Okta Workflows How-To: Setup a Workflows Helper Flow (With For-Each and Streaming Cards)
Okta Workflows is a no-code platform for automating identity processes.
This blog post is based on a question asked during office hours or the #okta-workflows channel in MacAdmins Slack: How to setup a Workflows helper flow (with For-Each and streaming cards)?
Getting started
Workflows has a number of cards that can perform a search for records. For example, the Okta – List Users with Filter lists users by status:
Searching for users card
A search card will build a list of records. A helper flow is then used to process each record from the list. Using the example above, once you have a list of users, you might want to check when was the last time a user signed into a system.
There are two ways to send the records to a helper flow:
- A list of records is passed to a List – For Each card. The For Each card then calls a helper flow for each record in the list
- A search card uses the Stream Matching Records option. The streaming option directly streams each record to the selected helper flow
In general, the streaming option is more scalable and allows for a significantly larger number of records to be processed. Learn more about data streaming with action cards.
Let’s look at examples using for-each and streaming options.
Using the List – For Each card
In this section, you will learn how to setup the main flow and the helper flow using the List – For Each card.
Setting up a helper flow
A helper flow is a flow that is called from another flow (main flow). A flow becomes a helper flow when the first card is On Demand – Helper Flow:
Choosing Helper Flow event
Helper flow first card
A helper flow will have one or more inputs that are passed to it from the main flow (or calling flow). In the example below, a helper flow has two inputs User (type Object) and email (type Text):
Helper flow with two inputs (User, email)
Looking at the complete helper flow, it gets passed two input values: User and email:
Helper flow
This flow doesn’t do a lot besides reading values passed to it. But that’s fine, the purpose of this blog post it to show you how to setup a helper flow/main flow.
Using the Object – Get card you can retrieve (get) a specific value from an object. In this example, the Email is retrieved.
The Flow Control – Assign card takes the email input to the helper flow and assigns it to another value (also called email). This can be helpful if you need to use the email later in a flow.
Let’s look at the main flow.
Setting up the main flow
The main flow is a regular flow and will call the helper flow. To start you need a search card that returns a list of records. The flow below uses List Users with Filter card. The Options field is set to First 200 Matching Records:
Card options
Returning first 200 matches option
The list is then passed to List – For Each card:
Passing deprovisioned users to a helper flow
Next you choose a helper flow to run for each record.
This important. Once you choose a helper flow, its inputs will be loaded on the For Each card.
For each helper flow input field click the arrow (on the right side of a field) and select a value and a type to pass to the helper flow. The type needs to match the type the helper flow expects.
Choosing a helper flow and setting its inputs
This is also important. If you update helper flow inputs, you need to repeat choosing a helper flow again (yes, it’s a bit annoying). Once you choose the helper flow, the inputs on For Each card will be updated based on the changes you made.
Here is another look at setting values passed to the helper flow.
First, you are passing: User ➡️(Item, type Object):
Selecting values to pass to the helper flow (User)
Then you are passing: email ➡️ (Email, type Text):
Selecting values to pass to the helper flow (email)
This is how the main flow and the helper flow look together and how data is passed:
Passing data from the main flow to the helper flow
Running the main flow:
Testing the main flow
Helper flow invocations will be equal to the number of records in the list (in the example below, the list contained three users):
Running a helper flow (3 times)
Using Streaming Matching Records option
In this section you will learn how to setup the main flow and a helper flow using the streaming option. As in the first part, you will start with the helper flow first.
Setting up the helper flow
As in the previous section, a helper flow is a flow that is called from another flow (main flow). A flow becomes a helper flow when the first card is On Demand – Helper Flow:
Helper flow
With the streaming option you also define helper flow inputs. But, the inputs are a bit different.
You need to create two helper flow inputs:
- Record (type Object)
- State (type Object)
Helper flow with inputs for streaming
Record is the current item, in our example User. This is the item that is being streamed (sent) to the helper flow. You have access to all its properties.
With State, you can define any additional inputs to pass to the helper flow.
You will come back to the helper to create flow inputs. Next, you are going to setup the main flow.
Setting up the main flow
If a search card has a Stream Matching Records option then you don’t need to use a For Each card. The streaming option will stream (send) records to a helper flow automatically.
This is a good place to learn more about data streaming with action cards.
Let’s go back to our example. We will use the same card, List Users with Filter.
Before you enable the streaming options, set the card options to First 200 Matching Records. It will help you test and setup inputs for the helper flow.
When testing – set options to First 200 Matching Records
With Status set to DEPROVISIONED:
Listing deprovisioned users
Click to test the card and expand one of the list items. On the left side, you will the User JSON object (shown as root) that will be passed to the helper flow. All the properties will be available to the helper flow.
Testing the List Users with Filter card
Now that you know how the JSON looks, you can setup the helper flow inputs.
Finishing up the helper flow
Going back to the helper flow, you define the inputs.
Record is the current item and for this particular flow, you are passing in ID and Email. These values are available because they are part of the JSON object (above).
Helper flow inputs connected to another card
And what about Admin email – where is this value coming from? Under State, you can pass any additional values to the helper flow. Let’s finish setting up the main flow and you will see how to pass in the Admin email.
Finishing up the main flow
To finish the main flow, go back to Options and choose Stream Matching Records:
Setting Stream Matching Records option
Next, choose the helper flow. Because of how steaming works, the helper flow inputs are not displayed as the entire object is sent to the helper.
Create an additional value to pass to the helper flow
To pass the additional value (Admin email), click to create a new field inside the orange rectangle.
The name of the field (Admin email) and type (Text) have to match exactly the name and typeof the field in the helper flow (Admin email, Text). You can pass more than one value this way.
Passing additional value to helper flow (Admin email)
Now everything is ready to run the flows.
Below is a screenshot running the main flow. Notice that under Results it shows the number of records streamed to the helper flow:
Testing the main flow
And is a helper flow run (total 3 runs):
Running the helper flow
This is how the flows look together:
Main flow and helper flow overview
Summary
In this blog post, you learned how to setup a helper flow with a For Each card and with a streaming option.
Get your Workflows questions answered
Do you have a question about Okta Workflows? Not sure how to build a flow? Join the weekly community office hours to get help.
Follow Max Katz
