Skip to content

Commit 58ac7d8

Browse files
iamarumugam-sourceiamarumugam-source
authored
Allowing changes to default blocklist called BlockedIpZone (#2690)
1 parent 7e91c7f commit 58ac7d8

6 files changed

Lines changed: 270 additions & 4 deletions

File tree

‎examples/resources/okta_network_zone/basic_issue_2689.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resource "okta_network_zone" "default_blocklist" {
2+
name = "BlockedIpZone"
3+
type = "IP"
4+
status = "ACTIVE"
5+
usage = "BLOCKLIST"
6+
gateways = []
7+
}

‎okta/services/idaas/data_source_okta_network_zone.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,11 @@ func dataSourceNetworkZone() *schema.Resource {
8888
Description: "List of ip service excluded. Use with type `DYNAMIC_V2`",
8989
Elem: &schema.Schema{Type: schema.TypeString},
9090
},
91+
"system": {
92+
Type: schema.TypeBool,
93+
Computed: true,
94+
Description: "Indicates a system Network Zone",
95+
},
9196
},
9297
Description: "Gets Okta Network Zone.",
9398
}

‎okta/services/idaas/resource_okta_network_zone.go‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,11 @@ func resourceNetworkZone() *schema.Resource {
102102
Optional: true,
103103
Description: "Set this parameter to true in your request when you update the DefaultExemptIpZone to allow IPs through the blocklist.",
104104
},
105+
"system": {
106+
Type: schema.TypeBool,
107+
Computed: true,
108+
Description: "Indicates a system Network Zone",
109+
},
105110
},
106111
}
107112
}
@@ -119,6 +124,10 @@ func resourceNetworkZoneCreate(ctx context.Context, d *schema.ResourceData, meta
119124
return diag.Errorf("the DefaultExemptIpZone is a built-in Okta network zone and cannot be created. " +
120125
"Please use 'terraform import okta_network_zone.<resource_name> <zone_id>' to manage it")
121126
}
127+
if d.Get("name").(string) == "BlockedIpZone" {
128+
return diag.Errorf("the BlockedIpZone is a built-in Okta network zone and cannot be created. " +
129+
"Please use 'terraform import okta_network_zone.<resource_name> <zone_id>' to manage it")
130+
}
122131
zone, _, err := getOktaV6ClientFromMetadata(meta).NetworkZoneAPI.CreateNetworkZone(ctx).Zone(payload).Execute()
123132
if err != nil {
124133
return diag.Errorf("failed to create network zone: %v", err)
@@ -181,7 +190,10 @@ func resourceNetworkZoneUpdate(ctx context.Context, d *schema.ResourceData, meta
181190
if err != nil {
182191
return diag.Errorf("failed to update network zone: %v", err)
183192
}
184-
if d.Get("name").(string) != "DefaultExemptIpZone" {
193+
194+
name := d.Get("name").(string)
195+
196+
if name != "DefaultExemptIpZone" && name != "BlockedIpZone" {
185197
if d.Get("status").(string) == "ACTIVE" {
186198
zone, _, err = getOktaV6ClientFromMetadata(meta).NetworkZoneAPI.ActivateNetworkZone(ctx, d.Id()).Execute()
187199
if err != nil {
@@ -204,9 +216,9 @@ func resourceNetworkZoneUpdate(ctx context.Context, d *schema.ResourceData, meta
204216
}
205217

