feat: implement AddZitadelProvider in ManagementService (#12056)

# Which Problems Are Solved

This PR adds implementation to add a Zitadel IdP at the
organization-level.

# How the Problems Are Solved
- Added handling/converters for the `AddZitadelProvider` endpoint in
`ManagementService` in the server layer
- Registered a new `org.idp.zitadel.added` event for org-level Zitadel
providers
- Added `AddOrgZitadelProvider` command to validate the request and push
`org.idp.zitadel.added` event to the eventstore
- Added the `org.idp.zitadel.added` event to the projection reducer
- Added unit and integration tests

# Additional Changes
added more tests for the ZitadelProvider in AdminService

# Additional Context
- Closes https://github.com/zitadel/zitadel/issues/11823
- Follow-up for PRs https://github.com/zitadel/zitadel/pull/12018,
https://github.com/zitadel/zitadel/pull/12020,
https://github.com/zitadel/zitadel/pull/12055

internal/api/grpc/admin/idp_converter.go

@@ -1,8 +1,6 @@
 package admin
 
 import (
-	"strings"
-
 	"github.com/crewjam/saml"
 	"github.com/muhlemmer/gu"
 	dsig "github.com/russellhaering/goxmldsig"
@@ -553,10 +551,11 @@ func addZitadelProviderToCommand(req *admin_pb.AddZitadelProviderRequest) comman
 	instanceRolesInfo := make([]idp.RolesInfo, 0, len(req.InstanceRolesInfo))
 	for _, info := range req.InstanceRolesInfo {
 		instanceRolesInfo = append(instanceRolesInfo, idp.RolesInfo{
-			OrganizationID:     strings.TrimSpace(info.OrganizationId),
-			OrganizationDomain: strings.TrimSpace(info.OrganizationDomain),
+			OrganizationID:     info.OrganizationId,
+			OrganizationDomain: info.OrganizationDomain,
 		})
 	}
+
 	return command.ZitadelProvider{
 		Name:              req.Name,
 		Issuer:            req.Issuer,

internal/api/grpc/admin/idp_converter_test.go

@@ -207,6 +207,35 @@ func Test_addZitadelProviderToCommand(t *testing.T) {
 		req  *admin_pb.AddZitadelProviderRequest
 		want command.ZitadelProvider
 	}{
+		{
+			name: "without instance roles info",
+			req: &admin_pb.AddZitadelProviderRequest{
+				Name:         "Zitadel Support IdP",
+				ClientId:     "test-client",
+				ClientSecret: "test-secret",
+				Scopes:       []string{"email", "profile", "urn:zitadel:iam:org:project:roles"},
+				ProviderOptions: &idp_pb.Options{
+					IsLinkingAllowed:  false,
+					IsCreationAllowed: true,
+					IsAutoCreation:    false,
+					IsAutoUpdate:      true,
+					AutoLinking:       0,
+				},
+			},
+			want: command.ZitadelProvider{
+				Name:         "Zitadel Support IdP",
+				ClientID:     "test-client",
+				ClientSecret: "test-secret",
+				Scopes:       []string{"email", "profile", "urn:zitadel:iam:org:project:roles"},
+				IDPOptions: idp.Options{
+					IsCreationAllowed: true,
+					IsAutoCreation:    false,
+					IsLinkingAllowed:  false,
+					IsAutoUpdate:      true,
+				},
+				InstanceRolesInfo: []idp.RolesInfo{},
+			},
+		},
 		{
 			name: "all fields filled",
 			req: &admin_pb.AddZitadelProviderRequest{

