adds support for office365Client config in signon_policy_rule resource (#2644)

Author: aditya-okta

examples/resources/okta_app_signon_policy_rule/office365_client_include.tf

@@ -0,0 +1,10 @@
+resource "okta_app_signon_policy" "test" {
+  name        = "testAcc_replace_with_uuid"
+  description = "Test policy for office365_client_include"
+}
+
+resource "okta_app_signon_policy_rule" "test" {
+  policy_id                = okta_app_signon_policy.test.id
+  name                     = "testAcc_replace_with_uuid"
+  office365_client_include = ["WEB", "MODERN_AUTH"]
+}

examples/resources/okta_app_signon_policy_rule/office365_client_include_updated.tf

@@ -0,0 +1,10 @@
+resource "okta_app_signon_policy" "test" {
+  name        = "testAcc_replace_with_uuid"
+  description = "Test policy for office365_client_include"
+}
+
+resource "okta_app_signon_policy_rule" "test" {
+  policy_id                = okta_app_signon_policy.test.id
+  name                     = "testAcc_replace_with_uuid"
+  office365_client_include = ["WEB", "MODERN_AUTH", "AAD_JOIN"]
+}

okta/services/idaas/resource_okta_app_signon_policy_rule.go

@@ -261,6 +261,15 @@ The only difference is that these fields are immutable and can not be managed: '
 				Optional:    true,
 				Description: "Use with verification method = `AUTH_METHOD_CHAIN` only",
 			},
+			"office365_client_include": {
+				Type:        schema.TypeSet,
+				Optional:    true,
+				Description: "Office 365 client types to include. Valid values: WEB, MODERN_AUTH, EXCHANGE_ACTIVE_SYNC, AAD_JOIN. This condition is specific to Office 365 applications.",
+				Elem: &schema.Schema{
+					Type:             schema.TypeString,
+					ValidateDiagFunc: validation.ToDiagFunc(validation.StringInSlice([]string{"WEB", "MODERN_AUTH", "EXCHANGE_ACTIVE_SYNC", "AAD_JOIN"}, false)),
+				},
+			},
 		},
 	}
 }
@@ -390,6 +399,13 @@ func resourceAppSignOnPolicyRuleRead(ctx context.Context, d *schema.ResourceData
 			_ = d.Set("risk_score", rule.Conditions.RiskScore.Level)
 		}
 		_ = utils.SetNonPrimitives(d, m)
+		var office365Includes []interface{}
+		if rule.Conditions.Office365Client != nil {
+			for _, v := range rule.Conditions.Office365Client.Include {
+				office365Includes = append(office365Includes, v)
+			}
+		}
+		_ = d.Set("office365_client_include", schema.NewSet(schema.HashString, office365Includes))
 	}
 	return nil
 }
@@ -569,6 +585,12 @@ func buildAppSignOnPolicyRule(d *schema.ResourceData) sdk.AccessPolicyRule {
 			Include: utils.ConvertInterfaceToStringSetNullable(userTypesIncluded),
 		}
 	}
+	office365ClientInclude, office365ClientIncludeOk := d.GetOk("office365_client_include")
+	if office365ClientIncludeOk {
+		rule.Conditions.Office365Client = &sdk.Office365ClientCondition{
+			Include: utils.ConvertInterfaceToStringSetNullable(office365ClientInclude),
+		}
+	}
 	return rule
 }
 

okta/services/idaas/resource_okta_app_signon_policy_rule_test.go

@@ -861,3 +861,48 @@ func TestAccResourceOktaAppSignOnPolicyRule_keep_me_signed_in_drift(t *testing.T
 		},
 	})
 }
+
+func TestAccResourceOktaAppSignOnPolicyRule_office365_client_include(t *testing.T) {
+	mgr := newFixtureManager("resources", resources.OktaIDaaSAppSignOnPolicyRule, t.Name())
+	resourceName := fmt.Sprintf("%s.test", resources.OktaIDaaSAppSignOnPolicyRule)
+	config := mgr.GetFixtures("office365_client_include.tf", t)
+	updatedConfig := mgr.GetFixtures("office365_client_include_updated.tf", t)
+
+	acctest.OktaResourceTest(t, resource.TestCase{
+		PreCheck:                 acctest.AccPreCheck(t),
+		ErrorCheck:               testAccErrorChecks(t),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactoriesForTestAcc(t),
+		CheckDestroy:             checkAppSignOnPolicyRuleDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "office365_client_include.#", "2"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "office365_client_include.*", "WEB"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "office365_client_include.*", "MODERN_AUTH"),
+				),
+			},
+			{
+				Config: updatedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "office365_client_include.#", "3"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "office365_client_include.*", "WEB"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "office365_client_include.*", "MODERN_AUTH"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "office365_client_include.*", "AAD_JOIN"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateIdFunc: func(s *terraform.State) (string, error) {
+					rs, ok := s.RootModule().Resources[resourceName]
+					if !ok {
+						return "", fmt.Errorf("failed to find app sign on policy rule %s", resourceName)
+					}
+					return fmt.Sprintf("%s/%s", rs.Primary.Attributes["policy_id"], rs.Primary.Attributes["id"]), nil
+				},
+			},
+		},
+	})
+}

sdk/v2_accessPolicyRuleConditions.go

@@ -25,6 +25,7 @@ type AccessPolicyRuleConditions struct {
 	Users                 *UserPolicyRuleCondition                       `json:"users,omitempty"`
 	ElCondition           *AccessPolicyRuleCustomCondition               `json:"elCondition,omitempty"`
 	UserType              *UserTypeCondition                             `json:"userType,omitempty"`
+	Office365Client       *Office365ClientCondition                      `json:"office365Client,omitempty"`
 }
 
 func NewAccessPolicyRuleConditions() *AccessPolicyRuleConditions {

sdk/v2_office365ClientCondition.go

@@ -0,0 +1,16 @@
+// DO NOT EDIT LOCAL SDK - USE v3 okta-sdk-golang FOR API CALLS THAT DO NOT EXIST IN LOCAL SDK
+package sdk
+
+// Office365ClientCondition represents the Office 365 client condition for access policy rules.
+// This condition allows filtering based on Office 365 client types such as WEB, MODERN_AUTH, AAD_JOIN, etc.
+type Office365ClientCondition struct {
+	Include []string `json:"include,omitempty"`
+}
+
+func NewOffice365ClientCondition() *Office365ClientCondition {
+	return &Office365ClientCondition{}
+}
+
+func (a *Office365ClientCondition) IsPolicyInstance() bool {
+	return true
+}