Tag: access-token

This lab demonstrates how an Okta Token Inline Hook can work with Okta Workflows and Identity Governance to dynamically enrich OAuth tokens. During token issuance, the workflow evaluates the user, retrieves relevant entitlements and returns those values to Okta so they can be added as custom claims in the token. The project shows a practical approach to carrying authorization data directly inside the token for downstream applications.

Configure the Okta Workflows

Create a new flow using the API Endpoint event. This endpoint is called during token issuance and sends the request to the workflow for processing.

User Id> data.context.user.id

Call the Processing Flow

Add a Call Flow card to send the request to a child flow, where the token processing logic will be handled

Retrieve the User Entitlements

The child flow receives the User ID and queries Okta Identity Governance for the user’s effective entitlements in the target application.

Add card ‘Connected apps’ > Okta> Custom API Action

/governance/api/v1/principal-entitlements?
filter=parent.externalId eq “”
AND parent.type eq “APPLICATION”
AND targetPrincipal.externalId eq “”
AND targetPrincipal.type eq “OKTA_USER”

Extract the Entitlement Values

Processing the Governance response and preparing entitlement values for the token claim.

• Pluck — values
  Extracts the entitlement values from the API response.
• Flatten
  Combines the returned entitlement lists into a single list.
• Pluck — externalValue
  Extracts the actual entitlement value that will be used as a token claim.
• JSON Stringify
  Converts the entitlement list into JSON format.
• Return
  Returns the processed entitlement values to the parent flow.

Create the Token Inline Hook

Create a Token Inline Hook in Okta and configure it to call the API Endpoint URL from the Workflow.

Admin Console → Workflow → Inline Hooks → Add Inline Hook → Token

• URL : URL del Workflow
• Authentication: OAuth 2.0 or client token

Token Inline Hook configured to invoke the Okta Workflow during token issuance.

Enable the Inline Hook in the Authorization Server

Enable the Token Inline Hook in the Authorization Server policy rule that issues the access token. This causes Okta to call the Workflow before the token is returned.

Authorization Server policy/rule configured to invoke the Token Inline Hook during token issuance

Return Entitlements as a Token Claim

Use the child flow output to build the Inline Hook response. The entitlement values are returned to Okta and added to the token as a custom claim.

The Workflow returns the user’s effective entitlements to Okta for inclusion in the token.

{“commands”:[{“type”:”com.okta.access.patch”,”value”:[{“op”:”add”,”path”:”/claims/roles”,”value”:”<ENTITLEMENT>”}]}]}

Adds the user’s effective entitlements to the defined claim in the access token

This lab demonstrates how Okta Token Inline Hooks, Workflows, and Identity Governance can work together to enrich access tokens with entitlement data at issuance time. By adding trusted authorization context directly to the token, downstream applications can make access decisions without performing separate entitlement lookups.