diff --git a/Packs/Okta/Integrations/Okta_v2/Okta_v2.py b/Packs/Okta/Integrations/Okta_v2/Okta_v2.py index 50e0c9a78614..5994b3e2b1c6 100644 --- a/Packs/Okta/Integrations/Okta_v2/Okta_v2.py +++ b/Packs/Okta/Integrations/Okta_v2/Okta_v2.py @@ -483,9 +483,10 @@ def delete_user(self, user_term): uri = f"/api/v1/users/{encode_string_results(user_term)}" return self.http_request(method="DELETE", url_suffix=uri, resp_type="text") - def clear_user_sessions(self, user_id): + def clear_user_sessions(self, user_id, revoke_oauth_tokens=False): uri = f"/api/v1/users/{user_id}/sessions" - return self.http_request(method="DELETE", url_suffix=uri, resp_type="text") + params = {"oauthTokens": "true"} if revoke_oauth_tokens else None + return self.http_request(method="DELETE", url_suffix=uri, params=params, resp_type="text") def get_zone(self, zoneID): uri = f"/api/v1/zones/{zoneID}" @@ -1030,7 +1031,8 @@ def delete_user_command(client, args): def clear_user_sessions_command(client, args): user_id = args.get("userId") - raw_response = client.clear_user_sessions(user_id) + revoke_oauth_tokens = argToBoolean(args.get("revokeOauthTokens", True)) + raw_response = client.clear_user_sessions(user_id, revoke_oauth_tokens) outputs = { "Okta.Metadata(true)": client.request_metadata, } diff --git a/Packs/Okta/Integrations/Okta_v2/Okta_v2.yml b/Packs/Okta/Integrations/Okta_v2/Okta_v2.yml index 5d79c7f5fe95..b3f841191238 100644 --- a/Packs/Okta/Integrations/Okta_v2/Okta_v2.yml +++ b/Packs/Okta/Integrations/Okta_v2/Okta_v2.yml @@ -1557,8 +1557,15 @@ script: - description: Okta User ID. name: userId required: true + - description: When true, revokes OpenID Connect and OAuth refresh and access tokens issued to the user. + name: revokeOauthTokens + auto: PREDEFINED + defaultValue: 'true' + predefined: + - 'true' + - 'false' description: |- - Removes all active identity provider sessions. This forces the user to authenticate upon the next operation. Optionally revokes OpenID Connect and OAuth refresh and access tokens issued to the user. + Removes all active identity provider sessions. This forces the user to authenticate upon the next operation. By default, OpenID Connect and OAuth refresh and access tokens issued to the user are revoked. Token revocation can be disabled if needed. For more information and examples: https://developer.okta.com/docs/reference/api/users/#user-sessions name: okta-clear-user-sessions diff --git a/Packs/Okta/Integrations/Okta_v2/Okta_v2_test.py b/Packs/Okta/Integrations/Okta_v2/Okta_v2_test.py index d639a6d5d286..95096da0858a 100644 --- a/Packs/Okta/Integrations/Okta_v2/Okta_v2_test.py +++ b/Packs/Okta/Integrations/Okta_v2/Okta_v2_test.py @@ -7,6 +7,7 @@ Client, apply_zone_updates, assign_group_to_app_command, + clear_user_sessions_command, create_group_command, create_user_command, create_zone_command, @@ -1387,3 +1388,53 @@ def test_extract_user_and_factor_id_from_url_failure(url): with pytest.raises(DemistoException, match="Could not extract user ID and Factor ID from the polling URL"): extract_user_and_factor_id_from_url(url) + + +def test_clear_user_sessions_with_oauth_tokens(mocker): + """ + Given: + - Arguments for clear_user_sessions_command with revokeOauthTokens set to true. + When: + - Running clear_user_sessions_command. + Then: + - Ensure the clear_user_sessions method is called with revoke_oauth_tokens=True. + - Ensure the API is called with the oauthTokens query parameter. + """ + mock_http_request = mocker.patch.object(client, "http_request", return_value="") + client.request_metadata = {} + + args = {"userId": "TestUserID456", "revokeOauthTokens": "true"} + readable_output, outputs, raw_response = clear_user_sessions_command(client, args) + + mock_http_request.assert_called_once_with( + method="DELETE", + url_suffix="/api/v1/users/TestUserID456/sessions", + params={"oauthTokens": "true"}, + resp_type="text", + ) + assert "TestUserID456" in readable_output + + +def test_clear_user_sessions_without_oauth_tokens(mocker): + """ + Given: + - Arguments for clear_user_sessions_command with revokeOauthTokens set to false. + When: + - Running clear_user_sessions_command. + Then: + - Ensure the clear_user_sessions method is called with revoke_oauth_tokens=False. + - Ensure the API is called without the oauthTokens query parameter. + """ + mock_http_request = mocker.patch.object(client, "http_request", return_value="") + client.request_metadata = {} + + args = {"userId": "TestUserID789", "revokeOauthTokens": "false"} + readable_output, outputs, raw_response = clear_user_sessions_command(client, args) + + mock_http_request.assert_called_once_with( + method="DELETE", + url_suffix="/api/v1/users/TestUserID789/sessions", + params=None, + resp_type="text", + ) + assert "TestUserID789" in readable_output diff --git a/Packs/Okta/Integrations/Okta_v2/README.md b/Packs/Okta/Integrations/Okta_v2/README.md index e99cd2d45f64..4e1fafe6f064 100644 --- a/Packs/Okta/Integrations/Okta_v2/README.md +++ b/Packs/Okta/Integrations/Okta_v2/README.md @@ -55,6 +55,8 @@ The following scopes are required for the Okta v2 integration to work properly: For more information, see the '[Implement OAuth for Okta](https://developer.okta.com/docs/guides/implement-oauth-for-okta/main/)' official documentation article. +**Note:** OAuth 2.0 authentication is confirmed to support the 'Revoke all user sessions' functionality. When using the `okta-clear-user-sessions` command with `revoke_oauth_tokens=true`, it revokes OpenID Connect and OAuth refresh and access tokens issued to the user. + ### Instance Configuration | **Parameter** | **Description** | **Required** | @@ -2159,7 +2161,7 @@ Deletes the specified user. ### okta-clear-user-sessions *** -Removes all active identity provider sessions. This forces the user to authenticate upon the next operation. Optionally revokes OpenID Connect and OAuth refresh and access tokens issued to the user. +Removes all active identity provider sessions. This forces the user to authenticate upon the next operation. By default, OpenID Connect and OAuth refresh and access tokens issued to the user are revoked. Token revocation can be disabled if needed. For more information and examples: https://developer.okta.com/docs/reference/api/users/#user-sessions @@ -2172,6 +2174,7 @@ https://developer.okta.com/docs/reference/api/users/#user-sessions | **Argument Name** | **Description** | **Required** | | --- | --- | --- | | userId | Okta User ID. | Required | +| revokeOauthTokens | When true, revokes OpenID Connect and OAuth refresh and access tokens issued to the user. Possible values are: true, false. Default is true. | Optional | #### Context Output diff --git a/Packs/Okta/ReleaseNotes/3_3_34.md b/Packs/Okta/ReleaseNotes/3_3_34.md new file mode 100644 index 000000000000..8cd1f89ecbf0 --- /dev/null +++ b/Packs/Okta/ReleaseNotes/3_3_34.md @@ -0,0 +1,6 @@ + +#### Integrations + +##### Okta v2 + +- Added support for *revokeOauthTokens* argument in the **okta-clear-user-sessions** command. diff --git a/Packs/Okta/pack_metadata.json b/Packs/Okta/pack_metadata.json index 4782bf0c5cfa..1dd19423b72c 100644 --- a/Packs/Okta/pack_metadata.json +++ b/Packs/Okta/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Okta", "description": "Integration with Okta's cloud-based identity management service.", "support": "xsoar", - "currentVersion": "3.3.33", + "currentVersion": "3.3.34", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "",