Skip to content

Commit df84d13

Browse files
dhiwakar-oktadhiwakar-okta
authored
GH-1030 | Support For preconfigured_app Attribute In okta_app_oauth Resource (#2721)
1 parent c31431d commit df84d13

7 files changed

Lines changed: 6162 additions & 12 deletions

File tree

‎docs/resources/app_oauth.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ resource "okta_app_oauth" "example" {
8484
- `consent_method` (String) *Early Access Property*. Indicates whether user consent is required or implicit. Valid values: REQUIRED, TRUSTED. Default value is TRUSTED. Note: Enable `API_ACCESS_MANAGEMENT`, `API_ACCESS_MANAGEMENT_CONSENT` feature flags in your org to use this property.
8585
- `enduser_note` (String) Application notes for end users.
8686
- `grant_types` (Set of String) List of OAuth 2.0 grant types. Conditional validation params found here https://developer.okta.com/docs/api/resources/apps#credentials-settings-details. Defaults to minimum requirements per app type.
87-
- `groups_claim` (Block Set, Max: 1) Groups claim for an OpenID Connect client application (argument is ignored when API auth is done with OAuth 2.0 credentials) (see [below for nested schema](#nestedblock--groups_claim))
87+
- `groups_claim` (Block Set, Max: 1) Groups claim for an OpenID Connect client application (argument is ignored when API auth is done with OAuth 2.0 credentials, and is not supported when `preconfigured_app` is set) (see [below for nested schema](#nestedblock--groups_claim))
8888
- `hide_ios` (Boolean) Do not display application icon on mobile app
8989
- `hide_web` (Boolean) Do not display application icon to users
9090
- `implicit_assignment` (Boolean) *Early Access Property*. Enable Federation Broker Mode.
@@ -100,6 +100,7 @@ resource "okta_app_oauth" "example" {
100100
- `pkce_required` (Boolean) Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
101101
- `policy_uri` (String) URI to web page providing client policy document.
102102
- `post_logout_redirect_uris` (Set of String) List of URIs for redirection after logout. Note: see okta_app_oauth_post_logout_redirect_uri for appending to this list in a decentralized way.
103+
- `preconfigured_app` (String) Tells Okta to use an existing application in their application catalog, as opposed to a custom application. Note: `groups_claim` is not supported when using `preconfigured_app`.
103104
- `profile` (String) Custom JSON that represents an OAuth application's profile
104105
- `redirect_uris` (List of String) List of URIs for use in the redirect-based flow. This is required for all application types except service. Note: see okta_app_oauth_redirect_uri for appending to this list in a decentralized way.
105106
- `refresh_token_leeway` (Number) *Early Access Property* Grace period for token rotation, required with grant types refresh_token

‎examples/resources/okta_app_oauth/basic_preconfigured_apps.tf‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
resource "okta_app_oauth" "test1" {
2+
preconfigured_app = "strongdm"
3+
label = "StrongDM"
4+
type = "web"
5+
}
6+
7+
resource "okta_app_oauth" "test2" {
8+
preconfigured_app = "Applauz"
9+
label = "Applauz"
10+
type = "web"
11+
}
12+
13+
resource "okta_app_oauth" "test3" {
14+
preconfigured_app = "Deel"
15+
label = "Deel"
16+
type = "web"
17+
}
18+
19+
resource "okta_app_oauth" "test4" {
20+
label = "StrongDM_CUSTOM"
21+
type = "web"
22+
redirect_uris = ["http://redirect-uri-2.com/"]
23+
}
24+
25+
resource "okta_app_oauth" "test5" {
26+
label = "CustomApp001"
27+
type = "web"
28+
grant_types = ["implicit", "authorization_code"]
29+
redirect_uris = ["http://redirect-uri.com/"]
30+
response_types = ["code", "token", "id_token"]
31+
issuer_mode = "ORG_URL"
32+
}

‎examples/resources/okta_app_oauth/basic_preconfigured_apps_updated.tf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
resource "okta_app_oauth" "test1" {
2+
preconfigured_app = "strongdm"
3+
label = "StrongDM_Updated"
4+
type = "web"
5+
redirect_uris = ["https://strongdm.example.com/callback"]
6+
}
7+
8+
resource "okta_app_oauth" "test2" {
9+
preconfigured_app = "Applauz"
10+
label = "Applauz_Updated"
11+
type = "web"
12+
redirect_uris = ["https://applauz.example.com/callback"]
13+
}
14+
15+
resource "okta_app_oauth" "test3" {
16+
preconfigured_app = "Deel"
17+
label = "Deel_Updated"
18+
type = "web"
19+
redirect_uris = ["https://deel.example.com/callback"]
20+
}
21+
22+
resource "okta_app_oauth" "test4" {
23+
label = "StrongDM_CUSTOM_Updated"
24+
type = "web"
25+
redirect_uris = ["http://redirect-uri-2-updated.com/"]
26+
}
27+
28+
resource "okta_app_oauth" "test5" {
29+
label = "CustomApp001_Updated"
30+
type = "web"
31+
grant_types = ["implicit", "authorization_code"]
32+
redirect_uris = ["http://redirect-uri-updated.com/"]
33+
response_types = ["code", "token", "id_token"]
34+
issuer_mode = "ORG_URL"
35+
}

‎okta/services/idaas/resource_okta_app_oauth.go‎

Lines changed: 24 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -398,12 +398,13 @@ other arguments that changed will be applied.`,
398398
Description: "*Early Access Property*. Enable Federation Broker Mode.",
399399
},
400400
"groups_claim": {
401-
Type: schema.TypeList,
402-
MaxItems: 1,
403-
Optional: true,
404-
Deprecated: "The groups_claim field is deprecated and will be removed in a future version. Use Authorization Server Claims (okta_auth_server_claim) or app profile configuration instead.",
405-
Description: "Groups claim for an OpenID Connect client application (DEPRECATED: This field will be removed in a future version. Use Authorization Server Claims instead).",
406-
Elem: groupsClaimResource,
401+
Type: schema.TypeList,
402+
MaxItems: 1,
403+
Optional: true,
404+
Deprecated: "The groups_claim field is deprecated and will be removed in a future version. Use Authorization Server Claims (okta_auth_server_claim) or app profile configuration instead.",
405+
Description: "Groups claim for an OpenID Connect client application (DEPRECATED: This field will be removed in a future version. Use Authorization Server Claims instead).",
406+
Elem: groupsClaimResource,
407+
ConflictsWith: []string{"preconfigured_app"},
407408
},
408409
"app_settings_json": {
409410
Type: schema.TypeString,
@@ -424,6 +425,11 @@ other arguments that changed will be applied.`,
424425
Optional: true,
425426
Description: "URL reference to JWKS",
426427
},
428+
"preconfigured_app": {
429+
Type: schema.TypeString,
430+
Optional: true,
431+
Description: "Tells Okta to use an existing application in their application catalog, as opposed to a custom application.",
432+
},
427433
}),
428434
Timeouts: &schema.ResourceTimeout{
429435
Create: schema.DefaultTimeout(1 * time.Hour),
@@ -536,15 +542,19 @@ func setAppOauthGroupsClaim(ctx context.Context, d *schema.ResourceData, meta in
536542
if d.Get("issuer_mode").(string) != "" {
537543
gc.IssuerMode = d.Get("issuer_mode").(string)
538544
} else {
539-
return errors.New("issuer_mode must be set when issuer_mode is set")
545+
return errors.New("issuer_mode must be set")
540546
}
541547
} else {
542-
return errors.New("issuer_mode must be set when issuer_mode is set")
548+
return errors.New("issuer_mode must be set")
543549
}
544550

545-
_, err := apiSupplement.UpdateAppOauthGroupsClaim(ctx, appID, gc)
546-
if err != nil {
547-
return fmt.Errorf("failed to update groups claim for an OAuth application: %v", err)
551+
if _, ok := d.GetOk("preconfigured_app"); !ok { // the internal api for setting app oauth groups claim doesn't work with most preconfigured i.e. existing apps
552+
_, err := apiSupplement.UpdateAppOauthGroupsClaim(ctx, appID, gc)
553+
if err != nil {
554+
return fmt.Errorf("failed to update groups claim for an OAuth application: %v", err)
555+
}
556+
} else {
557+
logger(meta).Info("Skipping updating app oauth groups for preconfigured apps.")
548558
}
549559
return nil
550560
}
@@ -953,6 +963,9 @@ func buildAppOAuthV6(d *schema.ResourceData, isNew bool) (v6okta.ListApplication
953963

954964
app.SetLabel(d.Get("label").(string))
955965
app.SetName("oidc_client")
966+
if preConfigName, ok := d.GetOk("preconfigured_app"); ok && preConfigName != "" {
967+
app.SetName(preConfigName.(string))
968+
}
956969
app.SetSignOnMode("OPENID_CONNECT")
957970

