Download the PHP package dragosgaftoneanu/okta-hooks-php without Composer

Okta Hooks PHP

This repository contains the source for the Okta Hooks PHP library that can be used for integrating the new Okta Hooks feature inside your PHP application.

:warning: Disclaimer: This is not an official product and does not qualify for Okta Support.

Installation

You can install this library by running the following command through Composer

Requirements

• An Okta account, called an organization (you can sign up for a free developer organization)
• A local web server that runs PHP 5.0+
• getallheaders() function available for usage
• The following features enabled on your Okta organization (you can request them through an email to [email protected])
  • Event Hook: CALLBACKS, WEBHOOKS
  • Token Inline Hook: CALLBACKS, API_ACCESS_MANAGEMENT_EXTENSIBILITY
  • Import Inline Hook: CALLBACKS, IMPORT_SYNC_CALLBACKS
  • SAML Assertion Inline Hook: CALLBACKS, SAML_EXTENSIBILITY
  • Registration Inline Hook: CALLBACKS
  • Password Import Inline Hook: CALLBACKS

Table of Contents

• Event Hook
  • Methods available
    • getRaw()
    • oneTimeVerification()
    • display()
  • Example
• Token Inline Hook
  • Methods available
    • getRaw()
    • addAccessTokenClaim($name, $value)
    • modifyAccessTokenClaim($name, $value)
    • removeAccessTokenClaim($name)
    • modifyAccessTokenLifetime($value)
    • addIDTokenClaim($name, $value)
    • modifyIDTokenClaim($name, $value)
    • removeIDTokenClaim($name)
    • modifyIDTokenLifetime($value)
    • display()
  • Example
• Import Inline Hook
  • Methods available
    • getRaw()
    • updateAppProfile($attribute, $value)
    • updateProfile($attribute, $value)
    • action($status)
    • linkWith($user)
    • display()
  • Example
• SAML Assertion Inline Hook
  • Methods available
    • getRaw()
    • addClaim($name, $nameFormat, $xsiType, $value)
    • modifyClaim($name, $newValue)
    • modifyAssertion($path, $newValue)
    • display()
  • Example
• Registration Inline Hook
  • Methods available
    • getRaw()
    • changeProfileAttribute($attribute, $value)
    • allowUser($status)
    • display()
    • error($message, $errorCode, $reason, $locationType, $location, $domain)
  • Example
• Password Import Inline Hook
  • Methods available
    • getRaw()
    • getCredentials()
    • allow()
    • deny()
  • Example

Event Hook

Methods available

You can find below the methods implemented for the class in order to successfully execute the hook.

getRaw()

This method returns the full request coming from Okta as an array.

oneTimeVerification()

This method checks for X-Okta-Verification-Challenge header in the request and replies with the verification JSON in order to complete the verification step for Okta.

display()

This method displays the final response to the request coming from Okta.

Example

You can find below an example script for verifying an event hook.

The answer that the library will return will look like the following.

Token Inline Hook

Methods available

You can find below the methods implemented for the class in order to successfully execute the hook.

getRaw()

This method returns the full request coming from Okta as an array.

addAccessTokenClaim($name, $value)

This method tells Okta to add a claim inside the access token that will be returned.

modifyAccessTokenClaim($name, $value)

This method tells Okta to modify a claim inside the access token that will be returned with a new value.

removeAccessTokenClaim($name)

This method tells Okta to remove a claim inside the access token that will be returned.

modifyAccessTokenLifetime($value)

This method tells Okta to modify the access token's lifetime. The token can have a lifetime of minimum 5 minutes (300 seconds) and a maximum of 24 hours (86400 seconds).

addIDTokenClaim($name, $value)

This method tells Okta to add a claim inside the ID token that will be returned.

modifyIDTokenClaim($name, $value)

This method tells Okta to modify a claim inside the ID token that will be returned with a new value.

removeIDTokenClaim($name)

This method tells Okta to remove a claim inside the ID token that will be returned.

modifyIDTokenLifetime($value)

This method tells Okta to modify the ID token's lifetime. The token can have a lifetime of minimum 5 minutes (300 seconds) and a maximum of 24 hours (86400 seconds).

display()

This method displays the final response to the request coming from Okta.

Example

You can find below an example script for adding a new claim inside an ID token, modifying an ID token's lifetime expiration to 1 day and changing an access token's audience.

The answer that the library will return is the following.

Import Inline Hook

Methods available

You can find below the methods implemented for the class in order to successfully execute the hook.

getRaw()

This method returns the full request coming from Okta as an array.

updateAppProfile($attribute, $value)

This method tells Okta to update a profile attribute from the ones available under data.appUser in the request coming from Okta.

updateProfile($attribute, $value)

This method tells Okta to update a profile attribute from the ones available under data.user in the request coming from Okta.

action($status)

This method tells Okta for the current imported user to either create it as a new user inside of Okta ($status = "create";) or to link it with an existing one ($status = "link";).

linkWith($user)

If action is set to link the user with an existing one, with this method you can mention the user ID with which the current imported user will be linked.

display()

This method displays the final response to the request coming from Okta.

Example

You can find below an example script for modifying the first name and last name for both user profile and app user profile and to link the user with an existing Okta user that has user ID set to 00uozbgc03wzqoaXp2p6.

The answer that the library will return is the following.

SAML Assertion Inline Hook

Methods available

You can find below the methods implemented for the class in order to successfully execute the hook.

getRaw()

This method returns the full request coming from Okta as an array.

addClaim($name, $nameFormat, $xsiType, $value)

This method tells Okta to add a claim inside the assertion.

modifyClaim($name, $newValue)

This method tells Okta to modify a specific claim value inside the assertion.

modifyAssertion($path, $newValue)

This method tells Okta to modify a specific value inside the assertion.

display()

This method displays the final response to the request coming from Okta.

Example

You can find below an example script for adding a new claim inside the assertion.

The answer that the library will return is the following.

Registration Inline Hook

Methods available

You can find below the methods implemented for the class in order to successfully execute the hook.

getRaw()

This method returns the full request coming from Okta as an array.

changeProfileAttribute($attribute, $value)

This method tells Okta to update a profile attribute from the ones available under data.user.profile in the request coming from Okta.

allowUser($status)

This method tells Okta to either allow the user to be registered ($status = TRUE;) or not ($status = FALSE;).

display()

This method displays the final response to the request coming from Okta.

error($message, $errorCode, $reason, $locationType, $location, $domain)

This method displays an error message for the end-user upon registration, as exemplified in the documentation here.

Example

You can find below an example script for modifying the first name and last name for user profile and then block the user.

The answer that the library will return is the following.

Password Import Inline Hook

Methods available

You can find below the methods implemented for the class in order to successfully execute the hook.

getRaw()

This method returns the full request coming from Okta as an array.

getCredentials()

This method returns data.context.credential from the request coming from Okta as an array.

allow()

This method displays a VERIFIED response that will tell Okta that the credentials are correct and allow the user to authenticate.

deny()

This method displays an UNVERIFIED response that will tell Okta that the credentials are incorrect and will not allow the user to authenticate.

Example

You can find below an example script for checking the username and a password received from Okta and allowing the request if they contain specific values.

The answer that the library will return is the following.

Bugs?

If you find a bug or encounter an issue when using the library, please open an issue on GitHub here and it will be further investigated.