Device Trust use cases

Using Device Trust’s authentication webhooks

You can use Device Trust’s webhooks for automating actions that are triggered from Device Trust.

This guide will use Device Trust’s webhooks to demonstrate a setup you can use to extend a users Slack session. In our scenario, we will:

• Set up an automation service. (such as Workato or Zapier)
• Create a webhook within Device Trust that is subscribed to auth_logs.success.
• Configure our Slack settings to utilize the webhook and automation service.
• Set up a workflow that extends the users Slack session upon a successful authentication.

Step 1: Set up an automation tool or a service to receive the webhook. This can be a service such as Zapier or Workato. We just need something that will massage out the nested data our API returns, since Slack only accepts data in a specific format.

Step 2: Set up a new webhook that’s subscribed to the auth_logs.success event in Device Trust:

1. In the Device Trust admin console, select your profile picture in the upper-right corner, then select Settings.
2. Select Developers > Webhooks, then select Add Endpoint.
3. In the “URL” field, enter the URL from the service you set up in Step 1.
4. Select auth_logs.success, then select Submit.

Learn more about the auth_logs.success event.

Step 3: Navigate to the settings of your Slack app and make sure you have the required permissions of admin.users:read, and admin.users:write. While you’re here, grab the User OAuth Token.

To find both, select OAuth & Permissions in your Slack app’s settings. The permissions are in the “User Token Scopes” section, and the token is in the “OAuth Tokens for Your Workspace” section. If a permission is missing, select Add an OAuth Scope in the “User Token Scopes” section to add it.

Step 4: When a user has a successful authentication, a webhook will be sent. Now we just need to parse that data, make an API call or two, and we’ll have this all set up.

Here’s an example of the data the auth_logs.success webhook sends. You’ll use the auth_log_url field in the next step.

{
  "event": "auth_logs.success",
  "id": "01HDW1V4TDE1B3KCAMR8V7Z4S5",
  "timestamp": "2024-03-11T21:28:17Z",
  "data": {
    "auth_log_url": "https://api.kolide.com/auth_logs/id3374648",
    "browser_name": "Chrome",
    "browser_version": "122.0.0.0",
    "device_id": 1,
    "device_name": "Wendys-MacBook-Pro",
    "launcher_version": "1.4.0",
    "person_id": 3
  }
}

So let’s send a GET request ¹ to the auth_log_url:

curl --location 'http://api.kolide.com//auth_logs/01HDW1V4TDE1B3KCAMR8V7Z4S5' \
--header 'x-kolide-api-version: <version>' \
--header 'Authorization: Bearer <token>'

From that GET request, we get the following info:

{
"id": "id1009230936994155308975657",
"timestamp": "2024-05-03T18:22:30.730Z",
"person_name": "John A",
"person_email": "johnappleseed@example.com",
"person_info": {
"identifier": 3,
"link": "https://api.kolide.com/people/3"
},
"device_info": {
"identifier": 16,
"link": "https://api.kolide.com/devices/16"
},
"result": "Success",
"initial_status": "all_good",
...
}

We now have all the info necessary to extend the user’s Slack session through Slack’s API.

Let’s start by getting the Slack user id for this user:

curl --location 'https://slack.com/api/users.lookupByEmail?email=johnappleseed@example.com' \
    --header 'Authorization: Bearer <slack_oauth_user_token>'

Which gives us:

{
"ok": true,
"user": {
"id": "WR3GPNZU1Z",
"name": "john a",
...
  }
}

Now that we have the user’s Slack id, we can use it to refresh the session:

You can see here I’m using a duration of 36000 seconds, which is 10 hours.

curl -X POST https://slack.com/api/admin.users.session.getSettings \
-H "Authorization: Bearer <slack_oauth_user_token>" \
-H "Content-Type: application/json" \
-d '{"user_ids":[WR3GPNZU1Z, WR3GPNZU1A, WR3GPNZU1B]}'

This concept can also be used in conjunction with either our auth_logs.success or the auth_logs.failure webhook events. Some use cases include, but are not limited to:

• Creating a workflow that utilizes the Doordash API to deliver a delicious pint of Graeter’s Black Raspberry Chocolate Chip ice cream to a user whenever they successfully authenticate.
• Creating a workflow that utilizes a Slack bot to send a user a confetti emoji upon successful authentication.

By accessing or using 1Password Developer Tools, you agree to the API and SDK Terms of Service.