Campaign-Template - how to set ownerRef

Identity Security Cloud (ISC) ISC Discussion and Questions
1

We have created a scheduled Manager Certification Campaign (based on the Campaign Template) which causes any Identity without a manager to be assigned to the “ownerRef” of the Campaign Template.
By default (and I discovered and was informed by design), the ownerRef defaults to the creator of the Campaign Template, which for us is the developer deploying it in production.

FYI - the POST API defaults ownerRef to the person invoking the API, both the PATCH and POST APIs ONLY allow you to set your OWN name/identity in that field - fails if you try to set it to anybody else! (even though the API documentation appears as if it “should” work).

Problem of course is, 1) we need a business owner to be the default recipient 2) when the developer leaves we need to redirect them (yes, there is a hard code mapping… but would be different people for different campaigns) 3) attempting to automate the activation of the scheduled campaign via workflow, will not allow for manual reassignment - again, could be different people for different campaigns all owned by the same developer

Has anyone come across this issue/requirement?
Is there any other solution/option? (other than setting a permanent “Reassign Certifications” to a certification manager that will need to reassign them all manually??)

2

I agree, Alf, the documentation (patch-campaign-template | SailPoint Developer Community) reads like we should be able to update the ownerref, but the API doesn’t allow us to set it to someone else. We need the ability to reassign the Campaign Template owner once it is setup. Here is a related Idea already submitted: https://ideas.sailpoint.com/ideas/GOV-I-2096

The Certification Reviewers, as we call the audit team members who are defining, previewing, launching, and reviewing campaigns, are not technical and wouldn’t have the knowledge or access to run the API call themselves. Further if the responsibility for the Certification changes (i.e. leaves, moves, etc.), the only option currently appears to be recreating the Campaign Template.

3

Hi Carla, hehe - yes, that’s the idea I submitted (apparently as guest!) :wink:

Yes I agree that the Certification Reviewers are usually not technical and would not be the ones running the API, and in fact they do not even create the templates. Hence our issue since it’s the developers / IT-IDN support team that create the templates and not the Cert Reviewers.

4

@carla_richey According to the patch campaign spec, you should be able to set the owner ref. How did you try to set it? Was there an error?

5

@colin_mckibben I’m using the Patch Campaign-template to update the ownerRef. The error text received is: “Illegal attempt to modify "ownerRef" field.”

The body (less specifics) follows

[
  {
    "op": "replace",
    "path": "/ownerRef",
    "value": {
            "email": "[email protected]",
            "type": "IDENTITY",
            "id": "identity GUID",
            "name": "Identity name"
        }
  }
]
1 Like
6

Thanks for confirming @carla_richey . I suspect that this is a documentation issue, and that ownerRef cannot be updated. I submitted this to engineering to get confirmation.

7

I have confirmed with engineering that this is a documentation bug. ownerRef is set at creation time by the user that created the template. It cannot be modified. We are going to get the doc updated soon.