Passing additional fields through the user service flows that aren't stored in the kratos db but can be used on the webhooks

[MilesNorton]

Hi,
I'm looking at how we can pass additional fields through the login flows that won't be saved on the kratos db side but can be used to send through the webhook to an external service.

Use case:
On registration I want the user to specify an organisation name, using this org name I will then create a group on our own database linked to that kratos id. This is so that we can create an application where the owner of an org can invite users and set permissions on each user. I do not want the organisation to live as a trait against that user in kratos, specifically because a user can have 'many' groups.

[Benehiko]

Hi @MilesNorton,

Yes, you can pass along headers, URL parameters and identity traits. Of course in your case, you would probably want to opt for using URL parameters.

To get this right you can use the provided ctx variable inside of your jssonet file. Here is an excerpt of what Kratos injects for you:

templateContext struct {
	Flow           flow.Flow          `json:"flow"`
	RequestHeaders http.Header        `json:"request_headers"`
	RequestMethod  string             `json:"request_method"`
	RequestUrl     string             `json:"request_url"`
	Identity       *identity.Identity `json:"identity"`
}

source

func (e *WebHook) ExecutePostRegistrationPostPersistHook(_ http.ResponseWriter, req *http.Request, flow *registration.Flow, session *session.Session) error {
	return e.execute(&templateContext{
		Flow:           flow,
		RequestHeaders: req.Header,
		RequestMethod:  req.Method,
		RequestUrl:     req.RequestURI,
		Identity:       session.Identity,
	})
}

source.

So to get for instance the RequestUrl from the context inside your jsonnet file, you do it like so:

function(ctx) {
  request_url: ctx.request_url
}

This will pass along the request_url to the JSON key request_url. You can also do some string manipulation with the jsonnet standard library, but for simplicity sake, I will pass along the entire URL.

Then inside my kratos.yml we add the webhook:

    registration:
      lifespan: 10m
      ui_url: http://127.0.0.1:4455/registration
      after:
        password:
          hooks:
            -
              hook: session
            -
              hook: web_hook
              config:
                url: http://<some_external_url>/group
                method: POST
                body: file:///etc/config/kratos/f.jsonnet

On the registration submission, I add a group=hello query parameter to the request.

I have a small gin server catching the result:

func main() {
	r := gin.Default()
	r.POST("/group", func(c *gin.Context) {
		out, _ := c.GetRawData()
		fmt.Printf("data: %s", string(out))
		c.JSON(200, gin.H{
			"message": "pong",
		})
	})
	r.Run("0.0.0.0:5555")
}

The output?

[GIN-debug] Listening and serving HTTP on 0.0.0.0:5555
data: {
   "request_url": "/self-service/registration?flow=040e2073-2ca6-4459-9082-650546be5e3b&group=hello"
}
[GIN] 2021/12/08 - 10:49:23 | 200 |      76.866µs |      172.18.0.5 | POST     "/group"

[MilesNorton]

Thanks for the answer 👍

[MilesNorton]

Just for anyone else reading, I'm assuming that you would want to ensure that the service the webhook is calling is in the private network if you don't have auth on it or if you do have auth on it you would need to update the kratos config to include the auth when calling the webhook: https://www.ory.sh/kratos/docs/self-service/hooks/#web-hooks