IDM User Provisioning Request via Webhook with Retries

id: idm-user-provisioning-webhook
namespace: company.team
description: |
  Front-door flow for identity management. Receives user provisioning requests
  via webhook, validates the payload, then runs the provisioning steps
  (create user, add to groups, register in the directory graph, call downstream
  APIs) with automatic retries on transient failures.

triggers:
  - id: user_provisioning_webhook
    type: io.kestra.plugin.core.trigger.Webhook
    key: "{{ secret('IDM_WEBHOOK_KEY') }}"

inputs:
  - id: payload
    type: JSON
    description: Provisioning request body, used when running manually instead of
      via webhook.
    defaults: |
      {
        "userPrincipalName": "jdoe@example.org",
        "displayName": "John Doe",
        "department": "Radiology",
        "licensePlan": "M365_E3",
        "groups": ["Radiology-Staff", "VPN-Users"],
        "expirationDate": "2025-12-31",
        "reason": "Contractor, 6 month project"
      }

tasks:
  - id: validateRequest
    type: io.kestra.plugin.scripts.python.Script
    description: Validate required fields and assign a request id.
    dependencies:
      - kestra
    script: |
      import json, uuid
      from kestra import Kestra

      raw = """{{ trigger.body ?? inputs.payload }}"""
      data = json.loads(raw)

      required = ["userPrincipalName", "displayName"]
      missing = [f for f in required if f not in data or not data[f]]
      if missing:
          print(f"Missing required fields: {', '.join(missing)}")
          raise Exception("Invalid request payload")

      data["requestId"] = str(uuid.uuid4())
      Kestra.outputs(data)

  - id: sendEmailProvisionRequest
    type: io.kestra.plugin.core.log.Log
    description: Replace with a MailSend task to notify the requester.
    message: "Send an email for provisioning request {{
      outputs.validateRequest.vars.requestId }} to {{
      outputs.validateRequest.vars.userPrincipalName }}"

  - id: provisionUser
    type: io.kestra.plugin.core.flow.Sequential
    retry:
      type: constant
      behavior: RETRY_FAILED_TASK
      maxAttempts: 5
      interval: PT2S
    tasks:
      - id: createUser
        type: io.kestra.plugin.scripts.powershell.Script
        description: "Stub: replace with your New-ADUser or Microsoft Graph call."
        script: |
          Write-Host "Creating user {{ outputs.validateRequest.vars.userPrincipalName }}"

      - id: addToGroup
        type: io.kestra.plugin.scripts.powershell.Script
        description: "Stub: replace with Add-ADGroupMember or Graph group assignment."
        script: |
          Write-Host "Adding user {{ outputs.validateRequest.vars.userPrincipalName }} to groups {{ outputs.validateRequest.vars.groups }}"

      - id: addToGraph
        type: io.kestra.plugin.scripts.powershell.Script
        description: Simulates a flaky directory call; succeeds on the third attempt.
        script: |
          Write-Host "Adding user {{ outputs.validateRequest.vars.userPrincipalName }} to Graph with display name {{ outputs.validateRequest.vars.displayName }}"
          $attempt = {{ (taskrun.attemptsCount ?? 0) + 1 }}
          Write-Host "Attempt number: $attempt"
          if ($attempt -lt 3) {
              Write-Error "Failed adding user to graph!"
              exit 1
          }
          Write-Host "Added user to graph successfully"

      - id: callProvisionAPIs
        type: io.kestra.plugin.core.http.Request
        description: "Stub downstream API call: replace with your ITSM or licensing
          endpoint."
        uri: https://postman-echo.com/get
        method: GET
        params:
          principalName: "{{ outputs.validateRequest.vars.userPrincipalName }}"

      - id: sendProvisionDone
        type: io.kestra.plugin.core.debug.Return
        format: |
          Provisioning request accepted.
          Request ID: {{ outputs.validateRequest.vars.requestId }}