Skip to content

Commit 4793367

Browse files
dhiwakar-oktadhiwakar-okta
authored
GH-2559 | Adding Self Service Password Requirements Support for okta_policy_rule_password (#2752)
1 parent 22410d2 commit 4793367

18 files changed

Lines changed: 8684 additions & 299 deletions

File tree

‎docs/data-sources/policy_rule_password.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
---
2+
page_title: "Data Source: okta_policy_rule_password"
3+
description: |-
4+
Get a Password Policy Rule from Okta.
5+
---
6+
7+
# Data Source: okta_policy_rule_password
8+
9+
Get a Password Policy Rule from Okta.
10+
11+
## Example Usage
12+
13+
```terraform
14+
data "okta_default_policy" "password" {
15+
type = "PASSWORD"
16+
}
17+
18+
resource "okta_policy_rule_password" "example" {
19+
policy_id = data.okta_default_policy.password.id
20+
name = "My Password Rule"
21+
}
22+
23+
data "okta_policy_rule_password" "example" {
24+
policy_id = data.okta_default_policy.password.id
25+
id = okta_policy_rule_password.example.id
26+
}
27+
```
28+
29+
<!-- schema generated by tfplugindocs -->
30+
## Schema
31+
32+
### Required
33+
34+
- `id` (String) ID of the rule.
35+
- `policy_id` (String) ID of the Policy owning this rule.
36+
37+
### Read-Only
38+
39+
- `id` (String) The ID of this resource.
40+
- `name` (String) Name of the rule.
41+
- `priority` (Number) Priority of the rule.
42+
- `status` (String) Status of the rule: `ACTIVE` or `INACTIVE`.
43+
- `network_connection` (String) Network selection mode: `ANYWHERE`, `ZONE`.
44+
- `network_includes` (List of String) Network zones to include (when `network_connection` = `ZONE`).
45+
- `network_excludes` (List of String) Network zones to exclude (when `network_connection` = `ZONE`).
46+
- `users_excluded` (Set of String) User IDs excluded from this rule.
47+
- `password_change` (String) Whether a user is allowed to change their password: `ALLOW` or `DENY`.
48+
- `password_reset` (String) Whether a user is allowed to reset their password: `ALLOW` or `DENY`.
49+
- `password_unlock` (String) Whether a user is allowed to unlock their account: `ALLOW` or `DENY`.
50+
- `password_reset_access_control` (String) Whether SSPR access is governed by an authentication policy or legacy behavior. Options: `LEGACY`, `AUTH_POLICY`.
51+
- `password_reset_requirement` (List of Object) Self-service password reset (SSPR) requirement settings. (see [below for nested schema](#nestedatt--password_reset_requirement))
52+
53+
<a id="nestedatt--password_reset_requirement"></a>
54+
### Nested Schema for `password_reset_requirement`
55+
56+
Read-Only:
57+
58+
- `method_constraints` (List of Object) Constraints on the values specified in `primary_methods`. (see [below for nested schema](#nestedatt--password_reset_requirement--method_constraints))
59+
- `primary_methods` (Set of String) Authenticator methods allowed for the initial authentication step of password recovery.
60+
- `step_up_enabled` (Boolean) Whether a secondary authenticator is required for password reset.
61+
- `step_up_methods` (Set of String) Authenticator methods required for the secondary authentication step of password recovery. Items value: `security_question`.
62+
63+
<a id="nestedatt--password_reset_requirement--method_constraints"></a>
64+
### Nested Schema for `password_reset_requirement.method_constraints`
65+
66+
Read-Only:
67+
68+
- `method` (String) The method to constrain (e.g. `otp`).
69+
- `allowed_authenticators` (Set of String) Keys of the authenticators allowed for this method (e.g. `google_otp`).

‎docs/resources/policy_rule_password.md‎

Lines changed: 66 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,49 @@ description: |-
88

