Configure agent lifecycle management hooks for Okta Privileged Access

The Okta Privileged Access lifecycle hooks exposes an event bus on your servers that receives notifications when an admin updates the local users and group configurations. Okta Privileged Access admins can customize these lifecycle hooks with scripts to fit any routine tasks that they need to perform when they make these changes. The hooks run scripts for all matching files in the configured hooks directory. You can discover which operating system objects are affected depending on the event, and see which scripts are running. See Directories and scripts and Lifecycle-related environment variables.

Configuration option

The AccountLifecycleHooksDir option in sftd.yaml specifies the directory from which the Okta Privileged Access agent loads lifecycle hook scripts. The following default paths apply if this option isn't set:

To override the default settings, add the AccountLifecycleHooksDir option to sftd.yaml with the path to your hooks directory:

AccountLifecycleHooksDir: /path/to/your/hooks

Procedure

Use the following steps as a guide to perform an on-host setup.

Create a custom script

1. From the command line, use SSH to connect to one of your target Linux servers.

2. Switch to root by running sudo su

3. Create a directory for the hooks script with the following command:

   mkdir -p /usr/lib/sftd/hooks/user-created.d

4. Using a text editor, create a file named 01-copyfiles.sh and copy/paste the following bash script:

   Note: The following is an example that demonstrates the basic functionality of agent lifecycle hooks. Modify the script as needed to fit your specific integration.

   #!/bin/bash
   SOURCE_FILES=/opt/sourcefiles
   cp $SOURCE_FILES/App?/home/"${SFT_HOOK_USERNAME}"
   if [ $? -eq 0 ]
   then
   echo "Successfully copied source files into /home/"${SFT_HOOK_USERNAME}"" >> /tmp/sourcefiles.out
   else
   echo "Error Copying source files into /home/"${SFT_HOOK_USERNAME}"" >> /tmp/sourcefiles.out

5. Grant the script execute access:

   chmod 755 01-copyfiles.sh

6. Run the ls -l command and confirm that permissions have been correctly set. The output should resemble the following:

   -rwxr-xr-x 1 root root 316 Jun 30 14:54 01-copyfiles.sh

Create source files

1. Create a directory for the source files by running the following commands:

   cd /opt
   mkdir sourcefiles

2. Next, create the source files with the following commands:

   cd sourcefiles
   touch App1 App2 App3

3. Run the ls command and confirm that the files App1, App2, and App3 have been created.

Create a Okta user and assign them to an authorized group

1. As an Okta administrator, go to the Admin Dashboard of the Okta tenant that manages your Okta Privileged Access application.
2. Go to Applications and click Okta Okta Privileged Access .
3. Click Assignments and then Groups. Remember the name of the group that has been assigned the application.
4. In the Okta Admin Console, select Directory , People and then Add Person.
5. Create a user with a memorable name.
6. In the Okta Admin Console, go to Directory, and then click Groups. From here, select the group that was assigned to Okta Privileged Access in step 3.

Validate user provisioning on your Linux server

1. From the Linux command prompt, enter the following commands:

   cd /home
   ls -l

2. Verify that the home directory for your new user has been created.

3. Switch to the new user's home directory by running cd <username>.

   You can verify that the files App1, App2, and App3 exist in the user's home directory with the ls command.

This is how you can use Okta Privileged Access agent lifecycle hooks to integrate any host-local automation, system, or external user directory with your users and groups in Okta.

Related information

Directories and scripts

The following directories and scripts are invoked depending on the user event that occurred. Paths shown use the default Linux and macOS base directory. If AccountLifecycleHooksDir is set in sftd.yaml, the base directory differs accordingly. The event type is captured in the SFT_HOOK_EVENT variable. See Lifecycle-related environment variables.

• user-created

  When a user is created, scripts in /usr/lib/sftd/hooks/user-created.d/*.sh are executed.

• user-updated

  When a user is updated, scripts in /usr/lib/sftd/hooks/user-updated.d/*.sh are executed.

• user-deleted

  When a user is deleted, scripts in /usr/lib/sftd/hooks/user-deleted.d/*.sh are executed.

Lifecycle-related environment variables