Configure agent lifecycle management hooks for Okta Privileged Access

The Okta Privileged Access lifecycle hooks feature exposes an event bus on your servers that receives notifications when membership changes are made to local users and group configurations on your Linux systems. Okta Privileged Access administrators can customize these lifecycle hooks with scripts to fit any routine tasks that need to be executed when these changes occur. Local scripts are also run globally, matching any files that are under the /usr/lib/sftd/hooks directory. You can discover which operating system objects are affected depending on which event is occurring, and see which scripts are running. See Directories and scripts and Lifecycle-related environment variables.

Procedure

Use the following steps as a guide to perform an on-host setup.

Create a custom script

1. From the command line, use SSH to connect to one of your target Linux servers.

2. Switch to root by running sudo su

3. Create a directory for the hooks script with the following command:

   mkdir -p /usr/lib/sftd/hooks/user-created.d

4. Using a text editor, create a file named 01-copyfiles.sh and copy/paste the following bash script:

   Note: The following is an example that demonstrates the basic functionality of agent lifecycle hooks. Modify the script as needed to fit your specific integration.

   #!/bin/bash SOURCE_FILES=/opt/sourcefiles cp $SOURCE_FILES/App?/home/"${SFT_HOOK_USERNAME}" if [ $? -eq 0 ] then echo "Successfully copied source files into /home/"${SFT_HOOK_USERNAME}"" >> /tmp/sourcefiles.out else echo "Error Copying source files into /home/"${SFT_HOOK_USERNAME}"" >> /tmp/sourcefiles.out

5. Grant the script execute access:

   chmod 755 01-copyfiles.sh

6. Run the ls -l command and confirm that permissions have been correctly set. The output should resemble the following:

   -rwxr-xr-x 1 root root 316 Jun 30 14:54 01-copyfiles.sh

Create source files

1. Create a directory for the source files by running the following commands:

   cd /opt mkdir sourcefiles

2. Next, create the source files with the following commands:

   cd sourcefiles touch App1 App2 App3

3. Run the ls command and confirm that the files App1, App2, and App3 have been created.

Create a Okta user and assign them to an authorized group

1. As an Okta administrator, go to the Admin Dashboard of the Okta tenant that manages your Okta Privileged Access application.
2. Go to Applications and click Okta Okta Privileged Access.
3. Click Assignments and then Groups. Remember the name of the group that has been assigned the application.
4. In the Okta Admin Console, select Directory , People and then Add Person.
5. Create a user with a memorable name.
6. In the Okta Admin Console, go to Directory, and then click Groups. From here, select the group that was assigned to Okta Privileged Access in step 3.

Validate user provisioning on your Linux server

1. From the Linux command prompt, enter the following commands:

   cd /home ls -l

2. Verify that the home directory for your new user has been created.

3. Switch to the new user's home directory by running cd <username>.

   You can verify that the files App1, App2, and App3 exist in the user's home directory with the ls command.

This is how you can use Okta Privileged Access agent lifecycle hooks to integrate any host-local automation, system, or external user directory with your users and groups in Okta.

Related information

Directories and scripts

The list below details which directories and scripts are invoked depending on the user event that occurred. The event type is captured in the SFT_HOOK_EVENT variable. See Lifecycle-related environment variables.

• user-created

  When a user is created, scripts in /usr/lib/sftd/hooks/user-created.d/*.sh are executed.

• user-updated

  When a user is updated, scripts in /usr/lib/sftd/hooks/user-updated.d/*.sh are executed.

• user-deleted

  When a user is deleted, scripts in /usr/lib/sftd/hooks/user-deleted.d/*.sh are executed.

Lifecycle-related environment variables

Hook	Environment variable	Contents
user-created	SFT_HOOK_EVENT	user-created
user-created	SFT_HOOK_USERNAME	alice.smith
user-updated	SFT_HOOK_EVENT	user-updated
user-updated	SFT_HOOK_USERNAME	alice.smith
user-deleted	SFT_HOOK_EVENT	user-deleted
user-deleted	SFT_HOOK_USERNAME	alice.smith