# Plugin Framework State upgraders

**URL:** <https://discuss.hashicorp.com/t/plugin-framework-state-upgraders/47699>\
**Category:** Plugin Development\
**Created:** [December 6, 2022, 8:29pm UTC](https://discuss.hashicorp.com/t/plugin-framework-state-upgraders/47699 "2022-12-06T20:29:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![iwarapter](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/iwarapter/32/3316_2.png) [@iwarapter](https://discuss.hashicorp.com/u/iwarapter)\
**Post date:** [December 6, 2022, 8:29pm UTC](https://discuss.hashicorp.com/t/plugin-framework-state-upgraders/47699/1 "2022-12-06T20:29:03Z")

</div>

I have a state upgrader which is converting from an sdkv2 provider with repeated blocks to a framework (v0.17.0) with nested attributes.

It works for the most part however I am seeing weird behaviour where it marks the nested attribute itself as changed but with no explicit changes.

Is there a way I can configure the test framework to tell me specifically what is different?

```auto
 ~ resource "pingfederate_oauth_authentication_policy_contract_mapping" "test" {
                id = "lG2s4menuXtZ7Wno"
              ~ issuance_criteria = {
                  ~ conditional_criteria = [
                      ~ {
                            # (4 unchanged attributes hidden)
                        },
                    ]
                  ~ expression_criteria = [
                      ~ {
                            # (1 unchanged attribute hidden)
                        },
                        # (1 unchanged element hidden)
                    ]
                }
              ~ ldap_attribute_sources = [
                  ~ {
                        id = "ldap"
                        # (5 unchanged attributes hidden)
                    },
                ]
                # (3 unchanged attributes hidden)
            }

```

SDKv2

```auto
resource "pingfederate_oauth_authentication_policy_contract_mapping" "test" {
  authentication_policy_contract_ref {
    id = pingfederate_authentication_policy_contract.demo.id
  }
  attribute_contract_fulfillment {
    key_name = "USER_NAME"
    source {
      type = "AUTHENTICATION_POLICY_CONTRACT"
    }
    value = "subject"
  }
  attribute_contract_fulfillment {
    key_name = "USER_KEY"
    source {
      type = "AUTHENTICATION_POLICY_CONTRACT"
    }
    value = "subject"
  }
  ldap_attribute_source {
    description = "desc"
    id = "ldap"
    member_of_nested_group = false
    search_filter = "uid=$${subject}"
    search_scope = "SUBTREE"

    data_store_ref {
      id = pingfederate_ldap_data_store.example.id
    }
  }
  jdbc_attribute_source {
    description = "jdbc"
    filter = "uid=$${email}"
    id = "jdbc"
    schema = "INFORMATION_SCHEMA"
    table = "ADMINISTRABLE_ROLE_AUTHORIZATIONS"

    data_store_ref {
      id = "ProvisionerDS"
    }
  }

  issuance_criteria {
    conditional_criteria {
      attribute_name = "Subject DN"
      condition = "EQUALS"
      value = "foo"

      source {
        id = "ldap"
        type = "LDAP_DATA_STORE"
      }
    }
    expression_criteria {
      expression = "far"
    }
    expression_criteria {
      error_result = "woot"
      expression = "bar"
    }
  }
}

```

Framework

```auto
resource "pingfederate_oauth_authentication_policy_contract_mapping" "test" {
  authentication_policy_contract_ref = pingfederate_authentication_policy_contract.demo.id
  attribute_contract_fulfillment = {
    "USER_NAME" = {
      source = {
        type = "AUTHENTICATION_POLICY_CONTRACT"
      }
      value = "subject"
    },
    "USER_KEY" = {
      source = {
        type = "AUTHENTICATION_POLICY_CONTRACT"
      }
      value = "subject"
    }
  }
  jdbc_attribute_sources = [{
    description = "jdbc"
    filter = "uid=$${email}"
    id = "jdbc"
    schema = "INFORMATION_SCHEMA"
    table = "ADMINISTRABLE_ROLE_AUTHORIZATIONS"
    data_store_ref = "ProvisionerDS"
  }]
  ldap_attribute_sources = [{
    description = "desc"
    id = "ldap"
    member_of_nested_group = false
    search_filter = "uid=$${subject}"
    search_scope = "SUBTREE"
    data_store_ref = pingfederate_ldap_data_store.example.id
  }]

  issuance_criteria = {
    conditional_criteria = [{
      attribute_name = "Subject DN"
      condition = "EQUALS"
      value = "foo"

      source = {
        id = "ldap"
        type = "LDAP_DATA_STORE"
      }
    }]
    expression_criteria = [{
      expression = "far"
      },
      {
        error_result = "woot"
        expression = "bar"
    }]
  }
}

```

---

<div class="post-metadata">

**Author:** ![iwarapter](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/iwarapter/32/3316_2.png) [@iwarapter](https://discuss.hashicorp.com/u/iwarapter)\
**Post date:** [December 8, 2022, 6:31pm UTC](https://discuss.hashicorp.com/t/plugin-framework-state-upgraders/47699/2 "2022-12-08T18:31:51Z")

</div>

If anyone else comes across something like this, I found my issue, I was missing some defaults which would cause the apply to fail later on. The plan was just misleading.

```auto
╷
│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to pingfederate_oauth_authentication_policy_contract_mapping.test, provider "provider[\"registry.terraform.io/iwarapter/pingfederate\"]" produced an unexpected new value: .issuance_criteria.expression_criteria[0].error_result: was
│ null, but now cty.StringVal("").

```

---

<div class="post-metadata">

**Author:** ![bflad](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/bflad/32/922_2.png) [@bflad](https://discuss.hashicorp.com/u/bflad)\
**Post date:** [December 14, 2022, 8:10pm UTC](https://discuss.hashicorp.com/t/plugin-framework-state-upgraders/47699/3 "2022-12-14T20:10:19Z")

</div>

Please note that issues with the plan output missing value differences with framework-based providers can be submitted into the [Terraform core issue tracker](https://github.com/hashicorp/terraform/issues) for resolution. One such case, which seems related to the fix mentioned here, is [CLI Plan Output Not Showing null to "" Differences for Non-Legacy Type System Providers · Issue #31887 · hashicorp/terraform · GitHub](https://github.com/hashicorp/terraform/issues/31887).