internal/api/grpc/admin/integration_test/idp_test.go

@@ -12,6 +12,7 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
+	"github.com/zitadel/zitadel/internal/integration"
 	admin_pb "github.com/zitadel/zitadel/pkg/grpc/admin"
 	idp_pb "github.com/zitadel/zitadel/pkg/grpc/idp"
 	object_pb "github.com/zitadel/zitadel/pkg/grpc/object"
@@ -28,6 +29,34 @@ func Test_AddZitadelProvider(t *testing.T) {
 		wantErr      error
 		wantResponse *admin_pb.AddZitadelProviderResponse
 	}{
+		{
+			name: "no permissions, error",
+			args: args{
+				ctx: Instance.WithAuthorizationToken(CTX, integration.UserTypeNoPermission),
+				req: &admin_pb.AddZitadelProviderRequest{
+					Name:         "Zitadel Support IdP",
+					Issuer:       "zitadel.example.com",
+					ClientId:     "test-client",
+					ClientSecret: "test-secret",
+					Scopes:       []string{"email", "profile"},
+				},
+			},
+			wantErr: status.Error(codes.NotFound, "membership not found (AUTHZ-cdgFk)"),
+		},
+		{
+			name: "insufficient permissions, error",
+			args: args{
+				ctx: Instance.WithAuthorizationToken(CTX, integration.UserTypeLogin),
+				req: &admin_pb.AddZitadelProviderRequest{
+					Name:         "Zitadel Support IdP",
+					Issuer:       "zitadel.example.com",
+					ClientId:     "test-client",
+					ClientSecret: "test-secret",
+					Scopes:       []string{"email", "profile"},
+				},
+			},
+			wantErr: status.Error(codes.PermissionDenied, "No matching permissions found (AUTH-5mWD2)"),
+		},
 		{
 			name: "missing required field: name",
 			args: args{

internal/api/grpc/management/idp.go

@@ -458,3 +458,14 @@ func (s *Server) DeleteProvider(ctx context.Context, req *mgmt_pb.DeleteProvider
 		Details: object_pb.DomainToChangeDetailsPb(details),
 	}, nil
 }
+
+func (s *Server) AddZitadelProvider(ctx context.Context, req *mgmt_pb.AddZitadelProviderRequest) (*mgmt_pb.AddZitadelProviderResponse, error) {
+	id, details, err := s.command.AddOrgZitadelProvider(ctx, authz.GetCtxData(ctx).OrgID, addZitadelProviderToCommand(req))
+	if err != nil {
+		return nil, err
+	}
+	return &mgmt_pb.AddZitadelProviderResponse{
+		Id:      id,
+		Details: object_pb.DomainToAddDetailsPb(details),
+	}, nil
+}

internal/api/grpc/management/idp_converter.go

@@ -14,6 +14,7 @@ import (
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/eventstore/v1/models"
 	"github.com/zitadel/zitadel/internal/query"
+	"github.com/zitadel/zitadel/internal/repository/idp"
 	"github.com/zitadel/zitadel/internal/zerrors"
 	idp_pb "github.com/zitadel/zitadel/pkg/grpc/idp"
 	mgmt_pb "github.com/zitadel/zitadel/pkg/grpc/management"
@@ -538,3 +539,23 @@ func signatureAlgorithmToCommand(signatureAlgorithm idp_pb.SAMLSignatureAlgorith
 		return ""
 	}
 }
+
+func addZitadelProviderToCommand(req *mgmt_pb.AddZitadelProviderRequest) command.ZitadelProvider {
+	instanceRolesInfo := make([]idp.RolesInfo, 0, len(req.InstanceRolesInfo))
+	for _, info := range req.InstanceRolesInfo {
+		instanceRolesInfo = append(instanceRolesInfo, idp.RolesInfo{
+			OrganizationID:     info.OrganizationId,
+			OrganizationDomain: info.OrganizationDomain,
+		})
+	}
+
+	return command.ZitadelProvider{
+		Name:              req.Name,
+		Issuer:            req.Issuer,
+		ClientID:          req.ClientId,
+		ClientSecret:      req.ClientSecret,
+		Scopes:            req.Scopes,
+		IDPOptions:        idp_grpc.OptionsToCommand(req.ProviderOptions),
+		InstanceRolesInfo: instanceRolesInfo,
+	}
+}

internal/api/grpc/management/idp_converter_test.go

@@ -3,10 +3,13 @@ package management
 import (
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/repository/idp"
 	"github.com/zitadel/zitadel/internal/test"
-	"github.com/zitadel/zitadel/pkg/grpc/idp"
+	idp_pb "github.com/zitadel/zitadel/pkg/grpc/idp"
 	mgmt_pb "github.com/zitadel/zitadel/pkg/grpc/management"
 )
 