958971
// Build credentials

‎okta/services/idaas/resource_okta_app_oauth_test.go‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1042,3 +1042,100 @@ resource "okta_app_oauth" "test" {
10421042
},
10431043
})
10441044
}
1045+
1046+
// TestAccResourceOktaAppOauth_preconfigured tests creating and updating OAuth applications
1047+
// using preconfigured apps from the Okta Integration Network (test1-test3), as well as
1048+
// custom OAuth apps (test4-test5). groups_claim is not supported for preconfigured apps
1049+
// and should be skipped without error.
1050+
func TestAccResourceOktaAppOauth_preconfigured(t *testing.T) {
1051+
mgr := newFixtureManager("resources", resources.OktaIDaaSAppOAuth, t.Name())
1052+
config := mgr.GetFixtures("basic_preconfigured_apps.tf", t)
1053+
updatedConfig := mgr.GetFixtures("basic_preconfigured_apps_updated.tf", t)
1054+
1055+
acctest.OktaResourceTest(t, resource.TestCase{
1056+
PreCheck: acctest.AccPreCheck(t),
1057+
ErrorCheck: testAccErrorChecks(t),
1058+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactoriesForTestAcc(t),
1059+
CheckDestroy: checkResourceDestroy(resources.OktaIDaaSAppOAuth, createDoesOAuthAppExist()),
1060+
Steps: []resource.TestStep{
1061+
{
1062+
Config: config,
1063+
Check: resource.ComposeTestCheckFunc(
1064+
// test1: strongdm preconfigured app
1065+
ensureResourceExists(fmt.Sprintf("%s.test1", resources.OktaIDaaSAppOAuth), createDoesOAuthAppExist()),
1066+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test1", resources.OktaIDaaSAppOAuth), "preconfigured_app", "strongdm"),
1067+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test1", resources.OktaIDaaSAppOAuth), "label", "StrongDM"),
1068+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test1", resources.OktaIDaaSAppOAuth), "status", idaas.StatusActive),
1069+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test1", resources.OktaIDaaSAppOAuth), "type", "web"),
1070+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test1", resources.OktaIDaaSAppOAuth), "name", "strongdm"),
1071+
// test2: Applauz preconfigured app
1072+
ensureResourceExists(fmt.Sprintf("%s.test2", resources.OktaIDaaSAppOAuth), createDoesOAuthAppExist()),
1073+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test2", resources.OktaIDaaSAppOAuth), "preconfigured_app", "Applauz"),
1074+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test2", resources.OktaIDaaSAppOAuth), "label", "Applauz"),
1075+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test2", resources.OktaIDaaSAppOAuth), "status", idaas.StatusActive),
1076+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test2", resources.OktaIDaaSAppOAuth), "type", "web"),
1077+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test2", resources.OktaIDaaSAppOAuth), "name", "applauz"),
1078+
// test3: Deel preconfigured app
1079+
ensureResourceExists(fmt.Sprintf("%s.test3", resources.OktaIDaaSAppOAuth), createDoesOAuthAppExist()),
1080+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test3", resources.OktaIDaaSAppOAuth), "preconfigured_app", "Deel"),
1081+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test3", resources.OktaIDaaSAppOAuth), "label", "Deel"),
1082+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test3", resources.OktaIDaaSAppOAuth), "status", idaas.StatusActive),
1083+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test3", resources.OktaIDaaSAppOAuth), "type", "web"),
1084+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test3", resources.OktaIDaaSAppOAuth), "name", "deel"),
1085+
// test4: custom app (no preconfigured_app)
1086+
ensureResourceExists(fmt.Sprintf("%s.test4", resources.OktaIDaaSAppOAuth), createDoesOAuthAppExist()),
1087+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test4", resources.OktaIDaaSAppOAuth), "label", "StrongDM_CUSTOM"),
1088+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test4", resources.OktaIDaaSAppOAuth), "status", idaas.StatusActive),
1089+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test4", resources.OktaIDaaSAppOAuth), "type", "web"),
1090+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test4", resources.OktaIDaaSAppOAuth), "redirect_uris.#", "1"),
1091+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test4", resources.OktaIDaaSAppOAuth), "redirect_uris.0", "http://redirect-uri-2.com/"),
1092+
// test5: custom app with grant types and issuer_mode
1093+
ensureResourceExists(fmt.Sprintf("%s.test5", resources.OktaIDaaSAppOAuth), createDoesOAuthAppExist()),
