Inconsistent plan when enabling service account

[pths]

Hi,

We ran into the following issue when enabling and assigning roles to the service account of an existing openid client in the same execution:

Error: Provider produced inconsistent final plan

When expanding the plan for
keycloak_openid_client_service_account_role.client2_service_account_role to
include new values learned so far during apply, provider
"registry.terraform.io/mrparkers/keycloak" produced an invalid new value for
.service_account_user_id: was cty.StringVal(""), but now
cty.StringVal("f003cf56-6b6f-4b5c-b9c2-68d89e458799").

This is a bug in the provider, which should be reported in the provider's own
issue tracker.

To reproduce, first apply the following HCL:

data "keycloak_realm" "realm" {
  realm   = "master"
}

resource "keycloak_openid_client" "client1" {
  realm_id            = data.keycloak_realm.realm.id
  client_id           = "client1"
  access_type         = "BEARER-ONLY"
}

resource "keycloak_role" "client1_role" {
  realm_id    = data.keycloak_realm.realm.id
  client_id   = keycloak_openid_client.client1.id
  name        = "client1_role"
}

resource "keycloak_openid_client" "client2" {
  realm_id            = data.keycloak_realm.realm.id
  client_id           = "client2"

  access_type         = "CONFIDENTIAL"
  service_accounts_enabled = false
}

And then:

data "keycloak_realm" "realm" {
  realm   = "master"
}

resource "keycloak_openid_client" "client1" {
  realm_id            = data.keycloak_realm.realm.id
  client_id           = "client1"
  access_type         = "BEARER-ONLY"
}

resource "keycloak_role" "client1_role" {
  realm_id    = data.keycloak_realm.realm.id
  client_id   = keycloak_openid_client.client1.id
  name        = "client1_role"
}

resource "keycloak_openid_client" "client2" {
  realm_id            = data.keycloak_realm.realm.id
  client_id           = "client2"

  access_type         = "CONFIDENTIAL"
  service_accounts_enabled = true
}

resource "keycloak_openid_client_service_account_role" "client2_service_account_role" {
  realm_id                = data.keycloak_realm.realm.id
  service_account_user_id = keycloak_openid_client.client2.service_account_user_id
  client_id               = keycloak_openid_client.client1.id
  role                    = keycloak_role.client1_role.name
}

Note: the error doesn't occur if client2 and client2_service_account_role are created simultaneously.