JoeL.04696 (Customer) asked a question.
Hi all,
I have an OpenLDAP <-> Okta setup which is working well, LDAP delegated authentication is in use for users signing in.
I would like to setup an event hook which fires when user profile data is updated in OpenLDAP, the idea being that Okta will perform an event hook POST to my application endpoint when this event occurs enabling me to handle refresh token revocation, forcing user sessions to expire.
So far I've setup an event hook for this purpose and Okta has successfully performed it's one time verification request to my application endpoint.
The problem I've encountered is that no automated event hook POST request is performed when user profile data is updated in LDAP, changes made in LDAP are reflected in near real in an Okta user profile but no event hook POST is received for the change.
Following the https://developer.okta.com/docs/reference/api/event-types/?q=event-hook-eligible docs, it looks like the best event to subscribe to might be the user.account.update_profile event but that doesn't appear to work.
Does anyone have any ideas how I might get this working? Is it possible?
Many thanks, Joe
More to add now.
The system log shows that the hook appears to be working albeit intermittently for some account updates that are applied in OpenLDAP and those events are being logged as:
Event Hook Delivery Failed failure: Exceeded maximum retry limit of 2
There's nothing useful in the system log identifying why these failures occur and no sign of the receiving side having received any HTTP POST requests.
If I look in the hook preview view, I am able to see the requests that are reported as failed in the system log and I'm also able to manually push a HTTP POST request from that view with the Deliver Request button which does perform a HTTP POST request as expected and which is received by the listening side as expected.
There's something very odd going on with this feature and I won't be able to debug this without Okta side support. I'm going to raise a case and I'll point the case at this question/post.
@JoeL.04696 (Customer) Little technical detail and commentary which may help:
1) As indicated in your original post there are eligible event hooks:
https://developer.okta.com/docs/reference/api/event-types/?q=event-hook-eligible
These are specific okta events (that you can search for / view) in the system log. When a hook is configured for a specific event a new "debug" object will show in the system log called (TargetEventHookID). If that is not present there was not hook monitoring the event.
2) Event hooks will attempt to deliver to an endpoint at least once. The system logs do not record any successful deliveries. However, it will display failure attempts and if I recall it should also provide the returned error from the endpoint (assuming client error).
3) There is a default timeout of 3 seconds on EventHooks. If your custom endpoint is unable to accept the entirety of the payload and return a response in that time frame the delivery will fail.
4) If multiple events of the same type occur at around the same time the events may be batched together into a single payload. I could easily see a custom endpoint being designed to receive a single event payload incorrectly handling a batched payload. Something like a 400 would be pretty feasible.
A final note: The Workflows product that this "Question" is categorized under (yes, I realize there is no specific category for Hooks) heavily leverages event hooks to start Flo's. This functionality most certainly works.