okta_campaign: Unable to Manage Access Certification Campaigns when "Automatically remove group-based access" is Enabled

[c-krug]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
  Before submitting a bug report, we ask that you first search existing issues and pull requests to see if someone else may have experienced the same issue or may have already submitted a fix for it. This helps to keep all relevant information in one place, including any potential workarounds.

A Note on Terraform Core Issues

We also ask that you consider whether your issue may be related to Terraform Core. If you are running into one of the following scenarios, we recommend opening an issue in the Terraform Core repository instead:

• Configuration Language or resource ordering issues
• State and State Backend issues
• Provisioner issues
• Registry issues
• Issues that span resources across multiple providers

Description

When a campaign has "Automatically remove group-based access" enabled, the okta_campaign resource is unable to manage it. I cannot import one that has been created in the UI, and I cannot fix drift if a terraform managed one has this enabled within the UI. The error message that arises is Error: Value Conversion Error. More specifically, this seems to indicate a mismatch in values between the API structure and the terraform object.

│ An unexpected error was encountered trying to convert from struct into an
│ object. This is always an error in the provider. Please report the
│ following to the provider developer:
│
│ Mismatch between struct and object type: Struct defines fields not found in
│ object: include_all_entitlements_and_bundles, entitlement_bundles, and
│ entitlements.
│ Struct: governance.targetResourceModel
│ Object type: types.ObjectType["resource_id":basetypes.StringType,
│ "resource_type":basetypes.StringType]

I assume this can be done via the API since I do see the above attributes in the json return when I get one of these campaign configurations from an API pull.

Terraform Version & Okta Provider Version(s)

Terraform v1.11.5
on Spacelift

• provider registry.terraform.io/providers/okta/okta/ v6.12.0

Affected Resource(s)

okta_campaign

Can this be done in the Admin UI?

Yes

Can this be done in the actual API call?

Unsure

Customer Information

Organization Name: Flatiron Health
Paid Customer: yes

Terraform Configuration

NA

Debug Output

NA

Expected Behavior

Successful management of the resource after import or apply.

Actual Behavior

Error message indicating a Value Conversion Error

Steps to reproduce

1. terraform apply or terraform import

Important Factoids

No response

References

No response