Achieve group provision on access requests creation

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi,

I have a requirement that whenever any user raise an access request for any access profile coming from a webservice source, an AD group / access profile should be assigned to the user first and then the webservice access profile should be assigned once provisioning is successfully completed for AD group.

Is it a standard case and what are common ways to achieve it in sailpoint ISC/IdentityNow?

1 Like
2

That would be difficult to achieve with the way SailPoint tends to execute provisioning activities in parallel.

If order didn’t matter, you could create a role that assigns the AD group based on the identity having an account with a specific attribute value in any of those sources.

With this, the AD group might be provisioned prior to the account creation in the web services source, but it might not.

Does the AD group just need to be provisioned before the user can log in? Order of operations may matter less in that circumstance

1 Like
3

Not sure these are the best, but here is what I can think of:

First option:

  1. Add an Approval Schema for the Access Profiles from WS Connector
  2. Subscribe to “Access Request Dynamic Approval Workflow“ and link to a workflow
  3. Inside the Workflow, check if user has the required AD Groups and reject the request with appropriate comments.
    Here you might want to handle the email notification that will be sent to user upon rejection
  4. Submit a request for AD Groups and Wait for some time (say 10 mins)
  5. Submit an Access Request for the original Access Profiles and approve them

Second:

Inside BeforeOperations rule, create a while loop inside which

  1. Check if user has required AD groups

  2. If yes, exit the while loop

  3. If not,
    Submit an Access Request for the AD Group

    Approve if required

    Sleep for some time

3 Likes
4

Can you explain the business need , why AD group is required 1st before creation of account? Are these SSO group?

5

@iamnithesh : your second approach is interesting. can you please point towards any doc’ on how to create access request from beforeOp.

if few seconds does not matter and avoid any custom code or workflow. I would go with @mcheek’s suggestion or expand on it by having something like a birthright role to provision AD ent’ based on webservice account/entitlement assigned to user.

If you want to explore workflow and avoid a new role, have a workflow with trigger Access req Decision and based on the decision, raise a request for AD Group. This almost close to @iamnithesh first option.

Unless there is a mechanism within the target system which would reject or fails the account creation or add ent’ based on users AD group assignment, the above should work. So if you think AD group should absolutely be assigned before WebService source assignment, then pick either of the approaches above and just add wait time before appropriate operation on the webservices beforeOp rule.

6

As BeforeOperation is a connector rule, you can send an API request from within the rule

7

Hey,

Thanks all for your inputs, I will check them.

The ask is AD group to be assigned first which is SSO. once this is assigned and provisioned then only access request should start executing for the webservice profiles which are part of an application Sailpoint ISC.

Kind regards,

Aayush

8

Hi @AsGoyal,

If I were you, I would try @iamnithesh’s first approach using Access Request trigger and submit an access request for the AD group / access item if not assigned to the requestee. This approach gives you the most control.

If you are requesting the SSO AD group earlier, you might want to think about what should happen if the request for the Web Services access item was rejected.
:slight_smile:
Thanks,
Amar

1 Like