0.37.6 harness_platform_usergroup SAML regression

[markdiuk]

When running via 0.37.6 all users are dropped from the harness_platform_usergroup when using SAML

resource "harness_platform_usergroup" "these" {
  for_each    = toset(var.teams)
  name        = each.key
  identifier  = replace(each.key, "-", "_")
  description = "${each.key} SAML linked group"

  externally_managed = false

  linked_sso_id           = var.linked_sso_id
  linked_sso_display_name = var.linked_sso_display_name
  linked_sso_type         = "SAML"
  sso_group_id            = each.key
  sso_group_name          = each.key
  sso_linked              = true
}

Refusing 0.37.6 fixes the issue

harness = {
      source  = "harness/harness"
      version = "~> 0.37.5, !=0.37.6"
}

[abhishekdas06]

@markdiuk Can you share the logs for the same? The resource/terraform commands specifically plan and apply and the diff which you are seeing?

[markdiuk]

Hi @abhishekdas06, the diff is as follows -:

This is running via Terraform Cloud

Terraform v1.10.5
on linux_amd64

no-op id : "id"
no-op name : "name"
no-op tags : [ ]
update users :
[
delete "-xq_id"
delete "-xq_id"
...
delete "-xq_id"
]

{"@level":"info","@message":"module.tenant.module.harness_groups_role_assignments.harness_platform_usergroup.these[\"name\"]: Drift detected (update)","@module":"terraform.ui","@timestamp":"2025-07-17T08:37:45.522415Z","change":{"resource":{"addr":"module.tenant.module.harness_groups_role_assignments.harness_platform_usergroup.these[\"name\"]","module":"module.tenant.module.harness_groups_role_assignments","resource":"harness_platform_usergroup.these[\"name\"]","implied_provider":"harness","resource_type":"harness_platform_usergroup","resource_name":"these","resource_key":"name"},"action":"update"},"type":"resource_drift"}

[imrantechwiz]

Hey @markdiuk -- i have validated this change and no users will actually be removed from the user group, so there is no impact.

We are planning a fix to address this discrepancy in an upcoming release.

[abhishekdas06]

Mentioning the behaviour in detail:
Before v0.37.6, for ssoLinked user groups we were setting the field "users" is empty. This is for when we are doing a read operation i.e on running terraform plan command.

After v0.37.6, a change was introduced where field "users_email" would get populated even if it isSSOLinked when running the terraform plan command.

So if an import of userGroup was done using version < 0.37.6 and then upgraded to version 0.37.6, the plan would show removal of user_emails field as part of the response. However, on doing apply it wouldn't actually alter anything as no users will be removed from user-group. This is only a read-discrepancy.

Fixing it as part of the below PR: #1282

Have validated the case where user-group was imported using version < 0.37.6 and then running terraform plan with the above PR changes shows no changes