Would be nice to have a sample code as a use case to pull custom okta user attributes about okta-sdk-python

[serhiibuniak-okta]

Hi @njonesuser. If I understand this sample correctly, you want to access attributes of OKTA user model through Flask-oidc user model? If it is correct, I can suggest write a bit complicated custom flask user model or get okta user manually via API, because these models represent different entities. Let me know if it works for you and I'll be able to help you in achieving this goal.

[serhiibuniak-okta]

I've investigated a bit more and it looks like you're trying to get okta user via okta_client.get_user. This method is asynchronous, thus we need to add some wrapper to get user:

import asyncio

# loop should be global as only one event loop is allowed
loop = asyncio.get_event_loop()

# modified before_request function
@app.before_request
def before_request():
    g.user = None
    if oidc.user_loggedin:
        res, resp, err = loop.run_until_complete(okta_client.get_user(oidc.user_getfield("sub")))
        if not err:
            g.user = res
            
            # then we can access different user attributes from OKTA model
            print(g.user.id)
            print(g.user.profile.first_name)

Please, let us know if it helps.

[njonesuser]

Hi Serhii, I can't use API because our license doesn't allow us to map claims. Right now I am getting 'sub', 'name' and 'email' attributes only using OpenIDConnect user_getinfo() methode. Prior to that, I have used the code provided as a sample. When I have looked at the okta-sdk-python okta package, I realized that it's been updated back in December to allow custom attributes to be reached. Let me know if it all makes sense. Thanks, Nina Jones

…

_______________________________ From: Serhii Buniak <[email protected]> Sent: Wednesday, February 24, 2021 2:20 AM To: okta/okta-sdk-python <[email protected]> Cc: Nina Jones <[email protected]>; Mention <[email protected]> Subject: Re: [okta/okta-sdk-python] Would be nice to have a sample code as a use case to pull custom okta user attributes (#170) EXTERNAL EMAIL: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and expect that the content is safe. If you received or responded to a potentially unsafe email, report it immediately to [email protected]<mailto:[email protected]?subject=FRAUD%20ALERT%20-%20Suspicious%20Email&body=Please%20drag%20and%20drop%20a%20copy%20of%20the%20suspicious%20email%20here%20to%20attach%20it.>. Hi @njonesuser<https://github.com/njonesuser>. If I understand this sample correctly, you want to access attributes of OKTA user model through Flask-oidc user model? If it is correct, I can suggest write a bit complicated custom flask user model or get okta user manually via API, because these models represent different entities. Let me know if it works for you and I'll be able to help you in achieving this goal. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#170 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AS636QXYEKQC443TJTUHA4TTASZFJANCNFSM4YDHNURQ>.

[njonesuser]

I will give it a try. Thanks a lot.

[serhiibuniak-okta]

Hi Nina,

Now things became more complicated.
Correct me if I'm wrong: you want to access custom attributes of OKTA user model, but you can't map claims from oidc (jwt token) to real user represented by OKTA user model? In the other words, you want to get them via OpenIDConnect user_getinfo() method, and don't use okta_client.get_user(oidc.user_getfield("sub"))?
In this case, you have to incorporate custom attributes into jwt token, see docs:
https://support.okta.com/help/s/article/How-to-add-custom-attributes-of-user-profile-as-claims-in-token?language=en_US
https://developer.okta.com/docs/guides/customize-tokens-returned-from-okta/add-custom-claim/
Let me know if it works for you.

[njonesuser]

What is the path to import UserClient? Nina Jones

…

_______________________________ From: Nina Jones <[email protected]> Sent: Wednesday, February 24, 2021 9:23 AM To: okta/okta-sdk-python <[email protected]> Subject: Re: [okta/okta-sdk-python] Would be nice to have a sample code as a use case to pull custom okta user attributes (#170) Hi Serhii, I can't use API because our license doesn't allow us to map claims. Right now I am getting 'sub', 'name' and 'email' attributes only using OpenIDConnect user_getinfo() methode. Prior to that, I have used the code provided as a sample. When I have looked at the okta-sdk-python okta package, I realized that it's been updated back in December to allow custom attributes to be reached. Let me know if it all makes sense. Thanks, Nina Jones Business Intelligence Developer Methode Electronics, Inc 8750 W. Bryn Mawr Ave 10TH floor. Chicago, IL, 60631 [phone]

________________________________ From: Serhii Buniak <[email protected]> Sent: Wednesday, February 24, 2021 2:20 AM To: okta/okta-sdk-python <[email protected]> Cc: Nina Jones <[email protected]>; Mention <[email protected]> Subject: Re: [okta/okta-sdk-python] Would be nice to have a sample code as a use case to pull custom okta user attributes (#170) EXTERNAL EMAIL: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and expect that the content is safe. If you received or responded to a potentially unsafe email, report it immediately to [email protected]<mailto:[email protected]?subject=FRAUD%20ALERT%20-%20Suspicious%20Email&body=Please%20drag%20and%20drop%20a%20copy%20of%20the%20suspicious%20email%20here%20to%20attach%20it.>. Hi @njonesuser<https://github.com/njonesuser>. If I understand this sample correctly, you want to access attributes of OKTA user model through Flask-oidc user model? If it is correct, I can suggest write a bit complicated custom flask user model or get okta user manually via API, because these models represent different entities. Let me know if it works for you and I'll be able to help you in achieving this goal. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#170 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AS636QXYEKQC443TJTUHA4TTASZFJANCNFSM4YDHNURQ>.