99
Creates a Password Policy Rule. This resource allows you to create and configure a Password Policy Rule.
1010

11+
## Example Usage
1112

13+
### AUTH_POLICY access control (delegates SSPR to authentication policy rules)
14+
15+
```hcl
16+
resource "okta_policy_rule_password" "example_auth_policy" {
17+
policy_id = "<policy_id>"
18+
name = "example_auth_policy_rule"
19+
status = "ACTIVE"
20+
21+
password_change = "ALLOW"
22+
password_reset = "ALLOW"
23+
password_unlock = "DENY"
24+
25+
password_reset_access_control = "AUTH_POLICY"
26+
}
27+
```
28+
29+
### LEGACY access control with primary methods and step-up
30+
31+
```hcl
32+
resource "okta_policy_rule_password" "example_legacy" {
33+
policy_id = "<policy_id>"
34+
name = "example_legacy_rule"
35+
status = "ACTIVE"
36+
37+
password_change = "ALLOW"
38+
password_reset = "ALLOW"
39+
password_unlock = "DENY"
40+
41+
password_reset_access_control = "LEGACY"
42+
43+
password_reset_requirement {
44+
method_constraints {
45+
method = "otp"
46+
allowed_authenticators = ["google_otp"]
47+
}
48+
primary_methods = ["otp", "email"]
49+
step_up_enabled = true
50+
step_up_methods = ["security_question"]
51+
}
52+
}
53+
```
1254

1355
<!-- schema generated by tfplugindocs -->
1456
## Schema
@@ -19,11 +61,13 @@ Creates a Password Policy Rule. This resource allows you to create and configure
1961

2062
### Optional
2163

22-
- `network_connection` (String) Network selection mode: `ANYWHERE`, `ZONE`, `ON_NETWORK`, or `OFF_NETWORK`. Default: `ANYWHERE`
64+
- `network_connection` (String) Network selection mode: `ANYWHERE`, `ZONE`. Default: `ANYWHERE`
2365
- `network_excludes` (List of String) Required if `network_connection` = `ZONE`. Indicates the network zones to exclude.
2466
- `network_includes` (List of String) Required if `network_connection` = `ZONE`. Indicates the network zones to include.
2567
- `password_change` (String) Allow or deny a user to change their password: `ALLOW` or `DENY`. Default: `ALLOW`
2668
- `password_reset` (String) Allow or deny a user to reset their password: `ALLOW` or `DENY`. Default: `ALLOW`
69+
- `password_reset_access_control` (String) Determines whether the Self-Service Password Reset (SSPR) access is governed by an authentication policy or legacy behavior. Options: `LEGACY`, `AUTH_POLICY`.
70+
- `password_reset_requirement` (Block List, Max: 1) Self-service password reset (SSPR) requirement settings. Use only when `password_reset_access_control = "LEGACY"`. (see [below for nested schema](#nestedblock--password_reset_requirement))
2771
- `password_unlock` (String) Allow or deny a user to unlock. Default: `DENY`
2872
- `policy_id` (String) Policy ID of the Rule
2973
- `priority` (Number) Rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
@@ -34,6 +78,27 @@ Creates a Password Policy Rule. This resource allows you to create and configure
3478

3579
- `id` (String) The ID of this resource.
3680

81+
<a id="nestedblock--password_reset_requirement"></a>
82+
### Nested Schema for `password_reset_requirement`
83+
84+
Optional:
85+
86+
- `method_constraints` (Block List) Constraints on the values specified in the `primary_methods` set. Specifying a constraint limits methods to specific authenticator(s). Currently, Google OTP is the only accepted constraint. The `otp` method requires a constraint. (see [below for nested schema](#nestedblock--password_reset_requirement--method_constraints))
87+
- `primary_methods` (Set of String) Authenticator methods allowed for the initial authentication step of password recovery. Method `otp` requires a constraint limiting it to a Google authenticator. Options: `otp`, `push`, `sms`, `email`, `voice`.
88+
- `step_up_enabled` (Boolean) Whether a secondary authenticator is required for password reset (`stepUp.required`). The following are three valid configurations: `required=false`, `required=true` with no methods to use any SSO authenticator, and `required=true` with `security_question` as the method. Default: `false`.
89+
- `step_up_methods` (Set of String) Authenticator methods required for the secondary authentication step of password recovery. Specify only when `step_up_enabled = true` and `security_question` is permitted for the secondary authentication. Items value: `security_question`.
90+
91+
<a id="nestedblock--password_reset_requirement--method_constraints"></a>
92+
### Nested Schema for `password_reset_requirement.method_constraints`
93+
94+
Required:
95+
96+
- `method` (String) The method to constrain (e.g. `otp`).
97+
98+
Optional:
99+
100+
- `allowed_authenticators` (Set of String) Keys of the authenticators allowed for this method (e.g. `google_otp`).
101+
37102
## Import
38103

39104
Import is supported using the following syntax:

‎examples/data-sources/okta_policy_rule_password/datasource.tf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
data "okta_default_policy" "default-replace_with_uuid" {
2+
type = "PASSWORD"
3+
}
4+
5+
resource "okta_policy_rule_password" "testAcc_replace_with_uuid" {
6+
policy_id = data.okta_default_policy.default-replace_with_uuid.id
7+
name = "testAcc_replace_with_uuid"
8+
status = "ACTIVE"
9+
10+
password_change = "ALLOW"
11+
password_reset = "ALLOW"
12+
password_unlock = "ALLOW"
13+
14+
users_included = ["00ustguf78owmG7Rt1d7"]
15+
users_excluded = ["00urzse61ohS6KPfT1d7"]
16+
groups_included = ["00gwxsozqariU272g1d7"]
17+
groups_excluded = ["00gwxstmy6w36z1dZ1d7"]
18+
19+
password_reset_access_control = "LEGACY"
20+
21+
password_reset_requirement {
22+
method_constraints {
23+
method = "otp"
24+
allowed_authenticators = ["google_otp"]
25+
}
26+
primary_methods = ["otp", "email"]
27+
step_up_enabled = true
28+
step_up_methods = ["security_question"]
29+
}
30+
}
31+
32+
data "okta_policy_rule_password" "testAcc_replace_with_uuid" {
33+
policy_id = data.okta_default_policy.default-replace_with_uuid.id
34+
id = okta_policy_rule_password.testAcc_replace_with_uuid.id
35+
depends_on = [okta_policy_rule_password.testAcc_replace_with_uuid]
36+
}

‎examples/resources/okta_policy_rule_password/sspr_auth_policy.tf‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
resource "okta_user" "included-replace_with_uuid" {
2+
first_name = "TestAcc"
3+
last_name = "Included"
4+
login = "testAcc-included-replace_with_uuid@example.com"
5+
email = "testAcc-included-replace_with_uuid@example.com"
6+
}
7+
8+
resource "okta_user" "excluded-replace_with_uuid" {
9+
first_name = "TestAcc"
10+
last_name = "Excluded"
11+
login = "testAcc-excluded-replace_with_uuid@example.com"
12+
email = "testAcc-excluded-replace_with_uuid@example.com"
13+
}
14+
15+
resource "okta_group" "included-replace_with_uuid" {
16+
name = "testAcc_included_replace_with_uuid"
17+
}
18+
19+
resource "okta_group" "excluded-replace_with_uuid" {
20+
name = "testAcc_excluded_replace_with_uuid"
21+
}
22+
23+
resource "okta_network_zone" "test" {
24+
name = "testAcc_replace_with_uuid"
25+
type = "IP"
26+
gateways = ["1.2.3.4/24", "2.3.4.5-2.3.4.15"]
27+
proxies = ["2.2.3.4/24", "3.3.4.5-3.3.4.15"]
28+
status = "ACTIVE"
29+
}
30+
31+
data "okta_default_policy" "default-replace_with_uuid" {
32+
type = "PASSWORD"
33+
}
34+
35+
resource "okta_policy_rule_password" "testAcc_replace_with_uuid" {
36+
policy_id = data.okta_default_policy.default-replace_with_uuid.id
37+
name = "testAcc_replace_with_uuid"
38+
status = "ACTIVE"
39+
40+
password_change = "ALLOW"
41+
password_reset = "ALLOW"
42+
password_unlock = "DENY"
43+
44+
users_included = [okta_user.included-replace_with_uuid.id]
45+
users_excluded = [okta_user.excluded-replace_with_uuid.id]
46+
groups_included = [okta_group.included-replace_with_uuid.id]
47+
groups_excluded = [okta_group.excluded-replace_with_uuid.id]
48+
49+
password_reset_access_control = "AUTH_POLICY"
50+
network_connection = "ZONE"
51+
network_includes = [okta_network_zone.test.id]
52+
}

