-
Notifications
You must be signed in to change notification settings - Fork 0
/
okta_user_application_request.yml
189 lines (171 loc) · 8.04 KB
/
okta_user_application_request.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
---
# Query for Open Approved Application Request Ticket ..
- name: Getting Approved Application Request Ticket...
vars:
jira_api_token: "{{ lookup('env','JIRA_API_TOKEN') | default(false) }}"
help_desk_project: NHD
jira_user: [email protected]
jira_server: example.atlassian.net
community.general.jira:
uri: "https://{{ jira_server }}"
username: "{{ jira_user }}"
password: "{{ jira_api_token }}"
project: "{{ help_desk_project }}"
operation: search
maxresults: 1
jql: resolution = Unresolved AND issuetype = "Service Request with Approvals" AND Approvals = approved() AND (labels ="user_application_request" AND labels !="ignore_app_request")
args:
fields:
lastViewed: null
register: application_request_help_desk_ticket
# Determine if a ticket came back, if it did then set an actioning fact, if not then it will skip the remaining tasks and end.
- name: Set actioning fact. Is there a ticket to action?
set_fact:
application_request_ticket_needs_actioned: "{{ 'yes' if (application_request_help_desk_ticket.meta.issues | length > 0) else 'no' }}"
# Gather fields of helpdesk ticket for actioning.
- name: Getting Parent Help Desk Ticket...
vars:
help_desk_ticket: "{{ application_request_help_desk_ticket.meta.issues.0.key }}"
jira_api_token: "{{ lookup('env','JIRA_API_TOKEN') | default(false) }}"
help_desk_project: NHD
jira_user: [email protected]
jira_server: example.atlassian.net
community.general.jira:
uri: "https://{{ jira_server }}"
username: "{{ jira_user }}"
password: "{{ jira_api_token }}"
project: "{{ help_desk_project }}"
operation: fetch
issue: "{{ help_desk_ticket }}"
register: app_rq_parent_help_desk_ticket # <var>.meta.key
when: application_request_ticket_needs_actioned
# Setting Facts for Requestor and Application for Okta query
- name: Set Parent Helpdesk Ticket facts
set_fact:
okta_app_user_name: "{{ app_rq_parent_help_desk_ticket.meta.fields.reporter.emailAddress }}"
requested_application_name: "{{ app_rq_parent_help_desk_ticket.meta.fields.customfield_10253.value }}"
app_approver: "{{ app_rq_parent_help_desk_ticket.meta.fields.customfield_10040.0.approvers.0.approver.emailAddress | default(false) }}"
when: application_request_ticket_needs_actioned
# Make sure the Requestor of the App isn't the Approver. This shouldn't be necessary but it's good practice to implement.
- name: Ensure the Requestor is not the Approver
set_fact:
requestor_is_not_approver: "{{ 'yes' if (okta_app_user_name != app_approver) else 'no' }}"
when: application_request_ticket_needs_actioned
# Berate the user if they try to approve their own app.
- name: Comment on issue if the Approver is set as the Requestor.
vars:
jira_api_token: "{{ lookup('env','JIRA_API_TOKEN') | default(false) }}"
help_desk_project: NHD
jira_user: [email protected]
jira_server: example.atlassian.net
community.general.jira:
uri: "https://{{ jira_server }}"
username: "{{ jira_user }}"
password: "{{ jira_api_token }}"
issue: "{{ app_rq_parent_help_desk_ticket.meta.key }}"
operation: comment
comment: |
Hi there!
This is a comment to let you know that your request for {{requested_application_name}} has been denied.
In order to minimize the damage of potentially compromised accounts we require that the requestor and the approver of a ticket like this be different people.