[serhiibuniak-okta]

I'm not sure if I got it, but we have UserClient accessible from okta.client:

from okta.client import UserClient

Or full path:

from okta.resource_clients.user_client import UserClient

[njonesuser]

Serhii, Figured out the path. Now I get this error: [cgid:error] [pid 2764217:tid 139636466759424] [client 10.50.184.87:52648] request, error = await self._request_executor.create_request(: /var/www/html/okta-example/index.cgi, referer: http://usil02-bidev03/okta-example/index.cgi/login?iss=https%3A%2F%2Fdev-320326.okta.com[Wed Feb 24 11:34:13.727775 2021] [cgid:error] [pid 2764217:tid 139636466759424] [client 10.50.184.87:52648] AttributeError: 'UserClient' object has no attribute '_request_executor': /var/www/html/okta-example/index.cgi, referer: http://usil02-bidev03/okta-example/index.cgi/login?iss=https%3A%2F%2Fdev-320326.okta.com Nina Jones

…

___ From: Nina Jones <[email protected]> Sent: Wednesday, February 24, 2021 11:33 AM To: okta/okta-sdk-python <[email protected]> Subject: Re: [okta/okta-sdk-python] Would be nice to have a sample code as a use case to pull custom okta user attributes (#170) What is the path to import UserClient? Nina Jones

_______________________________ From: Nina Jones <[email protected]> Sent: Wednesday, February 24, 2021 9:23 AM To: okta/okta-sdk-python <[email protected]> Subject: Re: [okta/okta-sdk-python] Would be nice to have a sample code as a use case to pull custom okta user attributes (#170) Hi Serhii, I can't use API because our license doesn't allow us to map claims. Right now I am getting 'sub', 'name' and 'email' attributes only using OpenIDConnect user_getinfo() methode. Prior to that, I have used the code provided as a sample. When I have looked at the okta-sdk-python okta package, I realized that it's been updated back in December to allow custom attributes to be reached. Let me know if it all makes sense. Thanks, Nina Jones

______________________________ From: Serhii Buniak <[email protected]> Sent: Wednesday, February 24, 2021 2:20 AM To: okta/okta-sdk-python <[email protected]> Cc: Nina Jones <[email protected]>; Mention <[email protected]> Subject: Re: [okta/okta-sdk-python] Would be nice to have a sample code as a use case to pull custom okta user attributes (#170) EXTERNAL EMAIL: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and expect that the content is safe. If you received or responded to a potentially unsafe email, report it immediately to [email protected]<mailto:[email protected]?subject=FRAUD%20ALERT%20-%20Suspicious%20Email&body=Please%20drag%20and%20drop%20a%20copy%20of%20the%20suspicious%20email%20here%20to%20attach%20it.>. Hi @njonesuser<https://github.com/njonesuser>. If I understand this sample correctly, you want to access attributes of OKTA user model through Flask-oidc user model? If it is correct, I can suggest write a bit complicated custom flask user model or get okta user manually via API, because these models represent different entities. Let me know if it works for you and I'll be able to help you in achieving this goal. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#170 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AS636QXYEKQC443TJTUHA4TTASZFJANCNFSM4YDHNURQ>.

[serhiibuniak-okta]

Nina, could you please share some code or explain what're you want to achieve?
For any requests we use class Client, which inherits from many classes including UserClient, but additionally class Client has request_executor and all other stuff needed to perform requests. In other words, if you want to execute method "UserClient.list_users", you need to execute "Client.list_users"

[njonesuser]

I only need to execute UserClient.get_user. I have a user logged in my Flask app. In order to control access to some pages in the app, I need to get a value for the custom attribute that was added to the user's profile in Okta by the admin.

[serhiibuniak-okta]

You need to execute Client.get_user, that's how it works.

[njonesuser]

Where do I import Client from?

[njonesuser]

And what should I pass to Client as user_config: dict = {}

[serhiibuniak-okta]

From README (https://github.com/okta/okta-sdk-python):

from okta.client import Client as OktaClient

client = OktaClient({'orgUrl': 'https://{yourOktaDomain}', 'token': '{yourAPIToken}'})

Then you will be able to execute

# user_id you can get from "sub" claim, as in posts above

client.get_user(user_id)

[njonesuser]

And where do I get user_id from?

[serhiibuniak-okta]

Hi Nina,

user_id in most cases represented by "sub" claim (exactly, like you tried to do from the start), and here's a bit modified working example to make things more clear:

import asyncio

from okta.client import Client as OktaClient

okta_client = OktaClient({'orgUrl': 'https://{yourOktaDomain}', 'token': '{yourAPIToken}'})

# loop should be global as only one event loop is allowed
loop = asyncio.get_event_loop()

# modified before_request function
@app.before_request
def before_request():
    user = None
    if oidc.user_loggedin:
        user_id = oidc.user_getfield("sub")
        res, resp, err = loop.run_until_complete(okta_client.get_user(user_id))
        if not err:
            user = res
            
            # then we can access different user attributes from OKTA model
            print(user.id)
            print(user.profile.first_name)
            
            # or print some custom attribute if it exists (with name "custom_attribute"):
            print(user.custom_attribute)

And another way to get custom attributes (as we discussed in few posts above) - incorporate them into jwt token.

Please, let us know if either of approaches work for you.

[njonesuser]

Thank you for being helpful and patient. It works.

[serhiibuniak-okta]

Thank you for the confirmation that it works. I'm going to close this issue as resolved. Feel free to reopen this issue or create a new one if you still have some questions.