When creating an okta_authenticator resource with the external Identity Provider (IdP) key using the Okta Terraform Provider, the apply phase fails with an API validation error stating that the provider.configuration.idpId field cannot be left blank, even though the configuration correctly references the IdP ID. This occurs because the Okta IdP that Terraform creates defaults to Single Sign-On (SSO) only usage, which disqualifies it from functioning as an authenticator factor. Creating the external IdP resource without the authenticator, manually updating the usage setting in the Okta Admin Console, and reapplying the configuration resolves the issue.

When the apply phase fails, the following error is generated:

provider.configuration.idpId: The field cannot be left blank.

• Okta Identity Engine (OIE)
• Okta Terraform Provider > (6.6.x)
• Identity Provider (IdP)

This issue occurs because the IdP usage in the Okta Admin Console defaults to SSO only when Terraform creates the external IdP. Setting the IdP as an authenticator requires configuring the IdP as a factor only. Since Terraform does not manage this attribute, the IdP does not qualify for use as an authenticator. Consequently, the idpId reference fails to resolve during the apply phase, which generates the validation error.

How is the external Identity Provider authenticator created using Terraform?

Create the external IdP resource without the authenticator, manually update the usage setting in the Okta Admin Console, and reapply the configuration to resolve the validation error.

1. Apply the Terraform configuration to create the external IdP resource (for example, okta_idp_saml) without the okta_authenticator resource.
2. Ensure Okta successfully creates the IdP before proceeding.
3. Sign in to the Okta Admin Console and navigate to Security > Identity Providers.
4. Locate the Terraform-generated IdP and select Edit.
5. Change the IdP Usage from SSO Only to Factor Only.
6. Save the change.
7. Add the okta_authenticator resource back to the Terraform configuration and run terraform apply again.

NOTE: If the error persists after completing the above steps, check the Okta Terraform provider version. If the version is older than 6.6.0, upgrade to the latest provider version and re-run terraform apply. The bug fix in provider version 6.6.0 is relevant only when the manual Admin Console change alone does not resolve the error.

Related References

• okta_authenticator | Terraform Registry
• terraform-provider-okta v6.6.0 | Github