onelogin / terraform-provider-onelogin

terraform provider onelogin

This guide lists the configuration for 'onelogin' Terraform provider resources that can be managed using Terraform v0.12.

• terraform provider onelogin
  • Provider Installation
  • Provider Configuration
    • Example Usage
  • Provider Resources
    • onelogin_apps
      • Example usage
      • Arguments Reference
      • Attributes Reference
      • Import
    • onelogin_apps_rules
      • Example usage
      • Arguments Reference
      • Attributes Reference
      • Import
    • onelogin_auth_servers
      • Example usage
      • Arguments Reference
      • Attributes Reference
      • Import
    • onelogin_privileges
      • Example usage
      • Arguments Reference
      • Attributes Reference
      • Import
    • onelogin_risk_rules
      • Example usage
      • Arguments Reference
      • Attributes Reference
      • Import
    • onelogin_roles
      • Example usage
      • Arguments Reference
      • Attributes Reference
      • Import
    • onelogin_users
      • Example usage
      • Arguments Reference
      • Attributes Reference
      • Import
    • onelogin_users_v1
      • Example usage
      • Arguments Reference
      • Attributes Reference
      • Import
  • Data Sources (using resource id)
    • onelogin_apps_instance
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_apps_rules_instance
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_auth_servers_instance
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_privileges_instance
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_risk_rules_instance
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_roles_instance
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_users_instance
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_users_v1_instance
      • Example usage
      • Arguments Reference
      • Attributes Reference
  • Data Sources (using filters)
    • onelogin_apps (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_apps_actions (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_apps_actions_values (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_apps_conditions (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_apps_conditions_operators (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_apps_rules (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_apps_users (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_auth_servers (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_auth_servers_claims (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_auth_servers_scopes (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_mappings (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_privileges (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_risk_rules (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_roles (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_roles_admins (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_roles_apps (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_roles_users (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_users (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_users_apps (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_users_devices (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_users_v1 (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference
    • onelogin_users_v1_apps (filters)
      • Example usage
      • Arguments Reference
      • Attributes Reference

Provider Installation

Note: As of Terraform >= 0.13 each Terraform module must declare which providers it requires, so that Terraform can install and use them. If you are using Terraform >= 0.13, copy into your .tf file the following snippet already populated with the provider configuration:

terraform {
  required_providers {
    onelogin = {
      source  = "onelogin/onelogin"
      version = ">= 0.4.7"
    }
  }
}

Provider Configuration

Example Usage

provider "onelogin" {
 apikey_auth = "..."
}

Provider Resources

onelogin_apps

Example usage

resource "onelogin_apps" "my_apps"{
    connector_id = 1234
    name = "name"
}

Arguments Reference

The following arguments are supported:

• connector_id [integer] - (Required) ID of the connector to base the app from.
• name [string] - (Required) The name of the app.
• tab_id [integer] - (Optional) ID of the OneLogin portal tab that the app is assigned to.
• role_ids [list of integers] - (Optional) List of Role IDs that are assigned to the app. On App Create or Update the entire array is replaced with the values provided.
• allow_assumed_signin [boolean] - (Optional) Indicates whether or not administrators can access the app as a user that they have assumed control over.
• auth_method [integer] - (Optional) An ID indicating the type of app: - 0: Password - 1: OpenId - 2: SAML - 3: API - 4: Google - 6: Forms Based App - 7: WSFED - 8: OpenId Connect
• policy_id [integer] - (Optional) The security policy assigned to the app.
• notes [string] - (Optional) Freeform notes about the app.
• * enforcement_point [object] - (Optional) For apps that connect to a OneLogin Access Enforcement Point the following enforcement_point object will be included with the app payload. The following properties compose the object schema :
  • * session_expiry_inactivity [object] - (Optional) unit: - 0 = Seconds - 1 = Minutes - 2 = Hours value: - When Unit = 0 or 1 value must be 0-60 - When Unit = 2 value must be 0-24. The following properties compose the object schema :
    • unit [integer] - (Optional)
    • value [integer] - (Optional)
  • case_sensitive [boolean] - (Optional) The URL path evaluation is case insensitive by default. Resources hosted on web servers such as Apache, NGINX and Java EE are case sensitive paths. Web servers such as Microsoft IIS are not case-sensitive.
  • permissions [string] - (Optional) Specify to always allow, deny access to resources, of if access is conditional.
  • target [string] - (Optional) A fully-qualified URL to the internal application including scheme, authority and path. The target host authority must be an IP address, not a hostname.
  • vhost [string] - (Optional) A comma-delimited list of one or more virtual hosts that map to applications assigned to the enforcement point. A VHOST may be a host name or an IP address. VHOST distinguish between applications that are at the same context root.
  • require_sitewide_authentication [boolean] - (Optional) Require user authentication to access any resource protected by this enforcement point.
  • * session_expiry_fixed [object] - (Optional) unit: - 0 = Seconds - 1 = Minutes - 2 = Hours value: - When Unit = 0 or 1 value must be 0-60 - When Unit = 2 value must be 0-24. The following properties compose the object schema :
    • unit [integer] - (Optional)
    • value [integer] - (Optional)
  • use_target_host_header [boolean] - (Optional) Use the target host header as opposed to the original gateway or upstream host header.
  • landing_page [string] - (Optional) The location within the context root to which the browser will be redirected for IdP-initiated single sign-on. For example, the landing page might be an index page in the context root such as index.html or default.aspx. The landing page cannot begin with a slash and must use valid URL characters.
  • resources [list of objects] - (Optional) Array of resource objects. The following properties compose the object schema :
    • path [string] - (Optional)
    • is_path_regex [boolean] - (Optional)
    • permission [string] - (Optional)
    • require_auth [boolean] - (Optional)
    • conditions [string] - (Optional) required if permission == "conditions"
  • context_root [string] - (Optional) The root path to the application, often the name of the application. Can be any name, path or just a slash (“/”). The context root uniquely identifies the application within the enforcement point.
  • conditions [string] - (Optional) If access is conditional, the conditions that must evaluate to true to allow access to a resource. For example, to require the user must be authenticated and have either the role Admin or User
• visible [boolean] - (Optional) Indicates if the app is visible in the OneLogin portal.
• brand_id [integer] - (Optional)
• * provisioning [object] - (Optional) Indicates if provisioning is enabled for this app.. The following properties compose the object schema :
  • enabled [boolean] - (Optional)
• * configuration [object] - (Optional) Only apply configurations that are applicable to the type of app. The following properties compose the object schema :
  • redirect_uri [string] - (Optional) OIDC Apps only Comma or newline separated list of valid redirect uris for the OpenId Connect Authorization Code flow.
  • post_logout_redirect_uri [string] - (Optional) OIDC Apps only
  • oidc_encryption_key [string] - (Optional) OIDC Apps only
  • token_endpoint_auth_method [integer] - (Optional) OIDC Apps only - 0: Basic - 1: POST - 2: None / PKCE
  • oidc_application_type [integer] - (Optional) OIDC Apps Only - 0: Web - 1: Native/Mobile
  • refresh_token_expiration_minutes [integer] - (Optional) Number of minutes the refresh token will be valid for.
  • access_token_expiration_minutes [integer] - (Optional) OIDC Apps only Number of minutes the refresh token will be valid for.
  • login_url [string] - (Optional) OIDC Apps only The OpenId Connect Client Id. Note that client_secret is only returned after Creating an App.
• icon_url [string] - (Optional) A link to the apps icon url
• description [string] - (Optional) Freeform description of the app.

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_apps.my_apps.sso[0].object_property)

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• auth_method_description [string]
• created_at [string] - the date the app was created
• * enforcement_point [object] - For apps that connect to a OneLogin Access Enforcement Point the following enforcement_point object will be included with the app payload. The following properties compose the object schema:
  • token [string] - Can only be set on create. Access Gateway Token.
• id [integer] - Apps unique ID in OneLogin.
• updated_at [string] - the date the app was last updated
• * provisioning [object] - Indicates if provisioning is enabled for this app. The following properties compose the object schema:
  • status [string]
• * configuration [object] - Only apply configurations that are applicable to the type of app The following properties compose the object schema:
  • oidc_api_version [string]
• * sso [object] - The attributes included in the sso section are determined by the type of app. All of the attributes of the sso object are read only. The following properties compose the object schema:
  • client_id [string] - The OpenId Connect Client Id. Note that client_secret is only returned after Creating an OIDC App.
  • metadata_url [string] - ID of the apps underlying connector. This is only returned after Creating a SAML App.
  • acs_url [string] - App Name. This is only returned after Creating a SAML App.
  • client_secret [string] - OpenId Connet Client Secret
  • issuer [string] - Issuer of app. This is only returned after Creating a SAML App.
• login_config [integer]

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_apps.my_apps.sso[0].object_property)

Import

apps resources can be imported using the id , e.g:

terraform import onelogin_apps.my_apps id

Note: In order for the import to work, the 'onelogin' terraform provider must be properly installed. Read more about Terraform import usage here.

onelogin_apps_rules

Example usage

resource "onelogin_apps_rules" "my_apps_rules"{
    apps_id = "apps_id"
}

Arguments Reference

The following arguments are supported:

• apps_id [string] - (Required) The apps_id that this resource belongs to
• match [string] - (Optional) Indicates how conditions should be matched.
• actions [list of objects] - (Optional) . The following properties compose the object schema :
  • value [list of strings] - (Optional) Only applicable to provisioned and set_* actions. Items in the array will be a plain text string or valid value for the selected action.
  • action [string] - (Optional) The action to apply
• name [string] - (Optional) Rule Name
• conditions [list of objects] - (Optional) An array of conditions that the user must meet in order for the rule to be applied.. The following properties compose the object schema :
  • operator [string] - (Optional) A valid operator for the selected condition source
  • source [string] - (Optional) source field to check.
  • value [string] - (Optional) A plain text string or valid value for the selected condition source
• enabled [boolean] - (Optional) Indicates if the rule is enabled or not.
• id [integer] - (Optional) App Rule ID
• position [integer] - (Optional) Indicates the order of the rule. When null this will default to last position.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

Import

apps_rules resources can be imported using the id . This is a sub-resource so the parent resource IDs ([apps_id]) are required to be able to retrieve an instance of this resource, e.g:

terraform import onelogin_apps_rules.my_apps_rules apps_id/apps_rules_id

Note: In order for the import to work, the 'onelogin' terraform provider must be properly installed. Read more about Terraform import usage here.

onelogin_auth_servers

Example usage

resource "onelogin_auth_servers" "my_auth_servers"{
    configuration {

    audiences = ["audiences1", "audiences2"]

    resource_identifier = "resource_identifier"
            }
    description = "description"
    name = "name"
}

Arguments Reference

The following arguments are supported:

• * configuration [object] - (Required) Authorization server configuration. The following properties compose the object schema :
  • access_token_expiration_minutes [integer] - (Optional) The number of minutes until access token expires. There is no maximum expiry limit.
  • audiences [list of strings] - (Required) List of API endpoints that will be returned in Access Tokens.
  • refresh_token_expiration_minutes [integer] - (Optional) The number of minutes until refresh token expires. There is no maximum expiry limit.
  • resource_identifier [string] - (Required) Unique identifier for the API that the Authorization Server will issue Access Tokens for.
• description [string] - (Required) Description of what the API does.
• name [string] - (Required) Name of the API.

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_auth_servers.my_auth_servers.configuration[0].object_property)

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• id [integer] - Auth server unique ID in Onelogin

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_auth_servers.my_auth_servers.configuration[0].object_property)

Import

auth_servers resources can be imported using the id , e.g:

terraform import onelogin_auth_servers.my_auth_servers id

Note: In order for the import to work, the 'onelogin' terraform provider must be properly installed. Read more about Terraform import usage here.

onelogin_privileges

Example usage

resource "onelogin_privileges" "my_privileges"{
    name = "name"
    privilege {

            }
}

Arguments Reference

The following arguments are supported:

• name [string] - (Required)
• * privilege [object] - (Required) . The following properties compose the object schema :
  • statement [list of objects] - (Optional) . The following properties compose the object schema :
    • effect [string] - (Required) Set to “Allow.” By default, all actions are denied, this Statement allows the listed actions to be executed.
    • action [list of strings] - (Required) An array of strings that represent actions within OneLogin. Actions are prefixed with the class of object they are related to and followed by a specific action for the given class. e.g. users:List, where the class is users and the specific action is List. Don’t mix classes within an Action array. To create a privilege that includes multiple different classes, create multiple statements. A wildcard * that includes all actions is supported. Use wildcards to create a Super User privilege.
    • scope [list of strings] - (Required) Target the privileged action against specific resources with the scope. The scope pattern is the class of object used by the Action, followed by an ID that represents a resource in OneLogin. e.g. apps/1234, where apps is the class and 1234 is the ID of an app. The wildcard * is supported and indicates that all resources of the class type declared, in the Action, are in scope. The Action and Scope classes must match. However, there is an exception, a scope of roles/{role_id} can be combined with Actions on the user or app class. The exception allows you to target groups of users or apps with specific actions.
  • version [string] - (Optional)
• id [string] - (Optional)
• description [string] - (Optional)

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_privileges.my_privileges.privilege[0].object_property)

Attributes Reference

In addition to all arguments above, the following attributes are exported:

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_privileges.my_privileges.privilege[0].object_property)

Import

privileges resources can be imported using the id , e.g:

terraform import onelogin_privileges.my_privileges id

Note: In order for the import to work, the 'onelogin' terraform provider must be properly installed. Read more about Terraform import usage here.

onelogin_risk_rules

Example usage

resource "onelogin_risk_rules" "my_risk_rules"{
}

Arguments Reference

The following arguments are supported:

• id [string] - (Optional)
• type [string] - (Optional) The type parameter specifies the type of rule that will be created.
• target [string] - (Optional) The target parameter that will be used when evaluating the rule against an incoming event.
• filters [list of strings] - (Optional) A list of IP addresses or country codes or names to evaluate against each event.
• * source [object] - (Optional) Used for targeting custom rules based on a group of people, customers, accounts, or even a single user.. The following properties compose the object schema :
  • name [string] - (Optional) The name of the source
  • id [string] - (Optional) A unique id that represents the source of the event.
• name [string] - (Optional) The name of this rule
• description [string] - (Optional)

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_risk_rules.my_risk_rules.source[0].object_property)

Attributes Reference

In addition to all arguments above, the following attributes are exported:

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_risk_rules.my_risk_rules.source[0].object_property)

Import

risk_rules resources can be imported using the id , e.g:

terraform import onelogin_risk_rules.my_risk_rules id

Note: In order for the import to work, the 'onelogin' terraform provider must be properly installed. Read more about Terraform import usage here.

onelogin_roles

Example usage

resource "onelogin_roles" "my_roles"{
    name = "name"
}

Arguments Reference

The following arguments are supported:

• name [string] - (Required) The name of the role.
• admins [list of integers] - (Optional) A list of user IDs to assign as role administrators.
• apps [list of integers] - (Optional) A list of app IDs that will be assigned to the role.
• users [list of integers] - (Optional) A list of user IDs to assign to the role.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• id [integer] - Role ID

Import

roles resources can be imported using the id , e.g:

terraform import onelogin_roles.my_roles id

Note: In order for the import to work, the 'onelogin' terraform provider must be properly installed. Read more about Terraform import usage here.

onelogin_users

Example usage

resource "onelogin_users" "my_users"{
}

Arguments Reference

The following arguments are supported:

• manager_ad_id [string] - (Optional) The ID of the user's manager in Active Directory.
• salt [string] - (Optional) The salt value used with the password_algorithm.
• password_changed_at [string] - (Optional)
• firstname [string] - (Optional) The user's first name.
• invitation_sent_at [string] - (Optional)
• password [string] - (Optional) The password to set for a user.
• username [string] - (Optional) A username for the user.
• status [integer] - (Optional)
• password_confirmation [string] - (Optional) Required if the password is being set.
• password_algorithm [string] - (Optional) Use this when importing a password that's already hashed. Prepend the salt value to the cleartext password value before SHA-256-encoding it
• phone [string] - (Optional) The E.164 format phone number for a user.
• samaccountname [string] - (Optional) The user's Active Directory username.
• invalid_login_attempts [integer] - (Optional)
• email [string] - (Optional) A valid email for the user.
• lastname [string] - (Optional) The user's last name.
• locked_until [string] - (Optional)
• id [integer] - (Optional)
• title [string] - (Optional) The user's job title.
• userprincipalname [string] - (Optional) The principle name of the user.
• member_of [string] - (Optional) The user's directory membership.
• role_ids [list of integers] - (Optional) A list of OneLogin Role IDs of the user
• state [integer] - (Optional)
• updated_at [string] - (Optional)
• trusted_idp_id [integer] - (Optional) The ID of the OneLogin Trusted IDP of the user.
• created_at [string] - (Optional)
• preferred_locale_code [string] - (Optional)
• group_id [integer] - (Optional) The ID of the Group in OneLogin that the user is assigned to.
• directory_id [integer] - (Optional) The ID of the OneLogin Directory of the user.
• distinguished_name [string] - (Optional) The distinguished name of the user.
• company [string] - (Optional) The user's company.
• manager_user_id [string] - (Optional) The OneLogin User ID for the user's manager.
• comment [string] - (Optional) Free text related to the user.
• department [string] - (Optional) The user's department.
• external_id [string] - (Optional) The ID of the user in an external directory.
• activated_at [string] - (Optional)
• last_login [string] - (Optional)

Attributes Reference

In addition to all arguments above, the following attributes are exported:

Import

users resources can be imported using the id , e.g:

terraform import onelogin_users.my_users id

Note: In order for the import to work, the 'onelogin' terraform provider must be properly installed. Read more about Terraform import usage here.

onelogin_users_v1

Example usage

resource "onelogin_users_v1" "my_users_v1"{
}

Arguments Reference

The following arguments are supported:

• manager_ad_id [string] - (Optional) The ID of the user's manager in Active Directory.
• salt [string] - (Optional) The salt value used with the password_algorithm.
• password_changed_at [string] - (Optional)
• firstname [string] - (Optional) The user's first name.
• invitation_sent_at [string] - (Optional)
• password [string] - (Optional) The password to set for a user.
• username [string] - (Optional) A username for the user.
• status [integer] - (Optional)
• password_confirmation [string] - (Optional) Required if the password is being set.
• password_algorithm [string] - (Optional) Use this when importing a password that's already hashed. Prepend the salt value to the cleartext password value before SHA-256-encoding it
• phone [string] - (Optional) The E.164 format phone number for a user.
• samaccountname [string] - (Optional) The user's Active Directory username.
• invalid_login_attempts [integer] - (Optional)
• email [string] - (Optional) A valid email for the user.
• lastname [string] - (Optional) The user's last name.
• locked_until [string] - (Optional)
• id [integer] - (Optional)
• title [string] - (Optional) The user's job title.
• userprincipalname [string] - (Optional) The principle name of the user.
• member_of [string] - (Optional) The user's directory membership.
• role_ids [list of integers] - (Optional) A list of OneLogin Role IDs of the user
• state [integer] - (Optional)
• updated_at [string] - (Optional)
• trusted_idp_id [integer] - (Optional) The ID of the OneLogin Trusted IDP of the user.
• created_at [string] - (Optional)
• preferred_locale_code [string] - (Optional)
• group_id [integer] - (Optional) The ID of the Group in OneLogin that the user is assigned to.
• directory_id [integer] - (Optional) The ID of the OneLogin Directory of the user.
• distinguished_name [string] - (Optional) The distinguished name of the user.
• company [string] - (Optional) The user's company.
• manager_user_id [string] - (Optional) The OneLogin User ID for the user's manager.
• comment [string] - (Optional) Free text related to the user.
• department [string] - (Optional) The user's department.
• external_id [string] - (Optional) The ID of the user in an external directory.
• activated_at [string] - (Optional)
• last_login [string] - (Optional)

Attributes Reference

In addition to all arguments above, the following attributes are exported:

Import

users_v1 resources can be imported using the id , e.g:

terraform import onelogin_users_v1.my_users_v1 id

Note: In order for the import to work, the 'onelogin' terraform provider must be properly installed. Read more about Terraform import usage here.

Data Sources (using resource id)

onelogin_apps_instance

Retrieve an existing resource using it's ID

Example usage

data "onelogin_apps_instance" "my_apps_instance"{
    id = "existing_resource_id"
}

Arguments Reference

The following arguments are supported:

• id - (Required) ID of the existing resource to retrieve

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• tab_id [integer] - ID of the OneLogin portal tab that the app is assigned to.
• auth_method_description [string]
• role_ids [list of integers] - List of Role IDs that are assigned to the app. On App Create or Update the entire array is replaced with the values provided.
• * configuration [object] - Only apply configurations that are applicable to the type of app The following properties compose the object schema:
  • redirect_uri [string] - OIDC Apps only Comma or newline separated list of valid redirect uris for the OpenId Connect Authorization Code flow.
  • post_logout_redirect_uri [string] - OIDC Apps only
  • oidc_encryption_key [string] - OIDC Apps only
  • oidc_application_type [integer] - OIDC Apps Only - 0: Web - 1: Native/Mobile
  • token_endpoint_auth_method [integer] - OIDC Apps only - 0: Basic - 1: POST - 2: None / PKCE
  • access_token_expiration_minutes [integer] - OIDC Apps only Number of minutes the refresh token will be valid for.
  • refresh_token_expiration_minutes [integer] - Number of minutes the refresh token will be valid for.
  • oidc_api_version [string]
  • login_url [string] - OIDC Apps only The OpenId Connect Client Id. Note that client_secret is only returned after Creating an App.
• name [string] - The name of the app.
• auth_method [integer] - An ID indicating the type of app: - 0: Password - 1: OpenId - 2: SAML - 3: API - 4: Google - 6: Forms Based App - 7: WSFED - 8: OpenId Connect
• allow_assumed_signin [boolean] - Indicates whether or not administrators can access the app as a user that they have assumed control over.
• created_at [string] - the date the app was created
• notes [string] - Freeform notes about the app.
• visible [boolean] - Indicates if the app is visible in the OneLogin portal.
• policy_id [integer] - The security policy assigned to the app.
• * provisioning [object] - Indicates if provisioning is enabled for this app. The following properties compose the object schema:
  • enabled [boolean]
  • status [string]
• id [integer] - Apps unique ID in OneLogin.
• brand_id [integer]
• updated_at [string] - the date the app was last updated
• * sso [object] - The attributes included in the sso section are determined by the type of app. All of the attributes of the sso object are read only. The following properties compose the object schema:
  • client_id [string] - The OpenId Connect Client Id. Note that client_secret is only returned after Creating an OIDC App.
  • metadata_url [string] - ID of the apps underlying connector. This is only returned after Creating a SAML App.
  • acs_url [string] - App Name. This is only returned after Creating a SAML App.
  • * certificate [object] - The certificate used for signing. This is only returned after Creating a SAML App. The following properties compose the object schema:
    • id [integer]
    • value [string]
    • name [string]
  • client_secret [string] - OpenId Connet Client Secret
  • issuer [string] - Issuer of app. This is only returned after Creating a SAML App.
• connector_id [integer] - ID of the connector to base the app from.
• description [string] - Freeform description of the app.
• * enforcement_point [object] - For apps that connect to a OneLogin Access Enforcement Point the following enforcement_point object will be included with the app payload. The following properties compose the object schema:
  • permissions [string] - Specify to always allow, deny access to resources, of if access is conditional.
  • case_sensitive [boolean] - The URL path evaluation is case insensitive by default. Resources hosted on web servers such as Apache, NGINX and Java EE are case sensitive paths. Web servers such as Microsoft IIS are not case-sensitive.
  • * session_expiry_fixed [object] - unit: - 0 = Seconds - 1 = Minutes - 2 = Hours value: - When Unit = 0 or 1 value must be 0-60 - When Unit = 2 value must be 0-24 The following properties compose the object schema:
    • unit [integer]
    • value [integer]
  • resources [list of objects] - Array of resource objects The following properties compose the object schema:
    • path [string]
    • permission [string]
    • is_path_regex [boolean]
    • require_auth [boolean]
    • conditions [string] - required if permission == "conditions"
  • vhost [string] - A comma-delimited list of one or more virtual hosts that map to applications assigned to the enforcement point. A VHOST may be a host name or an IP address. VHOST distinguish between applications that are at the same context root.
  • target [string] - A fully-qualified URL to the internal application including scheme, authority and path. The target host authority must be an IP address, not a hostname.
  • token [string] - Can only be set on create. Access Gateway Token.
  • landing_page [string] - The location within the context root to which the browser will be redirected for IdP-initiated single sign-on. For example, the landing page might be an index page in the context root such as index.html or default.aspx. The landing page cannot begin with a slash and must use valid URL characters.
  • use_target_host_header [boolean] - Use the target host header as opposed to the original gateway or upstream host header.
  • require_sitewide_authentication [boolean] - Require user authentication to access any resource protected by this enforcement point.
  • context_root [string] - The root path to the application, often the name of the application. Can be any name, path or just a slash (“/”). The context root uniquely identifies the application within the enforcement point.
  • * session_expiry_inactivity [object] - unit: - 0 = Seconds - 1 = Minutes - 2 = Hours value: - When Unit = 0 or 1 value must be 0-60 - When Unit = 2 value must be 0-24 The following properties compose the object schema:
    • unit [integer]
    • value [integer]
  • conditions [string] - If access is conditional, the conditions that must evaluate to true to allow access to a resource. For example, to require the user must be authenticated and have either the role Admin or User
• icon_url [string] - A link to the apps icon url
• login_config [integer]

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_apps_instance.my_apps_instance.enforcement_point[0].object_property)

onelogin_apps_rules_instance

Retrieve an existing resource using it's ID

Example usage

data "onelogin_apps_rules_instance" "my_apps_rules_instance"{
    id = "existing_resource_id"
}

Arguments Reference

The following arguments are supported:

• id - (Required) ID of the existing resource to retrieve

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• match [string] - Indicates how conditions should be matched.
• conditions [list of objects] - An array of conditions that the user must meet in order for the rule to be applied. The following properties compose the object schema:
  • source [string] - source field to check.
  • operator [string] - A valid operator for the selected condition source
  • value [string] - A plain text string or valid value for the selected condition source
• name [string] - Rule Name
• enabled [boolean] - Indicates if the rule is enabled or not.
• id [integer] - App Rule ID
• actions [list of objects] The following properties compose the object schema:
  • value [list of strings] - Only applicable to provisioned and set_* actions. Items in the array will be a plain text string or valid value for the selected action.
  • action [string] - The action to apply
• position [integer] - Indicates the order of the rule. When null this will default to last position.

onelogin_auth_servers_instance

Retrieve an existing resource using it's ID

Example usage

data "onelogin_auth_servers_instance" "my_auth_servers_instance"{
    id = "existing_resource_id"
}

Arguments Reference

The following arguments are supported:

• id - (Required) ID of the existing resource to retrieve

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• description [string] - Description of what the API does.
• name [string] - Name of the API.
• id [integer] - Auth server unique ID in Onelogin
• * configuration [object] - Authorization server configuration The following properties compose the object schema:
  • access_token_expiration_minutes [integer] - The number of minutes until access token expires. There is no maximum expiry limit.
  • refresh_token_expiration_minutes [integer] - The number of minutes until refresh token expires. There is no maximum expiry limit.
  • audiences [list of strings] - List of API endpoints that will be returned in Access Tokens.
  • resource_identifier [string] - Unique identifier for the API that the Authorization Server will issue Access Tokens for.

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_auth_servers_instance.my_auth_servers_instance.configuration[0].object_property)

onelogin_privileges_instance

Retrieve an existing resource using it's ID

Example usage

data "onelogin_privileges_instance" "my_privileges_instance"{
    id = "existing_resource_id"
}

Arguments Reference

The following arguments are supported:

• id - (Required) ID of the existing resource to retrieve

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• id [string]
• * privilege [object] The following properties compose the object schema:
  • statement [list of objects] The following properties compose the object schema:
    • scope [list of strings] - Target the privileged action against specific resources with the scope. The scope pattern is the class of object used by the Action, followed by an ID that represents a resource in OneLogin. e.g. apps/1234, where apps is the class and 1234 is the ID of an app. The wildcard * is supported and indicates that all resources of the class type declared, in the Action, are in scope. The Action and Scope classes must match. However, there is an exception, a scope of roles/{role_id} can be combined with Actions on the user or app class. The exception allows you to target groups of users or apps with specific actions.
    • action [list of strings] - An array of strings that represent actions within OneLogin. Actions are prefixed with the class of object they are related to and followed by a specific action for the given class. e.g. users:List, where the class is users and the specific action is List. Don’t mix classes within an Action array. To create a privilege that includes multiple different classes, create multiple statements. A wildcard * that includes all actions is supported. Use wildcards to create a Super User privilege.
    • effect [string] - Set to “Allow.” By default, all actions are denied, this Statement allows the listed actions to be executed.
  • version [string]
• description [string]
• name [string]

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_privileges_instance.my_privileges_instance.privilege[0].object_property)

onelogin_risk_rules_instance

Retrieve an existing resource using it's ID

Example usage

data "onelogin_risk_rules_instance" "my_risk_rules_instance"{
    id = "existing_resource_id"
}

Arguments Reference

The following arguments are supported:

• id - (Required) ID of the existing resource to retrieve

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• id [string]
• type [string] - The type parameter specifies the type of rule that will be created.
• filters [list of strings] - A list of IP addresses or country codes or names to evaluate against each event.
• target [string] - The target parameter that will be used when evaluating the rule against an incoming event.
• * source [object] - Used for targeting custom rules based on a group of people, customers, accounts, or even a single user. The following properties compose the object schema:
  • name [string] - The name of the source
  • id [string] - A unique id that represents the source of the event.
• name [string] - The name of this rule
• description [string]

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_risk_rules_instance.my_risk_rules_instance.source[0].object_property)

onelogin_roles_instance

Retrieve an existing resource using it's ID

Example usage

data "onelogin_roles_instance" "my_roles_instance"{
    id = "existing_resource_id"
}

Arguments Reference

The following arguments are supported:

• id - (Required) ID of the existing resource to retrieve

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• admins [list of integers] - A list of user IDs to assign as role administrators.
• name [string] - The name of the role.
• apps [list of integers] - A list of app IDs that will be assigned to the role.
• id [integer] - Role ID
• users [list of integers] - A list of user IDs to assign to the role.

onelogin_users_instance

Retrieve an existing resource using it's ID

Example usage

data "onelogin_users_instance" "my_users_instance"{
    id = "existing_resource_id"
}

Arguments Reference

The following arguments are supported:

