How to Find Expired SAML App Certificates Using Okta Workflows

Keeping SAML app certificates up to date is essential for uninterrupted authentication in an Okta org. This automation uses two Okta Workflows flows to retrieve all SAML 2.0 apps, check each app's certificate expiration date, and log a message for any app whose certificate has expired.

How is the Automation Is Structured?

The automation consists of two flows: a List applications flow that retrieves all SAML apps and passes each to a helper flow, and a Process application flow that checks a single app's certificate expiration date and logs a message if the certificate has expired.

The List Applications Flow

The List applications flow retrieves all SAML apps in the org and calls the Process application helper flow for each one.

List SAML applications

Send a GET request filtered to SAML apps and iterate over the results by following these steps:

1. The Okta - Custom API Action card sends a GET request to /api/v1/apps with the filter signOnMode eq "SAML_2_0". The filter returns only SAML apps.
2. The List - For Each card iterates through the list of apps and calls the Process application helper flow for each one, passing the app ID and label.

The Process Application Flow

The Process application flow checks the certificate expiration date for one app and logs a message if the certificate has expired.

Check the app certificate expiration date

Build the certificate API path, retrieve the expiration date, compare it to the current date, and log a message for any expired certificate by following these steps:

1. The Helper Flow card receives the app passed from the List applications flow.
2. The Text - Compose card builds the API path /api/v1/apps/{id}/credentials/keys using the app ID. This endpoint returns the app's certificates.
3. The Okta - Custom API Action card sends a GET request to that path.
4. The Object - Get card reads 0.expiresAt from the response, which is the expiration date of the first certificate. NOTE: If an app has more than one certificate, the flow does not check the additional certificates.
5. The Date - Now card returns the current date and time.
6. The Continue If card checks that the expiration date is earlier than the current date. If the certificate has not expired, the flow stops with the message App certificate hasn't expired.
7. The Text - Compose card builds the message The app certificate for [app label] expired.
8. The Note card records the message.

Related References

• How to Call an API when It Is Not Available from an Existing Card (Connection)
• How to Setup a Workflows Helper Flow (With For-Each and Streaming Cards)