Added 'OVERRIDE' master property

okta/resource_okta_app_user_base_schema.go

@@ -20,6 +20,14 @@ func resourceAppUserBaseSchema() *schema.Resource {
 			userTypeSchema,
 			userPatternSchema,
 			map[string]*schema.Schema{
+				"master": {
+					Type:     schema.TypeString,
+					Optional: true,
+					// Accepting an empty value to allow for zero value (when provisioning is off)
+					ValidateDiagFunc: stringInSlice([]string{"PROFILE_MASTER", "OKTA", ""}),
+					Description:      "SubSchema profile manager, if not set it will inherit its setting.",
+					Default:          "PROFILE_MASTER",
+				},
 				"app_id": {
 					Type:     schema.TypeString,
 					Required: true,

okta/resource_okta_app_user_schema.go

@@ -40,6 +40,14 @@ func resourceAppUserSchema() *schema.Resource {
 					ValidateDiagFunc: stringInSlice([]string{"SELF", "NONE", ""}),
 					ForceNew:         true, // since the `scope` is read-only attribute, the resource should be recreated
 				},
+				"master": {
+					Type:     schema.TypeString,
+					Optional: true,
+					// Accepting an empty value to allow for zero value (when provisioning is off)
+					ValidateDiagFunc: stringInSlice([]string{"PROFILE_MASTER", "OKTA", ""}),
+					Description:      "SubSchema profile manager, if not set it will inherit its setting.",
+					Default:          "PROFILE_MASTER",
+				},
 			}),
 		SchemaVersion: 2,
 		StateUpgraders: []schema.StateUpgrader{

okta/resource_okta_user_base_schema.go

@@ -33,7 +33,21 @@ func resourceUserBaseSchema() *schema.Resource {
 			},
 		},
 		SchemaVersion: 1,
-		Schema:        buildSchema(userBaseSchemaSchema, userTypeSchema, userPatternSchema),
+		Schema: buildSchema(
+			userBaseSchemaSchema,
+			userTypeSchema,
+			userPatternSchema,
+			map[string]*schema.Schema{
+				"master": {
+					Type:     schema.TypeString,
+					Optional: true,
+					// Accepting an empty value to allow for zero value (when provisioning is off)
+					ValidateDiagFunc: stringInSlice([]string{"PROFILE_MASTER", "OKTA", "OVERRIDE", ""}),
+					Description:      "SubSchema profile manager, if not set it will inherit its setting.",
+					Default:          "PROFILE_MASTER",
+				},
+			},
+		),
 		StateUpgraders: []schema.StateUpgrader{
 			{
 				Type: resourceUserBaseSchemaResourceV0().CoreConfigSchema().ImpliedType(),

okta/resource_okta_user_schema.go

@@ -2,6 +2,7 @@ package okta
 
 import (
 	"context"
+	"errors"
 	"reflect"
 	"strings"
 	"time"
@@ -46,6 +47,32 @@ func resourceUserSchema() *schema.Resource {
 					Default:          "NONE",
 					ValidateDiagFunc: stringInSlice([]string{"SELF", "NONE", ""}),
 				},
+				"master": {
+					Type:     schema.TypeString,
+					Optional: true,
+					// Accepting an empty value to allow for zero value (when provisioning is off)
+					ValidateDiagFunc: stringInSlice([]string{"PROFILE_MASTER", "OKTA", "OVERRIDE", ""}),
+					Description:      "SubSchema profile manager, if not set it will inherit its setting.",
+					Default:          "PROFILE_MASTER",
+				},
+				"master_override_priority": {
+					Type:        schema.TypeList,
+					Optional:    true,
+					Description: "",
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"type": {
+								Type:     schema.TypeString,
+								Optional: true,
+								Default:  "APP",
+							},
+							"value": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+						},
+					},
+				},
 			},
 		),
 		SchemaVersion: 1,
@@ -78,6 +105,10 @@ func resourceUserSchemaResourceV0() *schema.Resource {
 // this retry logic will be demolished.
 func resourceUserSchemaCreateOrUpdate(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
 	logger(m).Info("creating user schema", "name", d.Get("index").(string))
+	err := validateUserSchema(d)
+	if err != nil {
+		return diag.FromErr(err)
+	}
 	schemaUrl, err := getUserTypeSchemaUrl(ctx, getOktaClientFromMetadata(m), d.Get("user_type").(string))
 	if err != nil {
 		return diag.Errorf("failed to create user custom schema: %v", err)
@@ -148,3 +179,15 @@ func resourceUserSchemaDelete(ctx context.Context, d *schema.ResourceData, m int
 	}
 	return nil
 }
+
+func validateUserSchema(d *schema.ResourceData) error {
+	v, ok := d.GetOk("master")
+	if !ok || v.(string) != "OVERRIDE" {
+		return nil
+	}
+	mop, _ := d.Get("master_override_priority").([]interface{})
+	if len(mop) == 0 {
+		return errors.New("when setting profile master type to 'OVERRIDE' at least one 'master_override_priority' should be provided")
+	}
+	return nil
+}

