Missing properties for PolicyRuleProfileEnrollment

[rodriguesgm]

What happened?

Currently there is no way to set scopes for the preRegistrationInlineHooks neither the progressiveProfilingAction attributes of the okta.PolicyRuleProfileEnrollment.

When I create a new following policy:

export const rule = new okta.PolicyRuleProfileEnrollment('policy-name', {
  policyId: 'valid-policy-id',
  unknownUserAction: 'DENY',
  access: 'ALLOW',
  emailVerification: true,
  uiSchemaId: 'valid-schema-id',
  inlineHookId: 'my-inline-hook-id', // the type of the hook is com.okta.user.pre-registration
  profileAttributes: [
    {
      name: 'email',
      label: 'Primary Email',
      required: true,
    }
  ],
});

And them I do I call GET /api/v1/policies/:policyId/rules I have the following response

...
     "actions": {
            "profileEnrollment": {
                "access": "ALLOW",
                "preRegistrationInlineHooks": [
                    {
                        "inlineHookId": "valid-hook-id",
                        "scopes": [
                            "SELF_SERVICE_REGISTRATION"
                        ]
                    }
                ],
                "profileAttributes": [
                    {
                        "name": "email",
                        "label": "Primary Email",
                        "required": true
                    }
                ],
                "targetGroupIds": null,
                "unknownUserAction": "DENY",
                "activationRequirements": {
                    "emailVerification": true
                },
                "uiSchemaId": "valid-schema-id",
            }
        },
...

But, if I go to the Okta Admin Console and just edit and save my Profile Enrollement, without changing anything, and then I do the same GET call,

"actions": {
            "profileEnrollment": {
                "access": "ALLOW",
                "preRegistrationInlineHooks": [
                    {
                        "inlineHookId": "valid-hook-id",
                        "scopes": [
                            "PROGRESSIVE_PROFILING"
                        ]
                    }
                ],
                "profileAttributes": [
                    {
                        "name": "email",
                        "label": "Primary Email",
                        "required": true
                    }
                ],
                "targetGroupIds": null,
                "unknownUserAction": "DENY",
                "activationRequirements": {
                    "emailVerification": true
                },
                "uiSchemaId": "valid-schema-id",
                "progressiveProfilingAction": "ENABLED"
            }
        },

So, the scopes changed from SELF_SERVICE_REGISTRATION to PROGRESSIVE_PROFILING
and I can also see a new progressiveProfilingAction property as ENABLED.

So, How can I set those fields in the pulumi object to make sure it won't change?

Expected Behavior

Need a way to send those properties so it won't change

Steps to reproduce

Already detailed above

Output of pulumi about

CLI          
Version      3.51.0
Go Version   go1.19.4
Go Compiler  gc

Plugins
NAME    VERSION
nodejs  unknown
okta    4.0.5
purrl   0.4.0

Host     
OS       darwin
Version  10.15.7
Arch     x86_64

This project is written in nodejs: executable='/.nvm/versions/node/v16.20.0/bin/node' version='v16.20.0'

Dependencies:
NAME                              VERSION
@types/ejs                        3.1.1
@types/eslint                     8.4.10
ejs                               3.1.8
eslint-plugin-import              2.26.0
@typescript-eslint/eslint-plugin  5.45.0
@typescript-eslint/parser         5.45.0
eslint-config-standard            17.0.0
eslint                            8.28.0
@pulumi/okta                      4.0.5
@pulumiverse/purrl                0.4.0
eslint-plugin-node                11.1.0
eslint-plugin-promise             6.1.1
eslint-plugin-standard            4.1.0
typescript                        4.9.3

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[AaronFriel]

@rodriguesgm Thanks for flagging this. I'm filing an issue on the upstream provider, because this looks like an API issue where the resource and the API and the web console don't agree.

• Resource okta_policy_rule_profile_enrollment does not allow managing scopes okta/terraform-provider-okta#1624