resource_group_rule: in case expression is changed on ACTIVE rule, de…

…activate it prior to changing.

examples/okta_group_rule/basic_updated.tf

@@ -7,5 +7,5 @@ resource "okta_group_rule" "test" {
   status            = "ACTIVE"
   group_assignments = ["${okta_group.test_other.id}"]
   expression_type   = "urn:okta:expression:1.0"
-  expression_value  = "String.startsWith(user.articulateId,\"auth0|\")"
+  expression_value  = "String.startsWith(user.articulateId,String.toLowerCase(\"auth0|\"))"
 }

okta/resource_group_rule.go

@@ -1,7 +1,6 @@
 package okta
 
 import (
-	"errors"
 	"net/http"
 
 	"github.com/okta/okta-sdk-golang/okta"
@@ -129,15 +128,25 @@ func resourceGroupRuleUpdate(d *schema.ResourceData, m interface{}) error {
 	}
 
 	if hasGroupRuleChange(d) {
+		client := getOktaClientFromMetadata(m)
+		rule := buildGroupRule(d)
+
 		if status == "ACTIVE" {
-			return errors.New("an active rule cannot be modified, set status to INACTIVE with any other changes")
+			// Only inactive rules can be changed, thus we should deactivate the rule in case it was "ACTIVE"
+			_, err := client.Group.DeactivateRule(d.Id())
+			return err
 		}
 
-		rule := buildGroupRule(d)
-		_, _, err := getOktaClientFromMetadata(m).Group.UpdateRule(d.Id(), *rule)
+		_, _, err := client.Group.UpdateRule(d.Id(), *rule)
 		if err != nil {
 			return err
 		}
+
+		if status == "ACTIVE" {
+			// We should reactivate the rule in case it was deactivated.
+			_, err := client.Group.ActivateRule(d.Id())
+			return err
+		}
 	}
 
 	return resourceGroupRuleRead(d, m)