Account selector rule

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

8.5

I had created a account selector rule so that when provisioning entitlements to AD through dynamic roles and if user is having multiple AD accounts ,it would pick a preferred one. After creating the rule i had run refresh identity task for the user. But it seems rule is not executing as i added log statement at the very beginning but not showing in logs. Do this rule executes automatically or we need to assign it to role, because i am not able to find a provision to assign rule to role or application in UI.

2

Where have you configured your account selector rule. You need to set it on IT Role like this else there is no way SailPoint IIQ will know how to call this selector Rule.

image
image777×332 13.9 KB

3

Hello @lsaipriya26

In IIQ 8.5, creating an Account Selector rule alone won’t trigger it. You need to configure it in the relevant role’s provisioning settings.

Check the Provisioning Target Account Selector Rules section while editing the role, and associate the rule with the appropriate AD application.

Also, running an Identity Refresh task doesn’t necessarily execute the rule. It will run when IIQ performs a provisioning operation that requires account selection.

I would suggest triggering an actual entitlement provisioning request for a user who has multiple AD accounts and checking the logs. If your log statement at the beginning of the rule still doesn’t appear, verify that the rule is associated with the correct role and application and that the provisioning flow is actually invoking account selection.

4

Hi @lsaipriya26 - Creating the Account Selector rule alone won’t make it execute. You need to reference it from the relevant IT role under accountSelectorRules.

<AccountSelectorRules>

  <ApplicationAccountSelectorRules>

    <ApplicationAccountSelectorRule>

      <ApplicationRef>

        <Reference class="sailpoint.object.Application"

                   name="<AD Application Name>"/>

      </ApplicationRef>

      <RuleRef>

        <Reference class="sailpoint.object.Rule"

                   name="<Account Selector Rule Name>"/>

      </RuleRef>

    </ApplicationAccountSelectorRule>

  </ApplicationAccountSelectorRules>

</AccountSelectorRules>
Then test the dynamic-role provisioning again with a user who has multiple AD accounts.
5

Hi @lsaipriya26,

Just to add to the answers above, if you’re testing through an Identity Refresh, make sure Refresh assigned and detected roles and Provision assignments are enabled.

The Account Selector Rule won’t necessarily execute just because a refresh runs. IIQ needs to perform a provisioning operation that requires selecting a target account.

I’d also recommend testing with a fresh role assignment on an identity with multiple correlated AD accounts. If the entitlement is already provisioned, there may be no new account selection to perform and make sure the appropriate logger is configured at DEBUG level.

There’s a similar discussion explaining when these rules execute:

:t_rex: