Configuring Retry for Role Provisioning in JDBC Connector (SailPoint)

:bangbang: Please be sure you’ve read the docs and API specs before asking for help. Also, please be sure you’ve searched the forum for your answer before you create a new topic.

Please consider addressing the following when creating your topic:

  • What have you tried?
  • What errors did you face (share screenshots)?
  • Share the details of your efforts (code / search query, workflow json etc.)?
  • What is the result you are getting and what were you expecting?

Hello,

I am currently using the JDBC Connector in SailPoint and planning to assign roles automatically to new users, granting them access to the Sources.

However, we have the following constraint:

  • The target system does not create new users immediately.
  • For example, if HR adds a new user on the 27th, the Sources creates the account on the 28th.
  • As a result, even if the identity exists in SailPoint on the 27th, provisioning may fail because the account does not yet exist in the target system.

To handle this, I want to retry the account creation and role assignment on the 28th when the account becomes available.

Currently, I have identified the following retry-related options within the source configuration:

  • retryableErrors
  • provisioningRetryThreshold
  • retryWaitTime
  • provisioningMaxRetries
  • maxRetryCount

How can I configure these settings to ensure that provisioning automatically retries the next day (28th) when the account exists in the Sources?

Hi @joyoon00,

Ideally, if your role assignment fails on day 1, it should retry it the next day during the next full refresh.

If you do not want the initial failure, you can add a criteria in the role to check if the source account exists. This is applicable if you have some attribute in your source that follow a particular pattern, because you will need to make use of the contains operation as the “exist” operation is not available to use.

Else, you can consider creating an Identity attribute that flags if the source account exists -Yes/No by making use of a transform. Then use something as below in the role

1 Like