Combining multiple requests into one using addRemoveEntInSingleReq

Identity Security Cloud (ISC) ISC Discussion and Questions
, , , ,
1

We want to combine separate add entitlement calls into a single call given requested entitlements are of the same type as below:

{
  "updateRole": {
  "roles": ["role:1","role:2","role:3"]
  }
}

To achieve the above we tried setting addRemoveEntInSingleReq to true as below:

[
    {
        "op": "add",
        "path": "/connectorAttributes/addRemoveEntInSingleReq",
        "value": true
    }
]

And modified the operation body as:

{
  "updateRole": {
  "roles": $plan.Roles$
  }
}

But even after doing the above, IDN is sending individual add entitlement requests instead of combining it into one single request. Is there something we are missing here?

2

What connector are you using?

Alicia

3

it’s webservice connector.

4

Hi @mohan98 ,

I am not sure if enabling the addRemoveEntInSingleReq would help in handling your case. As far as I know, when there are requests for multiple type of entitlements(lets say group, role etc.), enabling this flag ensures one single Add Entitlement API can handle the request for all the types.

image

I never tried with multiple entitlements of the same type with this flag.
However, I followed the below approach for one of my previous projects which would work. My requirement was the Add entitlement operation is of type PUT where only the roles passed in the API request will be attached to the user. We cannot pass the group one by one as for each call the previous requested group is removed.

I utilized the provisioningPlan from webservice before operation rule to fetch all the requested groups at one go and updated my requestBody for all the groups and returned the updated requestEndPoint.

This ensures all the groups are passed in the same request and processed without issues. Only downside to this approach is the endpoint might be called multiple times, say 3 times if 3 groups are requested at once. I didn’t had any issues with that as at the end it is the same requestBody which is updated with all the groups is executed. Hence, no impact to the access.

Hope this helps.

Regards,
Uday Kilambi

1 Like
5

When I requested 2 roles together at once and printed provisioning plan using before operation rule on add entitlement operation, it printed two provisioning plans each with 1 role attribute request not one provisioning plan with both of the roles. My doubt is how can I fetch all the requested roles at one go when they are not in the same provisioning plan?

6

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.