https://www.ory.com/ logo
Join Slack
Powered by
I want to create and maintain an `external_id` for...
# talk-kratos
b
I want to create and maintain an 
external_id
for an Ory Identity during registration. The options I have explored so far are: • Use a 
PostRegistrationPrePersistHook
to update the metadata of the identity with the 
external_id
. However, the 
admin/identities
APIs do not allow for lookup or filtering by metadata fields. • Use a 
PostRegistrationPostPersistHook
to externally store a mapping from the generated Ory 
identity.id
to the 
external_id
. However, since the webhook is non-blocking, if it fails to reach the downstream service or returns an error, there’s no way to abort the registration. Are there any other options?
c
I've been playing with hook for the same use cases and I had the same concerns about interrupting the flow when the downstream service returns an error. Looking at the documentation, this looks possible (by parsing the response accordingly): https://www.ory.sh/docs/guides/integrate-with-ory-cloud-through-webhooks#flow-interrupting-webhooks
I did not give it a try yet 🤔
I've just tried and this works just fine by setting 
response.parse
to 
true
😉
Copy code
{
  "id": "aa3adcc5-717e-4427-81c8-181bc4326492",
  "error": {
    "code": 500,
    "status": "Internal Server Error",
    "message": "error while parsing webhook response: got no validation errors"
  },
  "created_at": "2023-10-23T14:57:38.103252Z",
  "updated_at": "2023-10-23T14:57:38.103252Z"
}
b
Thanks @careful-rain-13694 - I believe it’s not applicable to my use case because it refers to a 
PostRegistrationPrePersistHook
which does not provide the 
identity.id
in the hook since it has not been generated or persisted at that point in the flow.
c
Oh ok sorry! I used it as a hook called 
after
and the identity id is available from there (and the identity is not created in the end - if a failure happens downstream). Would that fit your initial need somehow?
b
I just gave it another shot, but sadly still getting a 
00000000-0000-0000-0000-000000000000
for the identity id. My config for reference:
Copy code
registration:
  lifespan: 10m
  ui_url: <http://127.0.0.1:4455/registration>
  after:
    password:
      hooks:
        - hook: web_hook
          config:
            url: <http://host.docker.internal:4000/user>
            method: POST
            body: file:///etc/config/kratos/registration.jsonnet
            response:
              parse: true
        - hook: session
c
Can you share your 
registration.jsonnet
file please?
Here is my hook config (I've defined session as first, don't know if this is related to your issue):
Copy code
registration:
      lifespan: 10m
      ui_url: <http://127.0.0.1:4455/registration>
      after:
        oidc:
          hooks:
            - hook: session
            - hook: show_verification_ui
            - hook: web_hook
              config:
                url: <http://host.docker.internal:1337/master/identities>
                method: POST
                body: file:///etc/config/kratos/hooks/register.jsonnet
                response:
                  ignore: false
                  parse: true
b
jsonnet is
Copy code
function(ctx) {
  flow_id: ctx.flow.id,
  identity: ctx.identity,
}
c
here is mine:
Copy code
function(ctx) {
  identityId: ctx.identity.id,
  email: ctx.identity.traits.email,
  name: ctx.identity.traits.name
}
Yours does not look wrong at first sight
b
Will try move the hooks around
Same result still. Can only think it’s a difference between oidc vs password
m
It works fine with password but not with OIDC? Or the other way round?
b
@magnificent-energy-493 not working for password
c
Actually, I've just tried with password and it works fine as well 🤔 It goes through while the downstream application returns HTTP 200 and raises an error in the other cases / blocks the registration flow
Here is my full 
registration
flow config (as an example):
Copy code
registration:
  lifespan: 10m
  ui_url: <http://127.0.0.1:4455/registration>
  after:
    oidc:
      hooks:
        - hook: session
        - hook: show_verification_ui
        - hook: web_hook
          config:
            url: <http://host.docker.internal:8080/master/identities>
            method: POST
            body: file:///etc/config/kratos/hooks/register.jsonnet
            response:
              ignore: false
              parse: true 
    password:
      hooks:
        - hook: session
        - hook: web_hook
          config:
            url: <http://host.docker.internal:8080/master/identities>
            method: POST
            body: file:///etc/config/kratos/hooks/register.jsonnet
            response:
              ignore: false
              parse: true
b
Blocks for me, but no 
identity.id
- reading the code, this seems to be the intended behaviour (as not persisted yet, and ID is generated on DB persistence)?
@careful-rain-13694 Can you confirm you are receiving the 
identity.id
on password after hook when parse set to true?
c
You're right @billowy-toddler-17598 I did not check for the 
identity.id
value from the other side so it did not fail but it is valued as 
"00000000-0000-0000-0000-000000000000
indeed. My bad, sorry 🙏
b
No problem, thanks for checking @careful-rain-13694
c
No problem, I'd be interested if you figure out any workaround solution for this use case as I may have to set up a similar configuration later on!
m
Thanks Remi for trying this out!
not persisted yet, and ID is generated on DB persistence
I am not sure if this is the behaviour but will investigage and follow up here
Maybe you can share some more details on the use case @billowy-toddler-17598? You want to associate an external ID with the identity in Ory. I have several questions: • Does the external ID exist for the identifier/email before you create the identity in Ory? • Why is the “update identity metadata” during registration hook not an option? • Why does the webhook need to be blocking on registration? Some condition on the external ID that not all registrations are accepted?
b
Sure, thanks @magnificent-energy-493
Does the external ID exist for the identifier/email before you create the identity in Ory?
No, we’re planning to generate it as part of the registration process. It serves as a user identifier, such as 
user_01ARZ3NDEKTSV4RRFFQ69G5FAV
. We prefer not to use Ory’s generated UUID elsewhere in the system, and from this issue, it doesn’t seem possible to specify a custom 
identifier.id
.
Why is the “update identity metadata” during registration hook not an option?
The 
identifier.id
is not available at this point, so we cannot create the 
external_id
to 
identity.id
mapping
Why does the webhook need to be blocking on registration? Some condition on the external ID that not all registrations are accepted?
If the webhook fails, registration should fail. If the webhook is asynchronous, there’s no guarantee it will be processed, potentially leaving the 
external_id
to 
identity.id
mapping incomplete. This would mean the entity would exist in Ory but not in our other system.
r
A bit late to the party, but I came across this comment which helped clear up a few things: https://github.com/ory/kratos/issues/3352 I was facing 2 issues: 1. Global webhooks defined were not firing for different flows; resolution: repeat webhook definition for each flow 2. Getting zero-value UUID (
00000000-0000-0000-0000-000000000000
) in `identity.id`; resolution: ensure the 
session
hook is defined after the other webhooks. Apparently when this executes, subsequently defined hooks are (silently) ignored.
14 Views
Open in Slack
PreviousNext
Powered by