Please edit the ticket and ensure that your line manager is selected. This ticket will now need manual intervention from the IS Team. Please make a member of the team aware.
when: application_request_ticket_needs_actioned and not requestor_is_not_approver
# Update Ticket to Ignore on future runs due to the approver = requestor workflow.
- name: Updating Parent Help Desk Ticket with ignore label...
vars:
jira_api_token: "{{ lookup('env','JIRA_API_TOKEN') | default(false) }}"
help_desk_project: NHD
jira_user: [email protected]
jira_server: example.atlassian.net
community.general.jira:
uri: "https://{{ jira_server }}"
username: "{{ jira_user }}"
password: "{{ jira_api_token }}"
issue: "{{ app_rq_parent_help_desk_ticket.meta.key }}"
operation: edit
args:
fields:
labels:
- ignore_app_request
register: app_rq_parent_help_desk_ticket_label # <var>.meta.key
when: application_request_ticket_needs_actioned and not requestor_is_not_approver
# Set the fact to action the request and assign the app.
- name: Setting actioning fact to continue the workflow.
set_fact:
app_request_needs_actioned: "{{ 'yes' if requestor_is_not_approver else '' }}"
when: application_request_ticket_needs_actioned and requestor_is_not_approver
# Take the given app list and match it to the correct Okta group ID. Make it Alphabetical to make it easier to follow.
- name: Set Okta Group ID based on App.
set_fact:
okta_app_group_id: >-
{{
'00gtlsf7xvPc9yx2N5d6' if requested_application_name == 'Asset Panda' else
'00gtsb4gjYz0klmIR5d6' if requested_application_name == 'Office 365'
else ''
}}
when: app_request_needs_actioned
# Gather Okta ID of the specified User.
- name: Query Okta User by ticket reporter.
vars:
okta_api_token: "{{ lookup('env','OKTA_API_TOKEN') | default(false) }}"
organization: example
uri:
url: "https://{{ organization }}.okta.com/api/v1/users?search=profile.email+eq+%22{{ okta_app_user_name }}%22+and+status+eq+%22ACTIVE%22"
method: GET
body_format: json
return_content: true
headers:
Accept: application/json
Content-Type: application/json
Authorization: "SSWS {{ okta_api_token }}"
register: okta_app_user_lookup
when: app_request_needs_actioned and okta_app_group_id is defined
# Utilise the API to add the user to the App-{Application} Okta Group.
- name: Add Okta User to Application Group
uri:
url: "https://{{ organization }}.okta.com/api/v1/groups/{{ okta_app_group_id }}/users/{{ okta_app_user_lookup.json.0.id }}"
method: PUT
body_format: json
status_code: 200, 204
return_content: true
headers:
Accept: application/json
Content-Type: application/json
Authorization: "SSWS {{ okta_api_token }}"
register: okta_user_added_to_app
when: app_request_needs_actioned
# Berate the user if they try to approve their own app.
- name: Comment on issue if the Approver is set as the Requestor.
vars:
jira_api_token: "{{ lookup('env','JIRA_API_TOKEN') | default(false) }}"
help_desk_project: NHD
jira_user: [email protected]
jira_server: example.atlassian.net
community.general.jira:
uri: "https://{{ jira_server }}"
username: "{{ jira_user }}"
password: "{{ jira_api_token }}"
issue: "{{ app_rq_parent_help_desk_ticket.meta.key }}"
operation: comment
comment: |
Hi there!
This is a comment to let you know that your request for {{requested_application_name}} has been automatically approved and actioned. To access {{requested_application_name}} you may have to log out and back into Okta. In some outlier instances, the application may not appear for up to an hour.
If anything went amiss with this automation feel free to reach out to a member of the IS team directly and quote your ticket number, {{ app_rq_parent_help_desk_ticket.meta.key }}
when: (application_request_ticket_needs_actioned) and (okta_user_added_to_app)
- name: Resolve the issue
vars:
jira_api_token: "{{ lookup('env','JIRA_API_TOKEN') | default(false) }}"
help_desk_project: NHD
jira_user: [email protected]
jira_server: example.atlassian.net
community.general.jira:
uri: "https://{{ jira_server }}"
username: "{{ jira_user }}"
password: "{{ jira_api_token }}"
issue: "{{ app_rq_parent_help_desk_ticket.meta.key }}"
operation: transition
status: Resolve this issue
fields:
resolution:
name: Done
when: application_request_ticket_needs_actioned and okta_user_added_to_app