Skip to content

fix: handle 404s gracefully in okta_push_group read, update, and delete - #2853

Open
exitcode0 wants to merge 1 commit into
okta:masterfrom
exitcode0:push_group_404
Open

fix: handle 404s gracefully in okta_push_group read, update, and delete#2853
exitcode0 wants to merge 1 commit into
okta:masterfrom
exitcode0:push_group_404

Conversation

@exitcode0

@exitcode0 exitcode0 commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

Fixes #2807

Summary

okta_push_group discarded the API response on its read, update, and delete calls (groupPushMapping, _, err := ...), so a 404 Not Found returned for a mapping that was deleted out of band (e.g. removed in the Okta Admin UI) surfaced as a hard error. This blocked terraform plan/apply and terraform destroy, forcing a manual terraform state rm to recover.

This mirrors the exact failure reported in #2807:

"Error reading Okta push group mapping ","detail":"404 Not Found"

Changes

Capture the V6 API response on each call and branch on a 404 via utils.SuppressErrorOn404_V6:

  • Read — remove the resource from state (resp.State.RemoveResource) so Terraform plans a recreate instead of erroring on refresh/plan.
  • Update — same: remove from state so Terraform plans a recreate.
  • Delete — treat an already-gone mapping as a successful destroy, covering both the INACTIVE deactivation call and the delete call.

This matches the established 404-handling patterns already in the provider:

  • resource_okta_authenticator_webauthn_custom_aaguid.go (read → RemoveResource)
  • resource_okta_group_owners.go (update/delete → suppress 404)

Behavior change

Before: 404 from an out-of-band-deleted mapping → hard error on plan/apply/destroy.
After: Terraform detects the mapping is gone and plans a recreate (read/update) or completes the destroy cleanly (delete) — the behavior requested in #2807.

The okta_push_group resource discarded the API response on its read,
update, and delete calls, so a 404 from a mapping that was deleted out
of band surfaced as a hard error. This blocked `terraform plan`/`apply`
and `terraform destroy`, forcing manual `state rm` to recover.

Capture the V6 API response on each call and branch on a 404 via
utils.SuppressErrorOn404_V6:

- Read:   remove the resource from state so Terraform plans a recreate.
- Update: remove the resource from state so Terraform plans a recreate.
- Delete: treat an already-gone mapping as a successful destroy (both
          the INACTIVE deactivation and the delete call).

Mirrors the existing 404-handling patterns in
resource_okta_authenticator_webauthn_custom_aaguid.go (read) and
resource_okta_group_owners.go (update/delete).

Fixes okta#2807
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

okta_push_group throw 404 error instead of being recreated

1 participant