Add orn attribute to resources and data sources

[eliyoung-10x]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• OKTA support Customers can ask to reach out to Okta Developer Support Engineer/Customer Success Engineer to expedite investigation and resolution of this issue.

Description

As part of building out support for managing OIG, there are a few resources that take ORNs as input (okta_entitlement_bundle, okta_resource_owner, okta_resource_set). Unfortunately, it is currently necessary to construct these manually. The documentation for okta_resource_set demonstrates this:

terraform-provider-okta/docs/resources/resource_set.md

Lines 75 to 86 in 1a8f38a

	### To Provide permissions to specific Groups via ORN
	locals {
	org_id = "00onr127891saSQS"
	}
	resource "okta_resource_set" "test" {
	label = "Specific Groups"
	description = "Only Specific Group"
	resources = [
	format("orn:okta:directory:%s:groups", local.org_id),
	]
	}

While this is mostly just an annoyance for users and groups, it's a problem for applications, which are of form orn:okta:idp:${ORG_ID}:apps:${APP_TYPE}:${APP_ID}, where APP_TYPE can be basically anything. Some examples include:

• bookmark
• oidc_client
• google
• office365
• mfa_rdp
• ${ORG_NAME}_${CUSTOM_LABEL}_${NUMBER}

This wouldn't be a problem if it were possible to retrieve a resource's ORN using Terraform but, despite the API supporting this, that isn't currently possible. As a result, if one wants to create a custom SAML app using Terraform and then assign ownership of that app, it is necessary to first create the app in Terraform and then look up the application type manually before feeding that back into Terraform to assign ownership.

New or Affected Resource(s)

The critical ones are:

• okta_app
• okta_app_*
• okta_group
• okta_user

However, ideally this would eventually include anything that the module supports that's on the list of things with ORNs, which by my count also means:

• okta_app_connection
• okta_auth_server
• okta_realm

Customer Information

Organization Name: 10xgenomics
Paid Customer: yes

Potential Terraform Configuration

When creating resources:

resource "okta_app_saml" "saml_app" {
  label                    = "Terraform-Created SAML App"
  sso_url                  = "https://example.com"
  recipient                = "https://example.com"
  destination              = "https://example.com"
  audience                 = "https://example.com/audience"
  subject_name_id_template = "$${user.userName}"
  subject_name_id_format   = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
  response_signed          = true
  signature_algorithm      = "RSA_SHA256"
  digest_algorithm         = "SHA256"
  authn_context_class_ref  = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
}

resource "okta_group" "saml_app_owners" {
  name        = "${okta_app_saml.saml_app.label} - Owners"
  description = "Owners of ${okta_app_saml.saml_app.label}"
}

resource "okta_resource_owner" "saml_app_owners" {
  resource_arns  = [okta_app_saml.saml_app.orn]
  principal_orns = [okta_group.saml_app_owners.orn]
}

When referencing existing resources:

data "okta_app" "preexisting_app" {
  label = "Precreated App of Some Kind"
}

data "okta_group" "preexisting_app_owners" {
  name = "Preexisting App of Some Kind - Owners"
}

resource "okta_resource_owner" "preexisting_app_owners" {
  resource_arns  = [data.okta_app.preexisting_app.orn]
  principal_orns = [data.okta_group.preexisting_app_owners.orn]
}

References

No response