Cannot Delete Account Upon Termination

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hi All,

We have a use case to delete the user’s account upon user termination. These are the configurations I did to achieved this:

  1. Configured the provisioning lifecycle to disable account
  2. Create and deployed BeforeProvisioning Rule to change the operation to delete
    image
    image
    image1017×299 7.1 KB
  3. Configured the http operation:
    image
    image
    image
    image705×455 5.86 KB
  4. Created a provisioning policy
    image

However, when I tested it, the account was not deleted nor disabled upon termination. Am I missing anything here? Please advice. Thank you!

1 Like
2

Jasmine,

If you look in ISC for the account, is the status still enabled or is it disabled? Are there any errors in the events?

Alicia

3

Hi Alicia,

Identity is still enabled and there are no errors in the events

4

Hi, according to this URL, the api request for the users seems to be deprecated: GET /api/user/list

GET /api/v2/user endpoint was turned off in june 2023

5

Hello @jasmedina,

  1. Are you able to see any events in the identity cube for this disable/delete action?
  2. If you check the search for the account request, do you see the operation as disable or delete?
  3. Have you turned on CCG debug logging and checked there?
6

Hi Kiran,

The DELETE /api/v2/users/{id} still works and I was able to successfully call it in POSTMAN

7

Hi Braden,

  1. The only event I see in the identity cube is when the user turned from active to inactive state but no specific event that points out that the account has been disabled/deleted.
  2. There is none also for specific application that needs to be deleted.
  3. Not yet but will try this one
8

Hi @jasmedina -

Can you confirm that the BeforeProvisioningRule is linked to the Source?

Regards,

9

Hi Kyle,

Yes it is linked to the source
image

10

I’d be cautious of using a deprecated IDN API as it could be turned off in the near future, if not already.

Have you tried to disable the account directly instead of going through the LCS?

You can do this on the accounts tab of an identity cube for an individual account. I know end use case won’t be this, but this takes factors out of the equation for troubleshooting. Manually triggering this will yield the same as if it were configured in the LCS.

2 Likes
11

Hi @jasmedina,
If the delete api call is working then is it going inside the if condition can you put loggers to see if it’s going inside the if condition ?

12

Thank you for this input! The account was deleted when I turned the LCS manually. :slight_smile:

I have added previously a new LCS in the Identity Profile:

image
image1336×309 13.7 KB

Is it correct to assume that I have change the Identity Attribute Trigger to deleteInactive instead of inactive? I think that might be causing the issue. Or are there other configuration I need to update with the deleteInactive attribute?

1 Like
13

You can configure any LCS to perform this action. The only requirement is that the LCS contains the “Disable Accounts” for this source.

It’s not required, but it is good practice to add NULL checks and try/catch to the before provisioning rule. Here is an example:

import sailpoint.object.ProvisioningPlan;
import sailpoint.object.ProvisioningPlan.Operation;
import sailpoint.object.ProvisioningPlan.ObjectOperation;
import sailpoint.object.ProvisioningPlan.AccountRequest;
import sailpoint.object.ProvisioningPlan.AccountRequest.Operation;
import sailpoint.object.ProvisioningPlan.AttributeRequest;

try {
    if(null != plan && null != plan.getAccountRequests()) {
        for ( AccountRequest accountRequest : plan.getAccountRequests() ) {  
            AccountRequest.Operation accountOperation = accountRequest.getOperation();

            if (null == accountOperation) continue;

            if ( accountOperation.equals( ProvisioningPlan.AccountRequest.Operation.Modify ) ) {
                accountRequest.setOperation( ProvisioningPlan.AccountRequest.Operation.Delete );
            }
        }
    }
} catch (Exception e) {
    log.error("The before provisioning rule threw an exception: ");
    log.error(e);
}
2 Likes
14

Got it! Looks like I have to change our cloudLifecycleState transform as well since it setting as inactive LCS instead of the delete LCS. Thanks for the help! This helped me pinpoint what needs to be updated. :slight_smile:

2 Likes
15

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.