‎examples/resources/okta_policy_rule_password/sspr_no_method_constraints.tf‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
resource "okta_user" "included-replace_with_uuid" {
2+
first_name = "TestAcc"
3+
last_name = "Included"
4+
login = "testAcc-included-replace_with_uuid@example.com"
5+
email = "testAcc-included-replace_with_uuid@example.com"
6+
}
7+
8+
resource "okta_user" "excluded-replace_with_uuid" {
9+
first_name = "TestAcc"
10+
last_name = "Excluded"
11+
login = "testAcc-excluded-replace_with_uuid@example.com"
12+
email = "testAcc-excluded-replace_with_uuid@example.com"
13+
}
14+
15+
resource "okta_group" "included-replace_with_uuid" {
16+
name = "testAcc_included_replace_with_uuid"
17+
}
18+
19+
resource "okta_group" "excluded-replace_with_uuid" {
20+
name = "testAcc_excluded_replace_with_uuid"
21+
}
22+
23+
resource "okta_network_zone" "test" {
24+
name = "testAcc_replace_with_uuid"
25+
type = "IP"
26+
gateways = ["1.2.3.4/24", "2.3.4.5-2.3.4.15"]
27+
proxies = ["2.2.3.4/24", "3.3.4.5-3.3.4.15"]
28+
status = "ACTIVE"
29+
}
30+
31+
data "okta_default_policy" "default-replace_with_uuid" {
32+
type = "PASSWORD"
33+
}
34+
35+
resource "okta_policy_rule_password" "testAcc_replace_with_uuid" {
36+
policy_id = data.okta_default_policy.default-replace_with_uuid.id
37+
name = "testAcc_replace_with_uuid"
38+
status = "ACTIVE"
39+
40+
password_change = "ALLOW"
41+
password_reset = "ALLOW"
42+
password_unlock = "DENY"
43+
44+
users_included = [okta_user.included-replace_with_uuid.id]
45+
users_excluded = [okta_user.excluded-replace_with_uuid.id]
46+
groups_included = [okta_group.included-replace_with_uuid.id]
47+
groups_excluded = [okta_group.excluded-replace_with_uuid.id]
48+
network_connection = "ZONE"
49+
network_includes = [okta_network_zone.test.id]
50+
51+
password_reset_access_control = "LEGACY"
52+
53+
password_reset_requirement {
54+
primary_methods = ["push", "sms"]
55+
step_up_enabled = true
56+
}
57+
}

‎examples/resources/okta_policy_rule_password/sspr_with_method_constraints.tf‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
resource "okta_user" "included-replace_with_uuid" {
2+
first_name = "TestAcc"
3+
last_name = "Included"
4+
login = "testAcc-included-replace_with_uuid@example.com"
5+
email = "testAcc-included-replace_with_uuid@example.com"
6+
}
7+
8+
resource "okta_user" "excluded-replace_with_uuid" {
9+
first_name = "TestAcc"
10+
last_name = "Excluded"
11+
login = "testAcc-excluded-replace_with_uuid@example.com"
12+
email = "testAcc-excluded-replace_with_uuid@example.com"
13+
}
14+
15+
resource "okta_group" "included-replace_with_uuid" {
16+
name = "testAcc_included_replace_with_uuid"
17+
}
18+
19+
resource "okta_group" "excluded-replace_with_uuid" {
20+
name = "testAcc_excluded_replace_with_uuid"
21+
}
22+
23+
resource "okta_network_zone" "test" {
24+
name = "testAcc_replace_with_uuid"
25+
type = "IP"
26+
gateways = ["1.2.3.4/24", "2.3.4.5-2.3.4.15"]
27+
proxies = ["2.2.3.4/24", "3.3.4.5-3.3.4.15"]
28+
status = "ACTIVE"
29+
}
30+
31+
data "okta_default_policy" "default-replace_with_uuid" {
32+
type = "PASSWORD"
33+
}
34+
35+
resource "okta_policy_rule_password" "testAcc_replace_with_uuid" {
36+
policy_id = data.okta_default_policy.default-replace_with_uuid.id
37+
name = "testAcc_replace_with_uuid"
38+
status = "ACTIVE"
39+
40+
password_change = "ALLOW"
41+
password_reset = "ALLOW"
42+
password_unlock = "ALLOW"
43+
44+
users_included = [okta_user.included-replace_with_uuid.id]
45+
users_excluded = [okta_user.excluded-replace_with_uuid.id]
46+
groups_included = [okta_group.included-replace_with_uuid.id]
47+
groups_excluded = [okta_group.excluded-replace_with_uuid.id]
48+
network_connection = "ZONE"
49+
network_includes = [okta_network_zone.test.id]
50+
51+
password_reset_access_control = "LEGACY"
52+
53+
password_reset_requirement {
54+
method_constraints {
55+
method = "otp"
56+
allowed_authenticators = ["google_otp"] # must be passed in case method is otp
57+
}
58+
primary_methods = ["otp"]
59+
step_up_enabled = true
60+
}
61+
}

0 commit comments

Comments
 (0)