Assigning capabilities to a user based on department

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Hi All ! Wanted to Assign capabilities to a user like for eg syslog administator capability to be assigned to a user who is from specific department for eg HR in an application

So in case what rule to write and what approach to follow can anyone help me with the rule

2

You can create a workgroup, designate a capability Syslog Administrator, and add identities to it, allowing them to gain indirect access.

3

Apart from workgroup how can we do it via rule

4

Yes, you can create a rule and execute it using a rule runner task. Additionally, you can schedule it to run periodically.

5

Can You review my Rule once import sailpoint.object.Identity;
import sailpoint.api.SailPointContext;
import sailpoint.tools.GeneralException;

public class CapabilityAssignmentRule {

public static void assignCapability(SailPointContext context, Identity identity) throws GeneralException {
    // Fetch the department attribute of the user
    String department = identity.getAttribute("department");

    // Check if the user belongs to HR department
    if ("HR".equalsIgnoreCase(department)) {
        // Assign the "syslog administrator" capability
        identity.setCapability("syslog administrator");

        // Save and commit changes
        context.saveObject(identity);
        context.commitTransaction();
    }
}

}

// Execute the rule in IdentityIQ
if (identity != null) {
CapabilityAssignmentRule.assignCapability(context, identity);
}

6

Modify the code accordingly.

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Rule PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Rule created="" id="" language="beanshell" modified="" name="Test Capability Assignment rule" significantModified="">
  <Source>

  import org.apache.commons.logging.Log;
  import org.apache.commons.logging.LogFactory;

  Log logger = LogFactory.getLog("rule.test.log");


  import sailpoint.object.Capability;
  import sailpoint.object.Identity;
  import sailpoint.api.SailPointContext;
  import sailpoint.tools.GeneralException;

  import java.util.ArrayList;
  import java.util.List;


  public static void assignCapability(SailPointContext context, Identity identity) throws GeneralException {
    // Fetch the department attribute of the user
    String department = (String) identity.getAttribute("department");

    List capabilities = new ArrayList();
    capabilities.add(context.getObjectByName(Capability.class, "SyslogAdministrator"));


    // Check if the user belongs to HR department
    if ("HR".equalsIgnoreCase(department)) {
      // Assign the "syslog administrator" capability
      identity.setCapabilities(capabilities);

      // Save and commit changes
      context.saveObject(identity);
      context.commitTransaction();
    }
  }

  // for testing
  Identity identity1 = context.getObjectByName(Identity.class, "1a");

  // calling method
  assignCapability(context, identity1);

  </Source>
</Rule>

Hope this helps!

8

Exception running rule: BeanShell script error: bsh.EvalError: Sourced file: inline evaluation of: import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFa . . . '' : Undefined argument: identity : at Line: 39 : in file: inline evaluation of: import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFa . . . ‘’ : ( context , identity )
BSF info: subiiii at line: 0 column: columnNo got this error while running rule in debug

9

Looks like there could’ve been a typo. try copying the code again, test it, and if it still fails, post your code here.

10

Its working for one user but i need to give rights to every users of that specific department

11

use QueryOptions to fetch identities

12

can u give the code please

15

import org.apache.commons.logging.Log;

import org.apache.commons.logging.LogFactory;

import sailpoint.object.QueryOptions;

import sailpoint.object.Filter;

import sailpoint.object.Capability;

import sailpoint.object.Identity;

import sailpoint.api.SailPointContext;

import sailpoint.tools.GeneralException;

import java.util.List;

import java.util.ArrayList;

import java.util.Iterator;

// Logger for debugging

Log logger = LogFactory.getLog(“rule.assignCapability.log”);

public static void assignCapability(SailPointContext context) throws GeneralException {

  // Query to fetch all identities where department is "HR"

  QueryOptions qo = new QueryOptions();

  qo.addFilter(Filter.eq("Dept_name", "Engineering"));

  // Fetch iterator for identities matching the criteria

  Iterator iterator = context.search(Identity.class, qo);

  // Get the capability object

  Capability capability = context.getObjectByName(Capability.class,"WorkItemAdministrator");

List updatedIdentities = new ArrayList();

List capabilities = new ArrayList();

  capabilities.add(capability);

  int count = 0;

  while (iterator.hasNext()) {

      Identity currentIdentity = iterator.next();

      currentIdentity.setCapabilities(capabilities);

      context.saveObject(currentIdentity);

      updatedIdentities.add(currentIdentity);

      count++;

  }

  // Commit transaction after processing all identities

  if (count > 0) {

      context.commitTransaction();

      logger.info(count + " HR identities updated with 'WorkItemAdministrator' capability.");

  } else {

      logger.info("No HR identities found.");

  }

}

// Call the function to update all HR employees

assignCapability(context);

Pls mark this as a solution

16

Thanku @uditsahntl01

17 
import org.apache.commons.logging.Log;
  import org.apache.commons.logging.LogFactory;

  Log logger = LogFactory.getLog("rule.test.log");

  import sailpoint.object.Capability;
  import sailpoint.object.Filter;
  import sailpoint.object.Identity;
  import sailpoint.api.SailPointContext;
  import sailpoint.object.QueryOptions;

  import sailpoint.tools.GeneralException;
  import sailpoint.tools.Util;

  import java.util.ArrayList;
  import java.util.Iterator;
  import java.util.List;

  public static void assignCapability(SailPointContext context) {

    try {
      List capabilities = new ArrayList();
      capabilities.add(context.getObjectByName(Capability.class, "SyslogAdministrator"));

      QueryOptions options = new QueryOptions();
      options.addFilter(Filter.and(Filter.eq("departmentName", "HR")));
      options.setCloneResults(true);

      int count = 0;
      Iterator it = context.search(Identity.class, options, "id");
      while (it != null &amp;&amp; it.hasNext()) {
        Object[] identityId = (Object[]) it.next();
        if (Util.isNotNullOrEmpty((String) identityId[0])) {
          Identity identity = context.getObjectById(Identity.class, (String) identityId[0]);
          identity.setCapabilities(capabilities);
          context.saveObject(identity);
          count++;
        }
      }

      if (count > 0) {
        context.commitTransaction();
      }
      if (it != null) {
        Util.flushIterator(it);
      }
    } catch (GeneralException e) {
      logger.error("Exception thrown while fetching the identities || Message: " + e.getMessage());
    }
  }

  assignCapability(context);
18

Thanku @pavankalyan Dosa

19

standalone rule doesn’t have identity object declaration.
Identity identity = context.getObjectByName(Identity.class,“username”);

20

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.