206218
func resourceNetworkZoneDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
207-
// Built-in zones like DefaultExemptIpZone cannot be deleted from Okta,
208-
// so just remove them from state.
209-
if d.Get("name").(string) == "DefaultExemptIpZone" {
219+
// System zones (e.g. DefaultExemptIpZone, BlockedIpZone) cannot be deleted
220+
// from Okta, so just remove them from state.
221+
if d.Get("system").(bool) || d.Get("name").(string) == "DefaultExemptIpZone" {
210222
return nil
211223
}
212224
_, resp, err := getOktaV6ClientFromMetadata(meta).NetworkZoneAPI.DeactivateNetworkZone(ctx, d.Id()).Execute()
@@ -229,6 +241,10 @@ func buildNetworkZone(d *schema.ResourceData) (v6okta.ListNetworkZones200Respons
229241
ipnz.SetName(d.Get("name").(string))
230242
ipnz.SetType(zoneType)
231243
ipnz.SetUsage(d.Get("usage").(string))
244+
if d.Get("name").(string) == "BlockedIpZone" {
245+
ipnz.SetSystem(d.Get("system").(bool))
246+
}
247+
232248
if values, ok := d.GetOk("gateways"); ok {
233249
ipnz.SetGateways(buildAddressObjList(values.(*schema.Set)))
234250
}
@@ -442,6 +458,7 @@ func mapNetworkZoneToState(d *schema.ResourceData, data *v6okta.ListNetworkZones
442458
_ = d.Set("type", v.GetType())
443459
_ = d.Set("status", v.GetStatus())
444460
_ = d.Set("usage", v.GetUsage())
461+
_ = d.Set("system", v.GetSystem())
445462
err = utils.SetNonPrimitives(d, map[string]interface{}{
446463
"gateways": flattenAddresses(v.GetGateways()),
447464
"proxies": flattenAddresses(v.GetProxies()),

‎okta/services/idaas/resource_okta_network_zone_test.go‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,39 @@ func TestAccResourceOktaNetworkZone_issue_2271(t *testing.T) {
144144
})
145145
}
146146

147+
func TestAccResourceOktaNetworkZone_issue_2689(t *testing.T) {
148+
mgr := newFixtureManager("resources", resources.OktaIDaaSNetworkZone, t.Name())
149+
config := mgr.GetFixtures("basic_issue_2689.tf", t)
150+
151+
acctest.OktaResourceTest(t, resource.TestCase{
152+
PreCheck: acctest.AccPreCheck(t),
153+
ErrorCheck: testAccErrorChecks(t),
154+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactoriesForTestAcc(t),
155+
CheckDestroy: func(state *terraform.State) error {
156+
return nil
157+
},
158+
Steps: []resource.TestStep{
159+
{
160+
ImportState: true,
161+
ResourceName: "okta_network_zone.default_blocklist",
162+
ImportStateId: "nzo1x48tm4y10Y5h01d8",
163+
ImportStatePersist: true,
164+
Config: config,
165+
},
166+
{
167+
Config: config,
168+
Check: resource.ComposeTestCheckFunc(
169+
resource.TestCheckResourceAttr("okta_network_zone.default_blocklist", "name", "BlockedIpZone"),
170+
resource.TestCheckResourceAttr("okta_network_zone.default_blocklist", "type", "IP"),
171+
resource.TestCheckResourceAttr("okta_network_zone.default_blocklist", "status", "ACTIVE"),
172+
resource.TestCheckResourceAttr("okta_network_zone.default_blocklist", "usage", "BLOCKLIST"),
173+
resource.TestCheckResourceAttr("okta_network_zone.default_blocklist", "gateways.#", "0"),
174+
),
175+
},
176+
},
177+
})
178+
}
179+
147180
func doesNetworkZoneExist(id string) (bool, error) {
148181
client := iDaaSAPIClientForTestUtil.OktaSDKClientV2()
149182
_, response, err := client.NetworkZone.GetNetworkZone(context.Background(), id)

