
wdhrt (wdhrt) asked a question.
(terraform plan result)
(error message from terraform apply)
(state file after import)
I am currently working on terraforming policies using terraform okta provider 4.8.1 version.
There is one problem in the current test tenant, so I would like to ask you.
I tried to add "other desktop" or "other mobile" settings in platform_included by referring to https://registry.terraform.io/providers/okta/okta/4.8.1/docs/resources/app_signon_policy_rule .
When I did terraform plan, I thought it would be added well, but when I applied it, the following error occurred.
│ Error: failed to create app sign on policy rule: the API returned an error: Api validation failed: conditions.platform. Causes: errorSummary: conditions.platform: The condition 'platform' must have os.expression if os.type is OTHER.
│
│ with okta_app_signon_policy_rule.test,
│ on test.tf line 1, in resource "okta_app_signon_policy_rule" "test":
│ 1: resource "okta_app_signon_policy_rule" "test" {
The error is that okta api says that if os_type is "other~~", os_expression must be included.
And as an extra, I set "other desktop" on the admin console and imported it into terraform and looked at the state file, and os_expression was coming to an empty value.
I didn't want that setting to change, so I tried applying "", "", "null", etc. in os_expression, but the above error continued to occur.
In conclusion, the terraform provider gives empty values to the "os_expression" attribute for os_type being "other~", and in fact, the admin console does not have a window to change the "os_expression" attribute, whereas okta api expects that there will always be an "os_expression" value for the platform "other~~".
Is there a good solution to this error?
In addition, what kind of os_expression setting is it, and we'd like to catch the people who use uvuntu
Please let me know what happens if you put os_expression = "Linux" or os_expression = "Linux.*(Ubuntu|Debian)" in the terraform code. (This way, the value goes in anyway, so I can apply.)

Hi @wdhrt (wdhrt) , Thank you for reaching out to the Okta Community!
This question is more appropriate for our dedicated Okta Developer Forum.
My advice would be to reach out via devforum.okta.com to take advantage of their expertise.
While we'll do our best to answer all of your questions here, this medium is more inclined towards Okta core products and features (non-custom/developer work).
Regards.
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
This month's AMA topic: Okta Device Access. Ask away today.