@@ -23,13 +26,13 @@ func Test_addOIDCIDPRequestToDomain(t *testing.T) {
 			args: args{
 				req: &mgmt_pb.AddOrgOIDCIDPRequest{
 					Name:               "ZITADEL",
-					StylingType:        idp.IDPStylingType_STYLING_TYPE_GOOGLE,
+					StylingType:        idp_pb.IDPStylingType_STYLING_TYPE_GOOGLE,
 					ClientId:           "test1234",
 					ClientSecret:       "test4321",
 					Issuer:             "zitadel.ch",
 					Scopes:             []string{"email", "profile"},
-					DisplayNameMapping: idp.OIDCMappingField_OIDC_MAPPING_FIELD_EMAIL,
-					UsernameMapping:    idp.OIDCMappingField_OIDC_MAPPING_FIELD_PREFERRED_USERNAME,
+					DisplayNameMapping: idp_pb.OIDCMappingField_OIDC_MAPPING_FIELD_EMAIL,
+					UsernameMapping:    idp_pb.OIDCMappingField_OIDC_MAPPING_FIELD_PREFERRED_USERNAME,
 					AutoRegister:       true,
 				},
 			},
@@ -70,8 +73,8 @@ func Test_addOIDCIDPRequestToDomainOIDCIDPConfig(t *testing.T) {
 					ClientSecret:       "test4321",
 					Issuer:             "zitadel.ch",
 					Scopes:             []string{"email", "profile"},
-					DisplayNameMapping: idp.OIDCMappingField_OIDC_MAPPING_FIELD_EMAIL,
-					UsernameMapping:    idp.OIDCMappingField_OIDC_MAPPING_FIELD_PREFERRED_USERNAME,
+					DisplayNameMapping: idp_pb.OIDCMappingField_OIDC_MAPPING_FIELD_EMAIL,
+					UsernameMapping:    idp_pb.OIDCMappingField_OIDC_MAPPING_FIELD_PREFERRED_USERNAME,
 				},
 			},
 		},
@@ -104,7 +107,7 @@ func Test_updateIDPToDomain(t *testing.T) {
 				req: &mgmt_pb.UpdateOrgIDPRequest{
 					IdpId:        "13523",
 					Name:         "new name",
-					StylingType:  idp.IDPStylingType_STYLING_TYPE_GOOGLE,
+					StylingType:  idp_pb.IDPStylingType_STYLING_TYPE_GOOGLE,
 					AutoRegister: true,
 				},
 			},
@@ -141,8 +144,8 @@ func Test_updateOIDCConfigToDomain(t *testing.T) {
 					ClientId:           "ZITEADEL",
 					ClientSecret:       "i'm so secret",
 					Scopes:             []string{"profile"},
-					DisplayNameMapping: idp.OIDCMappingField_OIDC_MAPPING_FIELD_EMAIL,
-					UsernameMapping:    idp.OIDCMappingField_OIDC_MAPPING_FIELD_PREFERRED_USERNAME,
+					DisplayNameMapping: idp_pb.OIDCMappingField_OIDC_MAPPING_FIELD_EMAIL,
+					UsernameMapping:    idp_pb.OIDCMappingField_OIDC_MAPPING_FIELD_PREFERRED_USERNAME,
 				},
 			},
 		},
@@ -164,7 +167,7 @@ func Test_signatureAlgorithmToCommand(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		name                   string
-		signatureAlgorithm     idp.SAMLSignatureAlgorithm
+		signatureAlgorithm     idp_pb.SAMLSignatureAlgorithm
 		wantSignatureAlgorithm string
 	}{
 		{
@@ -174,17 +177,17 @@ func Test_signatureAlgorithmToCommand(t *testing.T) {
 		},
 		{
 			name:                   "RSA_SHA1",
-			signatureAlgorithm:     idp.SAMLSignatureAlgorithm_SAML_SIGNATURE_RSA_SHA1,
+			signatureAlgorithm:     idp_pb.SAMLSignatureAlgorithm_SAML_SIGNATURE_RSA_SHA1,
 			wantSignatureAlgorithm: "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
 		},
 		{
 			name:                   "RSA_SHA256",
-			signatureAlgorithm:     idp.SAMLSignatureAlgorithm_SAML_SIGNATURE_RSA_SHA256,
+			signatureAlgorithm:     idp_pb.SAMLSignatureAlgorithm_SAML_SIGNATURE_RSA_SHA256,
