okta_policy_mfa is ignoring yubikey_token

[rajnadimpalli]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Affected Resource(s)

• okta_policy_mfa

Terraform Configuration Files

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key: https://keybase.io/hashicorp

resource "okta_policy_mfa" "testmfa_policy2" {
    is_oie          = true
    name            = "testmfa_policy2"
    description     = null
    google_otp      = {
        "enroll" = "NOT_ALLOWED"
    }
    groups_included = [
        "00ga23w8kfUVpHmUb1d7",
    ]

    okta_email      = {
        "enroll" = "NOT_ALLOWED"
    }
    okta_password   = {
        "enroll" = "REQUIRED"
    }
    yubikey_token   = {
        "enroll" = "OPTIONAL"
    }
    okta_verify     = {
        "enroll" = "NOT_ALLOWED"
    }
    phone_number    = {
        "enroll" = "NOT_ALLOWED"
    }
    priority        = 17
    status          = "ACTIVE"
    webauthn        = {
        "constraints" = "ANY"
        "enroll"      = "OPTIONAL"
    }
}

Debug Output

Panic Output

Expected Behavior

Yubikey should be enabled on the policy

Can this be done in the Admin UI? Yes

Can this be done in the actual API call? Yes

Actual Behavior

Yubikey is not enable on the policy

Steps to Reproduce

1. Create a terraform resource. Sample policy below:
   `resource "okta_policy_mfa" "testmfa_policy2" {
   is_oie = true
   name = "testmfa_policy2"
   description = null
   google_otp = {
   "enroll" = "NOT_ALLOWED"
   }
   groups_included = [
   "00ga23w8kfUVpHmUb1d7",
   ]

   okta_email = {
   "enroll" = "NOT_ALLOWED"
   }
   okta_password = {
   "enroll" = "REQUIRED"
   }
   yubikey_token = {
   "enroll" = "OPTIONAL"
   }
   okta_verify = {
   "enroll" = "NOT_ALLOWED"
   }
   phone_number = {
   "enroll" = "NOT_ALLOWED"
   }
   priority = 17
   status = "ACTIVE"
   webauthn = {
   "constraints" = "ANY"
   "enroll" = "OPTIONAL"
   }
   }`

2. Run terraform apply

3. Notice that yubikey is not enabled on the policy on Okta

Important Factoids

References

• #0000

[duytiennguyen-okta]

OKTA internal reference https://oktainc.atlassian.net/browse/OKTA-832972