metadata validation failed in okta_app_saml

[ppanan33]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Affected Resource(s)

• okta_app_saml

Terraform Configuration Files

resource "okta_app_saml" "default_0" {
  accessibility_self_service     = false
  assertion_signed               = false
  audience                       = ""
  authentication_policy          = "rst2gutoisLK0vjcq1d7"
  authn_context_class_ref        = ""
  auto_submit_toolbar            = true
  hide_ios                       = false
  hide_web                       = false
  idp_issuer                     = ""
  label                          = "Slack"
  saml_version                   = "2.0"
  skip_groups                    = true
  skip_users                     = true
  status                         = "INACTIVE"
  user_name_template             = "$${source.login}"
  user_name_template_push_status = ""
  user_name_template_suffix      = ""
  user_name_template_type        = "BUILT_IN"
}

Debug Output

Panic Output

Expected Behavior

when using okta_app_saml to deactive a saml app, it will return the error This operation on app metadata is not yet supported: No active instances. but the app DOES de-active successfully. For the API {{url}}/api/v1/apps/{{appId}}/sso/saml/metadata?kid={{keyId}}, if a saml app is inactive, the metadata can't be found, so I think okta_app_saml should be updated for this case.

Actual Behavior

Steps to Reproduce

1. terraform apply

Important Factoids

References

• #0000

[monde]

Thank @ppanan33 . I am not familiar with that specific error and will need time to debug it. There might be an issue in the app lifecycle where a change to the app needs to be made in a deactivated status first. I don't have any recommendations for a workaround with this yet. Marking this as a bug.

Okta internal reference https://oktainc.atlassian.net/browse/OKTA-581716

[ppanan33]

Thanks @monde, there is a hint might help, you can get the metadata via below API for ACTIVE saml app, but for INACTIVE saml app, it throw error which is almost same as in Terraform.
{{url}}/api/v1/apps/{{appId}}/sso/saml/metadata?kid={{keyId}}

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days

[askmeidentity]

Is there any update on this issue. When changing the status from ACTIVE to INACTIVE this error is thrown. We have dedicated api to deactivate app but for terraform there isnt anything other than status change.

[monde]

@ppanan33 @askmeidentity do you think the correct behavior, when the application is deactivated, is to set the metadata https://registry.terraform.io/providers/okta/okta/latest/docs/resources/app_saml#metadata value to blank "" and not make the API call to /api/v1/apps/{id}/sso/saml/metadata?kid={kid}? That way 1) the error doesn't occur 2) change detection occurs on metadata

[monde]

@duytiennguyen-okta and I looked at this some more. We think there is a flaw in the way all the apps do update. If you are using TF to disable an app then any other updates in the same apply are invalid for that update. Okta treats deactivated apps as a soft delete, once deactivated, the operator can no longer make associations to that app or update it's attributes. The only action or change that can be taken on an deactivated app is activate it or delete it. I'm going to update all the apps behavior to be more precise about this. And also update our docs.

cc: @ppanan33 @askmeidentity

[monde]

I was incorrect in my previous comment. We did make an update to all the Okta apps including okta_app_saml

During an apply if there is change in status the app will first be
activated or deactivated in accordance with the status change. Then, all
other arguments that changed will be applied.

That will be PR #1806