven't changed with this PR but that apply to both?

- `token_request_params` (Map of String) Optional provider-specific parameters added to the token request, for example a resource indicator. Applies to both client authentication methods.

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here: name both auth methods to which this applies.


Read-Only:

- `signing_key_info` (Attributes) Read-only metadata for the Atlas-managed signing key used by `PRIVATE_KEY_JWT`. Present only for that method. Register the jwks_uri with your identity provider. Atlas rotates the underlying key without changing this URL. (see [below for nested schema](#nestedatt--oauth--signing_key_info))

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same comments as above for similar content


<a id="nestedatt--oauth--signing_key_info"></a>
### Nested Schema for `oauth.signing_key_info`

Read-Only:

- `algorithm` (String) Signing algorithm of the Atlas-managed key.
- `created_at` (String) When the currently active signing key was created. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

@JuliaMongo JuliaMongo Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same comments as above for similar content.

- `jwks_uri` (String) Public JWKS URL serving this integration's signing keys. Fixed for the lifetime of the integration.
- `kid` (String) Key ID stamped on client assertions, the `SHA-1` thumbprint of the key certificate in uppercase hexadecimal. Changes when Atlas rotates the key.



<a id="nestedatt--headers_redacted"></a>
### Nested Schema for `headers_redacted`

Expand Down
69 changes: 69 additions & 0 deletions internal/serviceapi/metricintegration/data_source_schema.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

69 changes: 69 additions & 0 deletions internal/serviceapi/metricintegration/plural_data_source_schema.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading