Fixed attribute statements setup for preconfigured apps

go.mod

@@ -12,5 +12,5 @@ require (
 	github.com/hashicorp/go-hclog v0.16.0
 	github.com/hashicorp/go-retryablehttp v0.6.8
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.5.0
-	github.com/okta/okta-sdk-golang/v2 v2.3.1-0.20210317124025-8a2c70f65200
+	github.com/okta/okta-sdk-golang/v2 v2.3.1-0.20210423115517-16a380fed4fe
 )

go.sum

@@ -316,6 +316,12 @@ github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
 github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
 github.com/okta/okta-sdk-golang/v2 v2.3.1-0.20210317124025-8a2c70f65200 h1:SGN4z5BtwxAxDOFy70o/lGA4RRe0v1PxQ6qzP7mV81E=
 github.com/okta/okta-sdk-golang/v2 v2.3.1-0.20210317124025-8a2c70f65200/go.mod h1:G4GCqqnZJCt91zMqYhDMLhg2INVbjiiFKkQ2mnia1J0=
+github.com/okta/okta-sdk-golang/v2 v2.3.1-0.20210422090450-3012db3e6d86 h1:jIQzjZ77r8FYQsGrAgACu9finACK4rC+pnIgfVE7OCc=
+github.com/okta/okta-sdk-golang/v2 v2.3.1-0.20210422090450-3012db3e6d86/go.mod h1:G4GCqqnZJCt91zMqYhDMLhg2INVbjiiFKkQ2mnia1J0=
+github.com/okta/okta-sdk-golang/v2 v2.3.1-0.20210422092404-262cc26ea22d h1:S6iTeGp89R7g5gHYFCZfvJAkZl6rkVuPVmhMwuhlHE4=
+github.com/okta/okta-sdk-golang/v2 v2.3.1-0.20210422092404-262cc26ea22d/go.mod h1:G4GCqqnZJCt91zMqYhDMLhg2INVbjiiFKkQ2mnia1J0=
+github.com/okta/okta-sdk-golang/v2 v2.3.1-0.20210423115517-16a380fed4fe h1:7++r96cEElvJoVHrZwT4643RpQ4R5dTEQChljJFjk54=
+github.com/okta/okta-sdk-golang/v2 v2.3.1-0.20210423115517-16a380fed4fe/go.mod h1:G4GCqqnZJCt91zMqYhDMLhg2INVbjiiFKkQ2mnia1J0=
 github.com/patrickmn/go-cache v0.0.0-20180815053127-5633e0862627 h1:pSCLCl6joCFRnjpeojzOpEYs4q7Vditq8fySFG5ap3Y=
 github.com/patrickmn/go-cache v0.0.0-20180815053127-5633e0862627/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=

okta/config.go

@@ -131,5 +131,9 @@ func checkRetry(ctx context.Context, resp *http.Response, err error) (bool, erro
 	if ok && resp != nil && containsInt(retryCodes, resp.StatusCode) {
 		return true, nil
 	}
+	// don't retry on internal server errors
+	if resp != nil && resp.StatusCode == http.StatusInternalServerError {
+		return false, nil
+	}
 	return retryablehttp.DefaultRetryPolicy(ctx, resp, err)
 }

okta/resource_okta_app_group_assignment.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"net/http"
 	"strings"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -76,6 +77,7 @@ func resourceAppGroupAssignment() *schema.Resource {
 }
 
 func resourceAppGroupAssignmentCreate(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	ctx = context.WithValue(ctx, retryOnStatusCodes, []int{http.StatusInternalServerError})
 	assignment, _, err := getOktaClientFromMetadata(m).Application.CreateApplicationGroupAssignment(
 		ctx,
 		d.Get("app_id").(string),

okta/resource_okta_app_saml.go

@@ -491,10 +491,9 @@ func buildSamlApp(d *schema.ResourceData) (*okta.SamlApplication, error) {
 	responseSigned := d.Get("response_signed").(bool)
 	assertionSigned := d.Get("assertion_signed").(bool)
 
-	preconfigName, ok := d.GetOk("preconfigured_app")
-
+	preConfigName, ok := d.GetOk("preconfigured_app")
 	if ok {
-		app.Name = preconfigName.(string)
+		app.Name = preConfigName.(string)
 	} else {
 		app.Name = d.Get("name").(string)
 
@@ -607,6 +606,8 @@ func buildSamlApp(d *schema.ResourceData) (*okta.SamlApplication, error) {
 			}
 		}
 		app.Settings.SignOn.AttributeStatements = samlAttr
+	} else {
+		app.Settings.SignOn.AttributeStatements = []*okta.SamlAttributeStatement{}
 	}
 
 	if id, ok := d.GetOk("key_id"); ok {

okta/resource_okta_policy_rule_sign_on.go

@@ -2,6 +2,7 @@ package okta
 
 import (
 	"context"
+	"errors"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -78,8 +79,12 @@ func resourcePolicySignonRule() *schema.Resource {
 }
 
 func resourcePolicySignOnRuleCreate(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	err := validateSignOnPolicyRule(d)
+	if err != nil {
+		return diag.FromErr(err)
+	}
 	template := buildSignOnPolicyRule(d)
-	err := createRule(ctx, d, m, template, policyRuleSignOn)
+	err = createRule(ctx, d, m, template, policyRuleSignOn)
 	if err != nil {
 		return diag.Errorf("failed to create sign-on policy rule: %v", err)
 	}
@@ -116,8 +121,12 @@ func resourcePolicySignOnRuleRead(ctx context.Context, d *schema.ResourceData, m
 }
 
 func resourcePolicySignOnRuleUpdate(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	err := validateSignOnPolicyRule(d)
+	if err != nil {
+		return diag.FromErr(err)
+	}
 	template := buildSignOnPolicyRule(d)
-	err := updateRule(ctx, d, m, template)
+	err = updateRule(ctx, d, m, template)
 	if err != nil {
 		return diag.Errorf("failed to update sign-on policy rule: %v", err)
 	}
@@ -165,3 +174,17 @@ func buildSignOnPolicyRule(d *schema.ResourceData) sdk.PolicyRule {
 	}
 	return template
 }
+
+func validateSignOnPolicyRule(d *schema.ResourceData) error {
+	prompt, ok := d.GetOk("mfa_prompt")
+	if !ok {
+		return nil
+	}
+	if prompt.(string) != "DEVICE" {
+		d, ok := d.GetOk("mfa_remember_device")
+		if ok && d.(bool) {
+			return errors.New("'mfa_remember_device' can only be set when mfa_prompt='DEVICE'")
+		}
+	}
+	return nil
+}