okta/user_schema.go

@@ -1,6 +1,8 @@
 package okta
 
 import (
+	"fmt"
+
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/oktadeveloper/terraform-provider-okta/sdk"
 )
@@ -134,14 +136,6 @@ var (
 			Description:      "SubSchema permissions: HIDE, READ_ONLY, or READ_WRITE.",
 			Default:          "READ_ONLY",
 		},
-		"master": {
-			Type:     schema.TypeString,
-			Optional: true,
-			// Accepting an empty value to allow for zero value (when provisioning is off)
-			ValidateDiagFunc: stringInSlice([]string{"PROFILE_MASTER", "OKTA", ""}),
-			Description:      "SubSchema profile manager, if not set it will inherit its setting.",
-			Default:          "PROFILE_MASTER",
-		},
 		"required": {
 			Type:        schema.TypeBool,
 			Optional:    true,
@@ -195,6 +189,16 @@ func syncBaseUserSchema(d *schema.ResourceData, subschema *sdk.UserSubSchema) {
 	_ = d.Set("required", subschema.Required)
 	if subschema.Master != nil {
 		_ = d.Set("master", subschema.Master.Type)
+		if subschema.Master.Type == "OVERRIDE" {
+			arr := make([]map[string]interface{}, len(subschema.Master.Priority))
+			for i, st := range subschema.Master.Priority {
+				arr[i] = map[string]interface{}{
+					"type":  st.Type,
+					"value": st.Value,
+				}
+			}
+			_ = setNonPrimitives(d, map[string]interface{}{"master_override_priority": arr})
+		}
 	}
 	if len(subschema.Permissions) > 0 {
 		_ = d.Set("permissions", subschema.Permissions[0].Action)
@@ -237,11 +241,25 @@ func getNullableOneOf(d *schema.ResourceData, key string) (oneOf []*sdk.UserSche
 }
 
 func getNullableMaster(d *schema.ResourceData) *sdk.UserSchemaMaster {
-	if v, ok := d.GetOk("master"); ok {
-		return &sdk.UserSchemaMaster{Type: v.(string)}
+	v, ok := d.GetOk("master")
+	if !ok {
+		return nil
 	}
-
-	return nil
+	usm := &sdk.UserSchemaMaster{Type: v.(string)}
+	if v.(string) == "OVERRIDE" {
+		mop, ok := d.Get("master_override_priority").([]interface{})
+		if ok && len(mop) > 0 {
+			props := make([]sdk.UserSchemaMasterPriority, len(mop))
+			for i := range mop {
+				props[i] = sdk.UserSchemaMasterPriority{
+					Type:  d.Get(fmt.Sprintf("master_override_priority.%d.type", i)).(string),
+					Value: d.Get(fmt.Sprintf("master_override_priority.%d.value", i)).(string),
+				}
+			}
+			usm.Priority = props
+		}
+	}
+	return usm
 }
 
 func getNullableItem(d *schema.ResourceData) *sdk.UserSchemaItem {

okta/utils.go

@@ -325,11 +325,11 @@ func remove(arr []string, el string) []string {
 }
 
 // The best practices states that aggregate types should have error handling (think non-primitive). This will not attempt to set nil values.
-func setNonPrimitives(data *schema.ResourceData, valueMap map[string]interface{}) error {
+func setNonPrimitives(d *schema.ResourceData, valueMap map[string]interface{}) error {
 	for k, v := range valueMap {
 		if v != nil {
-			if err := data.Set(k, v); err != nil {
-				return fmt.Errorf("error setting %s for resource %s: %s", k, data.Id(), err)
+			if err := d.Set(k, v); err != nil {
+				return fmt.Errorf("error setting %s for resource %s: %s", k, d.Id(), err)
 			}
 		}
 	}

sdk/user_schema.go

@@ -41,7 +41,13 @@ type (
 	}
 
 	UserSchemaMaster struct {
-		Type string `json:"type,omitempty"`
+		Type     string                     `json:"type,omitempty"`
+		Priority []UserSchemaMasterPriority `json:"priority,omitempty"`
+	}
+
+	UserSchemaMasterPriority struct {
+		Type  string `json:"type,omitempty"`
+		Value string `json:"value,omitempty"`
 	}
 
 	UserSchemaEnum struct {

website/docs/r/user_schema.html.markdown

@@ -64,7 +64,11 @@ The following arguments are supported:
 
 - `permissions` - (Optional) Access control permissions for the property. It can be set to `"READ_WRITE"`, `"READ_ONLY"`, `"HIDE"`.
 
-- `master` - (Optional) Master priority for the user schema property. It can be set to `"PROFILE_MASTER"` or `"OKTA"`.
+- `master` - (Optional) Master priority for the user schema property. It can be set to `"PROFILE_MASTER"`, `"OVERRIDE"` or `"OKTA"`.
+
+- `master_override_priority` - (Optional) Prioritized list of profile sources (required when `master` is `"OVERRIDE"`).
+  - `type` - (Optional) - Type of profile source.
+  - `value` - (Required) - ID of profile source.
 
 - `external_name` - (Optional) External name of the user schema property.