okta_policy_rule_password password_reset_requirement block does not function

[serasval]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
  Before submitting a bug report, we ask that you first search existing issues and pull requests to see if someone else may have experienced the same issue or may have already submitted a fix for it. This helps to keep all relevant information in one place, including any potential workarounds.

A Note on Terraform Core Issues

We also ask that you consider whether your issue may be related to Terraform Core. If you are running into one of the following scenarios, we recommend opening an issue in the Terraform Core repository instead:

• Configuration Language or resource ordering issues
• State and State Backend issues
• Provisioner issues
• Registry issues
• Issues that span resources across multiple providers

Terraform Version & Okta Provider Version(s)

Terraform v1.7.5
on

• provider registry.terraform.io/providers/okta/okta/ v6.13.0

Affected Resource(s)

The new password_reset_requirement block that was added to the okta_policy_rule_password object.

Can this be done in the Admin UI?

Yes

Can this be done in the actual API call?

Unsure

Customer Information

No response

Terraform Configuration

resource "okta_policy_rule_password" "allow_password_ih_admin" {
  policy_id        = okta_policy_password.password_ih_admin.id
  name            = "Users can change/reset password in zone"
  status          = "ACTIVE"
  password_change = "ALLOW"
  password_reset  = "ALLOW"
  password_unlock = "DENY"
  network_connection = "ZONE"
  network_includes = var.PASSWORD_IH_ADMIN_IP_ZONES
  priority        = 1

  password_reset_requirement {
    method_constraints {
      method                 = "otp"
      allowed_authenticators = ["google_otp"]
    }
    primary_methods = ["otp", "push", "call", "sms"]
    step_up_enabled = true
    step_up_methods = ["security_question"]
  }
}

Debug Output

Wasn't able to get our pipeline task to actually output any debug information.

Expected Behavior

The password_reset_requirement should be able to control the checkboxes for various password reset factors as well as the radio button for if we need additional step up factors to reset passwords

Actual Behavior

The new password_reset_requirement block was added to the okta_policy_rule_password object. This block was intended to allow you to control the various password recovery factor options. Adding this block to a configuration does not appear to affect anything in the tenant. None of the checkboxes end up checked, the radio button for additional step up method is not set by its corresponding attribute either.

Steps to reproduce

1. Set up a password and password rule via terraform and attempt to use the password_reset_requirement on the rule to control the password recovery objects.
2. terraform apply

Important Factoids

No response

References

No response