Description
This presentation extends SailPoint’s access request process to solve a common challenge: manually verifying prerequisite attributes required for approval. Although any searchable attribute can be utilized, this presentation focuses on the training requirement (as an entitlement on the account) and location (as an identity attribute) to make the approval and denial decisions.
We will implement an automated “Attribute Checker” bot, built entirely with native SailPoint tools to handle these evaluations. This bot reviews, approves or denies requests, and sends companion emails (in the case of a denial) on a set schedule by checking for specific attributes on a user’s identity, streamlining the entire approval process and eliminating manual overhead.
I have included the workflows as links on this document, to act as examples of how this can be built out.
Additional Resources
- Workflows : Workflows - SailPoint Identity Services
- As your workflow would be customized to your needs, this document can help to assess exactly how to create what you require
- Access Requests: Access Requests - SailPoint Identity Services
- Just a quick overview of the access requests
- Governance Groups: Creating and Maintaining Governance Groups - SailPoint Identity Services
- Source creation: Configuring a Generic Flat File Source
- The source utilized is a generic flat file (csv).
Files:
- Example workflows
- Note that the creator, owner and a few other data elements have been removed. I have put << >> around the elements and a description of what would need to go there. Just search for “<<” and replace to have a functional version.
- Training verification workflow JSON (14.7 KB)
- Location Verification workflow JSON (6.3 KB)
- Note that the creator, owner and a few other data elements have been removed. I have put << >> around the elements and a description of what would need to go there. Just search for “<<” and replace to have a functional version.
Example Templates:
As they were rather quickly off the screen I wanted to also have how I had templatized my access items (template and then an example) so it is a bit clearer what the bots are “looking at”.
- Looking for Training course ONLY
- Template
-
<x> trainings *:<Training name 2>::<Training name 3>**
-
- Example
- 2 trainings *HealthTraining:SATSOR5** Grants generic access to the medical center login for IAM
- Template
- Looking for location ONLY
- Template
-
|LOCATION:<location name>|| <description of access>
-
- Example
- |LOCATION:Reno|| Custodial access for Lenel in the Reno, NV office
- Template
- Looking for BOTH Training Course AND Location
- Template
-
<X> trainings *<Training Name>** <description> |LOCATION:<location name>||
-
- Example
- 3 trainings *FERPA101:ROCKs::Geo_adv** Geography department advisor at the Austin,TX campus. |LOCATION:Austin||
- Template