okta_app_oauth: preconfigured OIDC import forces replace — type not read back #2868

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments.

Terraform Version & Okta Provider Version(s)

• Terraform v1.x / OpenTofu (reproduced on both)
• okta/okta provider v6.9.0
• Also reproduces against the code on main (post-v6.12.0) — see Important Factoids for source analysis.

Affected Resource(s)

• okta_app_oauth (preconfigured OIN OIDC apps, i.e. preconfigured_app = "<oin-key>")

Can this be done in the Admin UI?

N/A — this is a Terraform import/lifecycle issue, not a missing API/UI capability.

Can this be done in the actual API call?

N/A.

Terraform Configuration

preconfigured_app support for okta_app_oauth was added in #2721 (v6.7.0), which enables creating an OIN OIDC app. However, importing an existing preconfigured OIN OIDC app cannot produce a no-op plan:

import {
  to = okta_app_oauth.example
  id = "0oaXXXXXXXXXXXXXXXXX" # existing OIN OIDC app
}

resource "okta_app_oauth" "example" {
  label             = "Example"
  preconfigured_app = "<oin-oidc-key>" # e.g. an OIN OIDC integration
  status            = "ACTIVE"
  type              = "web"
  # grant_types / response_types intentionally omitted per the #2721 guidance
}

Debug Output

Plan after import (trimmed):

  # okta_app_oauth.example must be replaced
  ~ resource "okta_app_oauth" "example" {
      ~ id                = "0oaXXXXXXXXXXXXXXXXX" -> (known after apply)
      ~ name              = "<oin-key>" -> (known after apply)
      ~ sign_on_mode      = "OPENID_CONNECT" -> (known after apply)
      + type              = "web" # forces replacement
        ...
    }

Plan: 1 to import, 1 to add, ... , 1 to destroy.

Expected Behavior

After importing an existing preconfigured OIN OIDC app, a subsequent plan should be a no-op (import-only). The provider should populate type from the imported app so the configured type matches state.

Actual Behavior

On import, type is left empty in state. Because type is a ForceNew attribute, providing any value (e.g. type = "web", which is what #2721's docs/examples recommend for preconfigured apps) is seen as a change to a ForceNew field and forces replacement — Terraform plans to destroy and recreate the live app. There is no value of type (including omitting it, which errors as a required argument) that yields a clean import. Removing grant_types/response_types (per #2721 guidance) does not change this.

Steps to reproduce

1. Have an existing OIN OIDC integration app in the org (e.g. any OIN OIDC integration).
2. Write the import block + okta_app_oauth resource above with the matching preconfigured_app key and type = "web".
3. terraform plan (provider ≥ v6.7.0).
4. Observe okta_app_oauth.<name> must be replaced / type = "web" # forces replacement, with 1 to destroy in the summary.

Important Factoids (root-cause analysis)

In okta/services/idaas/resource_okta_app_oauth.go:

• type is declared with ForceNew: true.
• Read does _ = d.Set("type", oauthClient.GetApplicationType()). For preconfigured OIN OIDC apps the application type returned here is empty, so import leaves type="" in state.

Net effect: ForceNew type + empty-on-import → any configured type forces replacement of the live application. #2721 delivered the create path for preconfigured OIDC apps but not a clean import round-trip for type. This blocks bringing existing OIN OIDC apps (e.g. ISPM, Okta Privileged Access, and other OIN OIDC integrations) under Terraform management via import.

A possible fix: on Read, when preconfigured_app is set and the API returns no application type, derive/persist type so it round-trips (or relax the ForceNew/required behavior for preconfigured apps). A clean import is also a prerequisite for terraform plan -generate-config-out to emit a usable body.

References

• Support for preconfigured_app attribute in okta_app_oauth resource #1030 — Support for preconfigured_app attribute in okta_app_oauth (feature request)
• GH-1030 | Support For preconfigured_app Attribute In okta_app_oauth Resource #2721 — Support for preconfigured_app attribute in okta_app_oauth resource #1030 | Support For preconfigured_app Attribute In okta_app_oauth Resource (shipped in v6.7.0; create-only)