I’m setting up a Web Service connector for an application that contains two entitlement types: groups and permissions, each with its own HTTP operation.
I have a role that includes both groups and permissions.
When a user who already has an account requests this role, both types of entitlements are correctly granted.
Issue :
When a user who does not yet have an account on the application requests the same role:
The account is created
The group-type entitlements are added correctly
The permission-type entitlements are not added
I checked the provisioning plan and can see both entitlement types listed there, but the HTTP operation for the permissions entitlements is never called.
Do you have any ideas on this ?
Is there some kind of orchestration that I need to be aware of to ensure the Add-entitlement operations are done after the account is created ?
I did face a similar issue long back, though I can’t recall the exact use case for Blackline application integration. Here is how I solved it then, I enabled the configuration “Create Account With “Ent” Request” to true. I created multiple Create Operation endpoints:
Create Operation –> It creates the account and generates the account id as response
Create Operation –> Configured API to Add Teams (Entitlement type 1)
Create Operation –> Configured 3rd API to add groups (Entitlement Type 2)
For the 2nd and 3rd operations, I leveraged the response id received from the first operation.
In your case, it is not clear if the nativeIdentity attribute is properly translated to the next API call during creation.
That’s what I ended up doing, setting up the “Create Account With “ENT” Request” to true and then putting the entitlements in the account creation payload.
However this works only if your create API is able to handle entitlement, so it’s a workaround that has its limitation.
I created a ticket to the support to understand why all the entitlement type provisioning are not started
I didn’t quite follow the limitation here. Though your account creation payload API do not support the entitlement provision, you can extend the API operations as part of Creation, by defining multiple “Create Account” operations as I explained in the above comment.