‎test/fixtures/vcr/idaas/TestAccResourceOktaNetworkZone_issue_2689/classic-00.yaml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
---
2+
version: 2
3+
interactions:
4+
- id: 0
5+
request:
6+
proto: HTTP/1.1
7+
proto_major: 1
8+
proto_minor: 1
9+
content_length: 0
10+
host: classic-00.dne-okta.com
11+
headers:
12+
Accept:
13+
- application/json
14+
Authorization:
15+
- SSWS REDACTED
16+
url: https://classic-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8
17+
method: GET
18+
response:
19+
proto: HTTP/2.0
20+
proto_major: 2
21+
proto_minor: 0
22+
content_length: -1
23+
uncompressed: true
24+
body: '{"type":"IP","id":"nzo1x48tm4y10Y5h01d8","name":"BlockedIpZone","status":"ACTIVE","usage":"BLOCKLIST","created":"2025-07-23T15:09:39.000Z","lastUpdated":"2026-03-05T07:18:18.000Z","system":true,"gateways":null,"proxies":null,"_links":{"self":{"href":"https://classic-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8","hints":{"allow":["GET","PUT","DELETE"]}},"deactivate":{"href":"https://classic-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8/lifecycle/deactivate","hints":{"allow":["POST"]}}}}'
25+
headers:
26+
Accept-Ch:
27+
- Sec-CH-UA-Platform-Version
28+
Content-Type:
29+
- application/json
30+
Date:
31+
- Thu, 05 Mar 2026 07:22:25 GMT
32+
Referrer-Policy:
33+
- strict-origin-when-cross-origin
34+
status: 200 OK
35+
code: 200
36+
duration: 1.118145375s
37+
- id: 1
38+
request:
39+
proto: HTTP/1.1
40+
proto_major: 1
41+
proto_minor: 1
42+
content_length: 0
43+
host: classic-00.dne-okta.com
44+
headers:
45+
Accept:
46+
- application/json
47+
Authorization:
48+
- SSWS REDACTED
49+
url: https://classic-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8
50+
method: GET
51+
response:
52+
proto: HTTP/2.0
53+
proto_major: 2
54+
proto_minor: 0
55+
content_length: -1
56+
uncompressed: true
57+
body: '{"type":"IP","id":"nzo1x48tm4y10Y5h01d8","name":"BlockedIpZone","status":"ACTIVE","usage":"BLOCKLIST","created":"2025-07-23T15:09:39.000Z","lastUpdated":"2026-03-05T07:18:18.000Z","system":true,"gateways":null,"proxies":null,"_links":{"self":{"href":"https://classic-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8","hints":{"allow":["GET","PUT","DELETE"]}},"deactivate":{"href":"https://classic-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8/lifecycle/deactivate","hints":{"allow":["POST"]}}}}'
58+
headers:
59+
Accept-Ch:
60+
- Sec-CH-UA-Platform-Version
61+
Content-Type:
62+
- application/json
63+
Date:
64+
- Thu, 05 Mar 2026 07:22:26 GMT
65+
Referrer-Policy:
66+
- strict-origin-when-cross-origin
67+
status: 200 OK
68+
code: 200
69+
duration: 1.209628042s
70+
- id: 2
71+
request:
72+
proto: HTTP/1.1
73+
proto_major: 1
74+
proto_minor: 1
75+
content_length: 0
76+
host: classic-00.dne-okta.com
77+
headers:
78+
Accept:
79+
- application/json
80+
Authorization:
81+
- SSWS REDACTED
82+
url: https://classic-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8
83+
method: GET
84+
response:
85+
proto: HTTP/2.0
86+
proto_major: 2
87+
proto_minor: 0
88+
content_length: -1
89+
uncompressed: true
90+
body: '{"type":"IP","id":"nzo1x48tm4y10Y5h01d8","name":"BlockedIpZone","status":"ACTIVE","usage":"BLOCKLIST","created":"2025-07-23T15:09:39.000Z","lastUpdated":"2026-03-05T07:18:18.000Z","system":true,"gateways":null,"proxies":null,"_links":{"self":{"href":"https://classic-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8","hints":{"allow":["GET","PUT","DELETE"]}},"deactivate":{"href":"https://classic-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8/lifecycle/deactivate","hints":{"allow":["POST"]}}}}'
91+
headers:
92+
Accept-Ch:
93+
- Sec-CH-UA-Platform-Version
94+
Content-Type:
95+
- application/json
96+
Date:
97+
- Thu, 05 Mar 2026 07:22:28 GMT
98+
Referrer-Policy:
99+
- strict-origin-when-cross-origin
100+
status: 200 OK
101+
code: 200
102+
duration: 940.789875ms

