fix: prevent nil pointer dereference in idp_saml, idp_social, and idp_oidc when accountLink.filter.groups is null (#2843)

Author: aditya-okta

examples/resources/okta_idp_saml/account_link_auto.tf

@@ -0,0 +1,35 @@
+resource "okta_app_saml" "test" {
+  label                    = "testAcc_replace_with_uuid"
+  sso_url                  = "http://google.com"
+  recipient                = "http://here.com"
+  destination              = "http://its-about-the-journey.com"
+  audience                 = "http://audience.com"
+  subject_name_id_template = "$${user.userName}"
+  subject_name_id_format   = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+  response_signed          = true
+  signature_algorithm      = "RSA_SHA256"
+  digest_algorithm         = "SHA256"
+  honor_force_authn        = false
+  authn_context_class_ref  = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
+}
+
+resource "okta_idp_saml_key" "test" {
+  x5c = [okta_app_saml.test.certificate]
+}
+
+# account_link_action = AUTO without account_link_group_include exercises the code path fixed
+# in OKTA-1131393: on some Okta cells the API returns accountLink.filter.groups = null while
+# filter itself is non-null, which caused a nil pointer dereference in the Read function.
+resource "okta_idp_saml" "test" {
+  name                     = "testAcc_replace_with_uuid"
+  acs_type                 = "INSTANCE"
+  sso_url                  = "https://idp.example.com"
+  sso_destination          = "https://idp.example.com"
+  sso_binding              = "HTTP-POST"
+  username_template        = "idpuser.email"
+  kid                      = okta_idp_saml_key.test.id
+  issuer                   = "https://idp.example.com"
+  request_signature_scope  = "REQUEST"
+  response_signature_scope = "ANY"
+  account_link_action      = "AUTO"
+}

okta/services/idaas/resource_okta_idp_oidc.go

@@ -280,7 +280,7 @@ func resourceIdpRead(ctx context.Context, d *schema.ResourceData, meta interface
 	}
 	if idp.Policy.AccountLink != nil {
 		_ = d.Set("account_link_action", idp.Policy.AccountLink.Action)
-		if idp.Policy.AccountLink.Filter != nil {
+		if idp.Policy.AccountLink.Filter != nil && idp.Policy.AccountLink.Filter.Groups != nil {
 			setMap["account_link_group_include"] = utils.ConvertStringSliceToSet(idp.Policy.AccountLink.Filter.Groups.Include)
 		}
 	}

okta/services/idaas/resource_okta_idp_saml.go

@@ -228,7 +228,7 @@ func resourceIdpSamlRead(ctx context.Context, d *schema.ResourceData, meta inter
 	}
 	if idp.Policy.AccountLink != nil {
 		_ = d.Set("account_link_action", idp.Policy.AccountLink.Action)
-		if idp.Policy.AccountLink.Filter != nil {
+		if idp.Policy.AccountLink.Filter != nil && idp.Policy.AccountLink.Filter.Groups != nil {
 			setMap["account_link_group_include"] = utils.ConvertStringSliceToSet(idp.Policy.AccountLink.Filter.Groups.Include)
 		}
 	}

okta/services/idaas/resource_okta_idp_saml_test.go

@@ -118,6 +118,39 @@ func TestAccResourceOktaIdpSaml_crud(t *testing.T) {
 	})
 }
 
+// TestAccResourceOktaIdpSaml_account_link_auto exercises the Read path when account_link_action
+// is set to AUTO without account_link_group_include. Regression test for OKTA-1131393 where
+// the provider panicked with a nil pointer dereference when the Okta API returned
+// accountLink.filter.groups = null (filter non-null, groups null inside it).
+func TestAccResourceOktaIdpSaml_account_link_auto(t *testing.T) {
+	mgr := newFixtureManager("resources", resources.OktaIDaaSIdpSaml, t.Name())
+	config := mgr.GetFixtures("account_link_auto.tf", t)
+	resourceName := fmt.Sprintf("%s.test", resources.OktaIDaaSIdpSaml)
+
+	acctest.OktaResourceTest(t, resource.TestCase{
+		PreCheck:                 acctest.AccPreCheck(t),
+		ErrorCheck:               testAccErrorChecks(t),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactoriesForTestAcc(t),
+		CheckDestroy:             checkResourceDestroy(resources.OktaIDaaSIdpSaml, createDoesIdpExist),
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "name", acctest.BuildResourceName(mgr.Seed)),
+					resource.TestCheckResourceAttr(resourceName, "account_link_action", "AUTO"),
+					resource.TestCheckNoResourceAttr(resourceName, "account_link_group_include"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"issuer_mode"},
+			},
+		},
+	})
+}
+
 // TestAccResourceOktaIdpSaml_minimal_example was used to prove that the PR
 // https://github.com/okta/terraform-provider-okta/pull/1355 was correct. This
 // test would fail if the org was missing the mappings api feature. And pass if

okta/services/idaas/resource_okta_idp_social.go

@@ -232,7 +232,7 @@ func resourceIdpSocialRead(ctx context.Context, d *schema.ResourceData, meta int
 	if idp.Policy.AccountLink != nil {
 		_ = d.Set("account_link_action", idp.Policy.AccountLink.Action)
 
-		if idp.Policy.AccountLink.Filter != nil {
+		if idp.Policy.AccountLink.Filter != nil && idp.Policy.AccountLink.Filter.Groups != nil {
 			setMap["account_link_group_include"] = utils.ConvertStringSliceToSet(idp.Policy.AccountLink.Filter.Groups.Include)
 		}
 	}