Okta Workflows How-To: Set up a Workflows helper flow

Okta Workflows is a no-code platform for automating identity processes. 

This blog post is based on a question asked during office hours or the #okta-workflows channel in MacAdmins Slack: How to set up a Workflows helper flow (with For-Each and streaming cards)?

Getting started

Workflows have a number of cards that can perform a search for records. For example, the Okta – List Users with Filter lists users by status:

A search card will build a list of records. A helper flow is then used to process each record from the list. Using the example above, once you have a list of users, you might want to check when the last time a user signed into a system.

There are two ways to send the records to a helper flow:

1. A list of records is passed to a List – For Each card. The For Each card then calls a helper flow for each record in the list
2. A search card uses the Stream Matching Records option. The streaming option directly streams each record to the selected helper flow

In general, the streaming option is more scalable and allows for a significantly larger number of records to be processed. Learn more about data streaming with action cards.

Let’s look at examples using for-each and streaming options.

Using the List – For Each card

In this section, you will learn how to set up the main flow and the helper flow using the List – For Each card.

Setting up a helper flow

A helper flow is a flow that is called from another flow (main flow). A flow becomes a helper flow when the first card is On Demand – Helper Flow:

A helper flow will have one or more inputs that are passed to it from the main flow (or calling flow). In the example below, a helper flow has two inputs User (type Object) and email (type Text):

Looking at the complete helper flow, it gets passed two input values: User and email:

This flow doesn’t do a lot besides reading values passed to it. But that’s fine, the purpose of this blog post is to show you how to set up a helper flow/main flow.

Using the Object – Get card, you can retrieve (get) a specific value from an object. In this example, the Email is retrieved.

The Flow Control – Assign card takes the email input to the helper flow and assigns it to another value (also called email). This can be helpful if you need to use the email later in a flow.

Let’s look at the main flow.

Setting up the main flow

The main flow is a regular flow, and we will call the helper flow. To start, you need a search card that returns a list of records. The flow below uses List Users with Filter card. The Options field is set to First 200 Matching Records:

The list is then passed to List – For Each card:

Next, you choose a helper flow to run for each record.

This important. Once you choose a helper flow, its inputs will be loaded on the For Each card.

For each helper flow input field, click the arrow (on the right side of a field) and select a value and a type to pass to the helper flow. The type needs to match the type the helper flow expects.

This is also important. If you update helper flow inputs, you need to repeat choosing a helper flow again (yes, it’s a bit annoying). Once you choose the helper flow, the inputs on For Each card will be updated based on the changes you made.

Here is another look at setting values passed to the helper flow.

First, you are passing: User ➡️(Item, type Object):

Then you are passing: email ➡️ (Email, type Text):

This is how the main flow and the helper flow look together and how data is passed:

Running the main flow:

Helper flow invocations will be equal to the number of records in the list (in the example below, the list contained three users):

Using the Streaming Matching Records option

In this section, you will learn how to set up the main flow and a helper flow using the streaming option. As in the first part, you will start with the helper flow first.

Setting up the helper flow

As in the previous section, a helper flow is a flow that is called from another flow (main flow). A flow becomes a helper flow when the first card is On Demand – Helper Flow:

With the streaming option, you also define helper flow inputs. But the inputs are a bit different.

You need to create two helper flow inputs:

• Record (type Object)
• State (type Object)

Record is the current item, in our example User. This is the item that is being streamed (sent) to the helper flow. You have access to all its properties.

With State, you can define any additional inputs to pass to the helper flow.

You will come back to the helper to create flow inputs. Next, you are going to set up the main flow.

Setting up the main flow

If a search card has a Stream Matching Records option, then you don’t need to use a For Each card. The streaming option will stream (send) records to a helper flow automatically.

This is a good place to learn more about data streaming with action cards.

Let’s go back to our example. We will use the same card, List Users with Filter.

Before you enable the streaming options, set the card options to First 200 Matching Records. It will help you test and set up inputs for the helper flow.

With Status set to DEPROVISIONED:

Click to test the card and expand one of the list items. On the left side, you will see the User JSON object (shown as root) that will be passed to the helper flow. All the properties will be available to the helper flow.

Now that you know how the JSON looks, you can set up the helper flow inputs.

Finishing up the helper flow

Going back to the helper flow, you define the inputs.

Record is the current item, and for this particular flow, you are passing in ID and Email. These values are available because they are part of the JSON object (above).

And what about Admin email – where is this value coming from? Under State, you can pass any additional values to the helper flow. Let’s finish setting up the main flow, and you will see how to pass in the Admin email.

Finishing up the main flow

To finish the main flow, go back to Options and choose Stream Matching Records:

Next, choose the helper flow. Because of how steaming works, the helper flow inputs are not displayed as the entire object is sent to the helper.

To pass the additional value (Admin email), click to create a new field inside the orange rectangle.

The name of the field (Admin email) and type (Text) have to match exactly the name and type of the field in the helper flow (Admin email, Text). You can pass more than one value this way.

Now everything is ready to run the flows.

Below is a screenshot of running the main flow. Notice that under Results it shows the number of records streamed to the helper flow:

And is a helper flow run (total 3 runs):

This is how the flows look together:

Summary

In this blog post, you learned how to set up a helper flow with a For Each card and with a streaming option.

Get your Workflows questions answered

Do you have a question about Okta Workflows? Not sure how to build a flow? Join the weekly community office hours to get help.