• id - (Required) ID of the existing resource to retrieve

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• invitation_sent_at [string]
• firstname [string] - The user's first name.
• salt [string] - The salt value used with the password_algorithm.
• password_changed_at [string]
• manager_ad_id [string] - The ID of the user's manager in Active Directory.
• phone [string] - The E.164 format phone number for a user.
• samaccountname [string] - The user's Active Directory username.
• password_algorithm [string] - Use this when importing a password that's already hashed. Prepend the salt value to the cleartext password value before SHA-256-encoding it
• password_confirmation [string] - Required if the password is being set.
• password [string] - The password to set for a user.
• status [integer]
• username [string] - A username for the user.
• locked_until [string]
• lastname [string] - The user's last name.
• email [string] - A valid email for the user.
• invalid_login_attempts [integer]
• userprincipalname [string] - The principle name of the user.
• member_of [string] - The user's directory membership.
• title [string] - The user's job title.
• id [integer]
• updated_at [string]
• state [integer]
• role_ids [list of integers] - A list of OneLogin Role IDs of the user
• group_id [integer] - The ID of the Group in OneLogin that the user is assigned to.
• preferred_locale_code [string]
• directory_id [integer] - The ID of the OneLogin Directory of the user.
• created_at [string]
• trusted_idp_id [integer] - The ID of the OneLogin Trusted IDP of the user.
• company [string] - The user's company.
• distinguished_name [string] - The distinguished name of the user.
• activated_at [string]
• external_id [string] - The ID of the user in an external directory.
• last_login [string]
• comment [string] - Free text related to the user.
• department [string] - The user's department.
• manager_user_id [string] - The OneLogin User ID for the user's manager.

onelogin_users_v1_instance

Retrieve an existing resource using it's ID

Example usage

data "onelogin_users_v1_instance" "my_users_v1_instance"{
    id = "existing_resource_id"
}

Arguments Reference

The following arguments are supported:

• id - (Required) ID of the existing resource to retrieve

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• invitation_sent_at [string]
• firstname [string] - The user's first name.
• salt [string] - The salt value used with the password_algorithm.
• password_changed_at [string]
• manager_ad_id [string] - The ID of the user's manager in Active Directory.
• phone [string] - The E.164 format phone number for a user.
• samaccountname [string] - The user's Active Directory username.
• password_algorithm [string] - Use this when importing a password that's already hashed. Prepend the salt value to the cleartext password value before SHA-256-encoding it
• password_confirmation [string] - Required if the password is being set.
• password [string] - The password to set for a user.
• status [integer]
• username [string] - A username for the user.
• locked_until [string]
• lastname [string] - The user's last name.
• email [string] - A valid email for the user.
• invalid_login_attempts [integer]
• userprincipalname [string] - The principle name of the user.
• member_of [string] - The user's directory membership.
• title [string] - The user's job title.
• id [integer]
• updated_at [string]
• state [integer]
• role_ids [list of integers] - A list of OneLogin Role IDs of the user
• group_id [integer] - The ID of the Group in OneLogin that the user is assigned to.
• preferred_locale_code [string]
• directory_id [integer] - The ID of the OneLogin Directory of the user.
• created_at [string]
• trusted_idp_id [integer] - The ID of the OneLogin Trusted IDP of the user.
• company [string] - The user's company.
• distinguished_name [string] - The distinguished name of the user.
• activated_at [string]
• external_id [string] - The ID of the user in an external directory.
• last_login [string]
• comment [string] - Free text related to the user.
• department [string] - The user's department.
• manager_user_id [string] - The OneLogin User ID for the user's manager.

Data Sources (using filters)

onelogin_apps (filters)

The apps data source allows you to retrieve an already existing apps resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_apps" "my_apps"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: tab_id, auth_method_description, name, auth_method, allow_assumed_signin, created_at, notes, visible, policy_id, id, brand_id, updated_at, connector_id, description, icon_url, login_config,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• tab_id [integer] - ID of the OneLogin portal tab that the app is assigned to.
• auth_method_description [string]
• role_ids [list of integers] - List of Role IDs that are assigned to the app. On App Create or Update the entire array is replaced with the values provided.
• * configuration [object] - Only apply configurations that are applicable to the type of app The following properties compose the object schema:
  • redirect_uri [string] - OIDC Apps only Comma or newline separated list of valid redirect uris for the OpenId Connect Authorization Code flow.
  • post_logout_redirect_uri [string] - OIDC Apps only
  • oidc_encryption_key [string] - OIDC Apps only
  • oidc_application_type [integer] - OIDC Apps Only - 0: Web - 1: Native/Mobile
  • token_endpoint_auth_method [integer] - OIDC Apps only - 0: Basic - 1: POST - 2: None / PKCE
  • access_token_expiration_minutes [integer] - OIDC Apps only Number of minutes the refresh token will be valid for.
  • refresh_token_expiration_minutes [integer] - Number of minutes the refresh token will be valid for.
  • oidc_api_version [string]
  • login_url [string] - OIDC Apps only The OpenId Connect Client Id. Note that client_secret is only returned after Creating an App.
• name [string] - The name of the app.
• auth_method [integer] - An ID indicating the type of app: - 0: Password - 1: OpenId - 2: SAML - 3: API - 4: Google - 6: Forms Based App - 7: WSFED - 8: OpenId Connect
• allow_assumed_signin [boolean] - Indicates whether or not administrators can access the app as a user that they have assumed control over.
• created_at [string] - the date the app was created
• notes [string] - Freeform notes about the app.
• visible [boolean] - Indicates if the app is visible in the OneLogin portal.
• policy_id [integer] - The security policy assigned to the app.
• * provisioning [object] - Indicates if provisioning is enabled for this app. The following properties compose the object schema:
  • enabled [boolean]
  • status [string]
• id [integer] - Apps unique ID in OneLogin.
• brand_id [integer]
• updated_at [string] - the date the app was last updated
• * sso [object] - The attributes included in the sso section are determined by the type of app. All of the attributes of the sso object are read only. The following properties compose the object schema:
  • client_id [string] - The OpenId Connect Client Id. Note that client_secret is only returned after Creating an OIDC App.
  • metadata_url [string] - ID of the apps underlying connector. This is only returned after Creating a SAML App.
  • acs_url [string] - App Name. This is only returned after Creating a SAML App.
  • * certificate [object] - The certificate used for signing. This is only returned after Creating a SAML App. The following properties compose the object schema:
    • id [integer]
    • value [string]
    • name [string]
  • client_secret [string] - OpenId Connet Client Secret
  • issuer [string] - Issuer of app. This is only returned after Creating a SAML App.
• connector_id [integer] - ID of the connector to base the app from.
• description [string] - Freeform description of the app.
• * enforcement_point [object] - For apps that connect to a OneLogin Access Enforcement Point the following enforcement_point object will be included with the app payload. The following properties compose the object schema:
  • permissions [string] - Specify to always allow, deny access to resources, of if access is conditional.
  • case_sensitive [boolean] - The URL path evaluation is case insensitive by default. Resources hosted on web servers such as Apache, NGINX and Java EE are case sensitive paths. Web servers such as Microsoft IIS are not case-sensitive.
  • * session_expiry_fixed [object] - unit: - 0 = Seconds - 1 = Minutes - 2 = Hours value: - When Unit = 0 or 1 value must be 0-60 - When Unit = 2 value must be 0-24 The following properties compose the object schema:
    • unit [integer]
    • value [integer]
  • resources [list of objects] - Array of resource objects The following properties compose the object schema:
    • path [string]
    • permission [string]
    • is_path_regex [boolean]
    • require_auth [boolean]
    • conditions [string] - required if permission == "conditions"
  • vhost [string] - A comma-delimited list of one or more virtual hosts that map to applications assigned to the enforcement point. A VHOST may be a host name or an IP address. VHOST distinguish between applications that are at the same context root.
  • target [string] - A fully-qualified URL to the internal application including scheme, authority and path. The target host authority must be an IP address, not a hostname.
  • token [string] - Can only be set on create. Access Gateway Token.
  • landing_page [string] - The location within the context root to which the browser will be redirected for IdP-initiated single sign-on. For example, the landing page might be an index page in the context root such as index.html or default.aspx. The landing page cannot begin with a slash and must use valid URL characters.
  • use_target_host_header [boolean] - Use the target host header as opposed to the original gateway or upstream host header.
  • require_sitewide_authentication [boolean] - Require user authentication to access any resource protected by this enforcement point.
  • context_root [string] - The root path to the application, often the name of the application. Can be any name, path or just a slash (“/”). The context root uniquely identifies the application within the enforcement point.
  • * session_expiry_inactivity [object] - unit: - 0 = Seconds - 1 = Minutes - 2 = Hours value: - When Unit = 0 or 1 value must be 0-60 - When Unit = 2 value must be 0-24 The following properties compose the object schema:
    • unit [integer]
    • value [integer]
  • conditions [string] - If access is conditional, the conditions that must evaluate to true to allow access to a resource. For example, to require the user must be authenticated and have either the role Admin or User
• icon_url [string] - A link to the apps icon url
• login_config [integer]

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_apps.my_apps.enforcement_point[0].object_property)

onelogin_apps_actions (filters)

The apps_actions data source allows you to retrieve an already existing apps_actions resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_apps_actions" "my_apps_actions"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: apps_id, name, value,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• name [string] - Name of the Action
• value [string] - The unique identifier of the action. This should be used when defining actions for a User Mapping.

onelogin_apps_actions_values (filters)

The apps_actions_values data source allows you to retrieve an already existing apps_actions_values resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_apps_actions_values" "my_apps_actions_values"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: actions_id, apps_id, name, value,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• name [string] - Name of the Action
• value [string] - The unique identifier of the action. This should be used when defining actions for a User Mapping.

onelogin_apps_conditions (filters)

The apps_conditions data source allows you to retrieve an already existing apps_conditions resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_apps_conditions" "my_apps_conditions"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: value, apps_id, name,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• value [string] - The unique identifier of the condition. This should be used when defining conditions for a rule.
• name [string] - Name of the rule condition

onelogin_apps_conditions_operators (filters)

The apps_conditions_operators data source allows you to retrieve an already existing apps_conditions_operators resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_apps_conditions_operators" "my_apps_conditions_operators"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: name, apps_id, value, conditions_id,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• name [string] - Name of the operator
• value [string] - The condition operator value to use when creating or updating rules.

onelogin_apps_rules (filters)

The apps_rules data source allows you to retrieve an already existing apps_rules resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_apps_rules" "my_apps_rules"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: match, name, apps_id, enabled, id, position,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• match [string] - Indicates how conditions should be matched.
• conditions [list of objects] - An array of conditions that the user must meet in order for the rule to be applied. The following properties compose the object schema:
  • source [string] - source field to check.
  • operator [string] - A valid operator for the selected condition source
  • value [string] - A plain text string or valid value for the selected condition source
• name [string] - Rule Name
• enabled [boolean] - Indicates if the rule is enabled or not.
• id [integer] - App Rule ID
• actions [list of objects] The following properties compose the object schema:
  • value [list of strings] - Only applicable to provisioned and set_* actions. Items in the array will be a plain text string or valid value for the selected action.
  • action [string] - The action to apply
• position [integer] - Indicates the order of the rule. When null this will default to last position.

onelogin_apps_users (filters)

The apps_users data source allows you to retrieve an already existing apps_users resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_apps_users" "my_apps_users"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: invitation_sent_at, firstname, salt, password_changed_at, manager_ad_id, phone, samaccountname, password_algorithm, password_confirmation, password, status, username, locked_until, lastname, email, apps_id, invalid_login_attempts, userprincipalname, member_of, title, id, updated_at, state, group_id, preferred_locale_code, directory_id, created_at, trusted_idp_id, company, distinguished_name, activated_at, external_id, last_login, comment, department, manager_user_id,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• invitation_sent_at [string]
• firstname [string] - The user's first name.
• salt [string] - The salt value used with the password_algorithm.
• password_changed_at [string]
• manager_ad_id [string] - The ID of the user's manager in Active Directory.
• phone [string] - The E.164 format phone number for a user.
• samaccountname [string] - The user's Active Directory username.
• password_algorithm [string] - Use this when importing a password that's already hashed. Prepend the salt value to the cleartext password value before SHA-256-encoding it
• password_confirmation [string] - Required if the password is being set.
• password [string] - The password to set for a user.
• status [integer]
• username [string] - A username for the user.
• locked_until [string]
• lastname [string] - The user's last name.
• email [string] - A valid email for the user.
• invalid_login_attempts [integer]
• userprincipalname [string] - The principle name of the user.
• member_of [string] - The user's directory membership.
• title [string] - The user's job title.
• id [integer]
• updated_at [string]
• state [integer]
• role_ids [list of integers] - A list of OneLogin Role IDs of the user
• group_id [integer] - The ID of the Group in OneLogin that the user is assigned to.
• preferred_locale_code [string]
• directory_id [integer] - The ID of the OneLogin Directory of the user.
• created_at [string]
• trusted_idp_id [integer] - The ID of the OneLogin Trusted IDP of the user.
• company [string] - The user's company.
• distinguished_name [string] - The distinguished name of the user.
• activated_at [string]
• external_id [string] - The ID of the user in an external directory.
• last_login [string]
• comment [string] - Free text related to the user.
• department [string] - The user's department.
• manager_user_id [string] - The OneLogin User ID for the user's manager.

onelogin_auth_servers (filters)

The auth_servers data source allows you to retrieve an already existing auth_servers resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_auth_servers" "my_auth_servers"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: description, name, id,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• description [string] - Description of what the API does.
• name [string] - Name of the API.
• id [integer] - Auth server unique ID in Onelogin
• * configuration [object] - Authorization server configuration The following properties compose the object schema:
  • access_token_expiration_minutes [integer] - The number of minutes until access token expires. There is no maximum expiry limit.
  • refresh_token_expiration_minutes [integer] - The number of minutes until refresh token expires. There is no maximum expiry limit.
  • audiences [list of strings] - List of API endpoints that will be returned in Access Tokens.
  • resource_identifier [string] - Unique identifier for the API that the Authorization Server will issue Access Tokens for.

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_auth_servers.my_auth_servers.configuration[0].object_property)

onelogin_auth_servers_claims (filters)

The auth_servers_claims data source allows you to retrieve an already existing auth_servers_claims resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_auth_servers_claims" "my_auth_servers_claims"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: provisioned_entitlements, skip_if_blank, auth_servers_id, id, user_attribute_mappings, attribute_transformations, user_attribute_macros, default_values, label,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• provisioned_entitlements [boolean] - Relates to Rules/Entitlements. Not supported yet.
• skip_if_blank [boolean] - not used
• id [integer] - The unique ID of the claim.
• user_attribute_mappings [string] - A user attribute to map values from.
• attribute_transformations [string] - The type of transformation to perform on multi valued attributes.
• user*attribute_macros [string] - When user_attribute_mappings is set to \_macro* this macro will be used to assign the claims value.
• values [list of strings] - Relates to Rules/Entitlements. Not supported yet.
• default_values [string] - Relates to Rules/Entitlements. Not supported yet.
• label [string] - The UI label for the claims.

onelogin_auth_servers_scopes (filters)

The auth_servers_scopes data source allows you to retrieve an already existing auth_servers_scopes resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_auth_servers_scopes" "my_auth_servers_scopes"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: auth_servers_id, id, description, value,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• id [integer] - Unique ID for the Scope
• description [string] - A description of what access the scope enables
• value [string] - A value representing the api scope that with be authorized

onelogin_mappings (filters)

The mappings data source allows you to retrieve an already existing mappings resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_mappings" "my_mappings"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: match, name, id, enabled, position,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• match [string] - Indicates how conditions should be matched.
• name [string] - The name of the mapping.
• actions [list of objects] - An array of actions that will be applied to the users that are matched by the conditions. The following properties compose the object schema:
  • value [list of strings] - Only applicable to provisioned and set_* actions. Items in the array will be a plain text string or valid value for the selected action.
  • action [string] - The action to apply
• id [integer]
• enabled [boolean] - Indicates if the mapping is enabled or not.
• conditions [list of objects] - An array of conditions that the user must meet in order for the mapping to be applied. The following properties compose the object schema:
  • source [string] - source field to check.
  • operator [string] - A valid operator for the selected condition source
  • value [string] - A plain text string or valid value for the selected condition source
• position [integer] - Indicates the order of the mapping. When null this will default to last position.

onelogin_privileges (filters)

