oidc_extension_callback.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS CloudFormation template that contains a single Lambda function behind
  an API Gateway for Okta Sync Callbacks
Resources:
  CommandsLambda:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: |
          'use strict';
          // Commands Lambda
          exports.handler = (event, context, callback) => {

            //Get's the request body / query parameters for you
            let requestBody = JSON.parse(event.body);
            let queryParams = event.queryStringParameters;

            //Put your commands here
            var responseBody = {
              "commands": [{
                  "type": "com.okta.tokens.access_token.patch",
                  "value": [{
                    "op": "add",
                    "path": "/claims/guid",
                    "value": "F0384685-F87D-474B-848D-2058AC5655A7"
                  }, {
                    "op": "replace",
                    "path": "/lifetime",
                    "value": {
                      "expiration": 3600
                    }
                  }]
                },
                {
                  "type": "com.okta.tokens.refresh_token.patch",
                  "value": [{
                    "op": "replace",
                    "path": "/lifetime/window",
                    "value": 75000
                  }]
                }
              ],
              "debugContext": {
                "stuff": "hitTheFan"
              }
            };

            let statusCode = 200;
            let headers = {};

            var response = {
              "statusCode": statusCode,
              "headers": headers,
              "body": JSON.stringify(responseBody),
              "isBase64Encoded": false
            };

            callback(null, response);
          };
      Description: A Lambda that returns Okta Commands for testing sync callbacks
      FunctionName: CommandsLambda
      Handler: index.handler
      Role: !GetAtt 'LambdaExecutionRole.Arn'
      Runtime: nodejs6.10
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
  CommandsApi:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: Commands API
      Description: API used for returning commands to okta sync callback requests
      FailOnWarnings: true
  LambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:invokeFunction
      FunctionName: !GetAtt 'CommandsLambda.Arn'
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${CommandsApi}/*'
  ApiGatewayCloudWatchLogsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: ApiGatewayLogsPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                  - logs:GetLogEvents
                  - logs:FilterLogEvents
                Resource: '*'
  ApiGatewayAccount:
    Type: AWS::ApiGateway::Account
    Properties:
      CloudWatchRoleArn: !GetAtt 'ApiGatewayCloudWatchLogsRole.Arn'
  CommandsApiStage:
    DependsOn:
      - ApiGatewayAccount
    Type: AWS::ApiGateway::Stage
    Properties:
      DeploymentId: !Ref 'ApiDeployment'
      MethodSettings:
        - DataTraceEnabled: true
          HttpMethod: '*'
          LoggingLevel: INFO
          ResourcePath: /*
      RestApiId: !Ref 'CommandsApi'
      StageName: LATEST
  ApiDeployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn:
      - CommandsRequest
    Properties:
      RestApiId: !Ref 'CommandsApi'
      StageName: DummyStage
  CommandsResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref 'CommandsApi'
      ParentId: !GetAtt 'CommandsApi.RootResourceId'
      PathPart: commands
  CommandsRequest:
    DependsOn: LambdaPermission
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      HttpMethod: POST
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${CommandsLambda.Arn}/invocations'
        IntegrationResponses:
          - StatusCode: 200
        RequestTemplates:
          application/json: '{  "name": "$input.params(''name'')"}'
      RequestParameters:
        method.request.querystring.name: false
      ResourceId: !Ref 'CommandsResource'
      RestApiId: !Ref 'CommandsApi'
      MethodResponses:
        - StatusCode: 200
Outputs:
  RootUrl:
    Description: Root URL of the API gateway
    Value: !Sub 'https://${CommandsApi}.execute-api.${AWS::Region}.amazonaws.com'