Determining a user's sign-in geographical location in Okta Workflows requires extracting geolocation data from the sign-in event. Administrators retrieve this information by using the Okta User Sign In Attempt event card and parsing the event details with a Get Multiple card. This process enables the creation of automated flows that trigger notifications based on specific sign-in locations.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Workflows

How is the user sign-in location determined from the Okta - User Sign in Attempt card?

When using the Okta – User Sign In Attempt event card, the event contains information about the user’s geolocation.

View the geolocation information within the event details of the user sign-in attempt card.
   

The Event Details JSON section has information that also includes the geolocation information. 

To retrieve the location information, use the Get Multiple card with the client.geographicalContext path. 

For example, if a user signs in from San Diego, the JSON might look like this: 

{
  "city": "San Diego",
  "state": "California",
  "country": "United States",
  "postalCode": "92014",
  "geolocation": {
    "lat": 32.7157,
    "lon": -117.1610
  }
}

The other path in the Get Multiple card (the client.outcome) holds information on whether the sign-in was successful or not. 

JSON from a failed sign-in:

{
  "result": "FAILURE",
  "reason": "INVALID_CREDENTIALS"
}

JSON from a successful sign-in:

{"result":"SUCCESS"}

This section demonstrates how to build a flow that sends a notification when a user signs in from a particular country.

Configure a Flow to Send a Sign-In Notification Based on Location

Administrators update the flow to receive a notification when a sign-in occurs from a specific country. Okta Workflows sends a notification when a user signs in from a country listed in the Workflows table.

Review the following example of a country table used in Okta Workflows.

Review the following example of a complete flow designed to extract the location when a sign-in happens, and continue only when it is from a specific country from the table.

The flow has the following cards: 

1. The User Sign In Attempt event card fires when a user attempts a sign-in.
2. The Get Multiple card retrieves country and sign-in outcome information. The card is updated to retrieve the country name and sign-in outcome directly (in the first section, the JSON was retrieved). Paths to retrieve the exact values: 
   • client.geographicalContext.country
   • outcome.result
3. The Search Rows card searches if a country from which a sign-in happened matches a country listed in the table.

4. The first Continue If card checks if a country was matched. If yes, the flow continues.
5. The second Continue If card checks if a sign-in was successful. If yes, the flow continues.
6. The Compose card creates a message with sign-in information that can be sent to Slack, email, or SMS.

Related References

• Okta Workflows How-To: Determine User Sign-In Location