‎test/fixtures/vcr/idaas/TestAccResourceOktaNetworkZone_issue_2689/oie-00.yaml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
---
2+
version: 2
3+
interactions:
4+
- id: 0
5+
request:
6+
proto: HTTP/1.1
7+
proto_major: 1
8+
proto_minor: 1
9+
content_length: 0
10+
host: oie-00.dne-okta.com
11+
headers:
12+
Accept:
13+
- application/json
14+
Authorization:
15+
- SSWS REDACTED
16+
url: https://oie-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8
17+
method: GET
18+
response:
19+
proto: HTTP/2.0
20+
proto_major: 2
21+
proto_minor: 0
22+
content_length: -1
23+
uncompressed: true
24+
body: '{"type":"IP","id":"nzo1x48tm4y10Y5h01d8","name":"BlockedIpZone","status":"ACTIVE","usage":"BLOCKLIST","created":"2025-07-23T15:09:39.000Z","lastUpdated":"2026-03-05T07:18:18.000Z","system":true,"gateways":null,"proxies":null,"_links":{"self":{"href":"https://oie-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8","hints":{"allow":["GET","PUT","DELETE"]}},"deactivate":{"href":"https://oie-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8/lifecycle/deactivate","hints":{"allow":["POST"]}}}}'
25+
headers:
26+
Accept-Ch:
27+
- Sec-CH-UA-Platform-Version
28+
Content-Type:
29+
- application/json
30+
Date:
31+
- Thu, 05 Mar 2026 07:21:43 GMT
32+
Referrer-Policy:
33+
- strict-origin-when-cross-origin
34+
status: 200 OK
35+
code: 200
36+
duration: 1.216127333s
37+
- id: 1
38+
request:
39+
proto: HTTP/1.1
40+
proto_major: 1
41+
proto_minor: 1
42+
content_length: 0
43+
host: oie-00.dne-okta.com
44+
headers:
45+
Accept:
46+
- application/json
47+
Authorization:
48+
- SSWS REDACTED
49+
url: https://oie-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8
50+
method: GET
51+
response:
52+
proto: HTTP/2.0
53+
proto_major: 2
54+
proto_minor: 0
55+
content_length: -1
56+
uncompressed: true
57+
body: '{"type":"IP","id":"nzo1x48tm4y10Y5h01d8","name":"BlockedIpZone","status":"ACTIVE","usage":"BLOCKLIST","created":"2025-07-23T15:09:39.000Z","lastUpdated":"2026-03-05T07:18:18.000Z","system":true,"gateways":null,"proxies":null,"_links":{"self":{"href":"https://oie-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8","hints":{"allow":["GET","PUT","DELETE"]}},"deactivate":{"href":"https://oie-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8/lifecycle/deactivate","hints":{"allow":["POST"]}}}}'
58+
headers:
59+
Accept-Ch:
60+
- Sec-CH-UA-Platform-Version
61+
Content-Type:
62+
- application/json
63+
Date:
64+
- Thu, 05 Mar 2026 07:21:44 GMT
65+
Referrer-Policy:
66+
- strict-origin-when-cross-origin
67+
status: 200 OK
68+
code: 200
69+
duration: 1.156104084s
70+
- id: 2
71+
request:
72+
proto: HTTP/1.1
73+
proto_major: 1
74+
proto_minor: 1
75+
content_length: 0
76+
host: oie-00.dne-okta.com
77+
headers:
78+
Accept:
79+
- application/json
80+
Authorization:
81+
- SSWS REDACTED
82+
url: https://oie-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8
83+
method: GET
84+
response:
85+
proto: HTTP/2.0
86+
proto_major: 2
87+
proto_minor: 0
88+
content_length: -1
89+
uncompressed: true
90+
body: '{"type":"IP","id":"nzo1x48tm4y10Y5h01d8","name":"BlockedIpZone","status":"ACTIVE","usage":"BLOCKLIST","created":"2025-07-23T15:09:39.000Z","lastUpdated":"2026-03-05T07:18:18.000Z","system":true,"gateways":null,"proxies":null,"_links":{"self":{"href":"https://oie-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8","hints":{"allow":["GET","PUT","DELETE"]}},"deactivate":{"href":"https://oie-00.dne-okta.com/api/v1/zones/nzo1x48tm4y10Y5h01d8/lifecycle/deactivate","hints":{"allow":["POST"]}}}}'
91+
headers:
92+
Accept-Ch:
93+
- Sec-CH-UA-Platform-Version
94+
Content-Type:
95+
- application/json
96+
Date:
97+
- Thu, 05 Mar 2026 07:21:46 GMT
98+
Referrer-Policy:
99+
- strict-origin-when-cross-origin
100+
status: 200 OK
101+
code: 200
102+
duration: 1.245748s

0 commit comments

Comments
 (0)