Feature request: multitenancy support (tenant-scoped `VSessionId`)

[rr413d]

Summary

The provider has no support for vManage multitenancy. There is no way to configure a tenant context, so tenant-scoped resources on a multitenant (MT) vManage cannot be managed via Terraform. This gap exists in both the provider and its underlying client library (netascode/go-sdwan), so it can't be resolved in the provider alone.

Background — how vManage MT scoping works

On a multitenant vManage, a provider admin authenticates normally, but to operate as a tenant every API call must be scoped to that tenant via a VSessionId header, obtained from:

POST /dataservice/tenant/{tenantId}/vsessionid

That VSessionId is then attached to each subsequent request. Without it, calls execute in provider context, not the tenant's — so tenant templates, policies, and device config are unreachable.

What's missing

Provider (CiscoDevNet/sdwan, verified on main)

The full provider config schema is:

username · password · url · api_token · insecure · retries · task_timeout · deploy_on_out_of_date

There is no tenant, tenant_id, tenant_name, or vsessionid argument, and no corresponding environment variable. The client is constructed with sdwan.WithToken(...) or sdwan.WithLogin(...), neither of which accepts a tenant scope.

Client library (netascode/go-sdwan v0.2.0)

• No VSessionId field or header anywhere in the client.
• Login() posts only j_username / j_password to /j_security_check — there is no tenant-select step after login.
• X-XSRF-TOKEN is handled, but only for CSRF, not tenant scoping.
• The Client struct holds only Usr, Pwd, ApiToken, Token — no tenant field.

Impact

Scenario	Supported today
Provider (global) admin managing provider-level objects	✅ Yes
Managing a tenant's templates / policies / config via Terraform	❌ No — no way to pass VSessionId
Tenant-scoped operations on an MT deployment	❌ No

Teams running MT vManage cannot use the provider to manage per-tenant configuration at all.

Requested fix

1. netascode/go-sdwan: add tenant support — acquire VSessionId via POST /tenant/{tenantId}/vsessionid after login, and inject it as a header on subsequent requests. Add a tenant field to the client (e.g. WithTenant(tenantId)).
2. CiscoDevNet/sdwan: surface a tenant_id (and/or tenant_name) argument in the provider config, plus a SDWAN_TENANT_ID env var, and pass it through to the client.

Environment

• Provider: CiscoDevNet/sdwan (observed on main)
• Client library: github.com/netascode/go-sdwan v0.2.0
• vManage: multitenant mode, 20.12.x

Notes

Verified against provider and client source on main. Did not find an existing tracking issue for this at time of filing.

[koval4ukav]

Multitenancy support is on our radar, but there is no estimated date for its availability yet.