Add DPoP flag on Oauth apps #2028

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

The Okta Terraform provider should support the dpop_bound_access_tokens flag on okta_app_oauth resources.
It should default to false if omitted (which is the current behavior of the API).

New or Affected Resource(s)

• okta_app_oauth

Potential Terraform Configuration

resource "okta_app_oauth" "example" {
  label          = "example"
  type           = "web"
  grant_types    = ["authorization_code"]
  redirect_uris  = ["https://example.com/"]
  response_types = ["code"]
  dpop_bound_access_tokens = true
}

References

• Okta Apps API
• DPoP guide
• Remotely related to Provider support for Demonstrating Proof of Possession (DPoP) #1904