Call Powershell script into ISC to extract an site role attribute

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi All!

We need to extract the site roles from an on-prem application and use it as an entitlement, however, there is no API endpoint available to extract that particular attribute. As a workaround, the app owner suggested that they can create a powershell script to define the site roles and have ISC extract it. Is this possible? If so, could you share the high level steps on how to achieve it.

Thank you!

2

@jasmedina
Use powershell script to extract both accounts and entitlements from on-prem application as a csv file, then create source as delimited type on ISC.

Thanks

1 Like
3

Hi @Anshu_Kunal! If I am understanding it correctly, the powershell script should be stored as a csv file and use that file to upload in the Delimited Type source? Is that correct?

4

Correct, you can schedule powershell script to run daily and extract the file as csv. Use the same csv as for delimited source for aggregation on ISC.

Thanks

5

Hi @jasmedina ,
Adding to @Anshu_Kunal’s point ,

  1. Create a powershell script that can communicate to on-prem target application.
  2. The ps script will extract the accounts and access information of the identities from onprem and generates a csv.
  3. After that configure your delimited source (having same schema as the headers of csv generated).
  4. User fileupload utility to aggregate that csv file to ISC directly. File Upload Utility
  5. Once aggregation is done move that csv to archive folder.
  6. Schedule that ps script to do the same job daily/weekly as per requirement.
1 Like
6

Thank you, Anshu! We will try this :slight_smile:

7

Hi @gourab and @Anshu_Kunal! Would this also work for python script? :slight_smile:

8

ISC will read from csv files, so as long as you are able to create file in csv format using python or powershell script would be fine.

2 Likes
9

Hi @jasmedina ,
Python can be also used if you can connect to your target system , but we need java installed for fileupload utility.

1 Like
10

Right, you can use whatever you want. File Upload Utility is just one of many tools you can use - or build!

11

Hi Gourab! Just a question regarding:

  1. The ps script will extract the accounts and access information of the identities from onprem and generates a csv.

Does this mean that the powershell script should generate the csv that lists all the roles I need? Currently we have the script to print all the roles

    # Define the available site role
    site_roles = [
        "Creator",
        "Explorer",
        "ExplorerCanPublish",
        "Viewer",
        "Unlicensed"      
    ]
    return site_roles
 
if __name__ == "__main__":
    # List all available site roles
    roles = get_site_roles()
    print("Available Site Roles:")
    for role in roles:
        print(role)
12

Hi @jasmedina ,
The PowerShell or Python script must extract all user account information, including access details, and generate a CSV file for use in account aggregation within ISC.
If you have an script that generates access information only that you can use for entitlement aggregation.

More info on Delimited connector: Integrating SailPoint with Delimited File Source

1 Like
13

Hi @gourab we were able to extract all user accounts information via the web service connector. We would need these site roles to assign as an access profile to user during provisioning and access requests. Do we still need to include the accounts information in the script or just the site roles name would be enough? Sorry for the questions as this is my 1st time implementing this :slight_smile:

14

Hi @jasmedina
If the source has already been implemented via the Web Service connector, there is no need to generate CSV files. The generation of CSV files for account aggregation is only necessary for delimited sources.

In your Web Service connector configuration, follow these steps:

  1. Navigate to the Account schema and ensure that the schema is correct. Identify the attributes that define access and entitlements, and mark them as entitlements.
  2. In the source configuration, add all related operations, such as account aggregation and entitlement aggregation.
  3. Aggregate the accounts. As you have marked the entitlements in step 1, all entitlements will appear in the entitlements tab.
  4. Mark the entitlements as requestable. They will then be available for access requests through the request center.

Find here for more details: Integrating SailPoint with Web Services

1 Like
15

Thanks @gourab! This solves it :slight_smile:

1 Like
16

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.