Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add OIE support for MFA policies. #919

Merged
merged 1 commit into from
Feb 2, 2022

Conversation

virgofx
Copy link
Contributor

@virgofx virgofx commented Jan 21, 2022

This pull request adds support for using new OIE authenticators as factors in the MFA policies. Specifically:

  • Add new is_oie attribute for both okta_policy_mfa and okta_policy_mfa_default. This attribute specifies how to build the payload for creating/updating MFA policies for tenants that support the new authenticators component. The reason this is not computed is because technically you can use the legacy factors even in an OIE tenant. If an OIE tenant attempts to use factors, these will succeed in the API initially (and return factors); however, upon any changes in the UI for an OIE tenant, everything will then be converted to authenticators. Thus, is_oie can change from a computed perspective; however, more importantly, it's needed for the CREATE/UPDATE operations to ensure that an OIE tenant uses authenticators (since it could also use factors) by updating the settings payload accordingly.
  • Add support for new OIE authenticators in SDK and reference these appropriately in resources (small refactoring)
  • For classic mode, only include the factors in state that are returned instead of populating the entire state from all possible factors.
  • Updated documentation for providers, updated examples, and included some other caveats to handle priority
  • Rebased/up-to-date with master branch

@bogdanprodan-okta I was pretty thorough in my testing in 2 tenants (OIE and classic) and made sure everything was backwards compatible. Since this is a larger scoped PR I'm sure there's some more work that needs to be done. Open to more feedback.


Fixes: #878
Fixes: #879
Fixes: #880

@virgofx virgofx force-pushed the mark/support-okta-verify-for-policy-mfa branch 6 times, most recently from 6b15917 to ac010d2 Compare January 21, 2022 22:03
@virgofx
Copy link
Contributor Author

virgofx commented Jan 25, 2022

@bogdanprodan-okta Any chance I could get you to review this? I've had it running locally for the past few days and not had any issues.

@ghost
Copy link

ghost commented Jan 25, 2022

@bogdanprodan-okta +1 on this issue. We have been running for a few months and this just popped up today for us. Appreciate any time you can allocate to review this!

@virgofx
Copy link
Contributor Author

virgofx commented Jan 28, 2022

/cc @monde Since sounds like you'll have some time to review some PRs/issues tomorrow. TYIA

@monde monde self-requested a review February 1, 2022 22:07
@virgofx virgofx force-pushed the mark/support-okta-verify-for-policy-mfa branch from ac010d2 to 5daa45f Compare February 1, 2022 22:32
@virgofx
Copy link
Contributor Author

virgofx commented Feb 1, 2022

Latest commit fixes a typo ^

@virgofx virgofx force-pushed the mark/support-okta-verify-for-policy-mfa branch from 5daa45f to 63f58bf Compare February 1, 2022 22:33
@monde monde merged commit f22c008 into okta:master Feb 2, 2022
@virgofx virgofx deleted the mark/support-okta-verify-for-policy-mfa branch February 2, 2022 17:13
@virgofx
Copy link
Contributor Author

virgofx commented Feb 2, 2022

🎉 Thanks @bogdanprodan-okta @monde

If there's time to cut a new release with latest changes, that would be awesome 💪

@monde
Copy link
Collaborator

monde commented Feb 2, 2022

🎉 Thanks @bogdanprodan-okta @monde

If there's time to cut a new release with latest changes, that would be awesome 💪

@virgofx I'll be releasing v3.20.4 later today.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
3 participants