1094+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test5", resources.OktaIDaaSAppOAuth), "label", "CustomApp001"),
1095+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test5", resources.OktaIDaaSAppOAuth), "status", idaas.StatusActive),
1096+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test5", resources.OktaIDaaSAppOAuth), "type", "web"),
1097+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test5", resources.OktaIDaaSAppOAuth), "grant_types.#", "2"),
1098+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test5", resources.OktaIDaaSAppOAuth), "redirect_uris.#", "1"),
1099+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test5", resources.OktaIDaaSAppOAuth), "redirect_uris.0", "http://redirect-uri.com/"),
1100+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test5", resources.OktaIDaaSAppOAuth), "issuer_mode", "ORG_URL"),
1101+
),
1102+
},
1103+
{
1104+
Config: updatedConfig,
1105+
Check: resource.ComposeTestCheckFunc(
1106+
// test1: updated label + redirect URI added
1107+
ensureResourceExists(fmt.Sprintf("%s.test1", resources.OktaIDaaSAppOAuth), createDoesOAuthAppExist()),
1108+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test1", resources.OktaIDaaSAppOAuth), "preconfigured_app", "strongdm"),
1109+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test1", resources.OktaIDaaSAppOAuth), "label", "StrongDM_Updated"),
1110+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test1", resources.OktaIDaaSAppOAuth), "name", "strongdm"),
1111+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test1", resources.OktaIDaaSAppOAuth), "redirect_uris.#", "1"),
1112+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test1", resources.OktaIDaaSAppOAuth), "redirect_uris.0", "https://strongdm.example.com/callback"),
1113+
// test2: updated label + redirect URI added
1114+
ensureResourceExists(fmt.Sprintf("%s.test2", resources.OktaIDaaSAppOAuth), createDoesOAuthAppExist()),
1115+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test2", resources.OktaIDaaSAppOAuth), "preconfigured_app", "Applauz"),
1116+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test2", resources.OktaIDaaSAppOAuth), "label", "Applauz_Updated"),
1117+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test2", resources.OktaIDaaSAppOAuth), "name", "applauz"),
1118+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test2", resources.OktaIDaaSAppOAuth), "redirect_uris.#", "1"),
1119+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test2", resources.OktaIDaaSAppOAuth), "redirect_uris.0", "https://applauz.example.com/callback"),
1120+
// test3: updated label + redirect URI added
1121+
ensureResourceExists(fmt.Sprintf("%s.test3", resources.OktaIDaaSAppOAuth), createDoesOAuthAppExist()),
1122+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test3", resources.OktaIDaaSAppOAuth), "preconfigured_app", "Deel"),
1123+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test3", resources.OktaIDaaSAppOAuth), "label", "Deel_Updated"),
1124+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test3", resources.OktaIDaaSAppOAuth), "redirect_uris.#", "1"),
1125+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test3", resources.OktaIDaaSAppOAuth), "redirect_uris.0", "https://deel.example.com/callback"),
1126+
// test4: updated label + updated redirect URI
1127+
ensureResourceExists(fmt.Sprintf("%s.test4", resources.OktaIDaaSAppOAuth), createDoesOAuthAppExist()),
1128+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test4", resources.OktaIDaaSAppOAuth), "label", "StrongDM_CUSTOM_Updated"),
1129+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test4", resources.OktaIDaaSAppOAuth), "redirect_uris.#", "1"),
1130+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test4", resources.OktaIDaaSAppOAuth), "redirect_uris.0", "http://redirect-uri-2-updated.com/"),
1131+
// test5: updated label + updated redirect URI
1132+
ensureResourceExists(fmt.Sprintf("%s.test5", resources.OktaIDaaSAppOAuth), createDoesOAuthAppExist()),
1133+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test5", resources.OktaIDaaSAppOAuth), "label", "CustomApp001_Updated"),
1134+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test5", resources.OktaIDaaSAppOAuth), "redirect_uris.#", "1"),
1135+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test5", resources.OktaIDaaSAppOAuth), "redirect_uris.0", "http://redirect-uri-updated.com/"),
1136+
resource.TestCheckResourceAttr(fmt.Sprintf("%s.test5", resources.OktaIDaaSAppOAuth), "issuer_mode", "ORG_URL"),
1137+
),
1138+
},
1139+
},
1140+
})
1141+
}

0 commit comments

Comments
 (0)