The privileges data source allows you to retrieve an already existing privileges resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_privileges" "my_privileges"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: id, description, name,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• id [string]
• * privilege [object] The following properties compose the object schema:
  • statement [list of objects] The following properties compose the object schema:
    • scope [list of strings] - Target the privileged action against specific resources with the scope. The scope pattern is the class of object used by the Action, followed by an ID that represents a resource in OneLogin. e.g. apps/1234, where apps is the class and 1234 is the ID of an app. The wildcard * is supported and indicates that all resources of the class type declared, in the Action, are in scope. The Action and Scope classes must match. However, there is an exception, a scope of roles/{role_id} can be combined with Actions on the user or app class. The exception allows you to target groups of users or apps with specific actions.
    • action [list of strings] - An array of strings that represent actions within OneLogin. Actions are prefixed with the class of object they are related to and followed by a specific action for the given class. e.g. users:List, where the class is users and the specific action is List. Don’t mix classes within an Action array. To create a privilege that includes multiple different classes, create multiple statements. A wildcard * that includes all actions is supported. Use wildcards to create a Super User privilege.
    • effect [string] - Set to “Allow.” By default, all actions are denied, this Statement allows the listed actions to be executed.
  • version [string]
• description [string]
• name [string]

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_privileges.my_privileges.privilege[0].object_property)

onelogin_risk_rules (filters)

The risk_rules data source allows you to retrieve an already existing risk_rules resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_risk_rules" "my_risk_rules"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: id, type, target, name, description,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• id [string]
• type [string] - The type parameter specifies the type of rule that will be created.
• filters [list of strings] - A list of IP addresses or country codes or names to evaluate against each event.
• target [string] - The target parameter that will be used when evaluating the rule against an incoming event.
• * source [object] - Used for targeting custom rules based on a group of people, customers, accounts, or even a single user. The following properties compose the object schema:
  • name [string] - The name of the source
  • id [string] - A unique id that represents the source of the event.
• name [string] - The name of this rule
• description [string]

* Note: Object type properties are internally represented (in the state file) as a list of one elem due to Terraform SDK's limitation for supporting complex object types. Please index on the first elem of the array to reference the object values (eg: onelogin_risk_rules.my_risk_rules.source[0].object_property)

onelogin_roles (filters)

The roles data source allows you to retrieve an already existing roles resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_roles" "my_roles"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: name, id,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• admins [list of integers] - A list of user IDs to assign as role administrators.
• name [string] - The name of the role.
• apps [list of integers] - A list of app IDs that will be assigned to the role.
• id [integer] - Role ID
• users [list of integers] - A list of user IDs to assign to the role.

onelogin_roles_admins (filters)

The roles_admins data source allows you to retrieve an already existing roles_admins resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_roles_admins" "my_roles_admins"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: invitation_sent_at, firstname, salt, password_changed_at, manager_ad_id, phone, samaccountname, password_algorithm, password_confirmation, password, status, username, locked_until, lastname, email, invalid_login_attempts, userprincipalname, member_of, title, id, updated_at, state, group_id, preferred_locale_code, directory_id, created_at, trusted_idp_id, company, distinguished_name, activated_at, external_id, last_login, comment, department, roles_id, manager_user_id,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• invitation_sent_at [string]
• firstname [string] - The user's first name.
• salt [string] - The salt value used with the password_algorithm.
• password_changed_at [string]
• manager_ad_id [string] - The ID of the user's manager in Active Directory.
• phone [string] - The E.164 format phone number for a user.
• samaccountname [string] - The user's Active Directory username.
• password_algorithm [string] - Use this when importing a password that's already hashed. Prepend the salt value to the cleartext password value before SHA-256-encoding it
• password_confirmation [string] - Required if the password is being set.
• password [string] - The password to set for a user.
• status [integer]
• username [string] - A username for the user.
• locked_until [string]
• lastname [string] - The user's last name.
• email [string] - A valid email for the user.
• invalid_login_attempts [integer]
• userprincipalname [string] - The principle name of the user.
• member_of [string] - The user's directory membership.
• title [string] - The user's job title.
• id [integer]
• updated_at [string]
• state [integer]
• role_ids [list of integers] - A list of OneLogin Role IDs of the user
• group_id [integer] - The ID of the Group in OneLogin that the user is assigned to.
• preferred_locale_code [string]
• directory_id [integer] - The ID of the OneLogin Directory of the user.
• created_at [string]
• trusted_idp_id [integer] - The ID of the OneLogin Trusted IDP of the user.
• company [string] - The user's company.
• distinguished_name [string] - The distinguished name of the user.
• activated_at [string]
• external_id [string] - The ID of the user in an external directory.
• last_login [string]
• comment [string] - Free text related to the user.
• department [string] - The user's department.
• manager_user_id [string] - The OneLogin User ID for the user's manager.

onelogin_roles_apps (filters)

The roles_apps data source allows you to retrieve an already existing roles_apps resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_roles_apps" "my_roles_apps"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: icon_url, id, name, roles_id,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• icon_url [string] - url of Icon
• id [integer] - app id
• name [string] - app name

onelogin_roles_users (filters)

The roles_users data source allows you to retrieve an already existing roles_users resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_roles_users" "my_roles_users"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: invitation_sent_at, firstname, salt, password_changed_at, manager_ad_id, phone, samaccountname, password_algorithm, password_confirmation, password, status, username, locked_until, lastname, email, invalid_login_attempts, userprincipalname, member_of, title, id, updated_at, state, group_id, preferred_locale_code, directory_id, created_at, trusted_idp_id, company, distinguished_name, activated_at, external_id, last_login, comment, department, roles_id, manager_user_id,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• invitation_sent_at [string]
• firstname [string] - The user's first name.
• salt [string] - The salt value used with the password_algorithm.
• password_changed_at [string]
• manager_ad_id [string] - The ID of the user's manager in Active Directory.
• phone [string] - The E.164 format phone number for a user.
• samaccountname [string] - The user's Active Directory username.
• password_algorithm [string] - Use this when importing a password that's already hashed. Prepend the salt value to the cleartext password value before SHA-256-encoding it
• password_confirmation [string] - Required if the password is being set.
• password [string] - The password to set for a user.
• status [integer]
• username [string] - A username for the user.
• locked_until [string]
• lastname [string] - The user's last name.
• email [string] - A valid email for the user.
• invalid_login_attempts [integer]
• userprincipalname [string] - The principle name of the user.
• member_of [string] - The user's directory membership.
• title [string] - The user's job title.
• id [integer]
• updated_at [string]
• state [integer]
• role_ids [list of integers] - A list of OneLogin Role IDs of the user
• group_id [integer] - The ID of the Group in OneLogin that the user is assigned to.
• preferred_locale_code [string]
• directory_id [integer] - The ID of the OneLogin Directory of the user.
• created_at [string]
• trusted_idp_id [integer] - The ID of the OneLogin Trusted IDP of the user.
• company [string] - The user's company.
• distinguished_name [string] - The distinguished name of the user.
• activated_at [string]
• external_id [string] - The ID of the user in an external directory.
• last_login [string]
• comment [string] - Free text related to the user.
• department [string] - The user's department.
• manager_user_id [string] - The OneLogin User ID for the user's manager.

onelogin_users (filters)

The users data source allows you to retrieve an already existing users resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_users" "my_users"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: invitation_sent_at, firstname, salt, password_changed_at, manager_ad_id, phone, samaccountname, password_algorithm, password_confirmation, password, status, username, locked_until, lastname, email, invalid_login_attempts, userprincipalname, member_of, title, id, updated_at, state, group_id, preferred_locale_code, directory_id, created_at, trusted_idp_id, company, distinguished_name, activated_at, external_id, last_login, comment, department, manager_user_id,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• invitation_sent_at [string]
• firstname [string] - The user's first name.
• salt [string] - The salt value used with the password_algorithm.
• password_changed_at [string]
• manager_ad_id [string] - The ID of the user's manager in Active Directory.
• phone [string] - The E.164 format phone number for a user.
• samaccountname [string] - The user's Active Directory username.
• password_algorithm [string] - Use this when importing a password that's already hashed. Prepend the salt value to the cleartext password value before SHA-256-encoding it
• password_confirmation [string] - Required if the password is being set.
• password [string] - The password to set for a user.
• status [integer]
• username [string] - A username for the user.
• locked_until [string]
• lastname [string] - The user's last name.
• email [string] - A valid email for the user.
• invalid_login_attempts [integer]
• userprincipalname [string] - The principle name of the user.
• member_of [string] - The user's directory membership.
• title [string] - The user's job title.
• id [integer]
• updated_at [string]
• state [integer]
• role_ids [list of integers] - A list of OneLogin Role IDs of the user
• group_id [integer] - The ID of the Group in OneLogin that the user is assigned to.
• preferred_locale_code [string]
• directory_id [integer] - The ID of the OneLogin Directory of the user.
• created_at [string]
• trusted_idp_id [integer] - The ID of the OneLogin Trusted IDP of the user.
• company [string] - The user's company.
• distinguished_name [string] - The distinguished name of the user.
• activated_at [string]
• external_id [string] - The ID of the user in an external directory.
• last_login [string]
• comment [string] - Free text related to the user.
• department [string] - The user's department.
• manager_user_id [string] - The OneLogin User ID for the user's manager.

onelogin_users_apps (filters)

The users_apps data source allows you to retrieve an already existing users_apps resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_users_apps" "my_users_apps"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: login_id, extension, name, icon_url, id, provisioning_state, provisioning_enabled, users_id, provisioning_status,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• login_id [integer] - Unqiue identifier for this user and app combination.
• extension [boolean] - Boolean that indicates if the OneLogin browser extension is required to launch this app.
• name [string] - The name of the app.
• icon_url [string] - A url for the icon that represents the app in the OneLogin portal
• id [integer] - The App ID
• provisioning_state [string] - If provisioning is enabled this indicates the state of provisioning for the given user.
• provisioning_enabled [boolean] - Indicates if provisioning is enabled for this app.
• provisioning_status [string]

onelogin_users_devices (filters)

The users_devices data source allows you to retrieve an already existing users_devices resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_users_devices" "my_users_devices"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: device_id, default, user_display_name, auth_factor_name, users_id, type_display_name,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• device_id [string] - MFA device identifier.
• default [boolean] - true = is user’s default MFA device for OneLogin.
• user_display_name [string] - Authentication factor display name assigned by users when they register the device.
• auth_factor_name [string] - Authentication factor name, as it appears to administrators in OneLogin.
• type_display_name [string] - Authentication factor display name as it appears to users upon initial registration, as defined by admins at Settings > Authentication Factors.

onelogin_users_v1 (filters)

The users_v1 data source allows you to retrieve an already existing users_v1 resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_users_v1" "my_users_v1"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: invitation_sent_at, firstname, salt, password_changed_at, manager_ad_id, phone, samaccountname, password_algorithm, password_confirmation, password, status, username, locked_until, lastname, email, invalid_login_attempts, userprincipalname, member_of, title, id, updated_at, state, group_id, preferred_locale_code, directory_id, created_at, trusted_idp_id, company, distinguished_name, activated_at, external_id, last_login, comment, department, manager_user_id,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• invitation_sent_at [string]
• firstname [string] - The user's first name.
• salt [string] - The salt value used with the password_algorithm.
• password_changed_at [string]
• manager_ad_id [string] - The ID of the user's manager in Active Directory.
• phone [string] - The E.164 format phone number for a user.
• samaccountname [string] - The user's Active Directory username.
• password_algorithm [string] - Use this when importing a password that's already hashed. Prepend the salt value to the cleartext password value before SHA-256-encoding it
• password_confirmation [string] - Required if the password is being set.
• password [string] - The password to set for a user.
• status [integer]
• username [string] - A username for the user.
• locked_until [string]
• lastname [string] - The user's last name.
• email [string] - A valid email for the user.
• invalid_login_attempts [integer]
• userprincipalname [string] - The principle name of the user.
• member_of [string] - The user's directory membership.
• title [string] - The user's job title.
• id [integer]
• updated_at [string]
• state [integer]
• role_ids [list of integers] - A list of OneLogin Role IDs of the user
• group_id [integer] - The ID of the Group in OneLogin that the user is assigned to.
• preferred_locale_code [string]
• directory_id [integer] - The ID of the OneLogin Directory of the user.
• created_at [string]
• trusted_idp_id [integer] - The ID of the OneLogin Trusted IDP of the user.
• company [string] - The user's company.
• distinguished_name [string] - The distinguished name of the user.
• activated_at [string]
• external_id [string] - The ID of the user in an external directory.
• last_login [string]
• comment [string] - Free text related to the user.
• department [string] - The user's department.
• manager_user_id [string] - The OneLogin User ID for the user's manager.

onelogin_users_v1_apps (filters)

The users_v1_apps data source allows you to retrieve an already existing users_v1_apps resource using filters. Refer to the arguments section to learn more about how to configure the filters.

Example usage

data "onelogin_users_v1_apps" "my_users_v1_apps"{
    filter {
        name = "property name to filter by, see docs below for more info about available filter name options"
        values = ["filter value"]
    }
}

Arguments Reference

The following arguments are supported:

• filter - (Required) Object containing two properties.

• name [string]: the name should match one of the properties to filter by. The following property names are supported: login_id, extension, name, icon_url, id, provisioning_state, provisioning_enabled, users_v1_id, provisioning_status,

• values [array of string]: Values to filter by (only one value is supported at the moment).

Note: If more or less than a single match is returned by the search, Terraform will fail. Ensure that your search is specific enough to return a single result only.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• login_id [integer] - Unqiue identifier for this user and app combination.
• extension [boolean] - Boolean that indicates if the OneLogin browser extension is required to launch this app.
• name [string] - The name of the app.
• icon_url [string] - A url for the icon that represents the app in the OneLogin portal
• id [integer] - The App ID
• provisioning_state [string] - If provisioning is enabled this indicates the state of provisioning for the given user.
• provisioning_enabled [boolean] - Indicates if provisioning is enabled for this app.
• provisioning_status [string]

terraform-provider-onelogin's Issues

saml_app sso certificate attribute

The onelogin_saml_app provider docs indicate that the SAML certificate should be an attribute found at onelogin_saml_apps.myapp.sso.certificate

Quoting from the doc -

• sso - The attributes included in the sso section are determined by the type of app. sso attributes are read only.
  ...
  • certificate - The SSO certificate generated by OneLogin.

However, looking at the provider resource code, it appears that the certificate needs to be accessed at the parent level and through the value attribute, like so: onelogin_saml_apps.myapp.certificate.value

terraform-provider-onelogin/onelogin/resource_onelogin_saml_apps.go

Line 110 in 35a437f

d.Set("certificate", appssoschema.FlattenSAMLCert(*app.Sso))

terraform-provider-onelogin/ol_schema/app/sso/sso.go

Lines 16 to 21 in 35a437f

	func FlattenSAMLCert(sso apps.AppSso) map[string]interface{} {
	return map[string]interface{}{
	"name": sso.Certificate.Name,
	"value": sso.Certificate.Value,
	}
	}

test

Struggling to use the new provider 3.0.0

Using MacOS
in Readme reference to provider does not work. Script installs provider here:
~/.terraform.d/plugins/terraform.example.com/examplecorp/onelogin/3.0.0/darwin_amd64/terraform-provider-onelogin

Which makes required provider configuration:
terraform {
required_providers {
onelogin = {
source = "terraform.example.com/examplecorp/onelogin"
version = "= 3.0.0"
}
}
}

I can now initialize terraform. However when I run a plan, I get this error:

❯ tf plan
╷
│ Error: Failed to load plugin schemas
│
│ Error while loading schemas for plugin components: Failed to obtain provider schema: Could not load the schema for provider terraform.example.com/examplecorp/onelogin: failed to instantiate provider "terraform.example.com/examplecorp/onelogin" to
│ obtain schema: Unrecognized remote plugin message:
│
│ This usually means that the plugin is either invalid or simply
│ needs to be recompiled to support the latest protocol...

