Merge pull request #1081 from okta/fix_cso

Fix for v3.25.1 release
okta · Apr 26, 2022 · 51633d5 · 51633d5
2 parents cef7a30 + 17ed72f
commit 51633d5
Show file tree

Hide file tree

Showing 12 changed files with 77 additions and 30 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## 3.25.1 (April 26, 2022)
+
+BUGS:
+
+ * Fix incomplete `compound_search_operator` on data source `okta_users`. [#1077](https://github.com/okta/terraform-provider-okta/issues/1077). Thanks, [@monde](https://github.com/monde)!
+ * Fix default value regression on `okta_policy_rule_sign_on` for `identity_provider` attribute. [#1079](https://github.com/okta/terraform-provider-okta/issues/1079). Thanks, [@monde](https://github.com/monde)!
+
 ## 3.25.0 (April 21, 2022)
 
 ENHANCEMENTS:

diff --git a/examples/okta_policy_rule_signon/okta_identity_provider.tf b/examples/okta_policy_rule_signon/okta_identity_provider.tf
@@ -18,7 +18,6 @@ resource "okta_policy_rule_signon" "test" {
  mfa_required = true
  mfa_lifetime = 15
  mfa_prompt = "SESSION"
- identity_provider = "OKTA"
 }
 
 resource "okta_network_zone" "test" {

diff --git a/examples/okta_users/datasource.tf b/examples/okta_users/datasource.tf
@@ -0,0 +1,18 @@
+data "okta_users" "compound_search" {
+ compound_search_operator = "and"
+
+ search {
+ name = "profile.firstName"
+ value = "TestAcc"
+ }
+
+ search {
+ name = "profile.lastName"
+ value = "Jones"
+ }
+
+ search {
+ name = "profile.email"
+ comparison = "pr"
+ }
+}
diff --git a/okta/config.go b/okta/config.go
@@ -101,7 +101,7 @@ func (c *Config) loadAndValidate(ctx context.Context) error {
  okta.WithRateLimitMaxBackOff(int64(c.maxWait)),
  okta.WithRequestTimeout(int64(c.requestTimeout)),
  okta.WithRateLimitMaxRetries(int32(c.retryCount)),
- okta.WithUserAgentExtra("okta-terraform/3.25.0"),
+ okta.WithUserAgentExtra("okta-terraform/3.25.1"),
  }
  if c.apiToken == "" {
  setters = append(setters, okta.WithAuthorizationMode("PrivateKey"))

diff --git a/okta/data_source_okta_user.go b/okta/data_source_okta_user.go
@@ -17,7 +17,7 @@ var userSearchSchemaDescription = "Filter to find " +
  "must match what is in Okta, which is likely camel case. " +
  "Expression is a free form expression filter " +
  "https://developer.okta.com/docs/reference/core-okta-api/#filter . " +
- "The set name/value/comparision properties will be ignored if expression is present"
+ "The set name/value/comparison properties will be ignored if expression is present"
 
 var userSearchSchema = map[string]*schema.Schema{
  "name": {
@@ -30,10 +30,9 @@ var userSearchSchema = map[string]*schema.Schema{
  Optional: true,
  },
  "comparison": {
- Type: schema.TypeString,
- Optional: true,
- Default: "eq",
- ValidateDiagFunc: elemInSlice([]string{"eq", "lt", "gt", "sw"}),
+ Type: schema.TypeString,
+ Optional: true,
+ Default: "eq",
  },
  "expression": {
  Type: schema.TypeString,
@@ -76,7 +75,7 @@ func dataSourceUser() *schema.Resource {
  Optional: true,
  Default: "and",
  ValidateDiagFunc: elemInSlice([]string{"and", "or"}),
- Description: "Search operator uses when joining mulitple search clauses",
+ Description: "Search operator used when joining mulitple search clauses",
  },
  }),
  }
@@ -148,7 +147,15 @@ func getSearchCriteria(d *schema.ResourceData) string {
  filterList[i] = fmt.Sprintf(`%s`, fmap["expression"])
  continue
  }
- filterList[i] = fmt.Sprintf(`%s %s "%s"`, fmap["name"], fmap["comparison"], fmap["value"])
+
+ // Need to set up the filter clause to allow comparions that do not
+ // accept a right hand argument and those that do.
+ // profile.email pr
+ filterList[i] = fmt.Sprintf(`%s %s`, fmap["name"], fmap["comparison"])
+ if fmap["value"] != "" {
+ // profile.email eq "example@example.com"
+ filterList[i] = fmt.Sprintf(`%s "%s"`, filterList[i], fmap["value"])
+ }
  }
 
  operator := " and "

diff --git a/okta/data_source_okta_users.go b/okta/data_source_okta_users.go
@@ -36,6 +36,13 @@ func dataSourceUsers() *schema.Resource {
  }),
  },
  },
+ "compound_search_operator": {
+ Type: schema.TypeString,
+ Optional: true,
+ Default: "and",
+ ValidateDiagFunc: elemInSlice([]string{"and", "or"}),
+ Description: "Search operator used when joining mulitple search clauses",
+ },
  },
  }
 }

diff --git a/okta/data_source_okta_users_test.go b/okta/data_source_okta_users_test.go
@@ -12,6 +12,7 @@ func TestAccOktaDataSourceUsers_read(t *testing.T) {
  mgr := newFixtureManager(users)
  users := mgr.GetFixtures("users.tf", ri, t)
  config := mgr.GetFixtures("basic.tf", ri, t)
+ dataSource := mgr.GetFixtures("datasource.tf", ri, t)
 
  resource.Test(t, resource.TestCase{
  PreCheck: func() {
@@ -36,6 +37,15 @@ func TestAccOktaDataSourceUsers_read(t *testing.T) {
  resource.TestCheckResourceAttrSet("data.okta_users.test", "users.#"),
  ),
  },
+ {
+ Config: dataSource,
+ Check: resource.ComposeTestCheckFunc(
+ resource.TestCheckResourceAttrSet("data.okta_users.compound_search", "compound_search_operator"),
+ resource.TestCheckResourceAttr("data.okta_users.compound_search", "compound_search_operator", "and"),
+ resource.TestCheckResourceAttrSet("data.okta_users.compound_search", "users.#"),
+ resource.TestCheckResourceAttr("data.okta_users.compound_search", "users.#", "1"),
+ ),
+ },
  },
  })
 }
diff --git a/okta/resource_okta_policy_rule_sign_on.go b/okta/resource_okta_policy_rule_sign_on.go
@@ -79,7 +79,8 @@ func resourcePolicySignOnRule() *schema.Resource {
  Optional: true,
  ValidateDiagFunc: elemInSlice([]string{"", "ANY", "LOW", "MEDIUM", "HIGH"}),
  Description: "Risc level: ANY, LOW, MEDIUM or HIGH",
- Default: "ANY",
+ // On reads the Okta API can return a default value of "ANY" when not present in local TF config
+ DiffSuppressFunc: valueDiffDefaultAPIValueToLocalValue("ANY", ""),
  },
  "behaviors": {
  Type: schema.TypeSet,
@@ -135,7 +136,8 @@ func resourcePolicySignOnRule() *schema.Resource {
  Optional: true,
  ValidateDiagFunc: elemInSlice([]string{"ANY", "OKTA", "SPECIFIC_IDP"}),
  Description: "Apply rule based on the IdP used: ANY, OKTA or SPECIFIC_IDP.",
- Default: "ANY",
+ // On reads the Okta API can return a default value of "ANY" when not present in local TF config
+ DiffSuppressFunc: valueDiffDefaultAPIValueToLocalValue("ANY", ""),
  },
  "identity_provider_ids": { // identity_provider must be SPECIFIC_IDP
  Type: schema.TypeList,
@@ -195,12 +197,6 @@ func resourcePolicySignOnRuleRead(ctx context.Context, d *schema.ResourceData, m
  return diag.Errorf("failed to set sign-on policy rule behaviors: %v", err)
  }
  }
- if rule.Conditions.IdentityProvider != nil {
- _ = d.Set("identity_provider", rule.Conditions.IdentityProvider.Provider)
- if rule.Conditions.IdentityProvider.Provider == "SPECIFIC_IDP" {
- _ = d.Set("identity_provider_ids", convertStringSliceToInterfaceSlice(rule.Conditions.IdentityProvider.IdpIds))
- }
- }
  }
 
  if rule.Actions.SignOn.Access == "CHALLENGE" {
@@ -271,14 +267,6 @@ func buildSignOnPolicyRule(d *schema.ResourceData) sdk.PolicyRule {
  People: getUsers(d),
  }
 
- provider, ok := d.GetOk("identity_provider")
- if ok {
- template.Conditions.IdentityProvider = &okta.IdentityProviderPolicyRuleCondition{
- Provider: provider.(string),
- IdpIds: convertInterfaceToStringArr(d.Get("identity_provider_ids")),
- }
- }
-
  bi, ok := d.GetOk("behaviors")
  if ok {
  template.Conditions.Risk = &okta.RiskPolicyRuleCondition{

diff --git a/okta/resource_okta_policy_rule_sign_on_test.go b/okta/resource_okta_policy_rule_sign_on_test.go
@@ -84,7 +84,6 @@ func TestAccOktaPolicyRuleSignon_crud(t *testing.T) {
  resource.TestCheckResourceAttr(resourceName, "name", fmt.Sprintf("testAcc_%d", ri)),
  resource.TestCheckResourceAttr(resourceName, "status", statusActive),
  resource.TestCheckResourceAttr(resourceName, "mfa_required", "true"),
- resource.TestCheckResourceAttr(resourceName, "identity_provider", "OKTA"),
  ),
  },
  {
@@ -94,10 +93,12 @@ func TestAccOktaPolicyRuleSignon_crud(t *testing.T) {
  resource.TestCheckResourceAttr(resourceName, "name", fmt.Sprintf("testAcc_%d", ri)),
  resource.TestCheckResourceAttr(resourceName, "status", statusActive),
  resource.TestCheckResourceAttr(resourceName, "mfa_required", "false"),
- resource.TestCheckResourceAttr(resourceName, "identity_provider", "SPECIFIC_IDP"),
- resource.TestCheckResourceAttr(resourceName, "identity_provider_ids.#", "1"),
  ),
  },
+
+ // This test is failing on our OIE test orgs but not on the non-OIE
+ // org. Some orgs need a feature flag for behaviors and/or it isn't
+ // supported on OIE orgs
  {
  Config: factorSequence,
  Check: resource.ComposeTestCheckFunc(

diff --git a/okta/utils.go b/okta/utils.go
@@ -215,6 +215,16 @@ func createValueDiffSuppression(newValueToIgnore string) schema.SchemaDiffSuppre
  }
 }
 
+// ignore schema diff change if value changes from default value (TF old) to local value (TF new)
+func valueDiffDefaultAPIValueToLocalValue(defaultAPIValue, localValue string) schema.SchemaDiffSuppressFunc {
+ return func(k, old, new string, d *schema.ResourceData) bool {
+ if old == defaultAPIValue && new == localValue {
+ return true
+ }
+ return false
+ }
+}
+
 func ensureNotDefault(d *schema.ResourceData, t string) error {
  thing := fmt.Sprintf("Default %s", t)
 

diff --git a/website/docs/d/user.html.markdown b/website/docs/d/user.html.markdown
@@ -45,7 +45,7 @@ data "okta_user" "example" {
 
 - `search` - (Optional) Map of search criteria. It supports the following properties.
  - `name` - (Required w/ comparison and value) Name of property to search against.
- - `comparison` - (Required w/ name and value) Comparison to use.
+ - `comparison` - (Required w/ name and value) Comparison to use. Comparitors for strings: [`eq`, `ge`, `gt`, `le`, `lt`, `ne`, `pr`, `sw`](https://developer.okta.com/docs/reference/core-okta-api/#operators).
  - `value` - (Required w/ comparison and name) Value to compare with.
  - `expression` - (Optional, but overrides name/comparison/value) A raw search expression string. If present it will override name/comparison/value.
 - `compound_search_operator` - (Optional) Given multiple search elements they will be compounded together with the op. Default is `and`, `or` is also valid.

diff --git a/website/docs/d/users.html.markdown b/website/docs/d/users.html.markdown
@@ -33,7 +33,7 @@ data "okta_users" "example" {
 
 - `search` - (Optional) Map of search criteria. It supports the following properties.
  - `name` - (Required w/ comparison and value) Name of property to search against.
- - `comparison` - (Required w/ name and value) Comparison to use.
+ - `comparison` - (Required w/ name and value) Comparison to use. Comparitors for strings: [`eq`, `ge`, `gt`, `le`, `lt`, `ne`, `pr`, `sw`](https://developer.okta.com/docs/reference/core-okta-api/#operators).
  - `value` - (Required w/ comparison and name) Value to compare with.
  - `expression` - (Optional, but overrides name/comparison/value) A raw search expression string. If present it will override name/comparison/value.
 - `compound_search_operator` - (Optional) Given multiple search elements they will be compounded together with the op. Default is `and`, `or` is also valid.