Automatically run Identity Refresh after role assignment

[TMarcianelli (Tony Marcianelli)]

IIQ version 8.3p2

My Question-

Is there an easy way to call the Identity Refresh on a user when they are added to a role so that role and the required roles are provisioned right away? I’m just using a basic Match List and not a script.

Screenshot of my role

I tried to use a script for the assignment rule and include ‘identityService.refreshIdentity’ but I’m not sure if this will work.

import sailpoint.api.SailPointContext;
import sailpoint.object.Identity;
import sailpoint.object.RoleAssignment;
import sailpoint.object.Filter;
import sailpoint.object.QueryOptions;
import sailpoint.api.IdnetityService;
import sailpoint.tools.GeneralException;
import java.util.List;

	public class BusinessRoleAssignmentRule{
		
		public static void main(String[] args) throws GeneralException {
			SailPointContext context = SailPointFactory.getCurrentContext();
			String adGroup = "CN=MyExampleGroup";
			String tonyBusinessRole = "Tony Business Role";
			
			Filter filter = Filter.eq("memberOf", adGroup);
			QueryOptions queryOptions = new QueryOptions();
			queryOptions.addFilter(filter);
			
			List<Identity> identities = context.getObjects(Identity.class,queryOptions);
				
			for (Identity identity : identities){
				RoleAssignment roleAssignment = new RoleAssignment;
				roleAssignment.setIdentity(identity);
				roleAssignment.setRole(context.getObjectByName(Role.class, tonyBusinessRole));
				
				identity.addRoleAssignment(roleAssignment);
				context.saveObject(identity);
				
				IdentityService identityService = new IdentityService(context);
				identityService.refreshIdentity(identity.getID());
			}
		}
	}

[enistri_devo (Emanuele Nistri)]

Hi @TMarcianelli,

welcome back to the forum.

A role can be assigned or detected. For automatic assignacion, when an identity meets the necessary requirements, the role will be assigned on refresh. Into refrersh task you must mark this flag:

If you assigned a role through a request, the provisioning start automatically.

Into a BS role, is the same if you a script or a match list or a rule.

Also, if you want refresh on a identity you need to launch a workflow or an Identitizer(I dont know whot is it, I discover writing this post ). In this topic, see the replies of @kjakubiak and @iamksatish.

[TMarcianelli (Tony Marcianelli)]

Hi @enistri_devo thanks for your information!