Attribute assigmment / identityEntitlement not getting after remove Access wf

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

I have written a custom wf where i am creating a plan to remove access for a user. Inside the wf i am using the 3 default ootb steps of LCM wfs which is - Identity Request Initialize, Identity Request Provision, Identity Request Finalize.
Once the wf runs, the access request gets completed and successful marked with green but in actual the AttributeAssigmment / identityEntitlement are not getting removed which shows as an exclamation sign on UI of identity and when we run refresh obviously IIQ is re-provisioning the entitlement.
My question is - is ther any separate step i need to configure to get rid of the entitlement completely, i mean everything related to Entitlement should be removed and it should not get re-provisioned
Below is the plan created :

<ProvisioningPlan nativeIdentity="****" targetIntegration="Active Directory" trackingId="">
  <AccountRequest application="Active Directory" nativeIdentity="CN=Aaka***" op="Modify">
    <Attributes>
      <Map>
        <entry key="flow" value="AccessRequest"/>
        <entry key="interface" value="LCM"/>
        <entry key="operation" value="EntitlementRemove"/>
      </Map>
    </Attributes>
    <AttributeRequest name="memberOf" op="Remove" value="CN=OKT***"/>
  </AccountRequest>
  <Attributes>
    <Map>
      <entry key="comments" value="qa"/>
      <entry key="identityRequestId" value="000024"/>
      <entry key="requester" value="****"/>
      <entry key="source" value="LCM"/>
    </Map>
  </Attributes>
  <Requesters>
    <Reference class="sailpoint.object.Identity" id="" name="***"/>
  </Requesters>
</ProvisioningPlan>
2

You need to set the assignment argument on the AttributeRequest to ensure the AttributeAssignment gets removed. Add this to your code that generates the AttributeRequest.

attrReq.put("assignment", "true");
3

Hello Aakash. @patrickboston is right, the assignment flag is what you need here.

The group is removed from AD, but without this flag, IIQ retains the sticky AttributeAssignment on the identity. When Identity Refresh runs with “Provision assignments” enabled, IIQ sees that the assigned entitlement is missing from the account and provisions it again. The exclamation mark is consistent with that mismatch. Add the flag when building the removal request:

attrReq.setAssignment(true);

The plan XML should then include:

<entry key="assignment" value="true"/>

This allows IIQ to remove the AttributeAssignment along with the entitlement. No separate cleanup should normally be required. If the IdentityEntitlement remains temporarily, aggregate the account and refresh the identity to reconcile it.

4

@punna0001 hey you copied my answer :tired_face:

5

Not at all, Patrick :slightly_smiling_face: You may have missed the first line where I acknowledged that your answer was correct. I only added a little more context around it. Full credit to you for pointing out the assignment flag. We are on the same team here :handshake: