Skip to content

Add use support for OAuth app inline JWKS - #2840

Open
laurynas-jonusas wants to merge 1 commit into
okta:masterfrom
laurynas-jonusas:fix/app-oauth-inline-jwks-use
Open

Add use support for OAuth app inline JWKS#2840
laurynas-jonusas wants to merge 1 commit into
okta:masterfrom
laurynas-jonusas:fix/app-oauth-inline-jwks-use

Conversation

@laurynas-jonusas

Copy link
Copy Markdown

Summary

Adds use support to the okta_app_oauth.jwks block. This fixes an issue where inline signing keys used with private_key_jwt would lose use = "sig|enc" and set it to null which would break the key after an OAuth app update because the provider did not expose or send the field.

Changes

  • Adds jwks.use with valid values sig and enc.
  • Sends use = "sig" for RSA/EC signing keys.
  • Sends use = "enc" for RSA encryption keys.
  • Reads use from Okta API responses back into Terraform state.
  • Normalizes missing/null signing use to sig.
  • Preserves configured JWKS order by matching keys by kid to avoid TypeList positional drift when Okta returns keys in a different order.
  • Updates docs and examples.

Testing

  • go test ./okta/services/idaas
  • Manual local-provider test with terraform apply against Okta:
    • created OAuth service app with inline RSA JWKS and use = "sig"
    • added another generated RSA JWKS key
    • removed one key and verified final planned after.jwks
    • verified Okta API response kept use = "sig"

Real-infra acceptance test:

TF_ACC=1 go test ./okta/services/idaas \
  -v -run '^TestAccResourceOktaAppOauth_jwksUsePreservedWhenAddingKey$' \
  -timeout 10m

@github-actions
github-actions Bot requested a review from aditya-okta May 26, 2026 14:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant