AfterCreate Rule - how to upload using API

kag11 · November 23, 2024, 10:18am

I am trying to use the /beta/connector-rules/ API to upload the powershell script.
And using the below JSON as input for body -

{
    "name": "AfterCreate_Rule",
    "description": "Test AD After Create",
    "type": "ConnectorAfterCreate",
    "signature": {
        "input": [],
        "output": null
    },
    "sourceCode": {
        "version": "1.0",
        "script": "Set-ADUser -Identity mytest.mytest -State MH -Server Branch-DC02"
    },
    "attributes": {
    }
}

The rule is getting uploaded. My question is that is this the right way to upload After create rules that run on IQ Service? The examples in the docs have XML before the ps code.

sidharth_tarlapally · November 23, 2024, 11:43am

Hi @kag11 ,

In the script attribute the following template should be place after json escaping it .

$logDate = Get-Date -UFormat "%Y%m%d"
$command = "$logDate = Get-Date -UFormat "%Y%m%d"
$logFile = "path of log file"
$command = "Path of powershell script"
$enableDebug = $false

#====================-------Helper functions-------====================
function LogToFile([String] $info) {
    $info | Out-File $logFile -Append
}

#====================-------Get the request object-------====================
Try{
    if($enableDebug) {
        LogToFile("Entering SailPoint rule")
    }

    Add-type -path utils.dll;
 $sReader = New-Object System.IO.StringReader([System.String]$env:Request);
 $xmlReader = [System.xml.XmlTextReader]([sailpoint.utils.xml.XmlUtil]::getReader($sReader));
 $requestObject = New-Object Sailpoint.Utils.objects.AccountRequest($xmlReader);
    $requestAsString = $env:Request

    if($enableDebug) {
        LogToFile("Request as XML object is: $requestAsString")
    }

    #Call the client script
    $command = -join ($command, " -requestString '$requestAsString'")
    Invoke-Expression $command

}Catch{$logDate = Get-Date -UFormat "%Y%m%d"
$command = "$logDate = Get-Date -UFormat "%Y%m%d"
$logFile = "path of log file"
$command = "Path of powershell script"
$enableDebug = $false

#====================-------Helper functions-------====================
function LogToFile([String] $info) {
    $info | Out-File $logFile -Append
}

#====================-------Get the request object-------====================
Try{
    if($enableDebug) {
        LogToFile("Entering SailPoint rule")
    }

    Add-type -path utils.dll;
 $sReader = New-Object System.IO.StringReader([System.String]$env:Request);
 $xmlReader = [System.xml.XmlTextReader]([sailpoint.utils.xml.XmlUtil]::getReader($sReader));
 $requestObject = New-Object Sailpoint.Utils.objects.AccountRequest($xmlReader);
    $requestAsString = $env:Request

    if($enableDebug) {
        LogToFile("Request as XML object is: $requestAsString")
    }

    #Call the client script
    $command = -join ($command, " -requestString '$requestAsString'")
    Invoke-Expression $command

}Catch{
 $ErrorMessage = $_.Exception.Message
   $ErrorItem = $_.Exception.ItemName
   LogToFile("Error: Item = $ErrorItem -> Message = $ErrorMessage")
}

if($enableDebug) {
    LogToFile("Exiting SailPoint rule")
}"
$enableDebug = $false

#====================-------Helper functions-------====================
function LogToFile([String] $info) {
    $info | Out-File $logFile -Append
}

#====================-------Get the request object-------====================
Try{
    if($enableDebug) {
        LogToFile("Entering SailPoint rule")
    }

    Add-type -path utils.dll;
 $sReader = New-Object System.IO.StringReader([System.String]$env:Request);
 $xmlReader = [System.xml.XmlTextReader]([sailpoint.utils.xml.XmlUtil]::getReader($sReader));
 $requestObject = New-Object Sailpoint.Utils.objects.AccountRequest($xmlReader);
    $requestAsString = $env:Request

    if($enableDebug) {
        LogToFile("Request as XML object is: $requestAsString")
    }

    #Call the client script
    $command = -join ($command, " -requestString '$requestAsString'")
    Invoke-Expression $command

}Catch{
 $ErrorMessage = $_.Exception.Message
   $ErrorItem = $_.Exception.ItemName
   LogToFile("Error: Item = $ErrorItem -> Message = $ErrorMessage")
}

if($enableDebug) {
    LogToFile("Exiting SailPoint rule")
}
 $ErrorMessage = $_.Exception.Message
   $ErrorItem = $_.Exception.ItemName
   LogToFile("Error: Item = $ErrorItem -> Message = $ErrorMessage")
}

if($enableDebug) {
    LogToFile("Exiting SailPoint rule")
}"
$enableDebug = $false

#====================-------Helper functions-------====================
function LogToFile([String] $info) {
    $info | Out-File $logFile -Append
}

#====================-------Get the request object-------====================
Try{
    if($enableDebug) {
        LogToFile("Entering SailPoint rule")
    }

    Add-type -path utils.dll;
 $sReader = New-Object System.IO.StringReader([System.String]$env:Request);
 $xmlReader = [System.xml.XmlTextReader]([sailpoint.utils.xml.XmlUtil]::getReader($sReader));
 $requestObject = New-Object Sailpoint.Utils.objects.AccountRequest($xmlReader);
    $requestAsString = $env:Request

    if($enableDebug) {
        LogToFile("Request as XML object is: $requestAsString")
    }

    #Call the client script
    $command = -join ($command, " -requestString '$requestAsString'")
    Invoke-Expression $command

}Catch{
 $ErrorMessage = $_.Exception.Message
   $ErrorItem = $_.Exception.ItemName
   LogToFile("Error: Item = $ErrorItem -> Message = $ErrorMessage")
}

if($enableDebug) {
    LogToFile("Exiting SailPoint rule")
}

In the above script , place the path of the powershell script .
The final body for creating this rule shall look like :

{
  "description": "After Modify Rule for Mover",
  "type": "ConnectorAfterModify",
  "signature": {
    "input": [],
    "output": null
  },
  "sourceCode": {
    "version": "1.0",
    "script": "$logDate = Get-Date -UFormat \"%Y%m%d\"\r\n$command = \"$logDate = Get-Date -UFormat \"%Y%m%d\"\r\n$logFile = \"c:\\SailPoint\\Scripts\\Logs\\ConnectorAfterModify_$logDate.log\"\r\n$command = \"c:\\SailPoint\\Sample_Rules\\BeforeScriptTest.ps1\"\r\n$enableDebug = $false\r\n\r\n#====================-------Helper functions-------====================\r\nfunction LogToFile([String] $info) {\r\n    $info | Out-File $logFile -Append\r\n}\r\n\r\n#====================-------Get the request object-------====================\r\nTry{\r\n    if($enableDebug) {\r\n        LogToFile(\"Entering SailPoint rule\")\r\n    }\r\n\r\n    Add-type -path utils.dll;\r\n $sReader = New-Object System.IO.StringReader([System.String]$env:Request);\r\n $xmlReader = [System.xml.XmlTextReader]([sailpoint.utils.xml.XmlUtil]::getReader($sReader));\r\n $requestObject = New-Object Sailpoint.Utils.objects.AccountRequest($xmlReader);\r\n    $requestAsString = $env:Request\r\n\r\n    if($enableDebug) {\r\n        LogToFile(\"Request as XML object is: $requestAsString\")\r\n    }\r\n\r\n    #Call the client script\r\n    $command = -join ($command, \" -requestString '$requestAsString'\")\r\n    Invoke-Expression $command\r\n\r\n}Catch{\r\n $ErrorMessage = $_.Exception.Message\r\n   $ErrorItem = $_.Exception.ItemName\r\n   LogToFile(\"Error: Item = $ErrorItem -> Message = $ErrorMessage\")\r\n}\r\n\r\nif($enableDebug) {\r\n    LogToFile(\"Exiting SailPoint rule\")\r\n}\"\r\n$enableDebug = $false\r\n\r\n#====================-------Helper functions-------====================\r\nfunction LogToFile([String] $info) {\r\n    $info | Out-File $logFile -Append\r\n}\r\n\r\n#====================-------Get the request object-------====================\r\nTry{\r\n    if($enableDebug) {\r\n        LogToFile(\"Entering SailPoint rule\")\r\n    }\r\n\r\n    Add-type -path utils.dll;\r\n $sReader = New-Object System.IO.StringReader([System.String]$env:Request);\r\n $xmlReader = [System.xml.XmlTextReader]([sailpoint.utils.xml.XmlUtil]::getReader($sReader));\r\n $requestObject = New-Object Sailpoint.Utils.objects.AccountRequest($xmlReader);\r\n    $requestAsString = $env:Request\r\n\r\n    if($enableDebug) {\r\n        LogToFile(\"Request as XML object is: $requestAsString\")\r\n    }\r\n\r\n    #Call the client script\r\n    $command = -join ($command, \" -requestString '$requestAsString'\")\r\n    Invoke-Expression $command\r\n\r\n}Catch{\r\n $ErrorMessage = $_.Exception.Message\r\n   $ErrorItem = $_.Exception.ItemName\r\n   LogToFile(\"Error: Item = $ErrorItem -> Message = $ErrorMessage\")\r\n}\r\n\r\nif($enableDebug) {\r\n    LogToFile(\"Exiting SailPoint rule\")\r\n}"
  },
  "attributes": {
    "ObjectOrientedScript": "true",
    "extension": ".ps1",
    "sourceVersion": "1.0",
    "disabled": "false",
    "program": "powershell.exe",
    "timeout": "300"
  },

  "name": "AD After Modify Rule"
}

I hope this is clear.
Thanks

kag11 · November 25, 2024, 9:20am

Hi, Thanks for the inputs, I tried with a very basic script like below -
Just want to get a test email. However, I do not see any error at IDN and no email is fired as well. Provisioning is successful in Request Center. Not sure if the script is even getting fired.

I have attached the script in the source under “connectorAttributes”

“nativeRules”: [
“AfterCreate_Rule”
],

{
    "id": "8d59b7bbce0a4fd791883eba826b9f3d",
    "name": "AfterCreate_Rule",
    "description": "Test AD After Create",
    "type": "ConnectorAfterCreate",
    "signature": {
        "input": [],
        "output": null
    },
    "sourceCode": {
        "version": "1.0",
        "script": "Add-Type -Path \"C:\\SailPoint\\IQService\\Utils.dll\"; \r\n Send-MailMessage -From 'User01 <[email protected]>' -To 'User02 <[email protected]>' -Subject 'Test mail' -SmtpServer 'smtp.freesmtpservers.com'"
    },
    "attributes": {
        "ObjectOrientedScript": "true",
        "extension": ".ps1",
        "sourceVersion": "1.0",
        "disabled": "false",
        "program": "powershell.exe",
        "timeout": "300"
    }
}

sidharth_tarlapally · November 25, 2024, 10:08am

Hey Karan ,
I am not sure if the command that you mentioned in the script will send an email , as I believe there needs additional data to send an email , like :

$smtpServer = "smtp.gmail.com" # Replace with your SMTP server
$smtpPort = 587
$senderEmail = "[email protected]"
$recipientEmail = "[email protected]"
$subject = "Test Email from PowerShell"
$body = "This is a test email sent using PowerShell."

$credentials = New-Object System.Net.NetworkCredential($senderEmail, "your_password")

Send-MailMessage -From $senderEmail -To $recipientEmail -Subject $subject -Body $body -SmtpServer $smtpServer -SmtpPort $smtpPort -UseSsl -Credentials $credentials

.
Try to execute the same command on your power shell environment and expect the same during After Create Operation.

Thank you

system · January 24, 2025, 10:08am

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Aftercreate Rule and Powershell script to generate password and send email to user's manager ISC Discussion and Questions rules , identity-security-cloud , provisioning , connectors	5	272	March 15, 2025
Connector Rule that triggers Powershell Script residing on IQServer ISC Discussion and Questions rules , identity-security-cloud , provisioning , connectors	42	477	February 1, 2025
Problem in executing an after create rule with pawershell script ISC Discussion and Questions identity-security-cloud	18	166	July 21, 2025
AD AfterCreate Powershell Script fails: After script returned non zero exit code : 1 ISC Discussion and Questions identity-security-cloud	8	88	August 18, 2025
IdentityNow After Creation Rule implementation issue ISC Discussion and Questions rules , identity-security-cloud , provisioning , connectors	6	79	August 3, 2025

AfterCreate Rule - how to upload using API

Related topics