 			wantSignatureAlgorithm: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
 		},
 		{
 			name:                   "RSA_SHA512",
-			signatureAlgorithm:     idp.SAMLSignatureAlgorithm_SAML_SIGNATURE_RSA_SHA512,
+			signatureAlgorithm:     idp_pb.SAMLSignatureAlgorithm_SAML_SIGNATURE_RSA_SHA512,
 			wantSignatureAlgorithm: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512",
 		},
 	}
@@ -196,3 +199,98 @@ func Test_signatureAlgorithmToCommand(t *testing.T) {
 		})
 	}
 }
+
+func Test_addZitadelProviderToCommand(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name string
+		req  *mgmt_pb.AddZitadelProviderRequest
+		want command.ZitadelProvider
+	}{
+		{
+			name: "without instance roles info",
+			req: &mgmt_pb.AddZitadelProviderRequest{
+				Name:         "Zitadel Support IdP",
+				ClientId:     "test-client",
+				ClientSecret: "test-secret",
+				Scopes:       []string{"email", "profile", "urn:zitadel:iam:org:project:roles"},
+				ProviderOptions: &idp_pb.Options{
+					IsLinkingAllowed:  false,
+					IsCreationAllowed: true,
+					IsAutoCreation:    false,
+					IsAutoUpdate:      true,
+					AutoLinking:       0,
+				},
+			},
+			want: command.ZitadelProvider{
+				Name:         "Zitadel Support IdP",
+				ClientID:     "test-client",
+				ClientSecret: "test-secret",
+				Scopes:       []string{"email", "profile", "urn:zitadel:iam:org:project:roles"},
+				IDPOptions: idp.Options{
+					IsCreationAllowed: true,
+					IsAutoCreation:    false,
+					IsLinkingAllowed:  false,
+					IsAutoUpdate:      true,
+				},
+				InstanceRolesInfo: []idp.RolesInfo{},
+			},
+		},
+		{
+			name: "all fields filled",
+			req: &mgmt_pb.AddZitadelProviderRequest{
+				Name:         "Zitadel Support IdP",
+				ClientId:     "test-client",
+				ClientSecret: "test-secret",
+				Scopes:       []string{"email", "profile", "urn:zitadel:iam:org:project:roles"},
+				ProviderOptions: &idp_pb.Options{
+					IsLinkingAllowed:  false,
+					IsCreationAllowed: true,
+					IsAutoCreation:    false,
+					IsAutoUpdate:      true,
+					AutoLinking:       0,
+				},
+				InstanceRolesInfo: []*idp_pb.InstanceRolesInfo{
+					{
+						OrganizationId:     "org1",
+						OrganizationDomain: "org1.com",
+					},
+					{
+
+						OrganizationId:     "org2",
+						OrganizationDomain: "org2.com",
+					},
+				},
+			},
+			want: command.ZitadelProvider{
+				Name:         "Zitadel Support IdP",
+				ClientID:     "test-client",
+				ClientSecret: "test-secret",
+				Scopes:       []string{"email", "profile", "urn:zitadel:iam:org:project:roles"},
+				IDPOptions: idp.Options{
+					IsCreationAllowed: true,
+					IsAutoCreation:    false,
+					IsLinkingAllowed:  false,
+					IsAutoUpdate:      true,
+				},
+				InstanceRolesInfo: []idp.RolesInfo{
+					{
+						OrganizationID:     "org1",
+						OrganizationDomain: "org1.com",
+					},
+					{
+						OrganizationID:     "org2",
+						OrganizationDomain: "org2.com",
+					},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			got := addZitadelProviderToCommand(tt.req)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}

