terraform-provider-okta: okta_policy_rule_signon identity_provider variable causing API error Invalid condition type specified: identityProvider

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave “+1” or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v1.0.10
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v3.75.1
+ provider registry.terraform.io/okta/okta v3.25.0

Affected Resource(s)

• resource.okta_policy_rule_signon
• resource.okta_policy_signon

Terraform Configuration Files

resource "okta_policy_signon" "mnovitsk_policy" {
  name        = "mnovitsk_signon_policy"
  description = "Signon Policy for certain users"
  priority    = 1
  status      = "INACTIVE"
  groups_included = [
    resource.okta_group.mnovitsk_test.id
  ]
  depends_on = [
    resource.okta_group.mnovitsk_test
  ]
}

resource "okta_policy_rule_signon" "mnovitsk_policy_rule" {
  policy_id          = resource.okta_policy_signon.mnovitsk_policy.id
  status             = "INACTIVE"
  name               = "mnovitsk_signon_policy_rule"
  authtype           = "ANY"
  access             = "ALLOW"
  primary_factor     = "PASSWORD_IDP"
  network_connection = "ANYWHERE"
  session_idle       = 120 # 2 hour idle session
  session_lifetime   = 720 # 12 hour session lifetime
  depends_on = [
    resource.okta_policy_signon.mnovitsk_policy
  ]
}

Debug Output

Panic Output

Expected Behavior

Create a Global Session Policy (resource.okta_policy_signon) with a Policy Rule (resource.okta_policy_rule_signon)

Actual Behavior

Terraform errors out when trying to apply the configuration. It automatically supplies an identity_provider = "ANY" variable, even if it is not manually supplied, and then errors out. I encounter the same error when manually supplying identity_provider = "ANY" in the Terraform resource configuration.

Terraform used the selected providers to generate the following execution plan. Resource actions are
indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # okta_policy_rule_signon.mnovitsk_policy_rule will be created
  + resource "okta_policy_rule_signon" "mnovitsk_policy_rule" {
      + access              = "ALLOW"
      + authtype            = "ANY"
      + id                  = (known after apply)
      + identity_provider   = "ANY"
      + mfa_remember_device = false
      + mfa_required        = false
      + name                = "mnovitsk_signon_policy_rule"
      + network_connection  = "ANYWHERE"
      + policy_id           = (known after apply)
      + primary_factor      = "PASSWORD_IDP"
      + risc_level          = "ANY"
      + session_idle        = 120
      + session_lifetime    = 720
      + session_persistent  = false
      + status              = "INACTIVE"
    }

  # okta_policy_signon.mnovitsk_policy will be created
  + resource "okta_policy_signon" "mnovitsk_policy" {
      + description     = "Signon Policy for certain users"
      + groups_included = [
          + "<okta_group_id>",
        ]
      + id              = (known after apply)
      + name            = "mnovitsk_signon_policy"
      + priority        = 1
      + status          = "INACTIVE"
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

okta_policy_signon.mnovitsk_policy: Creating...
okta_policy_signon.mnovitsk_policy: Creation complete after 0s [id=00p3k04nmpYoSa3eq1d7]
okta_policy_rule_signon.mnovitsk_policy_rule: Creating...
╷
│ Error: failed to create sign-on policy rule: failed to create policy rule: the API returned an error: Api validation failed: conditions. Causes: errorSummary: conditions: Invalid condition type specified: identityProvider.
│ 
│   with okta_policy_rule_signon.mnovitsk_policy_rule,
│   on main.tf line 60, in resource "okta_policy_rule_signon" "mnovitsk_policy_rule":
│   60: resource "okta_policy_rule_signon" "mnovitsk_policy_rule" {
│ 
╵
Releasing state lock. This may take a few moments...

Steps to Reproduce

1. terraform apply

Important Factoids

References

I checked the Terraform Provider Documentation: https://registry.terraform.io/providers/okta/okta/latest/docs/resources/policy_rule_signon#identity_provider and it states that “Use of identity_provider requires a feature flag to be enabled.”, but I do not see a flag in the tenant features related to this setting.

I am able to create Global Session Policies and Policy Rules via the UI with no issues, but attempting to create these resources via Terraform does not work. The policy itself is successfully created via Terraform, but there are no policy rules associated with it.

• #1028 : I also am experiencing a similar issue when trying to assign a specific priority to a new okta_policy_signon resource. I’m currently just providing priority = 1 to get around this issue for now, but it is going to cause larger problems when trying to declare and configure multiple sign on policies.