Any thoughts?

onelogin_app_rules configuration block does not allow empty conditions

Hi

In Onelogin using the REST API and the UI we see that rules conditions can be empty which is the case for us.

[
    {
        "id": 12345,
        "name": "role_mapping",
        "match": "all",
        "enabled": true,
        "position": 8,
        "conditions": [], 
        "actions": [
            {
                "action": "set_groups",
                "value": [
                    "roles"
                ],
                "expression": "(.+)"
            }
        ]
    }
]

However the conditions in the terraform provider is required as documented here: https://registry.terraform.io/providers/onelogin/onelogin/latest/docs/resources/onelogin_app_rule#conditions

If we run terraform without the conditions we get the following error while applying:

Error: error: context: [ol http service], error_message: [{"code":422,"message":"Validation Failed","errors":[{"field":"conditions","message":["is reserved"]}]}]

Should this be really required? We at least would expect that this can be empty.

provider credential source

The provider's new openapi-based design presently requires a separate, manual REST operation to obtain an API token from your OL API credentials (client_id/client_secret).

The provider should obtain the token it needs by using the values of the env vars ONELOGIN_CLIENT_ID and ONELOGIN_CLIENT_SECRET.

issue with onelogin_saml_apps parameters block

I am trying to set a parameter for a saml app:

resource onelogin_saml_apps this {
  connector_id = 110016 # SAML 2.0 Advanced connector ID
  name =  "testonelogin"
  description = "test"

  configuration = {
      signature_algorithm = null
      saml_notonorafter = "3"
      consumer_url = "${local.base_url}/saml2/acs/"
      login = "${local.base_url}/saml2/acs/"
      audience        = "http://test.com/"
      generate_attribute_value_tags = "0"
      saml_initiater_id = "0"
      saml_notbefore = "3"
      saml_issuer_type = "0"
      saml_sign_element = "0"
      encrypt_assertion = "0"

      saml_sessionnotonorafter = "1440"
      saml_encryption_method_id = "0"
      recipient = "${local.base_url}/saml2/acs/"
      validator = ".*"
      relaystate = "${local.base_url}/"
      saml_nameid_format_id = 0
  }
  parameters {
      include_in_saml_assertion = true
      param_key_name = "urn:mace:dir:attribute-def:cn"
      user_attribute_mappings = "firstname"
    }
}

I might be doing it wrong but for some reason it does not set the user_attribute_mappings
Also when I run apply twice terraform crashes ( I guess it is not supported - just wish it wouldn't crash)....
terraform version used: 0.14.3 and 0.14.9

provider not working with our AWS Multi-account app

[this is an issue we had reported through another channel and wanted to capture it as a github isssue for better trackability]

We manually configured and got working through the UI the "AWS Multi-account applications" app following the instructions outlined here -- https://onelogin.service-now.com/kb_view.do?sysparm_article=KB0010344

I then did the following:

• used onelogin terraform-import to start managing this app in terraform.
• ran terraform plan to validate the project resolves cleanly
• commented out the last of three rules specified in our app configuration
• ran terraform plan to validate the plan would delete only that rule we no longer want
• ran 'terraform apply`
• in the UI, validated that there were only 2 rules in our application configuration
• in the UI, manually ran the applications "Reapply entitlement mappings" in the apps "more actions" section.
• Then tried to use the aws application and discovered it breaks. When redirected to AWS, I'm presented with the following error:

"Your request included an invalid SAML response. To logout, click here"

In troubleshooting this, I clicked on the first rule in my applications configuration and I can see that my rule configuration changed.

What used to look like this:

ended up looking like this:

It seems the actions got all messed up, switching from "from existing" over to "map from onelogin"

Once I manually reconfigured the rule back to what is was originally and re-ran "reapply entitlement mappings", the application started working again.

Is there some configuration application configuration not currently supported by this provider or exposed by the underlying API endpoint its calling?

Also, as a secondary question is the "reapply entitlement mappings" functionality exposed via the onelogin API? Assuming we can get the problem identified in this issue working, Ideally we would like to trigger a call to programmatically reapply the mappings if the rules change -- probably through a local provisioner inside a terraform null_resource.

Thanks.

Doug

onelogin_saml_apps has no possibility to configure Authentication Domain ID and SCIM Bearer token

Hi

We are currently trying to configure a saml application through the terraform provider. However we are wondering if there is any possibility to have the Authentication Domain or the Bearer token as a configurable field in terraform. Is this a feature which will come or are there reasons why it is not there?

We are aware of possible security implications this might have for the state file.

Timeout when creating onelogin_auth_servers

I'm trying to create an Auth server and when applying I get the following:

Error: request error: context: ol http service, error_message: Post "https://api.us.onelogin.com/api/2/api_authorizations": context deadline exceeded (Client.Timeout exceeded while awaiting headers)

Any ideas on what may be causing this, or how to resolve it? The same Terraform project has successfully managed to create an onelogin_oidc_apps resource so this may be isolated to just the onelogin_auth_servers resource.

The resource block for the auth server is really basic, as follows:

resource "onelogin_auth_servers" "webapp" {
  name        = "Web App - Dev"
  description = "Authorization server for the Dev Web Application."
  configuration {
    resource_identifier              = "https://webapp-dev.example.com/contacts"
    audiences                        = ["https://webapp-dev.exampe.com/contacts"]
    refresh_token_expiration_minutes = 30
    access_token_expiration_minutes  = 10
  }
}

Thanks

test

Early preview for delegated admin support?

Hi,

as you have announced the delegated admin feature to be in preview, I was wondering if you have a "preview" version of the terraform provider available as well?

Thanks
Marcus

Links as references
https://onelogin.service-now.com/support?id=kb_article&sys_id=128c53b2db1f2050ca1c400e0b961989&kb_category=20880e84db738300d5505eea4b9619fb
https://developers.onelogin.com/api-docs/1/privileges/list-privileges

Error: "context deadline exceeded (Client.Timeout exceeded while awaiting headers)"

I've been trying to get started with Onelogin + Terraform, but have been running into the same issue on two different computers using two different Onelogin Development accounts.

• I've set up the provider based on the documentation (see EXAMPLE 1 below.)
• I've exported the Client ID and Client Secret into the environment variables as documented and verified (i.e., env | grep ONELOGIN).
• I've been able to create a user via creating it in a users.tf file (see EXAMPLE 2 below.)
• However, I have been getting a Timeout error when running different operations (e.g., terraform apply, terraform refresh).

Any thoughts on how to translate the error message from below and resolve?

EXAMPLE 1

terraform {
  required_providers {
    onelogin = { 
      source = "onelogin/onelogin"
      version = "0.1.25"
    }   
  }
}

provider "onelogin" {
  # Configuration options
}

EXAMPLE 2

resource onelogin_users example_user {
    username  = "example"
    email     = "[email protected]"
  }

EXAMPLE 3

➜  onelogin-terraform terraform plan
onelogin_users.example_user Refreshing state... [id=12345678]
╷
│ Error: request error: context: ol http service, error_message: Post "https://api.us.onelogin.com/auth/oauth2/v2/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
│ 
│   with onelogin_users.example_user,
│   on users.tf line 1, in resource "onelogin_users" "example_user":
│    1: resource onelogin_users example_user {
│ 
╵

onelogin_app_role_attachments does not apply changes correctly

When applying role_attachments for the first time to an app, the provider crashes with an error message: App abc does not have role 123. The result in the UI is that some roles are attached and some are not. Sometimes also no roles are attached. The next run with the provider only works if the roles are selected manually in the app to reflect the persisted state.

data.terraform_remote_state.apps: Refreshing state...
data.external.app_newrelic_roles: Refreshing state... [id=-]

module.onelogin_roles.module.onelogin_app["aaaa"].onelogin_app_role_attachments.app_role["xxxx"]: Refreshing state... [id=aaaa]
module.onelogin_roles.module.onelogin_app["bbbb"].onelogin_app_role_attachments.app_role["zzz"]: Refreshing state... [id=bbbb]
module.onelogin_roles.module.onelogin_app["bbbb"].onelogin_app_role_attachments.app_role["xxxx"]: Refreshing state... [id=bbbb]
module.onelogin_roles.module.onelogin_app["bbbb"].onelogin_app_role_attachments.app_role["zzzz"]: Refreshing state... [id=bbbb]
module.onelogin_roles.module.onelogin_app["aaaa"].onelogin_app_role_attachments.app_role["zzzz"]: Refreshing state... [id=aaaa]

Error: App bbbb does not have role zzzz
Error: App aaaa does not have role xxxx

This could also be another outcome of the race condition in #30

App Rule Missing Macro Option

I want to use a macro for a app rule but im hitting an error when applying my terraform

╷
│ Error: Unsupported argument
│
│ on onelogin_app_rules.tf line 33, in resource "onelogin_app_rules" "blahhg":
│ 33: macro = "blahhfj"
│
│ An argument named "macro" is not expected here.
╵
ERRO[0001] 1 error occurred:
* exit status 1

example terraform

resource onelogin_app_rules blah{
  app_id = onelogin_oidc_apps.blah.id
  enabled = true
  match = "all"
  name = "ips_engineering"

  actions {
    action = "set_macro_thingy"
    macro = "texteter"
    value = []
  }

  conditions {
    operator = "ri"
    source   = "has_role"
    value    = "55953"
  }

}

The docs mention the macro value is available. https://registry.terraform.io/providers/onelogin/onelogin/latest/docs/resources/onelogin_app_rule#macro

using version 0.1.25

App Rule Action not selecting from list

When I use the Onelogin Go SDK to create an App Rule, eg:

var actions [1]apprules.AppRuleActions
action := "set_groups"
action_values := []string{"01pxezwc29uu74j"}

actions[0] = apprules.AppRuleActions{
    Action: &action,
    Value: action_values,
}
....
newAppRule := apprules.AppRule{
  ...
  Actions: actions[:],
}
err1 := sdkClient.Services.AppRulesV2.Create(&newAppRule)

it works nicely, I can see that the group was selected from the list of available groups.
I also see when running GET on /app/:app_id/rules that it looks like this:

    "actions": [
      {
        "action": "set_groups",
        "value": [
          "01pxezwc29uu74j"
        ]
      }
    ]

But when using this terraform inside of onelogin_app_rules

 actions {
   action = "set_groups"
   value = ["01pxezwc29uu74j"]
 }

then in the UI it has switched to a "map from onelogin" instead of choosing from list.
Also when running GET on /app/:app_id/rules that it looks like this:

    "actions": [
      {
        "action": "set_groups",
        "value": [
          "01pxezwc29uu74j"
        ],
        "expression": ""
      }
    ]

I see that "expression" has been added as an empty string. I think that's the culprit. But I don't know why it is added.

[Feature Request] Ability to set custom attributes for the user resource

We would love to be able to manage user resources via TF but the lack of support for custom attributes is a real blocker for us.

Would it be possible to add support for defining custom attributes to the user resource?

onelogin_role/s not able to create role

have tried to create a role using the terraform resource onelogin_roles but the terraform run consistently fails on that resource with the following message:

[onelogin_saml_apps.my](http://onelogin_saml_apps.my/)_saml_app: Creating...
[onelogin_saml_apps.my](http://onelogin_saml_apps.my/)_saml_app: Creation complete after 2s [id=1914900]
[onelogin_roles.my](http://onelogin_roles.my/)_role: Creating...
╷
│ Error: error: context: [ol http service], error_message: [unable to connect]
│
│   with [onelogin_roles.my](http://onelogin_roles.my/)_role,
│   on main.tf line 50, in resource "onelogin_roles" "my_role":
│   50: resource onelogin_roles my_role {

No issues are flagged on validate or plan but when running apply the failure occurs. Here is our most basic role resource code:

resource "onelogin_roles" "test_admin" {
  name   = "test admin role"
  apps   = [onelogin_saml_apps.saml_advanced.id]
  users  = []
  admins = []
}

The creation of the saml app works and the role looks to be intermittently created and displayed in the OL web app, but the error breaks terraform and the rest of the run is blocked.

Support for trusted identity providers

I have a use case where the number of trusted identity providers needs to scale (~100).
Would be super nice if TIDPs could be managed by terraform.

Which connectors are supported?

Is there a list of supported connector_ids?

I tried to create a new Splunk connector (connector_id=229), SAML 2.0 based. But got the following error:

Error: error: context: [ol http service], error_message: [{"message":"Unknown parameter on configuration section: provider_arn","name":"BadRequestError","statusCode":400}]

resource onelogin_saml_apps saml {
  connector_id = 229
  name         = "Terraform Test SAML App"
  description  = "SAML"

  configuration {
    signature_algorithm = "SHA-1"
  }
}

I understand this might be nowhere near to be ready, so I understand if you prefer people not to open issues yet.

We're quite keen to follow the development of this provider and can do beta testing if you need. We have a lot of manual OL apps we're keen to import in TF.

Thanks

plugin crash, failed "plugin.(*GRPCProvider).ApplyResourceChange call"

It's possible - likely even - that I've done something wrong in my TF code, but the output of the plugin crash specifically asks for a bug report.

The scenario is that I'm trying to set up a onelogin_saml_apps for AWS (connector id 30319). I imported the hand-configured saml app from OL, and then went to resolve the differences in my TF code to make it match. tf-plan runs fine, but it still shows some differences. The plugin crash happens when I try to tf-apply

Happy to provide more info, just not sure what else might be relevant/helpful.

 Error: Plugin did not respond
│
│   with onelogin_saml_apps.onelogin-admin,
│   on main.tf line 58, in resource "onelogin_saml_apps" "onelogin-admin":
│   58: resource "onelogin_saml_apps" "onelogin-admin" {
│
│ The plugin encountered an error, and failed to respond to the plugin.(*GRPCProvider).ApplyResourceChange call. The plugin logs may contain more details.
╵
Releasing state lock. This may take a few moments...

Stack trace from the terraform-provider-onelogin_v0.2.0 plugin:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x0 pc=0x100f9492c]

goroutine 16 [running]:
github.com/onelogin/onelogin-go-sdk/pkg/services/apps.(*V2Service).pruneParameters(0x14000349200, 0x140004a4f00, 0x1400028e840, 0x1010ea1e0, 0x1400028e840)
	github.com/onelogin/[email protected]/pkg/services/apps/v2.go:175 +0xdc
github.com/onelogin/onelogin-go-sdk/pkg/services/apps.(*V2Service).Update(0x14000349200, 0x1400028e840, 0x14000425910, 0x14000116fb4, 0x14000425920)
	github.com/onelogin/[email protected]/pkg/services/apps/v2.go:142 +0x364
github.com/onelogin/terraform-provider-onelogin/onelogin.samlAppUpdate(0x14000500080, 0x1010ea060, 0x14000344d20, 0xffffffffffffffff, 0x140004a5798)
	github.com/onelogin/terraform-provider-onelogin/onelogin/resource_onelogin_saml_apps.go:136 +0x6c8
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).update(0x140001bacc0, 0x1012362f8, 0x140001ae3c0, 0x14000500080, 0x1010ea060, 0x14000344d20, 0x0, 0x0, 0x0)
	github.com/hashicorp/terraform-plugin-sdk/[email protected]/helper/schema/resource.go:302 +0x5c
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).Apply(0x140001bacc0, 0x1012362f8, 0x140001ae3c0, 0x1400028b0a0, 0x1400084ec00, 0x1010ea060, 0x14000344d20, 0x0, 0x0, 0x0, ...)
	github.com/hashicorp/terraform-plugin-sdk/[email protected]/helper/schema/resource.go:404 +0x2c0
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*GRPCProviderServer).ApplyResourceChange(0x1400012b1e8, 0x1012362f8, 0x140001ae3c0, 0x1400028d180, 0x140001ae3c0, 0x1011dfc40, 0x0)
	github.com/hashicorp/terraform-plugin-sdk/[email protected]/helper/schema/grpc_provider.go:955 +0x6f8
github.com/hashicorp/terraform-plugin-go/tfprotov5/server.(*server).ApplyResourceChange(0x140004f5a00, 0x1012363a0, 0x140001ae3c0, 0x1400028aee0, 0x140004f5a00, 0x100e01470, 0x1011b9cc0)
	github.com/hashicorp/[email protected]/tfprotov5/server/server.go:332 +0x94
github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5._Provider_ApplyResourceChange_Handler(0x1011dfc40, 0x140004f5a00, 0x1012363a0, 0x140001b2240, 0x1400026b860, 0x0, 0x1012363a0, 0x140001b2240, 0x14000212500, 0x200d)
	github.com/hashicorp/[email protected]/tfprotov5/internal/tfplugin5/tfplugin5_grpc.pb.go:380 +0x1c8
google.golang.org/grpc.(*Server).processUnaryRPC(0x14000226e00, 0x10123ddb8, 0x14000583980, 0x140001fe000, 0x140003bc540, 0x10161c840, 0x0, 0x0, 0x0)
	google.golang.org/[email protected]/server.go:1194 +0x3e8
google.golang.org/grpc.(*Server).handleStream(0x14000226e00, 0x10123ddb8, 0x14000583980, 0x140001fe000, 0x0)
	google.golang.org/[email protected]/server.go:1517 +0xa50
google.golang.org/grpc.(*Server).serveStreams.func1.2(0x14000116490, 0x14000226e00, 0x10123ddb8, 0x14000583980, 0x140001fe000)
	google.golang.org/[email protected]/server.go:859 +0x94
created by google.golang.org/grpc.(*Server).serveStreams.func1
	google.golang.org/[email protected]/server.go:857 +0x1f8

Error: The terraform-provider-onelogin_v0.2.0 plugin crashed!

