When updating multiple okta_user_base_schema_property resources in one apply, only one base property is changed despite terraform returning success

[andrewlasal]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

3.31

Affected Resource(s)

• okta_user_base_schema_property

Terraform Configuration Files

data "okta_user_type" "user" {
  name = "user"
}

resource "okta_user_base_schema_property" "login" {
  index       = "login"
  title       = "Username"
  type        = "string"
  required    = true
  master      = "PROFILE_MASTER"
  user_type   = "${data.okta_user_type.user.id}"
  pattern     = ".+"
  permissions = "READ_ONLY"

}

resource "okta_user_base_schema_property" "firstname" {
  index       = "firstName"
  title       = "First name"
  type        = "string"
  required    = true
  master      = "PROFILE_MASTER"
  user_type   = "${data.okta_user_type.user.id}"
  permissions = "HIDE"
}

resource "okta_user_base_schema_property" "lastname" {
  index       = "lastName"
  title       = "Last name"
  type        = "string"
  required    = true
  master      = "PROFILE_MASTER"
  user_type   = "${data.okta_user_type.user.id}"
  permissions = "HIDE"
}

resource "okta_user_base_schema_property" "email" {
  index       = "email"
  title       = "Primary email"
  type        = "string"
  required    = true
  master      = "PROFILE_MASTER"
  user_type   = "${data.okta_user_type.user.id}"
  permissions = "HIDE"
}

resource "okta_user_base_schema_property" "mobilephone" {
  index       = "mobilePhone"
  title       = "Mobile phone"
  type        = "string"
  required    = true
  master      = "PROFILE_MASTER"
  user_type   = "${data.okta_user_type.user.id}"
  permissions = "HIDE"
}

Debug Output

Panic Output

Expected Behavior

All of the base properties permissions and masters should be updated accordingly
https://gyazo.com/fdfda5e644c3c02e76124f00564ec32f

Actual Behavior

Only one of the base properties actually gets updated, even though terraform says all of the changes were made
https://gyazo.com/8a3bcd105ceba237c65df6e597a6ba24
https://gyazo.com/5e1a1db5405b535ec87fc5884e1df0f3

Steps to Reproduce

1. Attempt to make changes to more than one base profile attribute during a single apply
2. terraform apply

Important Factoids

References

• #0000

[andrewlasal]

We noticed we were making the mobilePhone required and even after fixing that issue we're still only seeing one base attribute update per apply

[monde]

Thanks @andrewlasal , I'll have to look into this further.

[emanor-okta]

@andrewlasal - I think this is an issue with concurrent updates on the back-end.
Can you try running the plan/apply phases with -parallelism=1 to verify.

The API does appear to allow sending more than a single property in a single request, so maybe the resource could be updated to accept an array instead of making a separate resource definition for each property?

[monde]

Okta internal reference: https://oktainc.atlassian.net/browse/OKTA-520010

[johnnymongiat]

The -parallelism=1 workaround proposed by @emanor-okta worked.