Terraform resource "okta_inline_hook" with type "com.okta.saml.tokens" does not support OAuth 2.0 authentication even if API and Admin UI does

[deepaunni2006]

Description:

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request

• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request

• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

okta = {

  source  = "okta/okta"

  version = "~> 4.13.0" --

}



okta = {

  source  = "okta/okta"

  version = "~> 4.5.0"

}

every version

Affected Resource(s)

• okta_inline_hook
• type "com.okta.saml.tokens"

Terraform Configuration Files

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key: [https://keybase.io/hashicorp](https://urldefense.com/v3/__https://keybase.io/hashicorp__;!!PwKahg!9gh41yliulSPgUn3l9s8ylKYIB5aDI0e1js2S1AMjLJMra2LsscvA5ase601oe5XWBic6aRhpl07kSnZhoi1$)

resource "okta_inline_hook" "saml_hooks" {
  for_each = toset(var.app1_tenants)
  name     = "saml-${each.key}-app1-hook"
  type     = "com.okta.saml.tokens.transform"
  version  = "1.0.2"
  status   = "ACTIVE"
  channel = {
    type    = "HTTP"
    version = "1.0.0"
    method = "POST"
    uri     = var.hook_service_url
  }
  auth = {
    key = "Authorization"
    type = "OAUTH2"
    value = jsonencode({
        client_id     = var.hook_client_id
        client_secret = var.hook_secret
        token_url     = var.hook_token_url
        scope         = "api"
    })
  }
}

Debug Output

Panic Output

Expected Behavior

Can this be done in the Admin UI?

Can this be done in the actual API call?

Actual Behavior

Steps to Reproduce

1. TF_LOG=DEBUG terraform apply -auto-approve okta_plan.tfplan

Important Factoids

References

• #0000

[deepaunni2006]

Opened this on behalf of a customer

[monde]

@deepaunni2006 can you get the error output from the TF provider, it will help deduce the issue if I'm not able to reproduce this given the sparse background given in the issue. Thanks

https://oktainc.atlassian.net/browse/OKTA-858195

[monde]

I was trying to get this addressed in the https://github.com/okta/terraform-provider-okta/releases/tag/v4.14.0 release. But the issue is complicated by a few factors and I have work planned to address another aspect of the inline hook in my upcoming sprint.

Sharing my notes for now.

This resource has existed in the project since 2019 and the project started in 2018. There is sparse public documentation at Okta about the com.okta.saml.tokens.transform inline hook type. It is listed in the inline hook API docs and that's about it. All of the various examples I could find reference the com.okta.oauth2.tokens.transform inline hook type.

The API contract for com.okta.oauth2.tokens.transform looks like this:

{
    "channel": {
        "config": {
            "authScheme": {
                "key": "Authorization",
                "type": "HEADER",
                "value": "123"
            },
            "method": "POST",
            "uri": "https://example.com/test"
        },
        "type": "HTTP",
        "version": "1.0.0"
    },
    "name": "testAcc_4742334166877256077",
    "status": "ACTIVE",
    "type": "com.okta.oauth2.tokens.transform",
    "version": "1.0.1"
}

And the com.okta.telephony.provider inline hook has a similar API contract:

{
    "channel": {
        "config": {
            "authScheme": {
                "key": "Authorization",
                "type": "HEADER",
                "value": "secret"
            },
            "method": "POST",
            "uri": "https://example.com/test"
        },
        "type": "HTTP",
        "version": "1.0.0"
    },
    "name": "testAcc_4742334166877256077_twilio",
    "status": "ACTIVE",
    "type": "com.okta.telephony.provider",
    "version": "1.0.0"
}

The implementation of the okta_inline_hook (code, doc) assumes that the Terraform operator will appreciate an auth property that is at the same level as the channel property in the resource. But looking at the API contract above, in the case of com.okta.oauth2.tokens.transform the auth scheme is actually an object within the greater channel object.

resource "okta_inline_hook" "test" {
  name    = "testAcc_replace_with_uuid"
  version = "1.0.1"
  type    = "com.okta.oauth2.tokens.transform"

  channel = {
    type    = "HTTP"
    version = "1.0.0"
    uri     = "https://example.com/test"
    method  = "POST"
  }

  auth = {
    key   = "Authorization"
    type  = "HEADER"
    value = "123"
  }
}

This becomes an issue when we look at the com.okta.saml.tokens.transform inline hook and see that has a considerably different API contract:

{
    "status": "ACTIVE",
    "version": "1.0.0",
    "type": "com.okta.saml.tokens.transform",
    "name": "Test Name",
    "channel": {
        "type": "OAUTH",
        "version": "1.0.0",
        "config": {
            "headers": [],
            "method": "POST",
            "authType": "client_secret_post",
            "uri": "https://example.com/hook",
            "clientId": "ClientID",
            "clientSecret": "ClientSecret",
            "tokenUrl": "https://example.com/token",
            "scope": "okta.users.read"
        }
    }
}

I was able to get the contract example for com.okta.saml.tokens.transform from looking at the HTTP traffic in the Admin UI when it creates an inline hook. As one might infer, the resource okta_inline_hook, as originally developed, does not lend itself to the com.okta.saml.tokens.transform type.

Also, implementation is strict in that it assumes the value of auth is regular string and not a JSON string.

Two things need to be addressed:

Support for com.okta.saml.tokens.transform that has backwards compatibility for types like com.okta.oauth2.tokens.transform and com.okta.telephony.provider. Flexible string values.

When this work is done I think this is what would be supported for the use cased described in the issue:

resource "okta_inline_hook" "saml_hooks" {
  for_each = toset(var.app1_tenants)
  name     = "saml-${each.key}-app1-hook"
  type     = "com.okta.saml.tokens.transform"
  version  = "1.0.2"
  status   = "ACTIVE"
  channel_json = <<JSON
{
        "type": "OAUTH",
        "version": "1.0.0",
        "config": {
            "method": "POST",
            "authType": "client_secret_post",
            "uri": "$${var.hook_service_url}",
            "clientId": "$${var.hook_client_id}",
            "clientSecret": "$${var.hook_secret}",
            "tokenUrl": "$${var.hook_token_url}",
            "scope": "api"
        }
}
JSON
}