This is always indicative of a bug within the plugin. It would be immensely
helpful if you could report the crash with the plugin's maintainers so that it
can be fixed. The output above should help diagnose the issue.

Feature Request: Roles access to applications

Hello,

In our company we assign Roles to OneLogin apps in order to grant access to different people across our organisation.

It would be nice to be able to control this via Terraform when creating the app.

I could see this as being either embedded in the app resource, i.e.:

resource onelogin_oidc_apps oidc{
  connector_id = 108419
  name =  "Updated OIDC APP"
  description = "OIDC"

  access {
    role_ids = [
      12345,
      67890
    ]
  }
}

or have a separate TF resource to handle the attachment (inspired by the AWS IAM policy attachment), i.e.:

resource onelogin_oidc_app_role_attachment role_attach {
  app_id = onelogin_oidc_apps.oidc.id
  
  role_id = 12345
}

onelogin_auth_server not setting state correctly

The provider fails to correctly set the state for onelogin_auth_server resources.

The error is when updating the configuration here:

d.Set("configuration", authserverconfigurationschema.Flatten(*authServer.Configuration))

configuration: '': source data must be an array or slice, got map

Support for Apple Silicon?

Any chance we can get an updated build for Apple Silicon (darwin_arm64)?

Initializing provider plugins...
- Finding onelogin/onelogin versions matching "0.1.14"...
╷
│ Error: Incompatible provider version
│ 
│ Provider registry.terraform.io/onelogin/onelogin v0.1.14 does not have a package available for your current platform, darwin_arm64.
│ 
│ Provider releases are separate from Terraform CLI releases, so not all providers are available for all platforms. Other versions of this provider may
│ have different platforms supported.

User can't use apps despite being added to role

Example.

resource "onelogin_roles" "role" {
  name   = "Sample"
  apps   = local.foobar.id
  users  = [
    usera.id,
    userb.id,
  ]
}

In this case, I expect "usera" and "userb" can use "fooabr" app via onelogin portal, but it doesnt work.
"foobar" app doesnt apear on usera/userb portal site even though terraform plan doesnt show any diff.

This terraform resource uses update user api, and I also confirmed it is reproducible by curl base implementation.

Is it correct behavior?

And I also find that add role user api works as expected for me.

Following script delete/add users from Role.

# delete
curl -H "Authorization: bearer $TOKEN" -X DELETE -H "Content-Type: application/json" -d "[$users]" "https://api.us.onelogin.com/api/2/roles/${roleid}/users"

# add
curl -H "Authorization: bearer $TOKEN" -X POST -H "Content-Type: application/json" -d "[$users]" "https://api.us.onelogin.com/api/2/roles/${roleid}/users"

If it is not bug and correct specification, I propose to add "onelogin_user_role_attachments" resource, similar to existing resource "onelogin_app_role_attachments". Onelogin go sdk is needed to change for this proposal, too.

Give me your idea, please.

Missing brand_id on App resource

The OneLogin App resource now supports a brand_id attribute that can be used to control the branding of the login page for the app.

https://developers.onelogin.com/api-docs/2/apps/app-resource

Can we get this added to the App resource in the provider?

Allow increasing the timeout

Hello,
We are continually seeing this error when planning our terraform resources:

Error: App does not exist request error: context: ol http service, error_message: Post "https://api.us.onelogin.com/auth/oauth2/v2/token": EOF

On these errors, which happen frequently, there seems to be no automatic retrying. It would be great to be able to configure this: https://github.com/onelogin/terraform-provider-onelogin/blob/develop/onelogin/provider.go#L73

Documentation indentation issues

Several places in the documentation seem to have annoying (for readability) whitespace issues.
Examples:

• https://registry.terraform.io/providers/onelogin/onelogin/latest/docs/resources/onelogin_oidc_app
  2 vs 4 vs tab indentation? See the name and visible argument in the first example.
• https://registry.terraform.io/providers/onelogin/onelogin/latest/docs/resources/onelogin_app
  2 vs 4 spaces indentation? See the parameters block in the first example.

Unable to perform multi-stage AWS mappings due to entitlement mappings

Problem:

AWS app is configured to assign permissions via "map from onelogin" with match: "AWS - (.*)"

When a user is assigned the "AWS - FOO" role in OneLogin, you then need to click "Reapply Entitlement Mappings" for the SCIM to trigger and create the matching group in AWS SSO.

Our use case is creating the roles named "AWS - FOO" in onelogin via terraform (this works great),
Then use the AWS Terraform Provider to attach a permission set to the SSO Group.

This action fails as nothing triggers the "Reapply Entitlement Mappings" action from the terraform file, and thus never populates AWS for us to perform a match.

If there is an api endpoint for the reapply, I have not been able to find it or id trigger the call via local-exec and be unblocked.

Wish:
When making updates to user roles via Terraform, entitlement mapping updates would happen automagically.

Let me know what other detail I can provide.

creating an app by terraform

When I create an app using terraform, the credential setting is "Configured by end-users" by default as shown in the attached picture.

If I want to change the credential setting to "Configured by admins and shared by all users" and create an app, how do I set the Argument Reference described in the terraform documentation?

The documentation about Argument reference

Ability to fully configure apps

My apologies if this is already covered elsewhere.

What I'm trying to achieve: configure AWS and OneLogin to use the "Aws Multi-Account" app fully in terraform.

In my case, I need to be able to configure the "External Role Name", "External ID", and the "List of SAML providers" configuration values. Ideally, these would be exposed as additional resources, as otherwise, we would introduce circular dependencies (AWS SAML provider depends on app metadata, but the app configuration depends on the external role name).

Regarding the app metadata, it would be a nice bonus if that's exposed via an attribute so that we can directly use it with the "aws_iam_saml_provider" resource.

error when attempting terraform import of onelogin_app_rules

Hello. @dcaponi suggested here I could run the following to import an app rule into my project:

terraform import onelogin_app_rules.<your app_rule name> <app_rule_id>

However I received the following error when I tried to run it:

terraform import onelogin_app_rules.example NNNNNN
onelogin_app_rules.example: Importing from ID "NNNNNN"...
onelogin_app_rules.example: Import prepared!
  Prepared onelogin_app_rules for import
onelogin_app_rules.example: Refreshing state... [id=NNNNNN]
╷
│ Error: error: context: [ol http service], error_message: [{"name":"NotFoundError","message":"Resource not found","statusCode":404}]
│
│
╵

Here's what I did:

I have a project that looks like this:

resource "onelogin_app_rules" "example" {
  app_id   = XXXXXXX
  enabled  = true
  match    = "all"
  name     = "terraform-test"
  conditions {
    operator = "="
    source   = "email"
    value    = "[email protected]
  }
  actions {
    action = "set_role_from_existing"
    value = [
      "arn:aws:iam::YYYYYYYYYYYYYY:role/my-role"
    ]
  }
}

I then run terraform apply:

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

onelogin_app_rules.example: Creating...
onelogin_app_rules.example: Creation complete after 1s [id=NNNNNN]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

I then show the terraform state to get the rule id, remove the resource from state, and then attempt to re-import it, but get the error message:

$ terraform state show onelogin_app_rules.example
# onelogin_app_rules.example:
resource "onelogin_app_rules" "example" {
    app_id   = "AAAAAAAA"
    enabled  = true
    id       = "NNNNNN"
    match    = "all"
    name     = "terraform-test"
    position = 10

    actions {
        action = "set_role_from_existing"
        value  = [
            "arn:aws:iam::YYYYYYYYYYYYYY:role/my-role",
        ]
    }

    conditions {
        operator = "="
        source   = "email"
        value    = "[email protected]"
    }
}
$ terraform state rm onelogin_app_rules.example
Removed onelogin_app_rules.example
Successfully removed 1 resource instance(s).
$ terraform import onelogin_app_rules.example NNNNNN
onelogin_app_rules.example: Importing from ID "NNNNNN"...
onelogin_app_rules.example: Import prepared!
  Prepared onelogin_app_rules for import
onelogin_app_rules.example: Refreshing state... [id=NNNNNN]
╷
│ Error: error: context: [ol http service], error_message: [{"name":"NotFoundError","message":"Resource not found","statusCode":404}]
│
│
╵

Any idea what might be happening here? Am I doing something wrong?

Thanks.

Doug

Incomplete response on SAML app create

After initial terragrunt apply, I'm getting only partial sso object in response

sso = {
"issuer" = "https://app.onelogin.com/saml/metadata/24c06fcc-a132-49d5-a52e-879608d5508f"
"sls_url" = "https://mydomain.onelogin.com/trust/saml2/http-redirect/slo/1239708"
}

Only by running terragrunt apply again, I can get full response

sso = {
"acs_url" = "https://mydomain.onelogin.com/trust/saml2/http-post/sso/24c06fcc-a132-49d5-a52e-879608d5508f"
"issuer" = "https://app.onelogin.com/saml/metadata/24c06fcc-a132-49d5-a52e-879608d5508f"
"metadata_url" = "https://app.onelogin.com/saml/metadata/24c06fcc-a132-49d5-a52e-879608d5508f"
"sls_url" = "https://mydomain.onelogin.com/trust/saml2/http-redirect/slo/1239708"
}

onelogin_oidc_apps displays sensitive data

Hello,

When updating an onelogin_oidc_apps app resource that is already in state, the OIDC client_id and client_secret

Example

------------------------------------------------------------------------

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # onelogin_oidc_apps.example will be updated in-place
  ~ resource "onelogin_oidc_apps" "example" {
        allow_assumed_signin = false
        auth_method          = 8
      ~ configuration        = {
          ~ "login_url"                  = "https://localhost" -> "https://localhost:3000"
            "oidc_application_type"      = "0"
          ~ "redirect_uri"               = "https://localhost/oauth2/callback" -> "https://localhost:3000/oauth2/callback"
            "token_endpoint_auth_method" = "1"
        }
        connector_id         = 38568
        created_at           = "2020-12-17 09:46:50.742 +0000 UTC"
        description          = "Example"
        icon_url             = "/images/missing_connector_icon/square/original.png"
        id                   = "392906"
        name                 = "Example OIDC App"
        notes                = "Example"
        policy_id            = 0
        provisioning         = {
            "enabled" = false
        }
        sso                  = {
            "client_id"     = "bbbbbbbb-2222-1111-3333-12312312312312312"
            "client_secret" = "d5f29b6cd5f29b6cd5f29b6cd5f29b6cd5f29b6cd5f29b6cd5f29b6cd5f29b6c"
        }
        tab_id               = 0
        updated_at           = "2020-12-17 09:46:50.742 +0000 UTC"
        visible              = false

        parameters {
            attributes_transformations = "group_list"
            include_in_saml_assertion  = false
            label                      = "Groups"
            param_id                   = 55555
            param_key_name             = "groups"
            provisioned_entitlements   = false
            safe_entitlements_enabled  = false
            skip_if_blank              = false
            user_attribute_mappings    = "member_of"
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

------------------------------------------------------------------------

Code affected

terraform-provider-onelogin/onelogin/resource_onelogin_oidc_apps.go

Lines 26 to 30 in 7f9a226

	appSchema["sso"] = &schema.Schema{
	Type: schema.TypeMap,
	Computed: true,
	Elem: &schema.Schema{Type: schema.TypeString},
	}

Suggested fix

	appSchema["sso"] = &schema.Schema{
		Type:     schema.TypeMap,
		Computed: true,
		Elem:     &schema.Schema{Type: schema.TypeString},
		Sensitive: true,
	}

Setting the Sensitive Bool as described here https://www.terraform.io/docs/extend/schemas/schema-methods.html

Which results in the client_id and client_secret are marked as sensitive.

Terraform will perform the following actions:
  # onelogin_oidc_apps.example will be updated in-place
  ~ resource "onelogin_oidc_apps" "example" {
        allow_assumed_signin = false
        auth_method          = 8
        brand_id             = 0
      ~ configuration        = {
          ~ "login_url"                  = "https://localhost" -> "https://localhost:3000"
            "oidc_application_type"      = "0"
          ~ "redirect_uri"               = "https://localhost/oauth2/callback" -> "https://localhost:3000/oauth2/callback"
            "token_endpoint_auth_method" = "1"
        }
        connector_id         = 38568
        created_at           = "2020-12-17 09:46:50.742 +0000 UTC"
        description          = "Example"
        icon_url             = "/images/missing_connector_icon/square/original.png"
        id                   = "392906"
        name                 = "Example OIDC App"
        notes                = "Example"
        policy_id            = 0
        provisioning         = {
            "enabled" = false
        }
        sso                  = (sensitive value)
        tab_id               = 0
        updated_at           = "2020-12-17 09:46:50.742 +0000 UTC"
        visible              = false

        parameters {
            attributes_transformations = "group_list"
            include_in_saml_assertion  = false
            label                      = "Groups"
            param_id                   = 55555
            param_key_name             = "groups"
            provisioned_entitlements   = false
            safe_entitlements_enabled  = false
            skip_if_blank              = false
            user_attribute_mappings    = "member_of"
        }
    }

internal error "onelogin_brands: enabled: Default cannot be set with Required"

Using provider 0.3.6.

Still trying to wrap my head around the contents of swag-api.yml and haven't been able to figure out exactly where this problem is, but trying to use the provider in any way results in

Error: InternalValidate
│
│   with provider["registry.terraform.io/onelogin/onelogin"],
│   on providers.tf line 13, in provider "onelogin":
│   13: provider "onelogin" {}
│
│ Internal validation of the provider failed! This is always a bug
│ with the provider itself, and not a user issue. Please report
│ this bug:
│
│ 1 error occurred:
│ 	* resource onelogin_brands: enabled: Default cannot be set with Required

Sample code:

terraform {

  required_version = ">= 1.0.0"

  required_providers {
    onelogin = {
      source = "onelogin/onelogin"
      version = "0.3.6"
    }
  }
}

provider "onelogin" {} # seems to be required, even if empty as shown here

resource "onelogin_apps" "ol-aws-admin" {
  connector_id = 30319
  name         = var.ol_application_friendly_name
  auth_method  = 2 # SAML
}

Add relayState to configuration of onelogin_saml_app

Hi,

we would like to be able to maintain the relayState with the terraform verb onelogin_saml_app.