internal/api/grpc/management/integration_test/idp_test.go

@@ -0,0 +1,233 @@
+//go:build integration
+
+package management_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/zitadel/zitadel/internal/integration"
+	idp_pb "github.com/zitadel/zitadel/pkg/grpc/idp"
+	mgmt_pb "github.com/zitadel/zitadel/pkg/grpc/management"
+	object_pb "github.com/zitadel/zitadel/pkg/grpc/object"
+)
+
+func Test_AddZitadelProvider(t *testing.T) {
+	type args struct {
+		ctx context.Context
+		req *mgmt_pb.AddZitadelProviderRequest
+	}
+	tests := []struct {
+		name         string
+		args         args
+		wantErr      error
+		wantResponse *mgmt_pb.AddZitadelProviderResponse
+	}{
+		{
+			name: "no permissions, error",
+			args: args{
+				ctx: Instance.WithAuthorizationToken(CTX, integration.UserTypeNoPermission),
+				req: &mgmt_pb.AddZitadelProviderRequest{
+					Name:         "Zitadel Support IdP",
+					Issuer:       "zitadel.example.com",
+					ClientId:     "test-client",
+					ClientSecret: "test-secret",
+					Scopes:       []string{"email", "profile"},
+					ProviderOptions: &idp_pb.Options{
+						IsCreationAllowed: true,
+					},
+				},
+			},
+			wantErr: status.Error(codes.NotFound, "membership not found (AUTHZ-cdgFk)"),
+		},
+		{
+			name: "insufficient permissions, error",
+			args: args{
+				ctx: Instance.WithAuthorizationToken(CTX, integration.UserTypeLogin),
+				req: &mgmt_pb.AddZitadelProviderRequest{
+					Name:         "Zitadel Support IdP",
+					Issuer:       "zitadel.example.com",
+					ClientId:     "test-client",
+					ClientSecret: "test-secret",
+					Scopes:       []string{"email", "profile"},
+					ProviderOptions: &idp_pb.Options{
+						IsCreationAllowed: true,
+					},
+				},
+			},
+			wantErr: status.Error(codes.PermissionDenied, "No matching permissions found (AUTH-5mWD2)"),
+		},
+		{
+			name: "missing required field: name",
+			args: args{
+				ctx: OrgCTX,
+				req: &mgmt_pb.AddZitadelProviderRequest{},
+			},
+			wantErr: status.Error(codes.InvalidArgument, "invalid AddZitadelProviderRequest.Name: value length must be between 1 and 200 runes, inclusive"),
+		},
+		{
+			name: "missing required field: issuer",
+			args: args{
+				ctx: OrgCTX,
+				req: &mgmt_pb.AddZitadelProviderRequest{
+					Name: "Zitadel Support IdP",
+				},
+			},
+			wantErr: status.Error(codes.InvalidArgument, "invalid AddZitadelProviderRequest.Issuer: value length must be between 1 and 200 runes, inclusive"),
+		},
+		{
+			name: "missing required field: client_id",
+			args: args{
+				ctx: OrgCTX,
+				req: &mgmt_pb.AddZitadelProviderRequest{
+					Name:   "Zitadel Support IdP",
+					Issuer: "zitadel.example.com",
+				},
+			},
+			wantErr: status.Error(codes.InvalidArgument, "invalid AddZitadelProviderRequest.ClientId: value length must be between 1 and 200 runes, inclusive"),
+		},
+		{
+			name: "missing required field: client_secret",
+			args: args{
+				ctx: OrgCTX,
+				req: &mgmt_pb.AddZitadelProviderRequest{
+					Name:     "Zitadel Support IdP",
+					Issuer:   "zitadel.example.com",
+					ClientId: "test-client",
+				},
+			},
+			wantErr: status.Error(
+				codes.InvalidArgument,
+				"invalid AddZitadelProviderRequest.ClientSecret: value length must be between 1 and 1000 runes, inclusive",
+			),
+		},
+		{
+			name: "missing org ID in instance roles info",
+			args: args{
+				ctx: OrgCTX,
+				req: &mgmt_pb.AddZitadelProviderRequest{
+					Name:         "Zitadel Support IdP",
+					Issuer:       "zitadel.example.com",
+					ClientId:     "test-client",
+					ClientSecret: "test-secret",
+					Scopes:       []string{"email", "profile"},
+					ProviderOptions: &idp_pb.Options{
+						IsCreationAllowed: true,
+					},
+					InstanceRolesInfo: []*idp_pb.InstanceRolesInfo{
+						{
+							OrganizationId: "",
+						},
+					},
+				},
+			},
+			wantErr: status.Error(
+				codes.InvalidArgument,
+				"invalid AddZitadelProviderRequest.InstanceRolesInfo[0]: embedded message failed validation | caused by: invalid InstanceRolesInfo.OrganizationId: value length must be between 1 and 200 runes, inclusive",
+			),
+		},
+		{
+			name: "missing org domain in instance roles info",
+			args: args{
+				ctx: OrgCTX,
+				req: &mgmt_pb.AddZitadelProviderRequest{
+					Name:         "Zitadel Support IdP",
+					Issuer:       "zitadel.example.com",
+					ClientId:     "test-client",
+					ClientSecret: "test-secret",
+					Scopes:       []string{"email", "profile"},
+					ProviderOptions: &idp_pb.Options{
+						IsCreationAllowed: true,
+					},
+					InstanceRolesInfo: []*idp_pb.InstanceRolesInfo{
+						{
+							OrganizationId:     "org1",
+							OrganizationDomain: "org1.com",
+						},
+						{
+							OrganizationId: "org2",
+						},
+					},
+				},
+			},
+			wantErr: status.Error(
+				codes.InvalidArgument,
+				"invalid AddZitadelProviderRequest.InstanceRolesInfo[1]: embedded message failed validation | caused by: invalid InstanceRolesInfo.OrganizationDomain: value length must be between 1 and 200 runes, inclusive",
+			),
+		},
+		{
+			name: "valid request without instance roles info",
+			args: args{
+				ctx: OrgCTX,
+				req: &mgmt_pb.AddZitadelProviderRequest{
+					Name:         "Zitadel Support IdP",
+					Issuer:       "zitadel.example.com",
+					ClientId:     "test-client",
+					ClientSecret: "test-secret",
+					Scopes:       []string{"email", "profile"},
+					ProviderOptions: &idp_pb.Options{
+						IsCreationAllowed: true,
+					},
+				},
+			},
+			wantResponse: &mgmt_pb.AddZitadelProviderResponse{
+				Details: &object_pb.ObjectDetails{
+					ResourceOwner: Instance.DefaultOrg.Id,
+				},
+			},
+		},
+		{
+			name: "valid request with instance roles info",
+			args: args{
+				ctx: OrgCTX,
+				req: &mgmt_pb.AddZitadelProviderRequest{
+					Name:         "Zitadel Support IdP",
+					Issuer:       "zitadel.example.com",
+					ClientId:     "test-client",
+					ClientSecret: "test-secret",
+					Scopes:       []string{"email", "profile"},
+					ProviderOptions: &idp_pb.Options{
+						IsCreationAllowed: true,
+					},
+					InstanceRolesInfo: []*idp_pb.InstanceRolesInfo{
+						{
+							OrganizationId:     "org1",
+							OrganizationDomain: "org1.com",
+						},
+					},
+				},
+			},
+			wantResponse: &mgmt_pb.AddZitadelProviderResponse{
+				Details: &object_pb.ObjectDetails{
+					ResourceOwner: Instance.DefaultOrg.Id,
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			before := time.Now()
+			got, err := Client.AddZitadelProvider(tt.args.ctx, tt.args.req)
+			after := time.Now()
+			if tt.wantErr != nil {
+				require.Error(t, err)
+				grpcStatus, ok := status.FromError(err)
+				require.True(t, ok)
+				assert.Equal(t, status.Code(tt.wantErr), grpcStatus.Code())
+				assert.Equal(t, status.Convert(tt.wantErr).Message(), grpcStatus.Message())
+				return
+			}
+			require.NoError(t, err)
+			assert.NotNil(t, got)
+			assert.NotEmpty(t, got.GetId())
+			assert.WithinRange(t, got.GetDetails().GetCreationDate().AsTime(), before, after)
+			assert.Equal(t, tt.wantResponse.GetDetails().GetResourceOwner(), got.GetDetails().GetResourceOwner())
+		})
+	}
+}