Creating a way for a manager to only request specific entitlements and roles

IdentityIQ (IIQ) IIQ Discussion and Questions
,
9

Copy the rule below and save it as XML file (using Notepad, Notepad++, vi, emacs, …)

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Rule PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Rule language="beanshell" name="Specific Entitlemens for Specific Managers" type="RequestObjectSelector">
  <Source>

  import sailpoint.object.Filter;
  import sailpoint.object.Identity;
  import sailpoint.object.QueryOptions;
  import sailpoint.object.QueryInfo; 

  Filter entFilt1 = Filter.and(Filter.eq("application.name", "ApplicationName"),Filter.eq("value", "EntitlementValue"));

  Filter entFilt2 = Filter.and(Filter.eq("application.name", "ApplicationName"),Filter.eq("displayName", "EntitlementDisplayValue"));

  Filter orFilter = Filter.or(entFilt1,entFilt2);

  QueryInfo finalQueryInfo = new QueryInfo(orFilter, false);
  return finalQueryInfo;

  </Source>
</Rule>

This contains a filter for 2 entitlement, where the 1st is based on ApplicationName and EntitlementValue. The 2nd based on ApplicationName and DisplayValue.
You can change the filters to your liking.

In this example you need to change the values :

  • AplicatioName with the name of the application
  • EntitlementValue with the value
  • EntitlementDisplayValue with the DisplayName

If you want more than 2 entitlements, change the orFilter to something like:

Filter orFilter = Filter.or(entFilt1,Filter.or(entFilt2,Filter.or(entFilt3,entFilt4)));

When you have updated the file, it can be imported via: Gear->Global Settings->Import from File
If you want to change it later, you need to do this via debug (there is no UI option)

After import, you should be able to select it in the QuickLink config.

I have not tested it, but assume this to be working as expected.

– Remold

2 Likes