Can a jdbc record be created without an entitlement

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

If a JDBC environment has a table with fixed columns, where they don’t want to add a column for entitlements and all other columns are Identity replicated attributes, is there a way to create a record / account in the table?

We can mimic the aggregation of an entitlement for a column that isn’t there, so that all accounts appear to have an entitlement on aggregation even though that actual schema entitlement column doesn’t exist in the table. But I haven’t been able to provision an account.

My assumption is that all connectors must have a data field where we can build an association for an account that indicates they are entitled to have an account created, similar to the AD Group requirement.

Question: Are there any connectors where this wouldn’t be the case?

My research gives implications and assumptions, but I haven’t seen anything concrete.

2

When you say you haven’t been able to provision an account, can you clarify? Have you created a JDBCProvision rule?

Make sure your single account aggregation query also includes the non existent entitlement column in the query

3

I’ve had to do this for several JDBC connectors. Usually, just add to your account aggregation operations something like ‘DB Account’ as “Entitlement” so that every aggregated account has the entitlement called DB Account. Then you need to have either a JDBCProvision rule or use the Provisioning Query Settings (pictured):

image
image744×287 18 KB

You will still need to assign the “DB Account” entitlement, or whatever you end up calling it, in order to generate a provisioning plan.

4

With the provisioning query, can we prevent the entitlement add or do we need to use a cloud provisioning rule? I see it attempt to create the entitlement and the account on creation.

For the create account we are currently using:

INSERT INTO

(employeeid, brand, employeestatus, department, employeetype, managerlevel, country) VALUES ($plan.employeeid$, $plan.brand$, $plan.employeestatus$, $plan.department$, $plan.employeetype$, $plan.managerlevel$, $plan.country$)

We are then not choosing to add entitlement in the UI.

For the Account Query for the aggregation, we are using:
SELECT *, ‘Access’ AS role FROM

We are then using a role to assign the Access entitlement so that an event is triggered for a creation.

5

Is this the query to retrieve all accounts or the single account query?

You need to make sure you have something defined for the single account query because that’s what the provisioning action will use to determine whether or not an entitlement was “successfully assigned”