It is already possible with the API, so I hope, it is easy for you to add to the terraform provider as well. API example:
"configuration": {
"relay": "superduper",
"certificate_id": 271155,
"account_id": "9d11aa89-2033-4111-869a-e6c24e22556c",
"signature_algorithm": "SHA-1"
}

For us it is another step towards having the New Relic with organization app configured fully with terraform. In this sense #29 is related to this issue.

In our case we do use the EU region of New Relic and we would like to have users being ending up in this region right away. The app it self is able to do so (Thanks to Chris from your support team).

Thanks in advance

"Invalid action value" error when attempting to create app rule

I reported this as a comment on closed issue #16 but probably better to track this separately.

I'm getting an error when trying to apply the following code:

resource "onelogin_app_rules" "example" {
  app_id   = [REDACTED]
  position = 10
  enabled  = true
  match    = "all"
  name     = "terraform-test"
  conditions {
    operator = "="
    source   = "email"
    value    = "[REDACTED]"
  }
  actions {
    action = "set_role_from_existing"
    value = [
      "arn:aws:iam::[REDACTED]:role/[REDACTED]",
    ]
  }
}

The error message I'm getting is:

✗  terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # onelogin_app_rules.example will be created
  + resource "onelogin_app_rules" "example" {
      + app_id   = "[REDACTED]"
      + enabled  = true
      + id       = (known after apply)
      + match    = "all"
      + name     = "terraform-test"
      + position = 10

      + actions {
          + action = "set_role_from_existing"
          + value  = [
              + "arn:aws:iam::[REDACTED]:role/[REDACTED]",
            ]
        }

      + conditions {
          + operator = "="
          + source   = "email"
          + value    = "[REDACTED]"
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

onelogin_app_rules.example: Creating...
╷
│ Error: error: context: [ol http service], error_message: [{"code":422,"message":"Validation Failed","errors":[{"field":"actions","message":["Invalid action value(s): arn:aws:iam::[REDACTED]:role/[REDACTED]"]}]}]
│
│   with onelogin_app_rules.example,
│   on onelogin.tf line 23, in resource "onelogin_app_rules" "example":
│   23: resource "onelogin_app_rules" "example" {
│

Terraform version info:

terraform version
Terraform v0.15.3
on darwin_amd64
+ provider registry.terraform.io/onelogin/onelogin v0.1.14

I was trying this out in an attempt to test out the fix for issue #19 which had prevented us from moving forward with this provider. The fix was to introduce the set_role_from_existing action which and was introduced in release v0.1.14.

Note I tried this with the latest version v0.1.19 and the same problem fails there too.

It appears the error is trying to tell me that there's a problem with the role arn I'm passing in the action value, but I know that arn exists, as we have other app rules in our configuration which are referencing it. For example, when I write a python script to hit the API directly to get our applications rules, the following comes back for one of them:

{
  "[REDACTED]": {
    "id": 198648,
    "name": "[REDACTED]",
    "match": "all",
    "enabled": true,
    "position": 1,
    "conditions": [
      {
        "source": "has_role",
        "operator": "ri",
        "value": "331774"
      }
    ],
    "actions": [
      {
        "action": "set_role",
        "value": [
          "arn:aws:iam::[REDACTED]:role/[REDACTED]"
        ]
      }
    ]
  },
...

The same role I'm trying to set in rule position 10 (the next open position) is referenced in the rule in position 1, and that rule is working correctly and users are able to SAML assume into that particular AWS account.

I guess my next step to help troubleshot would be to attempt to create the rule via python and the APi and that might help to narrow things down.

Cheers

Doug

Data Resources

Can we get a data resource object for users? I see there is already a readUser function

terraform-provider-onelogin/onelogin/resource_onelogin_users.go

Line 99 in 86a146c

func usersRead(d *schema.ResourceData, m interface{}) error {

onelogin_app_role_attachments sporadically fails

Hi

When we use the onelogin_app_role_attachment we get random creation errors like the error below. If we execute it again one second later it works without a problem.

module.onelogin_roles.module.onelogin_app["390865"].onelogin_app_role_attachments.app_role["xxx"]: Creating...
module.onelogin_roles.module.onelogin_app["390864"].onelogin_app_role_attachments.app_role["xxx"]: Creating...
module.onelogin_roles.module.onelogin_app["390864"].onelogin_app_role_attachments.app_role["yyy"]: Creating...
module.onelogin_roles.module.onelogin_app["390866"].onelogin_app_role_attachments.app_role["yyy"]: Creating...
module.onelogin_roles.module.onelogin_app["390866"].onelogin_app_role_attachments.app_role["yyy"]: Creating...
module.onelogin_roles.module.onelogin_app["390865"].onelogin_app_role_attachments.app_role["yyy"]: Creating...
module.onelogin_roles.module.onelogin_app["390865"].onelogin_app_role_attachments.app_role["yyy"]: Creation complete after 1s [id=aaaa]
module.onelogin_roles.module.onelogin_app["390866"].onelogin_app_role_attachments.app_role["xxx"]: Creation complete after 1s [id=bbb]
module.onelogin_roles.module.onelogin_app["390864"].onelogin_app_role_attachments.app_role["xxx"]: Creation complete after 2s [id=ccc]

Error: App 1234 does not have role 44444
  on ../../modules/onelogin_role_attachment/role_attachment.tf line 1, in resource "onelogin_app_role_attachments" "app_role":
   1: resource "onelogin_app_role_attachments" "app_role" {

Error: App 4321 does not have role 44444
  on ../../modules/onelogin_role_attachment/role_attachment.tf line 1, in resource "onelogin_app_role_attachments" "app_role":

   1: resource "onelogin_app_role_attachments" "app_role" {

Error: App 6789 does not have role 5555
  on ../../modules/onelogin_role_attachment/role_attachment.tf line 1, in resource "onelogin_app_role_attachments" "app_role":

   1: resource "onelogin_app_role_attachments" "app_role" {

If necessary we can also run a terraform apply with DEBUG and provide you the output.

Panic when creating a role on version 0.1.3

Hi,

When trying to create a onelogin_roles resource using the v0.1.3 version, a panic occurs. However, this does work on v0.1.2.

terraform --version
Terraform v0.13.5
+ provider registry.terraform.io/onelogin/onelogin v0.1.3

panic: interface conversion: interface {} is *schema.Set, not []interface {}
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3:
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: goroutine 57 [running]:
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: github.com/onelogin/terraform-provider-onelogin/ol_schema/role.Inflate(0xc000561608, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: 	github.com/onelogin/terraform-provider-onelogin/ol_schema/role/role.go:48 +0x7b9
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: github.com/onelogin/terraform-provider-onelogin/onelogin.rolesCreate(0xc000184b60, 0x19dd1c0, 0xc0000a4c30, 0x2, 0x2524500)
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: 	github.com/onelogin/terraform-provider-onelogin/onelogin/resource_onelogin_roles.go:26 +0x311
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: github.com/hashicorp/terraform-plugin-sdk/helper/schema.(*Resource).Apply(0xc00043f950, 0xc00026e230, 0xc00081ea60, 0x19dd1c0, 0xc0000a4c30, 0x1a70d01, 0xc00019f2d8, 0xc0002039b0)
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: 	github.com/hashicorp/[email protected]/helper/schema/resource.go:310 +0x365
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: github.com/hashicorp/terraform-plugin-sdk/helper/schema.(*Provider).Apply(0xc000054a00, 0xc000561a10, 0xc00026e230, 0xc00081ea60, 0xc00038c508, 0xc000206198, 0x1a72980)
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: 	github.com/hashicorp/[email protected]/helper/schema/provider.go:294 +0x99
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: github.com/hashicorp/terraform-plugin-sdk/internal/helper/plugin.(*GRPCProviderServer).ApplyResourceChange(0xc00000ec70, 0x1e09f00, 0xc000203050, 0xc000184380, 0xc00000ec70, 0xc000203050, 0xc000155b78)
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: 	github.com/hashicorp/[email protected]/internal/helper/plugin/grpc_provider.go:885 +0x8b4
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: github.com/hashicorp/terraform-plugin-sdk/internal/tfplugin5._Provider_ApplyResourceChange_Handler(0x1b7c300, 0xc00000ec70, 0x1e09f00, 0xc000203050, 0xc000200b40, 0x0, 0x1e09f00, 0xc000203050, 0xc000050340, 0xc9)
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: 	github.com/hashicorp/[email protected]/internal/tfplugin5/tfplugin5.pb.go:3305 +0x217
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: google.golang.org/grpc.(*Server).processUnaryRPC(0xc000802c00, 0x1e14400, 0xc000803980, 0xc000266200, 0xc000531140, 0x24ea700, 0x0, 0x0, 0x0)
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: 	google.golang.org/[email protected]/server.go:1024 +0x501
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: google.golang.org/grpc.(*Server).handleStream(0xc000802c00, 0x1e14400, 0xc000803980, 0xc000266200, 0x0)
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: 	google.golang.org/[email protected]/server.go:1313 +0xd3d
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: google.golang.org/grpc.(*Server).serveStreams.func1.1(0xc0000344f0, 0xc000802c00, 0x1e14400, 0xc000803980, 0xc000266200)
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: 	google.golang.org/[email protected]/server.go:722 +0xa1
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: created by google.golang.org/grpc.(*Server).serveStreams.func1
2020-11-25T13:50:40.041Z [DEBUG] plugin.terraform-provider-onelogin_v0.1.3: 	google.golang.org/[email protected]/server.go:720 +0xa1

Steps to reproduce:

Try creating the following resource with v0.1.3:

resource onelogin_roles oidc_app {
  name   = var.name
  apps   = [1234]
  users  = []
  admins = []
}

Error messages seem to indicate github.com/onelogin/terraform-provider-onelogin/ol_schema/role/role.go:48 which may have been impacted by this change 0099909

Creating an App error

Hi,

For installing the provider we used go get since go install didn't work.

After verifying that the provider is installed and we were able to run terraform plan on this sample code

resource onelogin_oidc_apps oidc {
  connector_id = 108419
  name         = "OneLogin Terraform Test App (myct)"
  description  = "OIDC"  
  configuration {
    redirect_uri                     = "https://localhost:3000/callback"
    refresh_token_expiration_minutes = 1
    login_url                        = "https://www.test.com"
    oidc_application_type            = 0
    token_endpoint_auth_method       = 1
    access_token_expiration_minutes  = 1
  }
}

When trying to apply it we got the following error:

