Organization session and MFA policies

The keenauth_session_policy and keenauth_mfa_policy resources set an organization's own session lifetimes and multi-factor rules. An organization policy can only be stricter than the environment setting (keenauth_environment_settings). A looser value fails with 422 policy_weaker_than_parent.

resource "keenauth_session_policy" "acme" {
  organization_id   = keenauth_organization.acme.id
  idle_minutes      = 60
  absolute_minutes  = 720
  refresh_idle_days = 7
}

resource "keenauth_mfa_policy" "acme" {
  organization_id       = keenauth_organization.acme.id
  required_for          = "admins"
  allowed_factors       = ["webauthn", "totp"]
  enrollment_grace_days = 7
}

Session policy

Attribute	Range	Description
`idle_minutes`	5–144000	Session idle timeout. At most `absolute_minutes`.
`absolute_minutes`	60–525600	Absolute session lifetime.
`refresh_idle_days`	1–365	Refresh token idle lifetime. At most `refresh_absolute_days`.
`refresh_absolute_days`	1–365	Absolute refresh token lifetime.

Set at least one attribute. An attribute you leave out is inherited from the environment.
Shortening a lifetime ends the organization context of existing sessions.
The session policy needs the Enterprise plan (403 plan_feature_unavailable). It is open in development environments.

MFA policy

Attribute	Values	Description
`required_for`	`none`, `admins`, `all`	Who must use a second factor. `admins` covers organization administrator roles and members with `idp_` system permissions.
`allowed_factors`	`totp`, `webauthn`, `sms`, `email`	Second factors members may use. At least one; each must be enabled in the environment.
`enrollment_grace_days`	0–30	Days a member may sign in before enrolling a required factor. Defaults to `0`.

Lifecycle

An organization has one policy of each kind. The resource ID is the organization ID.
Every write sends the complete policy. A create does not overwrite an existing policy: if the organization already has one (set in the dashboard or the Admin Portal), the API answers 428 and you import it instead.
Updates and deletes send If-Match. A policy changed outside the provider shows up as drift in the next plan; a policy deleted outside the provider is created again.
Removing the resource deletes the policy, and the organization inherits the environment setting again.

Import

Import with the organization ID:

tofu import keenauth_session_policy.acme org_01j9zq3v8c5m2x7k4t6r1n0b3d
tofu import keenauth_mfa_policy.acme org_01j9zq3v8c5m2x7k4t6r1n0b3d