okta_app_saml Read fails fatally on 404 from GetSAMLMetadata for apps where Okta is not the metadata publisher

[julian-brennan-ca]

Description

resourceAppSamlRead in okta/services/idaas/resource_okta_app_saml.go unconditionally fetches SAML metadata via GetSAMLMetadata for any active app with a signing key, and treats any error from that call as fatal:

https://github.com/okta/terraform-provider-okta/blob/v6.15.0/okta/services/idaas/resource_okta_app_saml.go#L535-L541

if app.Credentials.Signing.Kid != "" && app.Status != StatusInactive {
    keyID := app.Credentials.Signing.Kid
    _ = d.Set("key_id", keyID)
    keyMetadata, metadataRoot, err := getAPISupplementFromMetadata(meta).GetSAMLMetadata(ctx, d.Id(), keyID)
    if err != nil {
        return diag.Errorf("failed to get app's SAML metadata: %v", err)
    }
    ...

For App Catalog SAML apps where Okta is the Service Provider (not the IdP), or where the third-party app publishes its own metadata, GET /api/v1/apps/{id}/sso/saml/metadata legitimately returns 404. That's not an error condition for the app itself — the app is fine, it just doesn't have Okta-hosted IdP metadata to serve. The provider currently can't distinguish "app is broken" from "app doesn't publish this metadata," so every plan/apply/refresh against these apps fails outright.

Impact

• Apps in this category can never be imported into Terraform state (the same fatal Read runs immediately after import).
• Apps already in state that transiently hit this 404 force users to run every plan/apply with -refresh=false to avoid an unrelated apply failing.
• No schema attribute or provider config exists to opt out of the metadata fetch.

Confirmed still present in the latest release (v6.15.0) as of 2026-08.

Suggested fix

Treat a 404 from GetSAMLMetadata as "no metadata available" (skip setting metadata/metadata_url/entity_key/entity_url/certificate, log a warning) rather than a fatal error on Read. Only fail hard on non-404 errors.

Reproduction

Any okta_app_saml App Catalog integration where Okta acts as the Service Provider (e.g., third-party SAML apps like Slack, Optimizely, Canva, Docker Hub, AWS SSO, BambooHR, G Suite, Netskope, OpenVPN, Salesforce Sandbox integrations) will reproduce this on terraform import or on any plan/apply without -refresh=false.