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.  Enter a value: yesonelogin_oidc_apps.oidc: Creating...Error: rpc error: code = Unavailable desc = transport is closing
panic: runtime error: invalid memory address or nil pointer dereference
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: [signal SIGSEGV: segmentation violation code=0x1 addr=0x48 pc=0x19761f6]
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: 
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: goroutine 42 [running]:
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: github.com/onelogin/onelogin-go-sdk/pkg/services/olhttp.(*OLHTTPService).executeHTTP(0xc0004fab28, 0xc00015a300, 0xc000628450, 0x28, 0x1bed07f, 0x5, 0xc0004c4ed0, 0x1aceee0, 0xc000190a40, 0x0, ...)
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/github.com/onelogin/[email protected]/pkg/services/olhttp/olrequest.go:203 +0xf6
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: github.com/onelogin/onelogin-go-sdk/pkg/services/olhttp.OLHTTPService.Create(0x1bf6482, 0xf, 0xc000042073, 0x40, 0xc000042017, 0x40, 0xc00003c072, 0x13, 0x1e20e80, 0xc0004b5a10, ...)
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/github.com/onelogin/[email protected]/pkg/services/olhttp/olrequest.go:103 +0x3ec
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: github.com/onelogin/onelogin-go-sdk/pkg/services/olhttp.(*OLHTTPService).mintBearerToken(0xc0004fb170, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b31040, 0xffffffffffffffff)
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/github.com/onelogin/[email protected]/pkg/services/olhttp/olrequest.go:229 +0x26f
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: github.com/onelogin/onelogin-go-sdk/pkg/services/olhttp.setBearerToken(0xc0004fb170, 0xc0004fae40, 0x30)
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/github.com/onelogin/[email protected]/pkg/services/olhttp/olrequest.go:248 +0x40
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: github.com/onelogin/onelogin-go-sdk/pkg/services/olhttp.(*OLHTTPService).attachHeaders(0xc0004fb170, 0xc00015a100, 0xc0001705c0, 0x1e, 0x1bededd, 0x6, 0xc0004c45a0, 0x1a01a20, 0xc000130460, 0xc0004fb030, ...)
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/github.com/onelogin/[email protected]/pkg/services/olhttp/olrequest.go:180 +0x3f3
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: github.com/onelogin/onelogin-go-sdk/pkg/services/olhttp.(*OLHTTPService).executeHTTP(0xc0004fb170, 0xc00015a100, 0xc0001705c0, 0x1e, 0x1bededd, 0x6, 0xc0004c45a0, 0x1a01a20, 0xc000130460, 0x0, ...)
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/github.com/onelogin/[email protected]/pkg/services/olhttp/olrequest.go:198 +0xaf
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: github.com/onelogin/onelogin-go-sdk/pkg/services/olhttp.OLHTTPService.Create(0x1bf6482, 0xf, 0xc000042073, 0x40, 0xc000042017, 0x40, 0xc00003c072, 0x13, 0x1e20e80, 0xc0004b5a10, ...)
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/github.com/onelogin/[email protected]/pkg/services/olhttp/olrequest.go:103 +0x3ec
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: github.com/onelogin/onelogin-go-sdk/pkg/services/apps.(*V2Service).Create(0xc000130400, 0xc000130460, 0xc000190510, 0xc0004ba4f4, 0xc000190520)
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/github.com/onelogin/[email protected]/pkg/services/apps/v2.go:98 +0x182
2020-06-17T14:36:36.252+0200 [DEBUG] plugin.terraform-provider-onelogin: github.com/onelogin/terraform-provider-onelogin/onelogin.oidcAppCreate(0xc0002e8000, 0x1a018e0, 0xc00029d130, 0x2, 0x2556580)
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/porsche/git/onelogin/terraform-provider-onelogin/onelogin/resource_onelogin_oidc_apps.go:63 +0x742
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: github.com/hashicorp/terraform-plugin-sdk/helper/schema.(*Resource).Apply(0xc0003aed80, 0xc0000c48c0, 0xc00061e720, 0x1a018e0, 0xc00029d130, 0xc000324101, 0xc0004c5770, 0xc000324228)
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/github.com/hashicorp/[email protected]/helper/schema/resource.go:310 +0x365
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: github.com/hashicorp/terraform-plugin-sdk/helper/schema.(*Provider).Apply(0xc000176900, 0xc0004fb9c8, 0xc0000c48c0, 0xc00061e720, 0xc0004b94c8, 0xc000684140, 0x1a84740)
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/github.com/hashicorp/[email protected]/helper/schema/provider.go:294 +0x99
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: github.com/hashicorp/terraform-plugin-sdk/internal/helper/plugin.(*GRPCProviderServer).ApplyResourceChange(0xc00014c4c0, 0x1e39f20, 0xc0001407e0, 0xc0002e8000, 0xc00014c4c0, 0xc0001407e0, 0xc0002f8b30)
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/github.com/hashicorp/[email protected]/internal/helper/plugin/grpc_provider.go:885 +0x8b4
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: github.com/hashicorp/terraform-plugin-sdk/internal/tfplugin5._Provider_ApplyResourceChange_Handler(0x1bb3000, 0xc00014c4c0, 0x1e39f20, 0xc0001407e0, 0xc000136360, 0x0, 0x1e39f20, 0xc0001407e0, 0xc0000e4c00, 0x3bb)
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/github.com/hashicorp/[email protected]/internal/tfplugin5/tfplugin5.pb.go:3305 +0x217
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: google.golang.org/grpc.(*Server).processUnaryRPC(0xc000540c00, 0x1e45a40, 0xc00057ed80, 0xc000134300, 0xc000140630, 0x252aa60, 0x0, 0x0, 0x0)
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/google.golang.org/[email protected]/server.go:1024 +0x4f4
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: google.golang.org/grpc.(*Server).handleStream(0xc000540c00, 0x1e45a40, 0xc00057ed80, 0xc000134300, 0x0)
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/google.golang.org/[email protected]/server.go:1313 +0xd97
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: google.golang.org/grpc.(*Server).serveStreams.func1.1(0xc000154180, 0xc000540c00, 0x1e45a40, 0xc00057ed80, 0xc000134300)
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/google.golang.org/[email protected]/server.go:722 +0xbb
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: created by google.golang.org/grpc.(*Server).serveStreams.func1
2020-06-17T14:36:36.253+0200 [DEBUG] plugin.terraform-provider-onelogin: 	/Users/amansour/go/pkg/mod/google.golang.org/[email protected]/server.go:720 +0xa1
2020/06/17 14:36:36 [DEBUG] onelogin_oidc_apps.oidc: apply errored, but we're indicating that via the Error pointer rather than returning it: rpc error: code = Unavailable desc = transport is closing
2020/06/17 14:36:36 [TRACE] <root>: eval: *terraform.EvalMaybeTainted
2020/06/17 14:36:36 [TRACE] EvalMaybeTainted: onelogin_oidc_apps.oidc encountered an error during creation, so it is now marked as tainted
2020/06/17 14:36:36 [TRACE] <root>: eval: *terraform.EvalWriteState
2020-06-17T14:36:36.255+0200 [DEBUG] plugin: plugin process exited: path=/Users/amansour/.terraform.d/plugins/terraform-provider-onelogin pid=911 error="exit status 2"
2020/06/17 14:36:36 [TRACE] EvalWriteState: removing state object for onelogin_oidc_apps.oidc
2020/06/17 14:36:36 [TRACE] <root>: eval: *terraform.EvalApplyProvisioners
2020/06/17 14:36:36 [TRACE] EvalApplyProvisioners: onelogin_oidc_apps.oidc has no state, so skipping provisioners
2020/06/17 14:36:36 [TRACE] <root>: eval: *terraform.EvalMaybeTainted
2020/06/17 14:36:36 [TRACE] EvalMaybeTainted: onelogin_oidc_apps.oidc encountered an error during creation, so it is now marked as tainted
2020/06/17 14:36:36 [TRACE] <root>: eval: *terraform.EvalWriteState
2020/06/17 14:36:36 [TRACE] EvalWriteState: removing state object for onelogin_oidc_apps.oidc
2020/06/17 14:36:36 [TRACE] <root>: eval: *terraform.EvalIf
2020/06/17 14:36:36 [TRACE] <root>: eval: *terraform.EvalIf
2020/06/17 14:36:36 [TRACE] <root>: eval: *terraform.EvalWriteDiff
2020/06/17 14:36:36 [TRACE] <root>: eval: *terraform.EvalApplyPost
2020/06/17 14:36:36 [ERROR] <root>: eval: *terraform.EvalApplyPost, err: rpc error: code = Unavailable desc = transport is closing
2020/06/17 14:36:36 [ERROR] <root>: eval: *terraform.EvalSequence, err: rpc error: code = Unavailable desc = transport is closing
2020/06/17 14:36:36 [TRACE] [walkApply] Exiting eval tree: onelogin_oidc_apps.oidc
2020/06/17 14:36:36 [TRACE] vertex "onelogin_oidc_apps.oidc": visit complete
2020/06/17 14:36:36 [TRACE] dag/walk: upstream of "provider.onelogin (close)" errored, so skipping
2020/06/17 14:36:36 [TRACE] dag/walk: upstream of "meta.count-boundary (EachMode fixup)" errored, so skipping
2020/06/17 14:36:36 [TRACE] dag/walk: upstream of "root" errored, so skipping
2020/06/17 14:36:36 [TRACE] statemgr.Filesystem: reading latest snapshot from terraform.tfstate
2020/06/17 14:36:36 [TRACE] statemgr.Filesystem: snapshot file has nil snapshot, but that's okay
2020/06/17 14:36:36 [TRACE] statemgr.Filesystem: read nil snapshot
2020/06/17 14:36:36 [TRACE] statemgr.Filesystem: no original state snapshot to back up
2020/06/17 14:36:36 [TRACE] statemgr.Filesystem: state has changed since last snapshot, so incrementing serial to 1
2020/06/17 14:36:36 [TRACE] statemgr.Filesystem: writing snapshot at terraform.tfstate
2020/06/17 14:36:36 [TRACE] statemgr.Filesystem: removing lock metadata file .terraform.tfstate.lock.info
2020/06/17 14:36:36 [TRACE] statemgr.Filesystem: unlocking terraform.tfstate using fcntl flock
2020-06-17T14:36:36.266+0200 [DEBUG] plugin: plugin exited!!!!!!!!!!!!!!!!!!!!!!!!!!! TERRAFORM CRASH !!!!!!!!!!!!!!!!!!!!!!!!!!!!Terraform crashed! This is always indicative of a bug within Terraform.
A crash log has been placed at "crash.log" relative to your current
working directory. It would be immensely helpful if you could please
report the crash with Terraform[1] so that we can fix this.When reporting bugs, please include your terraform version. That
information is available on the first line of crash.log. You can also
get it by running 'terraform --version' on the command line.SECURITY WARNING: the "crash.log" file that was created may contain 
sensitive information that must be redacted before it is safe to share 
on the issue tracker.[1]: https://github.com/hashicorp/terraform/issues!!!!!!!!!!!!!!!!!!!!!!!!!!! TERRAFORM CRASH !!!!!!!!!!!!!!!!!!!!!!!!!!!!

Attached here are the complete crash.log file
crash.log

The 0.3.0 api seems to be missing the configuration

Resource onelogin_apps seems to be lacking the "configuration" field, making it impossible to actually configure any application. Am I missing something?

Ability to manage groups through the provider

Hi,

I couldn't find any mention of this elsewhere, so I'm opening an issue.

The provider currently does not have to capability to manage OneLogin groups.

Is this planned by any chance?

Handle manual deletion of resources

Currently we find that Terraform plan breaks very very badly when a resource is deleted manually from OneLogin, i.e. an app or a role_attachment.

It would be nice if the provider could handle this: detect that a resource in the tfstate is not there anymore, and re-create it.

SSO attributes are exported in a list

I created an OIDC app and when trying to reference the client_id and secret, I get the following error:

     OIDC_Client_ID         = onelogin_oidc_apps.incident_response.sso.client_id
 Block type "sso" is represented by a list of objects, so it must be indexed
 using a numeric key, like .sso[0].

This is confirmed by a quick look in the state file, where SSO is a list:

            "sso": [
              {
                "client_id": "xxx",
                "client_secret": "xxx"
              }
            ],

I fixed it as Terraform recommended, but I'm wondering if this is meant to be: can there be more than one SSO objects? If so, perhaps the docs need updating.

docs, some examples missing TF resource internal '='

Might be something changed in newer versions of TF syntax, running v0.14.6 presently.

The OL provider docs and some example code are missing the required '=' when setting values inside a resource block. For example in onelogin_app.md:

resource onelogin_apps my_app {
...
  provisioning {
    enabled = false
  }

throws an error on terraform plan:

Error: Unsupported block type

  on onelogin-auth.tf line 19, in resource "onelogin_apps" "my_app":
  19:   provisioning {

Blocks of type "provisioning" are not expected here. Did you mean to define
argument "provisioning"? If so, use the equals sign to assign it a value.

The syntax should be

  provisioning = {
    enabled = false
  }

This issue+fix does not affect the provider's operation or functionality in any way.

OIDC App Missing post_logout_redirect_uri

looks like there is no option for post_logout_redirect_uri on the OIDC App
https://github.com/onelogin/terraform-provider-onelogin/blob/develop/docs/resources/onelogin_oidc_app.md

This caused me to accidentally blow away all our values on a dev server today. I noticed the OneLogin SDK for Go also doesn't support it yet so the SDK would likely need to be updated as well. https://github.com/onelogin/onelogin-go-sdk/blob/develop/pkg/services/apps/model.go#L61

onelogin_saml_apps missing fields available in the API

Hi, sorry if these have been asked/addressed somewhere else but I have spent some time searching through the issues and found nothing relevant.

I currently have some custom python written which I use to call the OneLogin API's to create my new application, which seems to work great (with the exception of setting "provisioning": { "enabled": True } in the payload.

I recently noticed that this Onelogin terraform provider existed and since I use terraform heavily for a number of other resources, I thought it was a no brainer to switch over to this. I have converted my working python, and while the majority of the app gets created with the correct parameters, I am missing a bunch of things that worked in the API.

A few of the fields I set in the API that aren't available in terraform, or simply do not work are:

• policy_id - (this is a policy that is used to 'Require OTP'). The API takes this in the root of the payload.
• tab_id - (this is the area/category that the item would show up in the UI). The API also takes this in the root of the payload.
• configuration.external_role - The API takes this in the configuration block of the payload.
• configuration.external_id - The API also takes this in the configuration block of the payload.
• configuration.certificate_id - Terraform seems to allow this as a field, and tries to set it, but never succeeds and always rolls back to my default, each time I see this in the logs (.configuration: element "certificate_id" has vanished)
• provisioning.enabled - Terraform seems to allow this as a field, and tries to set it, but never succeeds, each time I see this in the logs (.provisioning["enabled"]: was cty.True, but now cty.False)

Below is my code:

terraform {
  required_providers {
    onelogin = {
      source  = "onelogin/onelogin"
      version = "0.2.0"
    }
  }
}

provider "onelogin" {
  # Configuration options set as ENV vars
}


resource onelogin_saml_apps example_saml_app {
  visible = true
  connector_id = XXXXX
  description = "AWS - AccountAutomation"
  name = "AWS - AccountAutomation"
  notes = "AWS - AccountAutomation"
#   tab_id = "XXXXX" #"Computed attributes cannot be set"
#   policy_id = "XXXXX" #"Computed attributes cannot be set"

	parameters {
        param_key_name = "https://aws.amazon.com/SAML/Attributes/RoleSessionName"
		label = "RoleSessionName"
		provisioned_entitlements = false
		user_attribute_mappings = "email"
		values = null
		skip_if_blank = false
		attributes_transformations = "none"
		default_values = ""
		user_attribute_macros = null

		safe_entitlements_enabled = false
		include_in_saml_assertion = false
	}

      parameters {
		param_key_name = "https://aws.amazon.com/SAML/Attributes/Role"
		label = "Role"
		provisioned_entitlements = false
		user_attribute_mappings = "none"
		values = null
		skip_if_blank = false
		attributes_transformations = "amazon_roles"
		default_values = null
		user_attribute_macros = false

		include_in_saml_assertion = false
		safe_entitlements_enabled = false
	}

	parameters {
		param_key_name = "saml_username"
		label = "Amazon Username"
		provisioned_entitlements = false
		user_attribute_mappings = "email"
		values = null
		skip_if_blank = false
		attributes_transformations = "none"
		default_values = null
		user_attribute_macros = null

		include_in_saml_assertion = false
		safe_entitlements_enabled = false
	}

  configuration = {
    signature_algorithm = "SHA-256"
    idp_list = "arn:aws:iam::000000000000:saml-provider/SSO-OneLogin"
    certificate_id = XXXXX
  }

  provisioning = {
    enabled = "true"
  }
}


resource onelogin_app_role_attachments role_1 {
    app_id = onelogin_saml_apps.example_saml_app.id
    role_id = XXXXX
}

resource onelogin_app_role_attachments role_2 {
    app_id = onelogin_saml_apps.example_saml_app.id
    role_id = XXXXX

    depends_on = [
        onelogin_app_role_attachments.role_1 #Added due to race condition error when creating
  ]
}

inconsistent resource naming - singular v plural

There's a bit of inconsistency in if the resource name is singular onelogin_role or plural onelogin_roles.

The actual resource names appear to be the plural form. That is, in TF code we use onelogin_roles. However, the TOC on the left side refers to the resource in the singular, as do references in the test cases, ie:

base := GetFixture("onelogin_role_example.tf", t)
update := GetFixture("onelogin_role_updated_example.tf", t)

Glancing through the code, this applies to other OL resource types like oidc_apps as well.

Most likely someone started writing it one way and changed their mind later. I do that more than I care to admit. The singular resource form follows the convention of a (quick and non-scientific) sample of other providers' resources. IMHO, in most cases the singular form makes a bit more sense and reads clearer. In a given TF resource block, we're most often managing a single object, rather than many at once.

There are two different data sources, one singular data_source_onelogin_user and one plural data_source_onelogin_users. This makes complete sense - they're doing different things and returning different data types.

error - Missing required action attribute when running terraform apply

I picked up v0.1.20 and while it solves the problem of importing app_rules, there seems to have been a regression as I'm getting an error when I try to create a new app rule. The terraform apply works in v0.1.19

Here's my test project:

resource "onelogin_app_rules" "example" {
  app_id   = NNNNN
  #position = 10
  enabled  = true
  match    = "all"
  name     = "terraform-test"
  conditions {
    operator = "="
    source   = "email"
    value    = "[email protected]"

  }
  actions {
    action = "set_role_from_existing"
    value = [
      "arn:aws:iam::XXXXX:role/myrole"
    )
  }
}

Here's the run of terraform apply showing the error:

✗ terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # onelogin_app_rules.example will be created
  + resource "onelogin_app_rules" "example" {
      + app_id   = "NNNNN"
      + enabled  = true
      + id       = (known after apply)
      + match    = "all"
      + name     = "terraform-test"
      + position = (known after apply)

      + actions {
          + action = "set_role_from_existing"
          + value  = [
              + "arn:aws:iam::XXXXX:role/myrole",
            ]
        }

      + conditions {
          + operator = "="
          + source   = "email"
          + value    = "[email protected]"
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

onelogin_app_rules.example: Creating...
╷
│ Error: error: context: [ol http service], error_message: [{"code":422,"message":"Validation Failed","errors":[{"field":"actions","message":["Missing required action attribute"]}]}]
│
│   with onelogin_app_rules.example,
│   on onelogin.tf line 47, in resource "onelogin_app_rules" "example":
│   47: resource "onelogin_app_rules" "example" {
│
╵

Here's the terraform version info:

✗ terraform version
Terraform v0.15.3
on darwin_amd64
+ provider registry.terraform.io/onelogin/onelogin v0.1.20

Your version of Terraform is out of date! The latest version
is 1.0.0. You can update by downloading from https://www.terraform.io/downloads.html

Looks like there are some additional changes beyond the enhancement to app_rule imports --

https://github.com/onelogin/terraform-provider-onelogin/compare/v0.1.19...v0.1.20?w=1

Is this change causing issues? -- https://github.com/onelogin/terraform-provider-onelogin/pull/61/files

user_mapping 'position' var type

The resource onelogin_user_mappings requires the argument position with this explanation:

position - (Required) Indicates the ordering of the mapping. When null this will be placed last.

Internally, position is declared as a type schema.TypeInt. I don't know GO well enough yet to know for sure, but it seems like providing null for the value of position is a problem. When writing the resource argument this way position = null, Terraform (0.15.5) reports an error

Error: "position": required field is not set

Setting position to empty string or the string literal null is an error - not an int. The argument is required, so it can't be left out. Setting the position to an arbitrary value greater than the number of roles (ie 100) fails as well:

Error: error: context: [ol http service], error_message: [{"code":422,"message":"Validation Failed","errors":[{"field":"position","message":["Invalid position value: 100. Must be an integer between 1 and 57"]}]}]