Skip to content

v6: OpenIdConnectApplicationSettingsClient.UnmarshalJSON rejects real GET responses that omit grant_types #591

Description

@exitcode0

Overview

OpenIdConnectApplicationSettingsClient.UnmarshalJSON treats grant_types as required on read.
However, the Okta app okta_atspoke_iam_connector doesn't return grant_types, so the response fails to unmarshal, the same error happens with ListApplications

Repro

package main

import (
    "context"
    "log"
    "os"

    v6okta "github.com/okta/okta-sdk-golang/v6/okta"
)

func main() {
    cfg, _ := v6okta.NewConfiguration(
        v6okta.WithOrgUrl(os.Getenv("OKTA_ORG_URL")),
        v6okta.WithToken(os.Getenv("OKTA_API_TOKEN")),
        v6okta.WithAuthorizationMode("SSWS"),
    )
    client := v6okta.NewAPIClient(cfg)

    _, _, err := client.ApplicationAPI.
        ListApplications(context.Background()).
        Q("okta_atspoke_iam_connector").
        Execute()
    if err != nil {
        log.Fatal(err) // unmarshal failure on okta_atspoke_iam_connector
    }
    log.Fatal("expected unmarshal failure — SDK may have been fixed")
}

Impact

terraform-provider-okta currently works around this with a raw GET + JSON injection of empty grant_types before handing the body to the SDK.
Any non-Terraform v6 consumer calling GetApplication or ListApplications on a tenant with atspoke installed hits the same
crash.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions