Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Specify consent_method and response_types to all resource okta_app_oauth #250

Open
zeekhoo opened this issue Jul 16, 2020 · 2 comments
Labels
needs-review Needs further review type: bug Something isn't working

Comments

@zeekhoo
Copy link
Contributor

zeekhoo commented Jul 16, 2020

In the .tf files, add to all okta_app_oauth resources the following fields:
consent_method = "TRUSTED"
response_types = ["code"]

During testing it was found that SQS sometimes duplicates its request (cause not known yet). This causes terraform apply to happen > 1 times during a provision. When this happens the status of the provisioning changes to "Error" because the 2nd terraform apply finds a change in state:

Example output during plan

  # okta_app_oauth.travelagency will be updated in-place
  ~ resource "okta_app_oauth" "travelagency" {
        auto_key_rotation          = true
        auto_submit_toolbar        = false
        client_id                  = "0oasr7o1x6z1P1YL80h7"
        client_secret              = (sensitive value)
      - consent_method             = "TRUSTED" -> null
        grant_types                = [
            "authorization_code",
        ]
        hide_ios                   = true
        hide_web                   = true
        id                         = "0oasr7o1x6z1P1YL80h7"
        issuer_mode                = "ORG_URL"
        label                      = "test-123 travelagency Demo (Generated by UDP)"
        name                       = "oidc_client"
        omit_secret                = false
        post_logout_redirect_uris  = []
        redirect_uris              = [
            "http://localhost:8666/authorization-code/callback",
        ]
      ~ response_types             = [
          - "code",
        ]
        sign_on_mode               = "OPENID_CONNECT"
        status                     = "ACTIVE"
        token_endpoint_auth_method = "client_secret_basic"
        type                       = "web"
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Notice the change to consent_method:

consent_method = "TRUSTED" -> null

The resulting apply:

okta_app_oauth.travelagency: Modifying... [id=0oasr7o1x6z1P1YL80h7]

Error: The API returned an error: Api validation failed: App Instance. Causes: errorSummary: 'consent_method' is required.

Adding the fields with explicit settings will avoid this issue.

@noinarisak noinarisak added the type: bug Something isn't working label Jul 16, 2020
@noinarisak
Copy link
Contributor

noinarisak commented Jul 16, 2020

@zeekhoo It looks that attribute is already there or at least in the repo.

resource "okta_app_oauth" "travelagency" {
label = "${var.udp_subdomain} ${var.demo_app_name} Demo (Generated by UDP)"
type = "web"
grant_types = ["authorization_code"]
redirect_uris = [
"https://${local.app_domain}/authorization-code/callback",
"http://localhost:8666/authorization-code/callback"
]
response_types = ["code"]
issuer_mode = "ORG_URL"
consent_method = "TRUSTED"
groups = ["${data.okta_group.all.id}"]
}

Maybe the uploaded HCL script doesn't have it?

@noinarisak noinarisak added the needs-review Needs further review label Jul 16, 2020
@zeekhoo
Copy link
Contributor Author

zeekhoo commented Jul 16, 2020

Looks like it is not in all of them. e.g. admin.tf and healthcare.tf are missing them.

@noinarisak noinarisak changed the title Specify consent_method and response_types to all resource okta_app_oauth [BUG] Specify consent_method and response_types to all resource okta_app_oauth Aug 12, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs-review Needs further review type: bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants