Documentation
¶
Overview ¶
Package securitycloudtenant resolves the ID of the Jamf Security Cloud tenant the provider's credentials act on, which is what a ZTNA gateway's or grouped gateway's `tenantIds` names when the configuration leaves it out.
The value is the Security Cloud tenant's own ID: the one Jamf Account lists for the Jamf Security Cloud service of a platform environment, the `customerId` in the admin console's URL, and the `customerId` a UEM Connect connector on that tenant reports. The gateway service calls the field `customerIds` in its own error messages. The server does not default it: a create omitting `tenantIds`, or sending `[]`, is refused `400 [INVALID_FIELD] customerIds: must not be empty` (wire-probed on the EU gateway under X-Environment-Id, 2026-09-30).
Two sources are reliable, and Resolve tries them in order.
- Under tenant scope the configured `X-Tenant-Id` is the tenant, because a Security Cloud construct is only reachable there with a Security Cloud tenant's ID.
- Under environment scope the UEM Connect connector's documented `customerId` is. A tenant may hold none. It holds at most one, except that the spec lets a Jamf Pro and a Wizy connector coexist, and the US acceptance environment holds that pair, both reporting the same `customerId` (2026-09-30).
Nothing else carries the ID. With the connector deleted, 2026-09-30, the connector list came back empty and no documented Security Cloud read returned the ID in a body or a header. The one exception is the `Link` header of the deprecated, spec-withdrawn `GET /v1/groups`, whose `Deprecation` date has passed; the SDK has no method for that route and exposes no response headers, so reading it would mean an unlogged hand-built request, and it is deliberately not a source. The account-organization API ("environments and tenants") is the lookup that would cover every case, but its gateway mount answers a plain-text 404, and every published Jamf Account namespace is reachable only under organization scope, which no Security Cloud construct runs under.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNoSource = errors.New("no UEM Connect integration names the Security Cloud tenant")
ErrNoSource reports that the provider is environment-scoped and the tenant holds no UEM Connect connector, so nothing readable names the Security Cloud tenant.
Functions ¶
func AppendUnresolved ¶
func AppendUnresolved(diags *diag.Diagnostics, attr path.Path, err error)
AppendUnresolved adds the error for a tenant_ids that is unset and could not be resolved, attributed to attr.
func Resolve ¶
Resolve returns the Security Cloud tenant ID for scopeTenantID, the configured tenant-scope ID ("" under any other scope), falling back to the connectors list reports.
More than one distinct `customerId` across the connectors is an error rather than a choice. Every connector on a tenant belongs to that tenant, so disagreement means the assumption this package rests on no longer holds, and picking one would grant a gateway to a tenant nobody named.
Types ¶
type ConnectorLister ¶
type ConnectorLister func(ctx context.Context) (*securitycloud.ConnectorPage, error)
ConnectorLister reads the tenant's UEM Connect connectors. Callers pass a closure over their own client's ListUemConnectorsV1 so the call stays visible to their permissions check.
Source Files