fix: populate okta_app_oauth type on import for preconfigured OIN OIDC apps (GH-2868) - #2870
Open
exitcode0 wants to merge 5 commits into
Open
fix: populate okta_app_oauth type on import for preconfigured OIN OIDC apps (GH-2868)#2870exitcode0 wants to merge 5 commits into
exitcode0 wants to merge 5 commits into
Conversation
…C apps
The okta_app_oauth Read path set the Required + ForceNew "type" attribute
only inside setOAuthClientSettingsV6, which early-returns when
settings.oauthClient is nil. For preconfigured OIN OIDC apps Okta's public
GET /apps/{id} can omit oauthClient (nil pointer) or its application_type,
so "type" was left empty in state. The next plan then rendered
`type = "..." # forces replacement` and planned to destroy and recreate the
live app, making OIN OIDC apps (e.g. ISPM, Okta Privileged Access)
impossible to import cleanly.
Move type population into a dedicated setOAuthAppType helper that runs in
Read regardless of the nil-oauthClient early-return and never clobbers a
known type with an empty value, so post-import plans are a no-op.
oktaGH-2868
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2868.
Problem
Importing a preconfigured OIN OIDC app into
okta_app_oauthleaves thetypeattribute empty in state. BecausetypeisRequired+ForceNew, the nextterraform planshowstype = "web" # forces replacementand plans to destroy/recreate the live app, so existing OIN OIDC apps (e.g. ISPM, Okta Privileged Access) can't be imported cleanly. This is the import half left unaddressed by #2721 / #1030 (preconfigured_app create support, v6.7.0).Root cause
On Read,
typewas set only insidesetOAuthClientSettingsV6, which early-returns whensettings.oauthClientis nil. For preconfigured OIN apps the publicGET /apps/{id}can omitoauthClient(nil) and/orapplication_type(empty), sotypewas never populated.Fix
Move
typepopulation into a dedicatedsetOAuthAppTypehelper invoked fromresourceAppOAuthReadindependent of the nil-oauthClientearly-return. It only writestypewhenapplication_typeis present and otherwise preserves the existing state/config value, so it never clobbers theForceNewattribute with an empty string.typeremainsRequired+ForceNew(it is genuinely immutable in Okta).Tests
Added in-package unit test
TestSetOAuthAppTypecovering niloauthClient, emptyapplication_type, and concrete-value cases.go build,go vet,gofmt, and the new unit test all pass. Acceptance tests (TF_ACC) require a live org and were not run.