Unable to modify "memberOf" attribute for okta_app_saml

[daverin]

I am unable to set the "memberOf" attribute in the SAML settings.

If I attempt the following config:

resource "okta_app_saml" "aws_vpn_client_app" {
  label                 = "AWS Client VPN (Vault)"
  preconfigured_app     = "aws_clientvpn"
  saml_version          = "2.0"
  status                = "ACTIVE"
  authentication_policy = okta_app_signon_policy.aws_vpn_client_app_sign_on.id

  attribute_statements {
    type         = "GROUP"
    name         = "memberOf"
    filter_type  = "REGEX"
    filter_value = ".*"
  }

  lifecycle {
    ignore_changes = [groups]
  }
}

I receive:

Error: failed to update SAML application: the API returned an error: Operation on application settings failed.. Causes: errorSummary: customSamlGroupAttributes[0].name: Invalid SAML attribute name 'memberOf': duplicate name, errorSummary: customSamlGroupAttributes[0].name: Invalid attribute name: The SAML attribute 'memberOf' matches an existing attribute name within this integration. View the SAML 2.0 setup instructions for a list of predefined SAML attributes. Choose a different name for the SAML attribute to prevent name collision.

Any help would be greatly appreciated 🙌🏾

[monde]

@daverin the error is coming straight from the API "Choose a different name for the SAML attribute to prevent name collision.", so can you use use a different name? Also, if you run your TF command with TF_LOG=debug you'll get to see the actual API call and response bodies and that can help give some insight as to what the provider is crafting into the call body.

Let me know what you find.

[daverin]

Hi @monde . I understand why the API is giving me an error. The problem is that when creating a okta_app_saml resource a default attribute with the name "memberOf" is being created with a filter value of none.

I want to change this value to .* but have no way to achieve this with terraform.

[ghost]

Getting the same issue here, no workaround found as of yet

[stmyers]

I'm having the same problem - I don't think the provider currently supports the configuredAttributeStatements parameter?

https://developer.okta.com/docs/reference/api/apps/#add-saml-2-0-authentication-application

[github-actions[bot]]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days

[daverin]

Hi Okta team. Any update on this?

[markogenomics]

I'm facing the same issue